Terms of Service

These TOS govern RavenDB’s provision, licensing, installation, configuration, and support of the proprietary RavenDB software and managed cloud-based database services (collectively, the “Services”).

The Services are described on RavenDB’s website https://ravendb.net/ (the “Website”). Certain Services can be subscribed for via the Website, while for others the Website will direct you to a RavenDB representative. The Services, Fees (as defined below), any special terms shall be set forth in the subscription order form (the “Order Form”), which depending on the Services, will be generated automatically by website or via RavenDB representative.

Changes. RavenDB may change or discontinue the Services, or provide new, additional, or replacement services, at any time without liability to Customer. RavenDB may also impose limits on certain features or restrict Customer’s access to parts or all of the Services without notice or liability. Customer will receive reasonable prior written notification of any material changes. RavenDB reserves the right to amend these TOS from time to time upon prior notice to Customer. RavenDB will post notification of any such changes on the Website. Customer’s continued use of the Services following notice of changes shall constitute Customer’s acceptance of such changes. If any changes to these TOS are unacceptable to Customer, Customer may terminate these TOS in accordance with Section 10.

License Grant.

Use Limitations. Except as expressly permitted under Section 2.1 or required by law, Customer shall not, and shall not permit any third party to: (a) sublicense, rent, lease, lend, sell, assign, distribute, publish, pledge, or otherwise transfer the Services, the Software, or any right therein to any third party; (b) permit any unauthorized person to access or use the Services; (c) use the Services or any Outputs to provide services to, or for the benefit of, any third party without RavenDB’s prior written consent; (d) copy, photocopy, reproduce, translate, reverse engineer, derive source code, modify, disassemble, decompile, or create derivative works based on the Software or Services, except as expressly permitted with respect to non-compiled source files (including template files and script files) for Customer’s own internal use; (e) remove, obscure, or alter any proprietary notices or labels affixed to or contained in the Software or Services; (f) interfere with or circumvent the security or technical restrictions of the Services; (g) use the Services in any way that is unlawful, illegal, fraudulent, or harmful, or in connection with any unlawful, illegal, fraudulent, or harmful purpose or activity, including without limitation deceptive impersonation, pyramid schemes, surveys, chain letters, junk e-mail, spamming, or any duplicative or unsolicited messages (commercial or otherwise); (h) create any derivative works of RavenDB’s Property, the Software, or the Outputs, or build a similar or competitive product or service; (i) exceed the quantitative or qualitative usage parameters (e.g., number of licensed hardware processing cores, users, processing capacity, geographic scope) specified in the applicable Order Form; (j) fail to provide RavenDB with any information which it may reasonably require from time to time to enable RavenDB to perform its obligations under these TOS; (k) access, store, distribute, or transmit during the course of its use of the Services any malicious code (i.e., software viruses, Trojan horses, worms, malware, or other computer instructions, devices, or techniques that erase data or programming, infect, disrupt, damage, disable, or shut down a computer system or any component thereof), or any unlawful, threatening, obscene, or infringing material; (l) use any robot, spider, other automated device, toolbar, web-bar, or other web-client, device, software, routine, or manual process to access, monitor, or scrape information from the Services, or bypass any robot exclusion requests; (m) use any meta tags or any other “hidden text” utilizing any of RavenDB’s trademarks or intellectual property; or (n) harass or defame others, interfere with the access, use, or enjoyment of the Services by others, or promote hatred towards any group of people. Any breach of this Section 2.3 shall result in immediate, automatic termination of the applicable License, and shall subject Customer to civil and/or criminal liability. In addition, RavenDB reserves the right to seek injunctive relief and any other remedies available at law or in equity without the requirement to post bond or other security. RavenDB shall also have the right to audit Customer’s use of the Software and Services upon reasonable prior written notice to verify compliance with the terms of these TOS and the applicable Order Form.

Access to the Services; Users. RavenDB will make the Services available to Customer via password-protected online access or, for On-Premises Software, via license key and Access Credentials (the “Access Credentials”). Access to the Services is subject to RavenDB’s security protocols, policies, and documentation. Customer shall maintain adequate security and control of its Access Credentials and only provide such Access Credentials to those individuals who it has authorized to use the Services (each, an “Authorized User”). Only Customer’s employees and individual contractors who are bound by written confidentiality obligations no less restrictive than those in Section 10 may access and operate the Services. Customer shall ensure that all Authorized Users comply with these TOS, and Customer shall be fully liable for any breach by an Authorized User.

Delivery. RavenDB shall provide Customer with Access Credentials and instructions for accessing the Services within the timeframe set forth in the applicable Order Form. For Cloud Services, RavenDB shall provide online services that host Customer’s data (“Customer’s Data”) on cloud servers managed by RavenDB. Customer retains full ownership of Customer’s Data. These TOS do not grant RavenDB any rights to Customer’s Data except as necessary to operate and provide the Services. RavenDB may make technical design choices in administering the Cloud Services (including replication, storage, scaling, clustering, compression, decompression, and backup of Customer’s Data), and Customer hereby grants RavenDB full permission to make any such design choices.

Installation and Configuration. For On-Premises Software, RavenDB shall be responsible, in accordance with the terms of these TOS, for providing Customer with the Software and applicable license key, and Customer shall be responsible for all hosting, operation, and configuration of the Software in its own environment, and for providing necessary information and cooperation to enable access and use of the Services. For Cloud Services, RavenDB shall be responsible for hosting, maintaining, and configuring the Services in its own environment.

Software Components. RavenDB shall provide Customer with software components to be installed on end-devices, which are licensed to Customer in accordance with the provisions of Section 11.3. RavenDB may also provide Customer with a subdomain for use with the On-Premises Software. Such subdomain shall be used solely to host nodes or servers of RavenDB and not any other servers or services. Customer is solely responsible for the subdomain, all content made available thereunder, and all security thereof. Customer shall not host any subdomain that (a) infringes third-party intellectual property rights, (b) violates applicable law, (c) promotes criminal activity, or (d) contains hateful, racist, obscene, or otherwise offensive content. RavenDB may delete any subdomain without notice if it reasonably believes the subdomain is being used in breach of these TOS or applicable law, or if the subdomain has been unused for more than six (6) months. The Software and subdomains are not designed or certified for use in the operation of weapons, weapons systems, nuclear installations, means of mass transportation, aviation, life-support computers or equipment, pollution control, hazardous substances management, or any other application in which the failure of any product, service, or system could create a situation where personal injury or death may occur. Customer expressly agrees that RavenDB has no liability for any damages resulting from such use.

Free Services. RavenDB may, at its discretion, offer certain Services at no charge (“Free Services”), subject to resource limitations as specified on the RavenDB website. Once Customer reaches the maximum resources allocated for Free Services, Customer will be required to pay the applicable Fees in accordance with the applicable Order Form. RavenDB reserves the right to discontinue Free Services at any time without prior notice to Customer. Any free instance that is inactive for more than fourteen (14) days will be closed and deleted without notice. Any data bundles purchased shall be available for use during a twenty-four (24) month period from the purchase date. Data bundles are specific to a particular product and cannot be applied across different products. No refunds or credits shall apply to data bundles.

The Services may provide links to other websites (including those of RavenDB’s partners). RavenDB may, from time to time, at its sole discretion, add or remove links to other websites. Customer understands and agrees that RavenDB may utilize the services of third-party providers to provide certain services through the Services, such as registration, authentication, billing, hosting, or other services. Such services are provided by third parties in accordance with their own terms of service and privacy policies, and RavenDB makes no representations or warranties regarding the same.

These links and third-party services are provided solely as a convenience to Customer, and access to any such websites and/or use of such third-party services is at Customer’s own risk. Customer is recommended to review the information provided by third parties (such as, but not limited to, the privacy policy and terms of use of the relevant website) before accessing such websites. RavenDB does not endorse or control, and is not responsible for, these websites or their content, services, or availability.

Accordingly, RavenDB makes no representations about them, or any material found there, or any results that may be obtained from using them. Customer expressly releases RavenDB from any and all liability arising from Customer’s use of any third-party website or service. Although RavenDB will use reasonable efforts to assist Customer in any dispute that arises between Customer and a third party, RavenDB cannot be responsible for any loss or damage arising therefrom.

Infrastructure and Environment. Customer shall be responsible for maintaining secure access to the Services via the internet and ensuring that only Authorized Users are provided with access credentials.

Data and Backup. Customer is exclusively responsible for (i) the selection and lawful acquisition of any data ingested by or stored on the Services; (ii) the accuracy of such data; (iii) performing regular backups; and (iv) ensuring that all use of the Services and all data processed, stored, or transmitted through the Services complies with all applicable laws, including without limitation all privacy and data protection laws. For On-Premises Software, RavenDB shall not be liable for any loss, corruption, or unauthorized disclosure of data stored on Customer-controlled infrastructure. For Cloud Services, upon termination, RavenDB shall have no further responsibility for any of Customer’s data files, backup files, or usage history stored by RavenDB, and may delete Customer’s data files and backup data files within two (2) weeks after termination. Customer shall bear all liability with respect to compliance with all applicable laws, including without limitation privacy and data protection laws.

Output Review and Actions. Customer shall independently review all Outputs, evaluate any risks or threats identified therein, and determine appropriate actions. RavenDB shall bear no responsibility for Customer’s reliance on or use of the Outputs or the Services, or for any decisions taken or not taken based thereon.

Each Party represents and warrants that:

Customer represents, warrants and acknowledges that, at all times throughout the term of these TOS:

Consideration. In consideration for the Services, Customer shall pay RavenDB the fees set forth in the applicable Order Form (the “Fees”). Fees are non-refundable, except as expressly set forth herein. No refunds will be provided upon termination of these TOS for any reason, including early termination by Customer. Refunds, if awarded at RavenDB’s sole discretion, shall be awarded only in the form of credit for future Services. No cash refunds will be awarded.

Taxes. All Fees are exclusive of any applicable taxes, value-added taxes, or government charges, all of which shall be Customer’s sole responsibility and shall be added to each payment at the applicable rate.

Offset. Customer shall not be entitled to offset any payments due to RavenDB under these TOS.

Default. If Customer defaults in payment of any sum due to RavenDB, RavenDB shall provide a written notice to Customer. If the invoice remains unpaid for more than fifteen (15) days following such notice, then RavenDB may suspend further performance of the Services and Customer’s access to the Services until Customer pays the amount in full, without prejudice to any other rights or remedies available to RavenDB. RavenDB reserves the right to take all necessary actions to collect amounts due, including legal action and/or use of third-party collection agencies.

Interest. Interest will accrue on amounts which are more than fifteen (15) days past due at the lower of: (i) 1.5% per month, calculated from the original due date; or (ii) the maximum rate permitted under applicable law. In any proceeding brought by RavenDB to collect amounts due, RavenDB will also receive its actual costs of collection, including reasonable attorneys’ fees. Termination of these TOS shall not relieve Customer of any payment obligations accrued prior to the date of termination.

Price Adjustments Upon Renewal. RavenDB may, upon each Renewal Term (as defined below), adjust the Fees set forth in the applicable Order Form by providing Customer with written notice of such adjustment at least thirty (30) days prior to the commencement of the applicable Renewal Term. Any such price adjustment shall become effective at the start of the Renewal Term, unless Customer provides notice of non-renewal in accordance with Section 9.2.

Term. These TOS shall commence on the date of the applicable PO and shall remain in force until terminated in accordance with this Section 9. Each PO shall have the term specified therein (the “Term”).

Automatic Renewal. Unless otherwise specified in the applicable Order Form, upon expiration of the initial term set forth in the Order Form, the Order Form shall automatically renew for successive one (1) year periods (each, a “Renewal Term”), unless either Party provides the other Party with written notice of its intent not to renew at least thirty (30) days prior to the expiration of the then-current term. All terms and conditions of these TOS and the applicable Order Form shall remain in effect during any Renewal Term, unless otherwise agreed in writing by the Parties.

Termination for Cause. Either Party may, without prejudice to the other rights or remedies available to it, immediately terminate these TOS if the other Party:

Effect of Termination. Upon any termination or expiration of these TOS or an Order Form: (a) all Licenses and access rights granted under such Order Form shall automatically terminate; (b) for On-Premises Software, Customer shall immediately cease all use of, and uninstall, the Software, and within ten (10) days certify in writing to RavenDB that it has done so; Customer may thereafter continue to use the Software solely under the terms of the MIT license (for client libraries) and AGPLv3 (for server software), as set forth in Section 2.1(a); (c) each Party shall return or securely destroy the other Party’s Confidential Information; (d) RavenDB will be paid for all Services performed and expenses incurred during the Term; if Customer terminates an Order Form or these TOS without cause while any Order Form remains uncompleted, Customer shall pay any remaining Fees and/or cancellation fees applicable to the affected Order Form, as set forth therein; furthermore, any Fees paid in advance are non-refundable; and (e) for Cloud Services, RavenDB shall have no further responsibility for any of Customer’s data files, backup files, or usage history stored by RavenDB, and may delete Customer’s data files and backup data files within two (2) weeks after termination.

Survival. The provisions of Sections 2.2, 6.2, 6.3, 7, 8, 9 (with respect to accrued payment obligations), 10.5, 11 through 14, and 17 hereinafter shall remain in force even after the termination of these TOS for any reason.

“Confidential Information” means any trade, business, technical, scientific or other information relating to respective businesses of the Parties, whether in oral, written, graphic or machine-readable form, except to the extent such information: (i) was known to the receiving party (the “Recipient”) at the time it was disclosed, other than by previous disclosure by or on behalf of the disclosing party (the “Discloser”); (ii) is at the time of disclosure or later becomes publicly known under circumstances involving no breach of these TOS; (iii) is independently developed by the Recipient without the use of or reference to the Discloser; or (iv) is disclosed to the Recipient on a non-confidential basis by a third party that is not bound by any confidentiality obligation to the Discloser in respect of such information. RavenDB’s Property, the Services, and Outputs are RavenDB’s Confidential Information.

The Recipient undertakes to keep confidential, not disclose to any person, and not make any use of, the Confidential Information, other than for the purpose of fulfilling its obligations under these TOS. The Recipient shall treat the Confidential Information with at least the same degree of confidentiality as it keeps its own confidential information and no less than a high degree of care. The Recipient may disclose Confidential Information only to its employees, consultants, officers (including directors), shareholders and representatives who have a need to know such information, in order to enable the exercise of its rights and fulfill its obligations under these TOS, and who are legally bound by agreements which impose confidentiality and non-use obligations, substantially comparable to those assumed by the Recipient. The Recipient shall be responsible for the compliance, on the part of its employees, consultants, officers and representatives with the confidentiality obligations set forth in this Section 10.

The Recipient shall be permitted to furnish any portion of the Confidential Information to any governmental agency, judicial body or other regulatory authority having jurisdiction over the Recipient if it is legally required pursuant to an order or instruction of such agency, body or authority, provided that the Recipient shall, to the extent permitted by law, inform the Discloser immediately upon receipt of a demand to make such disclosure.

Ownership. All rights, of any kind whatsoever, including, but not limited to, intellectual property rights, copyrights, trademarks, brands, patents, trade secrets, know-how, Software, updates, documentation, methodologies, and any derivative works thereof, and/or any other material included and/or associated with the Services and the Outputs, whether said rights are registered or unregistered, are exclusively owned by RavenDB or any of its affiliates or licensors (collectively, “RavenDB’s Property”). Customer retains full ownership of Customer’s Data. These TOS do not grant RavenDB any rights to Customer’s Data except as necessary to provide the Services. Except for the limited License expressly granted in Section 2.1 and Section 11.3, these TOS do not convey to Customer any interest in or to the Services or the Outputs, but only a limited revocable right to use the same in accordance with the terms of these TOS, and nothing herein constitutes a waiver of RavenDB’s Property rights under any law.

Feedback. Customer may from time to time provide feedback, comments, or suggestions regarding the Services (“Feedback”). RavenDB shall be the sole and exclusive owner of all rights in connection with any and all ideas, inventions, and/or improvements conceived or derived from such Feedback. Customer irrevocably assigns to RavenDB any rights that Customer may have or acquire in such Feedback, and irrevocably waives any right to receive any payment, royalty, or other consideration with respect thereto. Feedback, even if designated as confidential by Customer, shall not, absent a separate written agreement, create any confidentiality obligation for RavenDB.

License. RavenDB hereby grants to Customer, during the Term, a non-exclusive, worldwide right to access and use any software that RavenDB has agreed to provide access to and use of under these TOS and the relevant Order Form, for Customer’s own internal business purposes.

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, RAVENDB, ITS PARENT, SUBSIDIARIES, AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, LICENSORS, SUPPLIERS, DISTRIBUTORS, AND RESELLERS SHALL NOT BE LIABLE, WHETHER UNDER CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, TO CUSTOMER OR ANY THIRD PARTY FOR ANY LOSS OR DAMAGE OF ANY KIND RESULTING FROM THE USE OR INABILITY TO USE THE SERVICES OR SOFTWARE, INCLUDING, BUT NOT LIMITED TO, LOSS OF DATA, LOSS OF GOODWILL, INACCURATE DATA, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, LOSS OR DAMAGE TO PRODUCT DATA, LAYOUTS, TEMPLATES, ARTWORK, OR OTHER INFORMATION STORED BY THE SOFTWARE, OR ANY AND ALL OTHER INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, EXEMPLARY, OR CONSEQUENTIAL DAMAGES OF ANY KIND, EVEN IF RAVENDB HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. RAVENDB SHALL NOT BE RESPONSIBLE FOR ANY INTERRUPTIONS OF SERVICE, INCLUDING ISP DISRUPTIONS, SOFTWARE OR HARDWARE FAILURES, OR ANY OTHER EVENT WHICH MAY RESULT IN A LOSS OF DATA OR DISRUPTION OF SERVICE. RAVENDB HAS NO LIABILITY OR RESPONSIBILITY FOR ANY VERSION OF THE SOFTWARE THAT CUSTOMER HAS MODIFIED.

WITHOUT LIMITING THE GENERALITY OF THE FOREGOING AND TO THE MAXIMUM EXTENT LEGALLY PERMISSIBLE, RAVENDB’S TOTAL CUMULATIVE LIABILITY FOR ALL CLAIMS ARISING UNDER OR RELATING TO THESE TOS, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, SHALL NOT EXCEED, IN THE AGGREGATE, THE AMOUNTS ACTUALLY PAID BY CUSTOMER TO RAVENDB IN THE THREE (3) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

RAVENDB ACCEPTS NO LIABILITY FOR ANY CLAIM NOTIFIED TO IT MORE THAN ONE (1) YEAR AFTER THE DATE OF THE PROVISION OF THE SERVICES OR ACCESS TO THE SOFTWARE THAT GAVE RISE TO THE CLAIM.

All the terms and limitations of these TOS, including the warranty and liability limitations and exclusions, are fair and reasonable in light of the amounts to be paid by Customer, the nature of the Services, the strength of the bargaining position of each Party, the alternative ways Customer’s needs could have been met, and the potential benefits and risks for both Parties in entering into these TOS.

Each Party shall comply with the applicable data protection laws to the extent applicable to its performance under these TOS.

In connection with Customer’s registration for, access to, and administration of the Services, RavenDB may collect, process, and store personal data relating to Customer’s account and business contacts, such as names, email addresses, phone numbers, billing details, company affiliation, login and account credentials, and other information provided by Customer or its Authorized Users for account creation, authentication, subscription management, billing, support communications, security, and ordinary administration of the Services. RavenDB shall process such personal data in accordance with its Privacy Policy, as may be updated from time to time data in accordance with these TOS.

To the extent RavenDB processes personal data contained in Customer Data on behalf of Customer in connection with the provision of the Services, including where access to such personal data is strictly necessary for troubleshooting, technical support, maintenance, security, or other support-related purposes, Customer shall act as the controller or business, as applicable, and RavenDB shall act as the processor or service provider, as applicable, except to the extent otherwise required by applicable law. Customer is solely responsible for determining the lawfulness of its instructions and its use of the Services, including providing all required notices and obtaining all necessary rights, consents, and authorizations for the processing of such personal data in connection with the Services.

The Data Processing Agreement made available by RavenDB and that shall be entered into by the Parties, including any schedules thereto, as may be updated or replaced from time to time in accordance with its terms, is hereby incorporated into and forms an integral part of these TOS. The DPA shall govern RavenDB’s processing of personal data on behalf of Customer in connection with the Services, including with respect to processing instructions, technical and organizational security measures, sub-processing, international data transfers, assistance with data subject requests, personal data breach notification, deletion and return of personal data, and audit rights.

RavenDB’s Privacy Policy, available on the Website, is hereby incorporated by reference into these TOS and governs RavenDB’s processing of personal data as an independent controller in connection with the Website, account registration, account administration, billing, payment processing, support communications, sales, marketing, compliance, and any related business operations. The Privacy Policy also describes, at a higher level, RavenDB’s handling of personal data that may be included in Customer Data where RavenDB’s access to such data is limited to providing support, maintenance, troubleshooting, security, or similar service-related functions.

In the event of any conflict or inconsistency between this Section 15, the DPA, and the Privacy Policy: (a) the DPA shall prevail with respect to the processing of personal data by RavenDB on behalf of Customer in connection with the Services; (b) the Privacy Policy shall prevail with respect to personal data and other information processed by RavenDB as an independent controller as described in Section 15.2 and Section 15.5; and (c) these TOS shall govern in all other respects.

“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control” for purposes of this definition means direct or indirect ownership or control of more than 50% of the voting interest in the subject entity.

“Applicable Law” means the EU and UK General Data Protection Regulation, where applicable (collectively, “GDPR”), the Israeli Protection of Privacy Law, 5741-1981, as amended from time to time, including Amendment No. 13, and regulations issued under it (collectively, “Israeli Privacy Law”), and any other applicable privacy or data-protection law.

“Customer Personal Data” means any Personal Data contained in Customer Data that Processor Processes on behalf of Customer in accordance with Applicable Law, pursuant to or in connection with the Terms of Service.

“Standard Contractual Clauses” means the standard contractual clauses for the transfer of Personal Data to data importers established in third countries pursuant to GDPR, as set out in Commission Implementing Decision (EU) 2021/914, as updated or replaced from time to time.

“Sub-processor” means a third party, excluding an employee of Processor or of a Processor Affiliate, engaged by Processor to Process Customer Personal Data on behalf of Customer in connection with the Services.

The terms “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processor”, “Processing” and “Supervisory Authority” have the meanings given to them under Applicable Law.

Processor shall Process Customer Personal Data on Customer’s behalf and only in accordance with Customer’s documented instructions as specified in the Terms of Service and this DPA, including with respect to transfers of Customer Personal Data to third countries. Processor may Process Customer Personal Data other than in accordance with Customer’s instructions where required by Applicable Law, in which case Processor shall, unless prohibited by Applicable Law, inform Customer before carrying out that Processing.

Customer instructs Processor, and authorizes Processor to instruct each Sub-processor, to: (i) Process Customer Personal Data as necessary to provide, operate, maintain, support, secure, administer, and improve the Services in accordance with the Terms of Service and this DPA and for the specific purposes directed by Customer; and (ii) transfer Customer Personal Data to countries or territories only as necessary to provide the Services and in accordance with Applicable Law.

The details of the Processing of Customer Personal Data required by Article 28(3) of the GDPR are set out in Schedule 1 (Details of Processing of Customer Personal Data).

To the extent Processor uses Sub-processors to Process Customer Personal Data in countries outside the European Economic Area that are not subject to an adequacy decision or another valid transfer mechanism under Applicable Law, Processor shall implement an appropriate transfer mechanism, including the Standard Contractual Clauses, the UK International Data Transfer Addendum, or another EU- or UK-approved transfer mechanism, together with supplementary measures where required by Applicable Law.

Where Customer Personal Data is transferred to Israel from the European Economic Area, Processor may rely on the applicable European Commission adequacy decision or another valid transfer mechanism under Applicable Law, as applicable.

Customer represents and warrants that it has and shall maintain throughout the term of the Terms of Service and this DPA all necessary rights, notices, consents, authorizations, and lawful bases to provide Customer Personal Data to Processor and to instruct the Processing contemplated by the Terms of Service and this DPA. To the extent required by Applicable Law, Customer is responsible for providing Data Subjects with required notices and maintaining records of consents where consent is the applicable lawful basis.

Processor shall take reasonable steps to ensure that access to Customer Personal Data is limited on a strict need-to-know basis and that all Processor personnel authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations under professional, contractual, or statutory requirements.

Processor shall implement reasonable and appropriate technical, organizational, and physical safeguards designed to protect Customer Personal Data against unauthorized or unlawful access, use, disclosure, alteration, loss, or destruction, as further described in Schedule 2. In assessing the appropriate level of security, Processor shall consider the risks presented by the nature of the Processing and the information available to Processor, in accordance with Applicable Law.

Processor shall notify Customer without undue delay and, where feasible, no later than forty-eight (48) hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. Processor shall provide Customer with commercially reasonable and available information to assist Customer in meeting its obligations to notify Data Subjects or Supervisory Authorities, where required by Applicable Law.

At Customer’s written request, Processor shall reasonably cooperate with Customer and take commercially reasonable steps, as agreed by the parties or required by Applicable Law, to assist in the investigation, mitigation, and remediation of a Personal Data Breach affecting Customer Personal Data.

Customer authorizes Processor to engage Sub-processors in accordance with this Section 7 and subject to the conditions of this DPA.

Processor may continue to use the Sub-processors identified to Customer as of the effective date of this DPA.

The current list of Sub-processors is set out in Schedule 3 (Sub-processor List).

Processor may appoint new Sub-processors and shall provide Customer notice of the appointment. If, within ten (10) days after receiving the notice, Customer notifies Processor in writing of a reasonable objection to the proposed appointment, Processor shall not appoint the proposed Sub-processor to Process Customer Personal Data until Processor has taken reasonable steps to address Customer’s objection and has provided Customer with a reasonable written explanation of those steps. If those steps do not resolve Customer’s reasonable objection, either Customer or Processor may terminate the affected Services upon written notice to the other party, with immediate effect, and neither party shall be liable solely because of that termination. If Customer does not object within ten (10) days after receiving the notice, Customer will be deemed to have consented to the appointment, provided that the appointment complies with Applicable Law.

With respect to each new Sub-processor, Processor shall:

Customer is responsible for compliance with statutory obligations concerning Data Subject requests under Applicable Law, including requests for access, correction, deletion, restriction, objection, or portability of Customer Personal Data. At Customer’s expense, Processor shall provide reasonable assistance to Customer in responding to Data Subject requests to the extent required by Applicable Law and considering the nature of the Processing.

Upon receiving a request from a Data Subject relating to Customer Personal Data, Processor shall promptly notify Customer and shall not respond directly to the request except on Customer’s documented instructions or where required by Applicable Law. Where Processor is required by Applicable Law to respond directly, Processor shall, to the extent permitted by Applicable Law, inform Customer of that requirement before responding.

Processor’s assistance in responding to Data Subject requests shall be limited to technical and organizational measures available to Processor and may be subject to reasonable cost reimbursement by Customer.

At Customer’s written request and expense, Processor and each Sub-processor shall provide commercially reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities relating to Customer Personal Data, to the extent required by Applicable Law and taking into account the nature of the Processing and the information available to Processor.

Upon termination or expiration of the Services involving the Processing of Customer Personal Data, Processor shall, at Customer’s choice, return or delete Customer Personal Data within sixty (60) days, unless Applicable Law requires Processor to retain it. Where Processor retains Customer Personal Data as required by Applicable Law, Processor shall protect the retained Customer Personal Data in accordance with this DPA and shall Process it only for the purpose required by Applicable Law.

Subject to Sections 11.2 and 11.3, Processor shall, upon Customer’s prior written request, make available to Customer or an auditor mandated by Customer such information as is reasonably necessary to demonstrate Processor’s compliance with this DPA and shall allow audits, including inspections, by a reputable independent auditor mandated by Customer in relation to Processor’s Processing of Customer Personal Data, provided that:

Any audit or inspection shall be: (a) at Customer’s sole expense; (b) conducted subject to Processor’s reasonable security policies and third-party confidentiality obligations; and (c) limited to providing reasonable evidence of compliance. The results of any audit or inspection shall be considered Processor’s Confidential Information and shall be treated in accordance with the confidentiality obligations set out in the Terms of Service.

Customer and any auditor on its behalf shall use reasonable efforts to minimize disruption to Processor’s premises, equipment, employees, and business. Customer and Processor shall mutually agree upon the scope, timing, and duration of the audit or inspection, and Customer shall reimburse Processor for its reasonable costs incurred in connection with the audit or inspection. Processor may reasonably limit access to its premises for an audit or inspection.

Processor shall immediately inform Customer if, in its opinion, an instruction received under this DPA infringes the GDPR or another Applicable Law.

Customer shall indemnify and hold Processor harmless against claims, actions, third-party claims, losses, damages, and expenses incurred by Processor and arising out of or in connection with Customer’s breach of this DPA or Applicable Law, but only to the extent that the breach is attributable to Customer’s acts or omissions. Each party’s liability to the other party shall be subject to the limitations of liability set out in the Terms of Service.

Governing Law and Jurisdiction

Order of Precedence

Severance