Terms of Use

These TOS govern RavenDB’s provision, licensing, installation, configuration, and support of the proprietary RavenDB software and managed cloud-based database services (collectively, the “Services”).

The Services are described on RavenDB’s website https://ravendb.net/ (the “Website”). Certain Services can be subscribed for via the Website, while for others the Website will direct you to a RavenDB representative. The Services, Fees (as defined below), any special terms shall be set forth in the subscription order form (the “Order Form”), which depending on the Services, will be generated automatically by website or via RavenDB representative.

Changes. RavenDB may change or discontinue the Services, or provide new, additional, or replacement services, at any time without liability to Customer. RavenDB may also impose limits on certain features or restrict Customer’s access to parts or all of the Services without notice or liability. Customer will receive reasonable prior written notification of any material changes. RavenDB reserves the right to amend these TOS from time to time upon prior notice to Customer. RavenDB will post notification of any such changes on the Website. Customer’s continued use of the Services following notice of changes shall constitute Customer’s acceptance of such changes. If any changes to these TOS are unacceptable to Customer, Customer may terminate these TOS in accordance with Section 10.

License Grant.

Use Limitations. Except as expressly permitted under Section 2.1 or required by law, Customer shall not, and shall not permit any third party to: (a) sublicense, rent, lease, lend, sell, assign, distribute, publish, pledge, or otherwise transfer the Services, the Software, or any right therein to any third party; (b) permit any unauthorized person to access or use the Services; (c) use the Services or any Outputs to provide services to, or for the benefit of, any third party without RavenDB’s prior written consent; (d) copy, photocopy, reproduce, translate, reverse engineer, derive source code, modify, disassemble, decompile, or create derivative works based on the Software or Services, except as expressly permitted with respect to non-compiled source files (including template files and script files) for Customer’s own internal use; (e) remove, obscure, or alter any proprietary notices or labels affixed to or contained in the Software or Services; (f) interfere with or circumvent the security or technical restrictions of the Services; (g) use the Services in any way that is unlawful, illegal, fraudulent, or harmful, or in connection with any unlawful, illegal, fraudulent, or harmful purpose or activity, including without limitation deceptive impersonation, pyramid schemes, surveys, chain letters, junk e-mail, spamming, or any duplicative or unsolicited messages (commercial or otherwise); (h) create any derivative works of RavenDB’s Property, the Software, or the Outputs, or build a similar or competitive product or service; (i) exceed the quantitative or qualitative usage parameters (e.g., number of licensed hardware processing cores, users, processing capacity, geographic scope) specified in the applicable Order Form; (j) fail to provide RavenDB with any information which it may reasonably require from time to time to enable RavenDB to perform its obligations under these TOS; (k) access, store, distribute, or transmit during the course of its use of the Services any malicious code (i.e., software viruses, Trojan horses, worms, malware, or other computer instructions, devices, or techniques that erase data or programming, infect, disrupt, damage, disable, or shut down a computer system or any component thereof), or any unlawful, threatening, obscene, or infringing material; (l) use any robot, spider, other automated device, toolbar, web-bar, or other web-client, device, software, routine, or manual process to access, monitor, or scrape information from the Services, or bypass any robot exclusion requests; (m) use any meta tags or any other “hidden text” utilizing any of RavenDB’s trademarks or intellectual property; or (n) harass or defame others, interfere with the access, use, or enjoyment of the Services by others, or promote hatred towards any group of people. Any breach of this Section 2.3 shall result in immediate, automatic termination of the applicable License, and shall subject Customer to civil and/or criminal liability. In addition, RavenDB reserves the right to seek injunctive relief and any other remedies available at law or in equity without the requirement to post bond or other security. RavenDB shall also have the right to audit Customer’s use of the Software and Services upon reasonable prior written notice to verify compliance with the terms of these TOS and the applicable Order Form.

Access to the Services; Users. RavenDB will make the Services available to Customer via password-protected online access or, for On-Premises Software, via license key and Access Credentials (the “Access Credentials”). Access to the Services is subject to RavenDB’s security protocols, policies, and documentation. Customer shall maintain adequate security and control of its Access Credentials and only provide such Access Credentials to those individuals who it has authorized to use the Services (each, an “Authorized User”). Only Customer’s employees and individual contractors who are bound by written confidentiality obligations no less restrictive than those in Section 10 may access and operate the Services. Customer shall ensure that all Authorized Users comply with these TOS, and Customer shall be fully liable for any breach by an Authorized User.

Delivery. RavenDB shall provide Customer with Access Credentials and instructions for accessing the Services within the timeframe set forth in the applicable Order Form. For Cloud Services, RavenDB shall provide online services that host Customer’s data (“Customer’s Data”) on cloud servers managed by RavenDB. Customer retains full ownership of Customer’s Data. These TOS do not grant RavenDB any rights to Customer’s Data except as necessary to operate and provide the Services. RavenDB may make technical design choices in administering the Cloud Services (including replication, storage, scaling, clustering, compression, decompression, and backup of Customer’s Data), and Customer hereby grants RavenDB full permission to make any such design choices.

Installation and Configuration. For On-Premises Software, RavenDB shall be responsible, in accordance with the terms of these TOS, for providing Customer with the Software and applicable license key, and Customer shall be responsible for all hosting, operation, and configuration of the Software in its own environment, and for providing necessary information and cooperation to enable access and use of the Services. For Cloud Services, RavenDB shall be responsible for hosting, maintaining, and configuring the Services in its own environment.

Software Components. RavenDB shall provide Customer with software components to be installed on end-devices, which are licensed to Customer in accordance with the provisions of Section 11.3. RavenDB may also provide Customer with a subdomain for use with the On-Premises Software. Such subdomain shall be used solely to host nodes or servers of RavenDB and not any other servers or services. Customer is solely responsible for the subdomain, all content made available thereunder, and all security thereof. Customer shall not host any subdomain that (a) infringes third-party intellectual property rights, (b) violates applicable law, (c) promotes criminal activity, or (d) contains hateful, racist, obscene, or otherwise offensive content. RavenDB may delete any subdomain without notice if it reasonably believes the subdomain is being used in breach of these TOS or applicable law, or if the subdomain has been unused for more than six (6) months. The Software and subdomains are not designed or certified for use in the operation of weapons, weapons systems, nuclear installations, means of mass transportation, aviation, life-support computers or equipment, pollution control, hazardous substances management, or any other application in which the failure of any product, service, or system could create a situation where personal injury or death may occur. Customer expressly agrees that RavenDB has no liability for any damages resulting from such use.

Free Services. RavenDB may, at its discretion, offer certain Services at no charge (“Free Services”), subject to resource limitations as specified on the RavenDB website. Once Customer reaches the maximum resources allocated for Free Services, Customer will be required to pay the applicable Fees in accordance with the applicable Order Form. RavenDB reserves the right to discontinue Free Services at any time without prior notice to Customer. Any free instance that is inactive for more than fourteen (14) days will be closed and deleted without notice. Any data bundles purchased shall be available for use during a twenty-four (24) month period from the purchase date. Data bundles are specific to a particular product and cannot be applied across different products. No refunds or credits shall apply to data bundles.

The Services may provide links to other websites (including those of RavenDB’s partners). RavenDB may, from time to time, at its sole discretion, add or remove links to other websites. Customer understands and agrees that RavenDB may utilize the services of third-party providers to provide certain services through the Services, such as registration, authentication, billing, hosting, or other services. Such services are provided by third parties in accordance with their own terms of service and privacy policies, and RavenDB makes no representations or warranties regarding the same.

These links and third-party services are provided solely as a convenience to Customer, and access to any such websites and/or use of such third-party services is at Customer’s own risk. Customer is recommended to review the information provided by third parties (such as, but not limited to, the privacy policy and terms of use of the relevant website) before accessing such websites. RavenDB does not endorse or control, and is not responsible for, these websites or their content, services, or availability.

Accordingly, RavenDB makes no representations about them, or any material found there, or any results that may be obtained from using them. Customer expressly releases RavenDB from any and all liability arising from Customer’s use of any third-party website or service. Although RavenDB will use reasonable efforts to assist Customer in any dispute that arises between Customer and a third party, RavenDB cannot be responsible for any loss or damage arising therefrom.

Infrastructure and Environment. Customer shall be responsible for maintaining secure access to the Services via the internet and ensuring that only Authorized Users are provided with access credentials.

Data and Backup. Customer is exclusively responsible for (i) the selection and lawful acquisition of any data ingested by or stored on the Services; (ii) the accuracy of such data; (iii) performing regular backups; and (iv) ensuring that all use of the Services and all data processed, stored, or transmitted through the Services complies with all applicable laws, including without limitation all privacy and data protection laws. For On-Premises Software, RavenDB shall not be liable for any loss, corruption, or unauthorized disclosure of data stored on Customer-controlled infrastructure. For Cloud Services, upon termination, RavenDB shall have no further responsibility for any of Customer’s data files, backup files, or usage history stored by RavenDB, and may delete Customer’s data files and backup data files within two (2) weeks after termination. Customer shall bear all liability with respect to compliance with all applicable laws, including without limitation privacy and data protection laws.

Output Review and Actions. Customer shall independently review all Outputs, evaluate any risks or threats identified therein, and determine appropriate actions. RavenDB shall bear no responsibility for Customer’s reliance on or use of the Outputs or the Services, or for any decisions taken or not taken based thereon.

Each Party represents and warrants that:

Customer represents, warrants and acknowledges that, at all times throughout the term of these TOS:

Consideration. In consideration for the Services, Customer shall pay RavenDB the fees set forth in the applicable Order Form (the “Fees”). Fees are non-refundable, except as expressly set forth herein. No refunds will be provided upon termination of these TOS for any reason, including early termination by Customer. Refunds, if awarded at RavenDB’s sole discretion, shall be awarded only in the form of credit for future Services. No cash refunds will be awarded.

Taxes. All Fees are exclusive of any applicable taxes, value-added taxes, or government charges, all of which shall be Customer’s sole responsibility and shall be added to each payment at the applicable rate.

Offset. Customer shall not be entitled to offset any payments due to RavenDB under these TOS.

Default. If Customer defaults in payment of any sum due to RavenDB, RavenDB shall provide a written notice to Customer. If the invoice remains unpaid for more than fifteen (15) days following such notice, then RavenDB may suspend further performance of the Services and Customer’s access to the Services until Customer pays the amount in full, without prejudice to any other rights or remedies available to RavenDB. RavenDB reserves the right to take all necessary actions to collect amounts due, including legal action and/or use of third-party collection agencies.

Interest. Interest will accrue on amounts which are more than fifteen (15) days past due at the lower of: (i) 1.5% per month, calculated from the original due date; or (ii) the maximum rate permitted under applicable law. In any proceeding brought by RavenDB to collect amounts due, RavenDB will also receive its actual costs of collection, including reasonable attorneys’ fees. Termination of these TOS shall not relieve Customer of any payment obligations accrued prior to the date of termination.

Price Adjustments Upon Renewal. RavenDB may, upon each Renewal Term (as defined below), adjust the Fees set forth in the applicable Order Form by providing Customer with written notice of such adjustment at least thirty (30) days prior to the commencement of the applicable Renewal Term. Any such price adjustment shall become effective at the start of the Renewal Term, unless Customer provides notice of non-renewal in accordance with Section 9.2.

Term. These TOS shall commence on the date of the applicable PO and shall remain in force until terminated in accordance with this Section 9. Each PO shall have the term specified therein (the “Term”).

Automatic Renewal. Unless otherwise specified in the applicable Order Form, upon expiration of the initial term set forth in the Order Form, the Order Form shall automatically renew for successive one (1) year periods (each, a “Renewal Term”), unless either Party provides the other Party with written notice of its intent not to renew at least thirty (30) days prior to the expiration of the then-current term. All terms and conditions of these TOS and the applicable Order Form shall remain in effect during any Renewal Term, unless otherwise agreed in writing by the Parties.

Termination for Cause. Either Party may, without prejudice to the other rights or remedies available to it, immediately terminate these TOS if the other Party:

Effect of Termination. Upon any termination or expiration of these TOS or an Order Form: (a) all Licenses and access rights granted under such Order Form shall automatically terminate; (b) for On-Premises Software, Customer shall immediately cease all use of, and uninstall, the Software, and within ten (10) days certify in writing to RavenDB that it has done so; Customer may thereafter continue to use the Software solely under the terms of the MIT license (for client libraries) and AGPLv3 (for server software), as set forth in Section 2.1(a); (c) each Party shall return or securely destroy the other Party’s Confidential Information; (d) RavenDB will be paid for all Services performed and expenses incurred during the Term; if Customer terminates an Order Form or these TOS without cause while any Order Form remains uncompleted, Customer shall pay any remaining Fees and/or cancellation fees applicable to the affected Order Form, as set forth therein; furthermore, any Fees paid in advance are non-refundable; and (e) for Cloud Services, RavenDB shall have no further responsibility for any of Customer’s data files, backup files, or usage history stored by RavenDB, and may delete Customer’s data files and backup data files within two (2) weeks after termination.

Survival. The provisions of Sections 2.2, 6.2, 6.3, 7, 8, 9 (with respect to accrued payment obligations), 10.5, 11 through 14, and 17 hereinafter shall remain in force even after the termination of these TOS for any reason.

“Confidential Information” means any trade, business, technical, scientific or other information relating to respective businesses of the Parties, whether in oral, written, graphic or machine-readable form, except to the extent such information: (i) was known to the receiving party (the “Recipient”) at the time it was disclosed, other than by previous disclosure by or on behalf of the disclosing party (the “Discloser”); (ii) is at the time of disclosure or later becomes publicly known under circumstances involving no breach of these TOS; (iii) is independently developed by the Recipient without the use of or reference to the Discloser; or (iv) is disclosed to the Recipient on a non-confidential basis by a third party that is not bound by any confidentiality obligation to the Discloser in respect of such information. RavenDB’s Property, the Services, and Outputs are RavenDB’s Confidential Information.

The Recipient undertakes to keep confidential, not disclose to any person, and not make any use of, the Confidential Information, other than for the purpose of fulfilling its obligations under these TOS. The Recipient shall treat the Confidential Information with at least the same degree of confidentiality as it keeps its own confidential information and no less than a high degree of care. The Recipient may disclose Confidential Information only to its employees, consultants, officers (including directors), shareholders and representatives who have a need to know such information, in order to enable the exercise of its rights and fulfill its obligations under these TOS, and who are legally bound by agreements which impose confidentiality and non-use obligations, substantially comparable to those assumed by the Recipient. The Recipient shall be responsible for the compliance, on the part of its employees, consultants, officers and representatives with the confidentiality obligations set forth in this Section 10.

The Recipient shall be permitted to furnish any portion of the Confidential Information to any governmental agency, judicial body or other regulatory authority having jurisdiction over the Recipient if it is legally required pursuant to an order or instruction of such agency, body or authority, provided that the Recipient shall, to the extent permitted by law, inform the Discloser immediately upon receipt of a demand to make such disclosure.

Ownership. All rights, of any kind whatsoever, including, but not limited to, intellectual property rights, copyrights, trademarks, brands, patents, trade secrets, know-how, Software, updates, documentation, methodologies, and any derivative works thereof, and/or any other material included and/or associated with the Services and the Outputs, whether said rights are registered or unregistered, are exclusively owned by RavenDB or any of its affiliates or licensors (collectively, “RavenDB’s Property”). Customer retains full ownership of Customer’s Data. These TOS do not grant RavenDB any rights to Customer’s Data except as necessary to provide the Services. Except for the limited License expressly granted in Section 2.1 and Section 11.3, these TOS do not convey to Customer any interest in or to the Services or the Outputs, but only a limited revocable right to use the same in accordance with the terms of these TOS, and nothing herein constitutes a waiver of RavenDB’s Property rights under any law.

Feedback. Customer may from time to time provide feedback, comments, or suggestions regarding the Services (“Feedback”). RavenDB shall be the sole and exclusive owner of all rights in connection with any and all ideas, inventions, and/or improvements conceived or derived from such Feedback. Customer irrevocably assigns to RavenDB any rights that Customer may have or acquire in such Feedback, and irrevocably waives any right to receive any payment, royalty, or other consideration with respect thereto. Feedback, even if designated as confidential by Customer, shall not, absent a separate written agreement, create any confidentiality obligation for RavenDB.

License. RavenDB hereby grants to Customer, during the Term, a non-exclusive, worldwide right to access and use any software that RavenDB has agreed to provide access to and use of under these TOS and the relevant Order Form, for Customer’s own internal business purposes.

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, RAVENDB, ITS PARENT, SUBSIDIARIES, AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, LICENSORS, SUPPLIERS, DISTRIBUTORS, AND RESELLERS SHALL NOT BE LIABLE, WHETHER UNDER CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, TO CUSTOMER OR ANY THIRD PARTY FOR ANY LOSS OR DAMAGE OF ANY KIND RESULTING FROM THE USE OR INABILITY TO USE THE SERVICES OR SOFTWARE, INCLUDING, BUT NOT LIMITED TO, LOSS OF DATA, LOSS OF GOODWILL, INACCURATE DATA, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, LOSS OR DAMAGE TO PRODUCT DATA, LAYOUTS, TEMPLATES, ARTWORK, OR OTHER INFORMATION STORED BY THE SOFTWARE, OR ANY AND ALL OTHER INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, EXEMPLARY, OR CONSEQUENTIAL DAMAGES OF ANY KIND, EVEN IF RAVENDB HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. RAVENDB SHALL NOT BE RESPONSIBLE FOR ANY INTERRUPTIONS OF SERVICE, INCLUDING ISP DISRUPTIONS, SOFTWARE OR HARDWARE FAILURES, OR ANY OTHER EVENT WHICH MAY RESULT IN A LOSS OF DATA OR DISRUPTION OF SERVICE. RAVENDB HAS NO LIABILITY OR RESPONSIBILITY FOR ANY VERSION OF THE SOFTWARE THAT CUSTOMER HAS MODIFIED.

WITHOUT LIMITING THE GENERALITY OF THE FOREGOING AND TO THE MAXIMUM EXTENT LEGALLY PERMISSIBLE, RAVENDB’S TOTAL CUMULATIVE LIABILITY FOR ALL CLAIMS ARISING UNDER OR RELATING TO THESE TOS, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, SHALL NOT EXCEED, IN THE AGGREGATE, THE AMOUNTS ACTUALLY PAID BY CUSTOMER TO RAVENDB IN THE THREE (3) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

RAVENDB ACCEPTS NO LIABILITY FOR ANY CLAIM NOTIFIED TO IT MORE THAN ONE (1) YEAR AFTER THE DATE OF THE PROVISION OF THE SERVICES OR ACCESS TO THE SOFTWARE THAT GAVE RISE TO THE CLAIM.

All the terms and limitations of these TOS, including the warranty and liability limitations and exclusions, are fair and reasonable in light of the amounts to be paid by Customer, the nature of the Services, the strength of the bargaining position of each Party, the alternative ways Customer’s needs could have been met, and the potential benefits and risks for both Parties in entering into these TOS.

Each Party shall comply with the applicable data protection laws to the extent applicable to its performance under these TOS.

In connection with Customer’s registration for, access to, and administration of the Services, RavenDB may collect, process, and store personal data relating to Customer’s account and business contacts, such as names, email addresses, phone numbers, billing details, company affiliation, login and account credentials, and other information provided by Customer or its Authorized Users for account creation, authentication, subscription management, billing, support communications, security, and ordinary administration of the Services. RavenDB shall process such personal data in accordance with its Privacy Policy, as may be updated from time to time data in accordance with these TOS.

To the extent RavenDB processes personal data contained in Customer Data on behalf of Customer in connection with the provision of the Services, including where access to such personal data is strictly necessary for troubleshooting, technical support, maintenance, security, or other support-related purposes, Customer shall act as the controller or business, as applicable, and RavenDB shall act as the processor or service provider, as applicable, except to the extent otherwise required by applicable law. Customer is solely responsible for determining the lawfulness of its instructions and its use of the Services, including providing all required notices and obtaining all necessary rights, consents, and authorizations for the processing of such personal data in connection with the Services.

The Data Processing Agreement made available by RavenDB and that shall be entered into by the Parties, including any schedules thereto, as may be updated or replaced from time to time in accordance with its terms, is hereby incorporated into and forms an integral part of these TOS. The DPA shall govern RavenDB’s processing of personal data on behalf of Customer in connection with the Services, including with respect to processing instructions, technical and organizational security measures, sub-processing, international data transfers, assistance with data subject requests, personal data breach notification, deletion and return of personal data, and audit rights.

RavenDB’s Privacy Policy, available on the Website, is hereby incorporated by reference into these TOS and governs RavenDB’s processing of personal data as an independent controller in connection with the Website, account registration, account administration, billing, payment processing, support communications, sales, marketing, compliance, and any related business operations. The Privacy Policy also describes, at a higher level, RavenDB’s handling of personal data that may be included in Customer Data where RavenDB’s access to such data is limited to providing support, maintenance, troubleshooting, security, or similar service-related functions.

In the event of any conflict or inconsistency between this Section 15, the DPA, and the Privacy Policy: (a) the DPA shall prevail with respect to the processing of personal data by RavenDB on behalf of Customer in connection with the Services; (b) the Privacy Policy shall prevail with respect to personal data and other information processed by RavenDB as an independent controller as described in Section 15.2 and Section 15.5; and (c) these TOS shall govern in all other respects.

“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control” for purposes of this definition means direct or indirect ownership or control of more than 50% of the voting interest in the subject entity.

“Applicable Data Protection Laws” means any local, state, federal, and international privacy laws as they apply on Personal Data and on Processor, including without limitation, (a) European Union (EU) or European Union Member State laws with respect to any ZIM Personal Data, including General Data Protection Regulation (EU) 2016/679 (“GDPR”); and (b) Israel Privacy Protection Law, 5741-1981 and the regulations promulgated thereunder, including, without limitation, the Privacy Protection Regulations (Data Security), 5777-2017 (the “Data Security Regulations”), the Privacy Protection Regulations (Transfer of Personal Data Abroad), 5761-2001 (the “Transfer of Data Abroad Regulations”), and the guidelines of the Israeli Privacy Protection Authority (collectively, “Israeli Privacy Law”).

“Controller Personal Data” means any Personal Data Processed by Processor on behalf of Controller pursuant to or in connection with the Terms.

“Standard Contractual Clauses” means the standard contractual clauses for the transfer of Personal Data to data importers established in third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as set out in Commission Implementing Decision (EU) 2021/914 and available at: eur-lex.europa.eu.

“Sub Processor” means any person (excluding an employee of Processor or any Processor Affiliate) appointed by or on behalf of Processor or any Processor Affiliate to Process Controller Personal Data on behalf of the Controller in connection with the Terms.

The terms “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processor”, “Processing” and “Supervisory Authority” shall have the meanings ascribed to them in Applicable Data Protection Laws.

Processor shall Process Controller Personal Data on Controller’s behalf and at Controller’s instructions as specified in the Terms and in this DPA, including without limitation with regard to transfers of Controller Personal Data to a third country or international organization. Any other Processing shall be permitted only in the event that such Processing is required by any Applicable Data Protection Laws to which the Processor is subject. In such event, Processor shall, unless prohibited by such Applicable Data Protection Laws on important grounds of public interest, inform Controller of that requirement before engaging in such Processing.

Controller instructs Processor (and authorizes Processor to instruct each Sub Processor) (i) to Process Controller Personal Data for the provision of the services, as detailed in the Terms (“Services”) and as otherwise set forth in the Terms and in this DPA, and/or as otherwise directed by Controller; and (ii) to transfer Controller Personal Data to any country or territory as reasonably necessary for the provision of the Services and in accordance with Applicable Data Protection Laws.

Controller sets forth the details of the Processing of Controller Personal Data, as required by Article 28(3) of the GDPR in Schedule 1 (Details of Processing of Controller Personal Data), attached hereto.

To the extent that the Processor uses Sub Processors in order to Process Personal Data in countries outside of the European Economic Area that do not provide an adequate level of data protection, as determined by the European Commission or other adequate authority as determined by the EU, it will enter into appropriate agreements with such Sub Processors, such as the Standard Contractual Clauses.

By virtue of the Adequacy decision n. (2011/61/EU), the State of Israel is providing an adequate level of protection for personal data as referred to in Directive 95/46/EC.

Controller represents and warrants that it has and shall maintain throughout the term of the Terms and this DPA, all necessary rights to provide the Controller Personal Data to Processor, for Processing to be performed for the purpose of providing the Services, and in accordance with the Terms and this DPA. To the extent required by Data Protection Laws, Controller is responsible for obtaining any necessary Data Subject consents and notices to the Processing, and to ensure that a record of such consents is maintained throughout the term of the Terms and this DPA and/or as otherwise required under Applicable Data Protection Laws.

Processor shall take reasonable steps to ensure that access to the Controller Personal Data is limited on a need to know and/or access basis, and that all Processor employees receiving such access are subject to confidentiality undertakings or professional or statutory obligations of confidentiality in connection with their access to and use of Controller Personal Data.

Processor shall implement appropriate technical and organizational measures to ensure an appropriate level of security of the Controller Personal Data as set forth in the Binding Security Document attached hereto as Schedule 2. In assessing the appropriate level of security, Processor shall take into account the risks that are presented by the nature of the Processing and the information available to the Processor.

Processor shall notify Controller without undue delay and, where feasible, not later than within 48 (forty eight) hours upon Processor becoming aware of a Personal Data Breach affecting Controller Personal Data. In such event, Processor shall provide Controller with commercially reasonable and available information to assist Controller in meeting any obligations to inform Data Subjects or Supervisory Authorities of the Personal Data Breach as required under Applicable Data Protection Laws.

At the written request of the Controller, Processor shall reasonably cooperate with Controller and take such commercially reasonable steps as are agreed by the parties or required under Applicable Data Protection Laws to assist in the investigation, mitigation and remediation of any Personal Data Breach.

Controller authorizes Processor to appoint (and permits each Sub Processor appointed in accordance with this Section 7 to appoint) Sub Processors in accordance with this Section 7.

Processor may continue to use those Sub Processors already engaged by Processor as identified to Controller as of the date of this DPA.

The current list of Sub Processors is as further described under Schedule 3 attached hereto as “Sub Processors List”.

Processor may appoint new Sub Processors and shall give notice of any such appointment to Controller. If, within ten (10) days of such notice, Controller notifies Processor in writing of any reasonable objections to the proposed appointment, Processor shall not appoint the proposed Sub Processor for the Processing of Controller Personal Data until reasonable steps have been taken to address the objections raised by Controller and Controller has been provided with a reasonable written explanation of the steps taken. Where such steps are not sufficient to relieve Controller’s reasonable objections, each of Controller or Processor may, by written notice to the other party and with immediate effect, terminate the Terms to the extent that it relates to the Services requiring the use of the proposed Sub Processor. In such event, the terminating party shall not bear any liability for such termination. If Controller does not respond to such notice within ten (10) days, Controller’s consent will be deemed to have been received and Processor shall be entitled to appoint the new Sub Processor.

With respect to each new Sub Processor, Processor shall:

Controller shall be solely responsible for compliance with any statutory obligations concerning requests to exercise Data Subject rights under Applicable Data Protection Laws (e.g., for access, rectification, deletion of Controller Personal Data if required under Applicable Data Protection Laws, etc.). Processor shall, at Controller’s sole expense, use commercially reasonable efforts to assist Controller in fulfilling Controller’s obligations with respect to such Data Subject requests, as required under Data Protection Laws.

Upon receipt of a request from a Data Subject under any Applicable Data Protection Laws in respect to Controller Personal Data, Processor shall promptly notify Controller of such request and shall not respond to such request except on the documented instructions of Controller or as required by Applicable Data Protection Laws to which the Processor is subject, in which case Processor shall, to the extent permitted by Applicable Data Protection Laws, inform Controller of such legal requirement prior to responding to the request.

The Processor’s assistance in responding to such requests shall be limited to technical measures and shall be subject to reimbursement of reasonable costs.

At Controller’s written request and expense, the Processor and each Sub Processor shall provide commercially reasonable assistance to Controller with respect to any Controller Personal Data Processed by Processor and/or a Sub Processor, with any data protection impact assessments or prior consultations with Supervisory Authorities or other competent data privacy authorities, as required under any Applicable Data Protection Laws.

Processor shall promptly and in any event within 60 (sixty) days of the date of cessation of provision of the Services to Controller involving the Processing of Controller Personal Data, delete, return, or anonymize all copies of such Controller Personal Data, provided however that Processor may retain Controller Personal Data for legal purposes, as permitted by Applicable Data Protection Laws.

Subject to Sections 11.2 and 11.3, Processor shall make available to an auditor mandated by Controller in coordination with Processor, upon prior written request, such information reasonably necessary to demonstrate compliance with this DPA and shall allow for audits, including inspections, by such reputable auditor mandated by the Controller in relation to the Processing of the Controller Personal Data by the Processor, provided that such third-party auditor shall be subject to confidentiality obligations.

Any audit or inspection shall be at Controller’s sole, and subject to Processor’s reasonable security policies and obligations to third parties, including with respect to confidentiality. The results of any audit or inspection shall be considered the confidential information of the Processor and shall be treated with the same degree of care as Controller affords its own confidential information.

Controller and any auditor on its behalf shall use best efforts to minimize or avoid causing any damage, injury or disruption to the Processors’ premises, equipment, employees and business and shall not interfere with the Processor’s day-to-day business. Controller and Processor shall mutually agree upon the scope, timing and duration of the audit or inspection and the reimbursement rate, for which Controller shall be responsible. Processor need not give access to its premises for the purposes of such an audit or inspection:

Controller shall indemnify and hold Processor harmless against all claims, actions, third party claims, losses, damages and expenses incurred by the Processor and arising directly or indirectly out of or in connection with a breach of this DPA and/or the Data Protection Laws by Controller. Each party’s liability toward the other party shall be subject to the limitations on liability under the Terms.

Governing Law and Jurisdiction

Order of Precedence

Changes in Data Protection Laws

Severance

Should any provision of this DPA be held invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall either be (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.