Definitions

The following definitions will apply (and additional definitions provided below) will apply to these terms and conditions of Smart Symbols BV (the "Terms and Conditions"):

"Smart Symbols" is a limited liability company (besloten vennootschap or BV) established, organized and existing under the laws of Belgium, with registered office at Stationsstraat 11, 8880 Ledegem, Belgium, and registered with the Crossroads Bank for Enterprises under the company number 0760.447.633;

"Additional Features" has the meaning set forth in Article 9.1.4 of these Terms and Conditions.

"Agreement" means these Terms and Conditions together with any Order Forms between Smart Symbols and the Customer;

"Authorized users" means users who are authorized by the Customer and/or Smart Symbols to access and use the Platform and Documentation through a user account, like teachers, school leaders, ICT-coordinators or employees;

"Confidential Information" means any information disclosed by the Disclosing Party to the Receiving Party whether orally, in writing or in electronic or other form, or otherwise obtained by the Receiving Party through observation or investigation of the Disclosing Party's activities. Whether or not the Confidential Information is marked or identified, it contains all information that may reasonably be considered confidential, including, but not limited to, prices, terms and conditions, attachments, appendices, and all information related to the Platform associated with the Agreement. Confidential Information of Smart Symbols will be deemed to include the Platform and all general tools, programs, algorithms and benchmarks built or developed by Smart Symbols based on data collected from Customer (whether such data is Customer Data or Customer Confidential Information). Customer Confidential Information will be deemed to include Customer Data;

"Customer" means every legal entity that concludes an agreement with Smart Symbols with regard to the Platform and/or Services;

"Customer Data" means data, information or material provided or submitted by the Customer or its Authorized users to Smart Symbols, whether through the Platform or otherwise. Smart Symbols may input Customer Data on behalf of the Customer for the purpose of using the Services or to facilitate the Customer’s use of the Services;

"DPA" means the Data Processing Agreement, entered into between Smart Symbols and Customer and attached to the Agreement as ANNEX 1 - DATA PROCESSING AGREEMENT;

"Data Protection Legislation" means the EU Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), together with the codes of practice, codes of conduct, regulatory guidelines and standard clauses and other related legislation arising from such Directive or Regulation, as updated from time to time;

"Disclosing Party" means the Party that discloses Confidential Information under the Agreement;

"Documentation" means any documentation regarding the use of the Platform provided by Smart Symbols, including the set of resources, manuals, guides, and online help to assist Authorized Users in understanding and utilizing the Services. This also includes detailed instructions on how to set up, configure, and operate the software, as well as explanations of features, functionalities, and best practices for using the Services effectively. The Documentation serves as a valuable tool for both novice and experienced users, helping to resolve common issues, answer frequently asked questions, and provide troubleshooting assistance. The Documentation is made available in digital format, accessible through Smart Symbols’ website or directly within the software interface. It is regularly updated to reflect any changes, enhancements, or updates made to the Services, ensuring that users have access to the most current and relevant information;

"Effective Date" means the first date that is mentioned in the relevant Order Form, i.e. the indication of the start of the Initial Term;

"Fee(s)" means the fees paid by Customer in consideration for the Platform as set forth in the relevant Order Form;

"Feedback" has the meaning set forth in Article 5.3 of these Terms and Conditions;

"Initial Term" has the meaning set forth in Article 12.1.1 of these Terms and Conditions;

"Intellectual Property Rights" means all (a) rights now known or hereafter existing in relation to works of authorship, including copyrights, design rights and moral rights; (b) rights to trademarks or service marks; (c) rights to trade secrets, know-how; (d) patents, patent rights, and industrial property rights (e) layout design rights, design rights, (f) trade and business names, domain names, database rights and any other industrial or intellectual property or similar rights (whether registered or unregistered) (g) all registrations, applications for registration, renewals, extensions, divisions, improvements or reissues relating to any of these rights and the right to apply for, maintain and enforce any of the foregoing items, in each case in any jurisdiction throughout the world;

"Normal Business Hours" means from 8.00h to 17.00h local GMT +1 time, Monday through Friday.

"Order Form" means a form of quotation submitted by Smart Symbols to the Customer in which the terms and conditions of the Agreement are or are deemed to be incorporated.

"Personal Data" means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by an identifier such as a name, an identification number, location data, an online identifier or by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

"Platform" the ‘software-as-a-service’ online platform developed and owned by Smart Symbols for schools accessible through aweb browser as further described in the applicable Documentation to provide assistive technology for early childhood education. The Platform can include several modules or packages, as specified in the Order Form. The Platform may also include any additional features, content, or updates that Smart Symbols may release over time;

"Receiving Party" means the Party that receives Confidential Information under the Agreement;

"Renewal Term" has the meaning set forth in Article 12.1.1 of these Terms and Conditions;

"Services" means the Platform, Support Services and/or any other services provided by Smart Symbols to the Customer pursuant to an Order Form;

"Student Users" means students that are using a specific part of the Platform: the activity board. The activity board is accessible without authorization and made available by an Authorized User on one or more devices. The students are identified by a unique identifier, which is a symbol.

"Support Services" means the maintenance and technical support services to be delivered by Smart Symbols pursuant to Article 10.2;

"Subscription Term" means each of the Initial Terms and the Renewal Terms, as applicable;

"Third Party" means any legal entity or natural person that is not a Party or a User;

"Users" means each of the Authorized Users and the Student Users.

"User Subscriptions" means the subscriptions purchased by the Customer under these Terms and Conditions which gives the Customer and their Users access to the Platform, Services and Documentation;

"Virus" means a virus, cancelbot, worm, "backdoor", logic bomb, Trojan horse or other harmful component of software or data;

Scope

The terms and conditions set forth in these Terms and Conditions will apply to all agreements and Order Forms relating to the use of the Platform between Smart Symbols and Customer, except where special written terms and conditions or agreements provide otherwise. These terms and conditions of Smart Symbols will be deemed accepted by Customer.

These Terms and Conditions of Smart Symbols are deemed to be read, understood and accepted by the Customer when the Customer or its Users start using the Platform. These Terms and Conditions are deemed accepted even when they are conflicting with the Customer’s general or special purchasing terms and conditions. The fact that Smart Symbols did not explicitly reject the terms and conditions of the Customer referred to in any contract or Order Form cannot be interpreted by the Customer as an acceptance by Smart Symbols of such terms and conditions.

Smart Symbols reserves the right to amend these Terms and Conditions from time to time. Smart Symbols will notify Customer by e-mail of important changes materially affecting the obligations of the Parties under these Terms and Conditions. In such cases, the amendments will apply to Customer thirty (30) days after the notification. If Customer has not objected to such changes within the notification period, Customer shall be deemed to have accepted the changes. If the Customer objects to the changes, the Customer may terminate the Agreement or continue the Subscription Term under the previous conditions. In the latter case, the new conditions will in any case come into effect upon the first Renewal Term.

Platform license

Customer Data License

Customer grants Smart Symbols during the Subscription Term a worldwide, non-exclusive, royalty-free, transferable, assignable, sublicensable license to use, copy, store, modify, transmit and display Customer Data to the extent necessary to perform its obligations under the Agreement, in particular to provide and maintain the Platform and/or Services. Customer also grants Smart Symbols, for the Subscription Term, a worldwide, non-exclusive, royalty-free, transferable, assignable, sublicensable license to compile and use Customer Data solely for the purpose of researching, developing, modifying, enhancing or supporting the Platform and/or Services, provided that such data is used in an anonymous or aggregate form where such information cannot be used or will not be used directly or reasonably to identify Customer, Users or any other data subjects included therein. Under no circumstances will Smart Symbols sell or transfer Customer Data to third parties for marketing or advertising purposes.

Intellectual property

Warranties

The Customer and Smart Symbols represent and warrant to each other that they have the authority to enter into the binding Agreement personally. The Customer and Smart Symbols will perform their obligations under the Agreement in a good and workmanlike manner.

Customer warrants that the Customer Data provided will be accurate and truthful and will not (i) infringe any Intellectual Property Rights of Third Parties; (ii) misappropriate any trade secret; (iii) be misleading, defamatory, obscene, pornographic or unlawful; (iv) contain Viruses, whether or not intended to damage the Platform; or (v) otherwise infringe the rights of any Third Party. Any use of the Platform in violation of these representations and warranties by Customer will constitute an unauthorized and improper use of the Platform.

Except as expressly provided in the Agreement and to the extent permitted under applicable law, Smart Symbols expressly disclaims all warranties, express or implied, including but not limited to warranties of merchantability, non-infringement, satisfactory quality and fitness for a particular purpose of the Platform and/or Services. In particular, Smart Symbols does not warrant that the Platform and/or Services will be error free or that the use and/or operation of the Platform and/or Services will be secure or uninterrupted, that Smart Symbols will detect any or all defects in Customer's systems, or that any or all problems related to the Platform and/or Services can be resolved, and hereby disclaims any liability therefore. The Platform and/or Services will be provided by Smart Symbols under the Agreement on an "as-is" and "as available" basis. However, Smart Symbols agrees to use all reasonable efforts to fix bugs reported by Customer.

Liability

• To the maximum extent permitted under applicable law, each Party's maximum liability to the other Party arising under the Agreement will in no event exceed the Fees paid or payable by Customer to Smart Symbols during the preceding twelve (12) month period. The foregoing limitations will not apply to a Party's liability due to (i) fraud or deceit, and/or (ii) wilful misconduct.
• For the avoidance of doubt, it is specified that in no event will either Party be liable for any indirect, consequential or other similar damages (including, without limitation, damages for loss of profits, revenues, business, contracts or customers, loss or corruption of data, loss of goodwill, damage to equipment and reputation, loss of opportunity, loss of anticipated savings, and costs of obtaining substitute goods or services), even if such Party has been advised or notified of the possibility of such costs or damages.

Indemnification

Smart Symbols will defend, indemnify and hold Customer harmless from any substantiated and well-founded claim, demand, loss, liability or damage of any kind, including reasonable attorneys' fees, whether in tort or contract, incurred as a result of, or arising from, against any Third Party claim to the extent that such claim is based on an infringement of such Third Party's Intellectual Property Rights by the Platform and excluding any claims arising from (i) any unauthorized use of the Platform by Customer or any User or any use not in accordance with the Agreement and/or the Documentation, (ii) modification of the Platform by Customer or a Third Party, (iii) Customer's failure to use the most recent version of the Platform made available to it, or (iv) Customer's use of the Platform in combination with Third Party products or services.

Such indemnification obligation will be subject to the following: (i) Smart Symbols will be given prompt written notice of any such claim; (ii) Smart Symbols will have exclusive control over the defence and settlement of any such claim; (iii) at the request of Smart Symbols, Customer will cooperate fully with Smart Symbols in the defence and settlement of any such claim, at Smart Symbols’ expense; and (iv) Customer does not acknowledge that Smart Symbols is liable with respect to any such claim, nor does Customer agree to any settlement with respect to any such claim without the prior written consent of Smart Symbols. Provided these conditions are met, Smart Symbols will indemnify Customer for all direct damages and costs incurred by Customer as a result of any such claim, as awarded by a court of competent last resort, or as agreed by Smart Symbols pursuant to a settlement agreement.

In the event that the Platform or any part thereof is, in the reasonable opinion of Smart Symbols, likely to be or become the subject of a Third Party infringement claim, Smart Symbols will have the right, at its option and expense, to: (i) modify the (allegedly) infringing portion of the Platform so that it becomes non-infringing while maintaining equivalent functionality; (ii) obtain for Customer a license to continue to use the Platform in accordance with the Agreement.

The foregoing states the entire liability and obligation of Smart Symbols and the sole remedy of Customer with respect to any infringement or alleged infringement of any Intellectual Property Rights caused by the Platform or any part thereof.

Price and Payment Conditions

Services

Smart Symbols will perform the Services in a professional manner and will use reasonable skill and care in performing the Services.

Smart Symbols will during the Subscription Term provide Support Services relating to the Platform on a best-efforts basis via the Platform, during Normal Business Hours.

The Customer will co-operate with Smart Symbols and provide such assistance, information and equipment as reasonably requested by Smart Symbols to be able to adequately perform the Services. Where performance of the Services is delayed by the Customer (or a Third Party acting under the Customer’s control or on the Customer’s behalf), including as a result of Customer dependencies not being met, any costs incurred by Smart Symbols as a result thereof will be paid by the Customer. The Customer acknowledges and agrees that in the event the Customer fails to fulfil any of its obligations under the Agreement, the timeline and fees will be adversely impacted.

Data Protection

Each Party will and will ensure that its personnel and (sub)contractors will at all times comply with its/their respective obligations under all applicable Data Protection Legislation and the DPA agreed between the Parties in respect of all Personal Data processed under the Agreement.

In connection with and for the purpose of providing the Platform under the Agreement, Smart Symbols will process Personal Data in accordance with the provisions of the DPA.

Term and Termination

Confidentiality

The Receiving Party will use its best efforts to protect Confidential Information of the Disclosing Party from unauthorized disclosure to Third Parties.

It is agreed between the Parties that the Agreement itself will also be considered Confidential Information.

The Receiving Party agrees that it will not distribute or disclose Confidential Information to Third Parties. The Receiving Party will in no event exercise a lesser degree of care in protecting the Disclosing Party's Confidential Information than it exercises for its own Confidential Information of equal sensitivity and importance and upon discovery of any unauthorized disclosure of Confidential Information in its possession, the Receiving Party will use its best efforts to prevent further disclosure or unauthorized use thereof.

Unless otherwise agreed by the Disclosing Party, the Receiving Party will use the Disclosing Party's Confidential Information only in connection with the purposes of the Agreement and will make such Confidential Information available only to its directors, employees, suppliers and (sub)contractors on a "need to know" basis for the performance of the Agreement and who are bound by confidentiality either by their employment agreements or otherwise expressly in writing to a degree no less stringent than the obligations imposed on the Receiving Party under the Agreement.

Each Party will be liable for acts and omissions of its directors, employees, suppliers and (sub)contractors that result in unauthorized dissemination, use and/or disclosure of Confidential Information as if such acts or omissions had been its own.

The Confidential Information will remain the exclusive property of the Disclosing Party. The Receiving Party will return or destroy all Confidential Information upon the Disclosing Party's first request.

The Receiving Party's obligations with respect to the Confidential Information will remain in effect for a period of indefinite duration.

Upon termination of the Agreement for any reason, the Receiving Party will return all Confidential Information of the Disclosing Party and all copies thereof to the Disclosing Party or, at the Disclosing Party's option, erase or destroy all Confidential Information. Upon request by the Receiving Party, the Disclosing Party will certify in writing that it no longer possesses any Confidential Information or copies thereof.

The obligations and limitations of this Article will not apply to information disclosed by the other Party to a Party or to which a Party may have access, nor to Confidential Information or portions thereof that the Receiving Party can demonstrate that it (a) was rightfully known prior to disclosure; (b) was rightfully obtained from a Third Party authorized to make such disclosure, without violation of the terms and provisions of the Agreement; (c) was independently developed by the Receiving Party, as evidenced by documents from that time; (d) is available to the public without restriction; (e) has been approved for disclosure with the prior written consent of the Disclosing Party; or (f) has been disclosed pursuant to a court order or as otherwise required by law, provided that the Receiving Party required to disclose the information gives the Disclosing Party prompt prior notice so that the Disclosing Party may seek a protective order or otherwise prevent the disclosure.

Free trial

Smart Symbols offers a free trial period to new Customers registering for our Platform for the first time. The following terms apply to the free trial period.

Eligibility

The free trial is available to new Customers who have not previously subscribed to our Services. No credit card or other payment method is required to sign up for the trial.

Duration

The free trial period is valid for three (3) months (unless stated otherwise), commencing upon the Customer's registration completion, after which access to the Platform is granted. Smart Symbols reserves the right to modify or discontinue the trial period offer at any time and without notice.

Service Access

During the free trial, you will have access to all features and functions of the Services as a paid Customer would, unless stated otherwise.

Changes to Terms

Smart Symbols may change the terms and conditions of the free trial offer or cancel such offer at any time. Smart Symbols will provide you with reasonable notice of any such changes.

Limitations

Smart Symbols reserves the right to limit eligibility for the free trial offer to prevent any misuse. If Smart Symbols detects that an email address or payment method has been used for a previous trial, we may exclude that Customer from receiving a new free trial.

Use of Data

Data collected during the free trial will be used in accordance with our Privacy Policy to deliver personalized services and for other purposes, as further detailed in our Privacy Policy.

Miscellaneous

Severability

If any provision of the Agreement is declared invalid or unenforceable by a court of competent jurisdiction, such provision(s) will be construed, to the fullest extent possible, in accordance with the intentions of the invalid or unenforceable provision(s), with all other provisions remaining in full force and effect.

No Partnership

No joint venture, partnership, employment or agency relationship exists between Customer and Smart Symbols as a result of the Agreement or use of the Platform.

No Waiver

The failure of a Party to enforce any right or provision in the Agreement will not constitute a waiver of such right or provision unless acknowledged and agreed to in writing by that Party.

Force Majeure

Except for the payment of the Fee or any other charge due from Customer, if the performance of the Agreement by either Party is prevented, hindered, delayed or otherwise made impossible by any circumstance beyond the control of the parties that could not be foreseen and could not be avoided by means of reasonable efforts, including, but not limited to flood, riot, fire, judicial or governmental action, labour disputes, act of God, power outages, cybercrime, unauthorized access to Smart Symbols’ information technology systems by Third Parties, or any other cause beyond such Party’s control, such Party will be excused to the extent it is prevented, hindered or delayed by such causes.

Non-assignment

The Agreement may not be assigned by a Party to a Third Party or User without the prior written consent of the other Party.

Notification

Each Party will give all notices or other communications required or permitted to be given under the Agreement to the other Party in writing at the address shown on the first page of the Agreement, by courier, registered or recorded mail (postage prepaid and return receipt requested), by email or fax, or by a nationally recognised express delivery service. The notice will be effective upon receipt or refusal of delivery. In the case of delivery by registered mail, notice will be deemed given five (5) calendar days after posting, as evidenced by the date of the postmark. In the case of delivery by courier or express mail, such notice will be deemed to have been given on the delivery date as evidenced by the courier's or express mail's receipt. Notices sent by e-mail or fax will be deemed effective as of the date thereof (provided, however, that if no confirmation is received within three (3) business days , the notice shall be deemed to have been received on the day when such confirmation is actually received). Either Party may change its address for the receipt of notifications by notifying the other Party of such change.

Entire Agreement

The Agreement, together with all applicable Documentation, constitutes the entire agreement between Customer and Smart Symbols and supersedes all prior or contemporaneous negotiations, discussions or agreements, whether written or oral, between the Parties with respect to the subject matter contained herein. No modification or amendment of the Agreement will be binding unless in writing and signed by an authorized representative of each Party.

References

Smart Symbols is entitled to make public reference to the Customer as a customer of Smart Symbols and to use the Customer’s name and logo on its website for this purpose only (for the avoidance of doubt, without, in any event, disclosing any Confidential Information), after prior written approval of the Customer.

Applicable Law and Jurisdiction

The Agreement will be construed in accordance with its provisions, without any strict interpretation in favour of or against one of the Parties and in accordance with Belgian law, without application of any conflict of laws. All disputes or controversies arising out of or in connection with the Agreement or its subject matter that cannot be resolved by amicable settlement within a term of thirty (30) days from the date that the dispute is referred from one party to the other, will be subject to the exclusive jurisdiction of the courts of Kortrijk, Belgium.

Definitions

"Contact Person" means the individual(s) assigned by a Party and communicated to the other Party as point of contact and representing the Party for (a part of) the Services.

"Data Controller" means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the Processing of Personal Data.

"Data Processor" means a natural or legal person, public authority, agency or any other body which processes Personal Data on behalf of the Data Controller.

"Data Subject", "Personal Data", "Personal Data Breach", and "Processing" shall have the same meanings as in the Data Protection Legislation. "Processed" and "Process" shall be construed in accordance with the definition of "Processing".

"Data Protection Legislation" means the EU Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), together with the codes of practice, codes of conduct, regulatory guidelines and standard clauses and other related legislation arising from such Directive or Regulation, as updated from time to time;

"Third Party" means any person or entity which is not a party to the Terms and Conditions, including any contractors (including Sub-Contractors).

"Services" means the services, functions, responsibilities and outputs to be provided and fulfilled by the Data Processor under the Terms and Conditions.

"Sub-Contractor" means a Third Party engaged by the Data Processor as sub-contractor to provide the Services or any part of them.

Scope and Purpose

The Data Controller requests the Services of the Data Processor, by which the Data Processor will Process Personal Data on behalf of the Data Controller. The Data Controller determines the purposes and means of the Processing and expressly acknowledges and warrants that it has all necessary rights to provide the Personal Data to the Data Processor, and that one or more lawful bases set forth in the Data Protection Legislation supports the lawfulness of the processing. The Data Controller shall take all reasonable steps to keep Personal Data up to date to ensure the data are not inaccurate or incomplete regarding the purposes for which they are collected. The Data Processor shall without undue delay inform the Data Controller if, in its opinion, an instruction infringes this DPA, Data Protection Legislation or other EU or Member State data protection provisions.

Data Processing Obligations

Where Personal Data is Processed by Data Processor, its agents, Sub-Contractors or employees under or in connection with the Agreement, Data Processor shall, and shall procure that its agents, Sub-Contractors and employees shall:

Only Process the Personal Data or disclose or permit the disclosure of the Personal Data to any Third Party:

• in accordance with the instructions of the Data Controller as stated in this DPA; or
• where required by EU or Member State law to which Data Processor is subject, in which case Data Processor shall inform Data Controller of that legal requirement before Processing that Personal Data, unless that law prohibits such information being provided on important grounds of public interest;

Take reasonable steps to ensure that all employees, agents and Sub-Contractors who may have access to the Personal Data:

• are informed of the confidential nature of the Personal Data; and
• are subject to confidentiality undertakings or professional or statutory obligations of confidentiality that apply with respect to (the Processing of) such Personal Data;

except where statutory guidance indicates that a Personal Data Breach is not required to be notified by a Data Processor to a Data Controller, notify Data Controller without undue delay and at the latest within forty-eight (48) hours after having become aware of a Personal Data Breach, and otherwise assist Data Controller taking into account the nature of Processing and the information available to Data Processor, in meeting its obligations regarding the notification, investigation, mitigation and remediation of a Personal Data Breach under the Data Protection Legislation, without prejudice to Data Processors right to charge Data Controller any reasonable costs for such assistance. A party’s obligation to report or respond to a Personal Data Breach is not and will not be construed as an acknowledgement by that Party of any fault or liability with respect to the Personal Data Breach;

with regard to the protection of Data Subjects’ rights pursuant to the applicable Data Protection Legislation, facilitate the exercise of Data Subject rights and ensure that adequate information is provided to Data Subjects about the Processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language;

co-operate as reasonably requested by Data Controller, to the extent necessary to enable Data Controller to comply with any exercise of rights by a Data Subject under the Data Protection Legislation in respect of Personal Data Processed by Data Processor under the Agreement or comply with any assessment, enquiry, notice or investigation under the Data Protection Legislation, including by any regulator, subject to reasonable advance notice and without prejudice to Data Processor’s right to charge Customer any reasonable costs for such assistance;

inform the Data Controller of requests, should a Data Subject directly contact Data Processor wanting to exercise his individual rights, within five (5) business days and provide the Data Controller with full details thereof, together with a copy of the Personal Data held by it in relation to the Data Subject where relevant. Data Processor shall promptly direct such Data Subject to the Customer.

only authorise Sub-Contractors to Process the Personal Data (“Sub-Processor”) not objected to by Data Controller, subject to:

• informing Data Controller of the identity of the proposed Sub-Processor. Data Processor informs the Data Controller of all intended changes with regard to the addition or replacement of other Sub-Contractors. The Data Controller has the right to object to such changes; and
• including terms in the contract between Data Processor and the Sub-Processor which are mutatis mutandis as those set out in this DPA; and
• Data Processor remaining liable to Data Controller in accordance with the terms of the Agreement relating to liability, for any failure by a Sub-Processor to fulfil its obligations in relation to the Processing of any Personal Data;

cease Processing the Personal Data upon the termination or expiry of the Agreement or, if sooner, the Service to which it relates and, at Data Controller’s option, either (if technically possible) return or delete the Personal Data and any copies of it or of the information it contains, without prejudice to any EU or Member State legal obligations for Data Processor to store or archive such Personal Data.

Consultation and Correction of Personal Data

Data Processor will provide Data Controller with access to Personal Data Processed under the Terms and Conditions, in order to allow Data Controller to consult and correct such Personal Data.

Details of Processing of Personal Data

The nature and purpose of the Processing, type of personal data and categories of Personal Data to be Processed are further detailed hereunder:

• The nature and purpose of the Processing of Personal Data: first name, last name, email address
• Storage location: Frankfurt, Germany
• Storage period: Until 24 months after termination of the Agreement
• Transfer of Personal Data (outside the EEA): No

Use of Sub-Processors

Data Controller authorizes the use of Third Party Sub-Processors to process personal data on its behalf. Data Processor hereby provides Data Controller with a list of its currently appointed Sub-Processors. This list includes the identities of the Sub-processors and their country of location. Upon execution of this Agreement, Data Controller explicitly gives its written authorization to engage these Sub-Processors to Process personal data on Data Controller’s behalf.

Data Processor shall notify Data Controller by email of any intended changes concerning the addition or replacement of its current Sub-Processors prior to any such changes. Data Controller will be allowed to object to such addition or replacement on reasonable grounds relating to the protection of personal data within 30 days after the notification by submitting an email to [email protected]. The Data Controller’s failure to object within this timeframe shall be deemed to have waived its right to object and to have authorized Data Processor to engage such Sub-Processor.

If Data Controller does notify Data Processor of such an objection, Parties will discuss Data Controller's concerns with a view to achieving a reasonable resolution. If no such resolution can be reached, Data Processor will, at its sole discretion, either not appoint the new Sub-Processor, or permit Data Controller to suspend or terminate the affected Service in accordance with the termination provisions without liability to either Party (but without prejudice to any fees incurred by Data Controller prior to suspension or termination of the Terms and Conditions).

Liability

Data Processor can only be held liable for an infringement of this DPA that is directly attributable to them, or the provisions that apply directly to Data Processor on the basis of the applicable Data Protection Legislation insofar as Data Controller has complied with its own obligations as set out in this DPA and the applicable Data Protection Legislation. The liability provision set out in the Terms and Conditions is fully applicable.

Compliance

Upon request, Data Processor shall make available to Data Controller all information necessary to demonstrate compliance with its obligations under Article 32 to 36 of the GDPR and allow for and contribute to audits conducted by Data Controller or another auditor mandated by Data Controller (which may be refused by Data Processor if this is a competitor of Data Processor or if there is a conflict of interest with this mandated auditor) for the purpose of verifying the compliance with its obligations under this DPA without prejudice to Data Processor’s right to charge Data Controller any reasonable costs for such assistance. An audit may not take place more than once per contract year and must be notified at least 60 days in advance. All audit costs are exclusively borne by the Data Controller. Data Processor may limit the access of Data Controller to the premises of Data Processor to a space provided by Data Processor and the auditor may not copy or delete documents from Data Processor without the prior approval and consent of Data Processor. Data Controller shall guarantee that the audit is carried out in such a way that the inconvenience for Data Processor is kept to a minimum. Data Controller will impose sufficient confidentiality obligations on its auditors. In addition, Data Processor has the right to require the auditors to sign a non-disclosure agreement before the start of the audit. In all cases, it is essential to protect the confidential information of Data Processor. Data Controller must, or will request that its external auditors, send a draft version of the audit report to Data Processor. Data Processor has the right to submit its comments within a timeframe as agreed between the Parties. The auditor shall take the comments of Data Processor into account.

Technical and Organisational Measures

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, each Party shall implement the measures stated in article 32 of the GDPR and ensure that its agents, Sub-Contractors and employees implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account in particular the risk of accidental or unlawful destruction, loss, alteration or unauthorised disclosure of or access to the Personal Data. The Data Controller and Data Processor shall take steps to ensure that any natural person acting under the authority of the Data Controller or the Data Processor who has access to personal data does not process them except on instructions from the Data Controller, unless he or she is required to do so by EU or Member State law.

Term and Termination

This DPA enters into force on the Effective Date and remains in force until Processing of Personal Data by Data Processor is no longer required in the framework of or pursuant to the Agreement.

Any terms and conditions which are intended by their nature to survive any termination, cancellation or expiration of the Agreement, shall remain in full force and effect.

Upon expiration or termination of the Agreement, Data Processor shall at the Data Controller’s request either delete or return any Personal Data. If such Personal Data are to be returned, The Data Processor will return the Personal Data in a structured, machine-readable and commonly used format and, if applicable, the costs in relation thereto. If Data Controller requests to delete such Personal Data, such Personal Data shall be deleted upon expiry of the backup retention period, without prejudice to any EU or Member State legal obligations for Data Processor to store or archive such Personal Data after termination.

Regulatory Changes

If there is new guidance or a change in the Data Protection Legislation or case law that renders all or part of the Services illegal, Data Processor may terminate the Terms and Conditions unless the Parties reach agreement to change the Services whereby the Services are no longer illegal.

Severability

If a provision of this DPA is proven to be invalid or unenforceable in whole or in part, it will be regarded as severable (insofar as it is invalid or unenforceable) and the validity of the other provisions of this DPA and the remainder of the provisions in question will remain unaffected. If the invalid provision is of fundamental importance for achieving the goal of this DPA, the Parties shall negotiate in good faith to remedy the invalidity, illegality or unenforceability of the provision or otherwise change this DPA to achieve its purpose.

Notifications

Unless legally prohibited from doing so, Data Processor shall notify the Data Controller as soon as reasonably possible, and at the latest within five (5) business days of becoming aware of the relevant circumstances, if it or any of its Sub-processors:

• receives an inquiry, a subpoena or a request for inspection or audit from a competent public authority relating to the Processing;
• intends to disclose Personal Data to any competent public authority outside the scope of the Services of the Agreement.
• receives an instruction that infringes the Data Protection Legislation or the obligations of this Data Processing Agreement;

Any notification under this DPA, including a Personal Data Breach notification, will be delivered to one or more of the Data Controller’s Contact Persons via email possibly supplemented by any other means Data Processor selects. Upon request of the Data Controller, Data Processor shall provide the Data Controller with an overview of the contact information of the registered Data Controller’s Contact Persons. It is Customer’s sole responsibility to timely report any changes in contact information and to ensure the Customer’s Contact Persons maintain accurate contact information.