Home Terms of use for the development and certification of plug-ins for the HCU platform between eQ‑3 (hereinafter "eQ‑3") and the plug-in developer (hereinafter "Plug-in Developer") 1. Preamble and definitions1.1 Purpose: These terms of use regulate the use of the HCU platform by third-party developers for the development, certification and (where applicable) distribution of plug-ins, as well as the associated rights and obligations of both parties.1.2 Definitions: "Plug-in" refers to a software component from a third-party developer that interacts with the Home Control Unit (HCU) using the interfaces provided by eQ‑3; "HCU" refers to the hardware/software control centre from eQ‑3; "Connect API" refers to the development tools and interfaces provided for this purpose; "Certification" refers to the testing and approval process defined by eQ‑3; "Security vulnerability" refers to a weakness that can be rated according to the CVSS; "Confidential information" and "personal data" have the legal meanings defined in the GDPR and German Trade Secrets (Protection) Act (GeschGehG). 2. Subject matter and scope of contract2.1 Licence: eQ‑3 grants the Plug-in Developer a non‑exclusive, revocable, non-transferable licence to use the Connect API, exclusively for the development, testing and supply of plug-ins for the HCU.2.2 Restrictions: The Plug-in Developer must not bypass security mechanisms, perform any impermissible reverse engineering (unless permitted by law), integrate any harmful functions or misuse the platform.2.3 Compatibility: The Plug-in Developer shall ensure that the plug-in is compatible with the specified HCU versions and complies with the published API guidelines. 3. Certification process3.1 Submission: The Plug-in Developer submits the required material artefacts (binary, optional source code for inspection, documentation, SBOM), complete licence information including any open-source licences used, test results and data protection information in accordance with the certification guidelines. 3.2 Criteria: eQ‑3 checks the security and the general operability of the plug-in.3.3 Deadlines and decisions: eQ‑3 releases plug-ins approximately four times per year and will communicate the review status within reasonable time frames. In the event of a rejection, eQ-3 shall specify the reasons as well as options for remediation. A plug-in can be published on the release date if the internal processes have completed all review steps.3.4 Recertification: Recertification is required for major updates to the plug-in or significant API changes. 4. Intellectual property rights and licensing4.1 Copyrights: The Plug-in Developer retains the rights to the plug-in. eQ‑3 receives the necessary rights of use for testing, certification, listing in the marketplace (if available) as well as for support purposes.4.2 Trademarks: The use of the marks "eQ‑3", "HCU" and any certification seals requires prior written consent and must comply with CI/CD guidelines.4.3 Open‑source compliance: The Plug-in Developer shall ensure compliance with all open‑source licences, document components in an SBOM and guarantee that no licence obligations arise that would disclose the HCU source code. 5. Data protection and data security (GDPR)5.1 Roles and responsibilities: Where personal data is processed, the Plug-in Developer shall be responsible for this data. The developer must provide a data protection declaration for this purpose.5.2 Principles: Data minimisation, purpose limitation, transparency towards end customers, deletion concepts and data subject rights must be ensured.5.3 Technical and organisational measures: The Plug-in Developer shall implement appropriate technical and organisational measures (e.g. encryption, access controls, logging).5.4 Incident reports: Security incidents shall be reported to eQ‑3 immediately, and no later than 24 hours after becoming aware of them, together with relevant details; the Plug-in Developer shall support countermeasures.5.5 Telemetry: The collection of usage or telemetry data shall require a suitable legal basis (e.g. consent) and transparent information for end users. 6. Security, quality and localisation6.1 Secure development: The Plug-in Developer must follow a secure development process, including code reviews, static/dynamic analyses and, if applicable, penetration tests.6.2 Vulnerability management: Critical vulnerabilities (CVSS ≥ 9.0) shall be rectified within 7 days, high vulnerabilities within 14 days; status reports to eQ‑3 are mandatory.6.3 Compatibility and performance tests: The plug-in must not affect the stability of the HCU. eQ-3 reserves the right to disable plug-ins if system limits (RAM and CPU) are reached. 6.4 The texts in the plug-in and the legal documents must be available at least in English and German. Refer to the Connect API documentation for the implementation of languages for a plug-in. The Plug-in Developer shall be responsible for providing additional languages. English shall be used as the fallback language. 7. Support, maintenance and update obligations7.1 Support level: The Plug-in Developer shall generally be responsible for providing support to end users. Adequate support shall be provided via defined channels; contact details must be included in the descriptive text of the plug-in. eQ-3 shall provide support only if and to the extent that faults are proved not to originate from the sphere of responsibility of the Plug-in Developer. 7.2 Updates: The Plug-in Developer shall provide security and compatibility updates and shall communicate release notes via the agreed channels.7.3 End‑of‑life: Discontinuation of a plug-in shall be announced with reasonable notice and migration notes.7.4 eQ-3 shall provide changes to the API in a timely manner in the event of breaking changes. The Plug-in Developer must implement the changes and provide a plug-in update. During a transition phase, functions shall be marked as deprecated in the API. 8. Fees, invoicing and marketplace terms8.1 Certification fees: There are no costs for certification and listing. 9. Warranty, liability and indemnification9.1 Warranty: The Plug-in Developer shall warrant that the plug-in is free from third-party rights, defects and malware.9.2 The Plug-in Developer shall be liable to eQ-3 in accordance with the legal provisions.9.3 Indemnification: The Plug-in Developer shall indemnify eQ‑3 against third-party claims arising from IP infringements, data protection violations, or unlawful functions of the plug-in, including reasonable legal defence costs. 10. Compliance and prohibited content/functions10.1 Legal compliance: The Plug-in Developer shall comply with applicable law, including export control, sanction, consumer protection and product safety laws.10.2 Prohibitions: The plug-in must not contain any malicious code, hidden data exfiltration, illegal content or functions.10.3 Code of conduct: The Plug-in Developer shall commit to fair, respectful behaviour within the developer ecosystem. 11. Confidentiality11.1 Confidentiality: Confidential information shall be treated as strictly confidential and used only for the purposes of this contract.11.2 Duration: The confidentiality obligation shall apply during the term of the contract and shall continue for 5 years after the end of the contract. 12. Term, delisting and consequences12.1 Term: These provisions shall apply for as long as the developer's plug-in is listed as a certified plug-in; section 11.2 remains unaffected. 12.2 eQ-3 shall be entitled to delist the plug-in without notice if it no longer meets the requirements of these terms of use, particularly in the event of serious malfunctions, security vulnerabilities or data protection breaches.12.3 If the Plug-in Developer or eQ-3 decides to no longer supply the certified plug-in, without a situation as defined in section 12.2 occurring, the other party shall be informed accordingly with reasonable notice. In this case, certificates may be withdrawn and plug-ins delisted; eQ‑3 shall inform end customers appropriately about the effects. 13. Audit and control rights13.1 Technical audits: eQ‑3 may carry out reasonable audits, request access to relevant evidence (e.g. pen test reports, SBOM) and monitor compliance.13.2 Confidentiality of audits: Audits shall be carried out to a reasonable extent while maintaining confidentiality. 14. Changes, API updates and communication14.1 Change management: eQ‑3 shall announce significant API changes with reasonable notice; deprecation policies with transition periods apply.14.2 Communication channels: Release notes, developer portal and named contact persons will be used. 15. Applicable law, jurisdiction and dispute resolution15.1 Applicable law: This agreement is subject solely to the law of the Federal Republic of Germany.15.2 Place of jurisdiction: As far as legally permissible, the place of jurisdiction shall be the registered office of eQ‑3.15.3 Dispute resolution: The parties shall first endeavour to reach an amicable settlement; alternatively, mediation or arbitration may be agreed upon. 16. Final provisions16.1 Contract language: German; in the event of a conflict, the German version shall prevail.16.2 Severability clause: Should a provision be ineffective, the contract shall otherwise remain effective; the parties shall replace the provision with an effective provision coming as close as possible to the economic objective of the original provision.16.3 Written form: Amendments and supplements to these terms of use must be made in writing.
