Mutual Non-Disclosure Agreement

Fill in the highlighted fields, print, sign, and return a scanned copy to ricardo.gsa@proton.me. The countersigned copy comes back by e-mail and is what authorises you to send a model.

§1Parties

Party A and Party B are each a Party and together the Parties. Because information flows in both directions, each Party may act as Disclosing Party and as Receiving Party under this Agreement.

§2Purpose

The Parties wish to evaluate and, where agreed, carry out a technical collaboration consisting of the verification, sizing and optimisation of steel structures to EN 1993-1-1, on the basis of analysis models supplied by the Client — typically Oasys GSA text exports (.gwa) containing geometry, sections, load cases and analysis results — and the return of optimised models, verification reports and calculation data (the Purpose).

Any information exchanged for the Purpose is exchanged under this Agreement. This Agreement does not oblige either Party to disclose anything, to enter into any further contract, or to purchase or supply any service.

Nature of the service

Nothing in this Agreement creates an engagement, a retainer, a contract for professional services, or any design responsibility on the part of Party B.

§3Confidential Information

Confidential Information means any information disclosed by one Party to the other in connection with the Purpose, in any form and on any medium, whether or not marked as confidential, including in particular:

1. analysis models and their exports, including geometry, node and element data, section definitions, materials, load cases, combinations, prestress, and analysis results;
2. drawings, specifications, tender documents, calculation notes, reports and correspondence;
3. commercial information: prices, rates, quantities, tonnage, programme and workload data;
4. the identity of the project, its location, its client and the other parties involved;
5. the software, scripts, methods, catalogues and know-how used by Party B to perform the Purpose, and the source code and internal logic of Party B's tools;
6. the existence, content and status of the Parties' discussions.

Anonymised reference

The service described in §2 exists in order to show what Party B's engineering work can do, so Party B needs to be able to speak about it. Party B may therefore refer to the collaboration in anonymised form only: type of structure, profile families, tonnage, run times and utilisation figures, with no name, location, image or other detail from which the project, the Client or the Client's own client could be identified. Any reference beyond that requires the Client's prior written consent, which may be given in Annex A and withdrawn at any time.

Exclusions

Confidential Information does not include information that the Receiving Party can demonstrate: (a) is or becomes public without breach of this Agreement; (b) was lawfully in its possession without a duty of confidence before disclosure; (c) is lawfully received from a third party free to disclose it; or (d) was independently developed without use of the Confidential Information.

§4Obligations of the Receiving Party

1. To use the Confidential Information solely for the Purpose, and for no other purpose, commercial or otherwise.
2. To keep it secret and to protect it with at least the degree of care it applies to its own confidential information of similar importance, and in no event less than reasonable care.
3. To disclose it only to those of its employees, officers, professional advisers and subcontractors who need it for the Purpose (need-to-know), and only where those persons are bound by confidentiality obligations at least as protective as this Agreement. The Receiving Party remains liable for their acts and omissions.
4. Not to copy or reproduce it beyond what the Purpose requires, and to keep every copy subject to this Agreement.
5. Not to reverse-engineer, decompile or disassemble any software, script or compiled module disclosed to it.
6. To notify the Disclosing Party without undue delay upon becoming aware of any unauthorised use, disclosure or loss.

Disclosure required by law

Where disclosure is required by law, by a court or by a competent authority, the Receiving Party may disclose to the extent required, provided it notifies the Disclosing Party beforehand where legally permitted, and limits the disclosure to what is required.

§5No use for training of machine-learning systems

The Receiving Party shall not use the Confidential Information, in whole or in part, to train, fine-tune, evaluate, benchmark or otherwise improve any machine-learning or artificial intelligence model, and shall not submit it to any third-party artificial-intelligence, machine-learning, translation or cloud-processing service.

Processing by automated tools operated locally and under the Receiving Party's sole control — including self-hosted language models running on the Receiving Party's own hardware, with no transmission of data to a third party and no retention by any third party — is permitted for the Purpose, provided the resulting model weights, indexes and derived data are treated as Confidential Information and deleted in accordance with §8.

Any output derived from the Confidential Information, including embeddings, indexes, summaries and statistics, is itself Confidential Information.

§6Protection of personal data

The Parties process personal data under this Agreement in accordance with Regulation (EU) 2016/679 (GDPR) and the German Federal Data Protection Act (BDSG).

1. Scope. The exchange under the Purpose is technical in nature. Personal data is limited to business contact data of the Parties' representatives (name, position, business e-mail address, business telephone number) and to any personal data incidentally contained in the documents exchanged (for example the name of the author of a drawing or a calculation note). The Parties shall avoid transmitting personal data that is not necessary for the Purpose, and shall not transmit special categories of data within the meaning of Art. 9 GDPR.
2. Roles. With respect to business contact data each Party acts as an independent controller (Art. 4(7) GDPR) and processes it on the basis of Art. 6(1)(b) and (f) GDPR, for the purposes of initiating, performing and documenting the collaboration. Where, in the course of a subsequent engagement, one Party processes personal data on behalf of the other, the Parties shall conclude a data-processing agreement under Art. 28 GDPR before that processing begins; this Agreement does not replace such an agreement.
3. Purpose limitation. Personal data received under this Agreement is processed solely for the Purpose. It is not used for advertising, profiling or automated decision-making, is not sold, rented or otherwise made available for consideration, and — consistently with §5 — is not used to train any machine-learning model.
4. Place of processing. Processing takes place within the European Union or the European Economic Area. A transfer to a third country only occurs where an adequacy decision under Art. 45 GDPR or appropriate safeguards under Art. 46 GDPR are in place, and the other Party has been informed in advance.
5. Sub-processors and service providers. Each Party shall inform the other, on request, of the service providers it uses to process data received under this Agreement (for example hosting, e-mail and file-transfer providers), and shall engage them only under written terms granting protection equivalent to this Agreement. The Party engaging them remains fully responsible for their performance.
6. Security. Each Party shall implement appropriate technical and organisational measures under Art. 32 GDPR, including: encryption of data in transit (TLS) and at rest; access limited to named individuals on a need-to-know basis; separation of client data by project; authenticated, expiring links for large-file transfer; and logging of access to received models.
7. Retention. Personal data is erased as soon as it is no longer required for the Purpose and no statutory retention obligation applies. Business correspondence subject to German commercial and tax retention rules is retained for the statutory period and, during that period, processed only to comply with those obligations.
8. Data subject rights. Data subjects may exercise their rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21) against the respective controller. Each Party shall support the other, without undue delay and free of charge, in responding to a request that concerns data received under this Agreement.
9. Personal data breach. Each Party shall notify the other without undue delay, and in any event within 48 hours of becoming aware, of any breach affecting personal data received from the other, with the information needed for that Party to meet its obligations under Arts. 33 and 34 GDPR.
10. Supervisory authority. Each Party remains entitled to lodge a complaint with a supervisory authority; for Party B this is the Berlin Commissioner for Data Protection and Freedom of Information.

§7Transfer channel and handling of models

1. Signed copies of this Agreement and written correspondence are exchanged by e-mail with ricardo.gsa@proton.me.
2. Analysis models are transferred by an authenticated, expiring download link issued by a file-transfer service established in the European Union, or by another channel agreed in writing. Models are not sent as unprotected e-mail attachments.
3. Before a model is transferred, the Client may check it locally with the pre-flight validator published at ricardomerino.com/intake/. That validator runs entirely in the Client's own browser; the model is not uploaded and does not leave the Client's computer.
4. Received models are stored encrypted, in a folder dedicated to the project, and are not placed in any third-party synchronisation or backup service other than those disclosed under §6(5).
5. The Client is responsible for supplying a workable model. The model must open and run on ordinary desktop hardware and must not be of a disproportionate size or computational weight. Party B may decline a model on that ground alone, and is under no obligation to procure hardware or licences in order to process it.
6. Format. The model must be saved in a format compatible with Oasys GSA 10.2 build 18 (x64). A file written by a later version of GSA, or in a format that this version cannot read, cannot be processed. The GSA version that wrote the file is reported by the pre-flight validator of item 3 and is recorded in Annex A.

§8Return, deletion and retention period

On written request of the Disclosing Party, and in any event within 30 days of the earlier of (a) completion of the Purpose or (b) termination of this Agreement, the Receiving Party shall return or irreversibly delete all Confidential Information, including copies, working files, intermediate results and derived data.

The Receiving Party may retain: (i) one archival copy to the extent required by law or by professional documentation duties, and (ii) copies held in routine backups that cannot reasonably be isolated. Retained copies remain subject to this Agreement for as long as they are held. On request, the Receiving Party shall confirm deletion in writing.

§9Intellectual property

Nothing in this Agreement transfers or grants any right, title, licence or interest in the Confidential Information, or in any patent, copyright, design right, database right or know-how of the Disclosing Party, beyond the limited right to use it for the Purpose. Rights in the results produced under a subsequent engagement are governed by that engagement's own contract.

§10No warranty, validation of results and reliance

Confidential Information is provided "as is". Neither Party warrants its accuracy or completeness, and neither Party is liable to the other for decisions taken on the basis of information disclosed under this Agreement. This does not limit liability for intent, gross negligence, or injury to life, body or health, nor any liability that cannot be excluded by law.

Validation by the Client. Every result returned by Party B — optimised model, section sizes, utilisation figures, verification report — must be reviewed and validated by the Client before it is used for any purpose. Results are a technical contribution to the Client's own work and are never a design, a structural verification or a certificate. The Client's own qualified engineer remains solely responsible for the structure, for the analysis model, for its loads, combinations and boundary conditions, and for the final sizing decisions.

Reliance on the model as supplied. Party B works from the model exactly as the Client supplies it and does not review or verify its assumptions. A verification to EN 1993-1-1 is only ever as good as the internal forces the model produces.

No third-party reliance. The results are for the Client's internal use. They may not be relied upon by third parties, nor submitted to a building authority, a checking engineer or any other body as a verification issued by Party B, without Party B's prior written consent.

§11Term and survival

This Agreement takes effect on the date of the last signature and remains in force for 2 years, unless replaced by a written agreement covering the same subject matter. The confidentiality obligations survive for 5 years from the date of each disclosure; for information protected as a trade secret, they survive for as long as that protection lasts. The obligations under §5 and §6 survive without time limit in respect of the data actually received.

§12Remedies

The Parties acknowledge that damages alone may be an inadequate remedy for a breach of this Agreement, and that the Disclosing Party is entitled to seek injunctive relief in addition to any other remedy available at law.

§13Governing law, jurisdiction and language

This Agreement is governed by the law of the Federal Republic of Germany, excluding its conflict of laws rules and the UN Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction for merchants is Berlin, Germany, provided that mandatory places of jurisdiction remain unaffected.

This Agreement is executed in English. A German translation is available; in case of discrepancy, the English version prevails.

§14Miscellaneous

1. Amendments and additions require text form (§126b BGB), including any waiver of this requirement.
2. Neither Party may assign this Agreement without the other's prior written consent.
3. If a provision is or becomes invalid, the remainder stays in force, and the invalid provision is replaced by the valid provision closest to its commercial intent.
4. This Agreement constitutes the entire agreement between the Parties on its subject matter and supersedes prior understandings on that subject.