Master Service Agreement

Version 2.0 • Nov 30, 2026     View Previous Versions

---

This Master Service Agreement (the “MSA”) and the applicable Product Addendum set forth the terms and conditions applicable to the licensing of the Product(s) from ID123 Inc., a Delaware corporation with its principal place of business at 100 Summer Street, Suite 1600, Boston, Massachusetts 02110, United States (the “Service Provider”), by the party subscribing to the license (“Client”).

Notice: Updates to this MSA apply to a Subscription only from its next renewal date, as described in Section 1.4.

1. Scope

1.1 Terms and Conditions. This MSA, effective as of the date set out above, together with the applicable Product Addendum published at https://www.id123.io/terms/idcs-product-addendum/, sets forth the terms and conditions applicable to the licensing of the Product(s) from the Service Provider by Client, commencing on the Effective Date. The “Effective Date” means the earliest of: (a) the date specified in the applicable signed quote or Order Form; (b) the date this Agreement is signed by both Parties; or (c) the date on which Client first accesses or uses the Licensed Product, whether under a free trial or a paid Subscription. The offer of the Product licenses pursuant to this Agreement, and Client’s registration for a free trial or purchase of the corresponding Subscription, constitutes each Party’s acceptance of this MSA together with the applicable Product Addendum and their entry into the Agreement. During a free trial, the free trial terms in the applicable Product Addendum govern warranties, remedies, indemnities and liability notwithstanding Section 1.3, but do not reduce the Service Provider’s obligations under the Data Processing Addendum, and the exception in Section 8.6 for the standard contractual clauses and the UK International Data Transfer Addendum continues to apply. Unless defined elsewhere in this MSA, terms in initial capital letters have the meanings set forth in Section 14. Client and the Service Provider are referred to collectively as the “Parties” and individually as a “Party”.

1.2 Product Subscription. The Service Provider will fulfill the Subscription to Client based on the pricing and term referenced in an Order Form. A Subscription, as described in the applicable Product Addendum and the corresponding purchase transaction, is a license to use the Product deployed as a Cloud Service hosted in the Service Provider’s Computing Environment. Additional information concerning the Subscription and other services offered is set out in the Product Addendum.

1.3 Agreement. Each Subscription is subject to and governed by this MSA, the applicable Product Addendum together with a Subscription Pricing Schedule attached or referenced, the Data Processing Addendum, a paid Service Level Agreement if applicable, any addendum applicable to Client by reason of its sector or jurisdiction, and any amendments to any of the foregoing agreed in writing by the Parties, which together constitute the agreement between Client and the Service Provider (the “Agreement”). Each Subscription constitutes a separate Agreement between Client and the Service Provider. In the event of any conflict between the terms of the components of this Agreement, the following order of precedence applies: (a) the Data Processing Addendum, together with any data transfer addendum or international data transfer mechanism incorporated into it; (b) any addendum applicable to Client by reason of its sector or jurisdiction; (c) an amendment agreed by the Parties; (d) this MSA; (e) the Order Form; and (f) the Product Addendum. Notwithstanding the foregoing, an addendum applicable to Client by reason of its sector or jurisdiction prevails over the Data Processing Addendum to the extent that it specifically addresses the matter in conflict. Section 8.6 applies notwithstanding this order of precedence.

1.4 Updates. The Service Provider may update this MSA, the Product Addendum or any addendum referred to in Section 13.16 from time to time. An update applies to a Subscription only from its next renewal date, unless Client agrees otherwise in writing, and does not apply where the applicable Order Form excludes such changes. The Service Provider will give Client written notice of any update that materially changes Client’s rights or obligations at least ninety (90) days before the renewal date from which it applies; where notice is given later, the update applies from the following renewal date. If Client does not accept such an update, Client may elect not to renew the affected Subscription by written notice given at any time before the renewal date, notwithstanding any longer notice period in the Product Addendum. Updates to the Data Processing Addendum are governed by Section 15.4 of that Addendum.

2. Licensed Product

2.1 Grant of License.

2.1.1 Subject to Section 2.1.2, the Service Provider grants to Client, and to each Affiliate of Client that purchases a Subscription under this Agreement, for the Term of each Subscription, a nonexclusive, worldwide (subject to Section 13.4), non-transferable (except in connection with an assignment permitted under Section 13.2) license to use the Product described in the applicable Product Addendum (the “Licensed Product”), to access and use the Product via the Cloud Service, and to allow its Users to access and use the Product through the Cloud Service, in each case in accordance with this Agreement and the usage purchased under the Subscription.

2.1.2 Client and each Affiliate holding a Subscription under this Agreement may use the Licensed Product only in support of its own operations or those of its Affiliates’ business or organization, in connection with Client’s and its Affiliates’ products and services (but, for clarity, not as a stand-alone product or service resold or aggregated by Client or an Affiliate), and in connection with Client’s and its Affiliates’ interactions with Users.

2.1.3 Client may make a reasonable number of copies of the Documentation necessary to use the Licensed Product in accordance with the rights granted under this Agreement, provided that Client does not remove any proprietary legend or notice from such copies. The Service Provider retains all rights not expressly granted to Client under this Agreement.

2.2 Affiliates and Contractors. With respect to Affiliates and Contractors that Client permits to use the Licensed Product under this Agreement: (a) Client remains responsible for all obligations arising in connection with such Affiliate’s or Contractor’s use of the Licensed Product; and (b) Client is directly liable for any act or omission of such Affiliate or Contractor to the same degree as if the act or omission were performed by Client, such that a breach by an Affiliate or Contractor of this Agreement is deemed a breach by Client. The performance of any act or omission under this Agreement by an Affiliate or Contractor for, by or through Client is deemed the act or omission of Client.

2.3 Restrictions.

2.3.1 Except as expressly permitted by this Agreement or otherwise agreed in writing in an addendum, Client will not, and will not permit any other person to:

(i) reverse engineer, decompile, or attempt to discover any source code or underlying ideas or algorithms of the Licensed Product, except to the extent such activity is expressly permitted by Applicable Laws;

(ii) provide, sell, transfer, sublicense, lend, distribute, rent, or otherwise permit others to access or use the Licensed Product;

(iii) remove any proprietary notice or label from the Licensed Product;

(iv) copy, modify, or create derivative works of the Licensed Product;

(v) conduct security or vulnerability testing on, interfere with the operation of, cause performance degradation of, or circumvent access restrictions of the Licensed Product;

(vi) access accounts, information, data, or portions of the Licensed Product to which Client does not have explicit authorization;

(vii) use the Licensed Product to develop a competing service or product;

(viii) use the Licensed Product for any activity that violates Applicable Laws;

(ix) use the Licensed Product to obtain unauthorized access to any other person’s networks or equipment; or

(x) upload, submit, or otherwise make available to the Licensed Product any Client Data in which Client and its Users do not hold the necessary rights.

2.4 No Additional Terms. No shrink-wrap, click-acceptance, third-party integration, purchase order or other terms and conditions outside this Agreement (“Additional Terms”) provided by Client will bind the Service Provider unless agreed in this Agreement or in writing as an addendum to this Agreement. Any such Additional Terms are of no force or effect and are deemed rejected in their entirety.

3. Services

3.1 Cloud Service. The Service Provider will provide the Licensed Product to Client as a Cloud Service in accordance with the Product Addendum promptly following purchase of the Subscription and continuing until termination of the Subscription in accordance with Section 10. The Service Provider will provide Client all access credentials necessary to access and use the Licensed Product via the Cloud Service as set forth in the Product Addendum. Client may use the Licensed Product and the credentials only in accordance with the Product Addendum and only if Client complies with this Agreement.

3.2 Support Services. The Service Provider will make available to Client Documentation concerning the use and operation of the Licensed Product and will provide Support Services to Client as described, incorporated or referenced in the Product Addendum.

3.3 Hosting and Data Region. Client acknowledges that the Service Provider uses a Cloud Provider for the processing and hosting of the Cloud Service. Subject to this Agreement, Client consents to the storage of Client Data in the Cloud Provider Region in which Client’s Account is hosted, as selected by Client where the Service Provider offers a choice of regions (the “Data Region”) and to the Service Provider’s use of the Cloud Provider’s infrastructure and services to process Client Data and provide the Cloud Service.

3.3.1 Cloud Provider standard. The Service Provider will engage as a Cloud Provider only a provider that maintains a recognized independently audited information security certification. Access to Client Data from outside the Data Region for support, maintenance or incident investigation is permitted only as provided in the Data Processing Addendum.

3.3.2 Relocation of Client Data. The Service Provider will not relocate Client Data at rest from the Data Region to a different Cloud Provider Region except:

(a) to a Cloud Provider Region located in, or offering closer alignment with, the country in which Client is established;

(b) to another Cloud Provider Region located in the same country as the current Data Region;

(c) where necessary to comply with Applicable Law, including any data localization or data residency requirement applicable to Client or to the Service Provider;

(d) with Client’s prior written consent.

A relocation under subsection (a), (b) or (c) does not require Client’s consent, provided that a relocation under subsection (a) or (b) does not reduce the level of protection applicable to the Client Data. In particular, Client Data will not be relocated out of the country in which Client is established without Client’s consent, except under subsection (c). The Service Provider will give Client reasonable advance written notice of a relocation under subsection (a) or (c) where practicable, and otherwise notice without undue delay; no notice is required for a relocation under subsection (b). On any such relocation the Data Region recorded for Client’s Account is updated to the new Cloud Provider Region. Replication, backup or failover of Client Data within the Data Region, or to another Cloud Provider Region in the same country as the Data Region or, where the Data Region is in the European Economic Area, in another country in the European Economic Area, is not a relocation for the purposes of this Section. Resilience within the Data Region is addressed by the measures described in Section 7.5.7; Section 13.5 applies where a Force Majeure Event prevents the Cloud Service from operating.

3.3.3 Published regions. The Cloud Provider Regions available from time to time, the country in which each is located, and the identity of each Cloud Provider, are published at the addresses referenced in Section 14.4 and on the Sub-Processors page referenced in the Data Processing Addendum. A change to the Cloud Provider serving Client’s Data Region is subject to the sub-processor notification and objection provisions of the Data Processing Addendum.

3.4 Service Level. During the Term, the Service Provider will maintain the Cloud Service so that it performs as specified in this Agreement not less than 99.95% of the time in each calendar month, measured on a 24x7x365 basis and excluding scheduled maintenance, unscheduled emergency maintenance not exceeding four hours in any calendar month (with any excess counting as unavailability), and any period of unavailability arising from causes beyond the Service Provider’s reasonable control (the “Basic Service Level”). Notwithstanding any other provision of this Agreement, Client may terminate this Agreement if measured availability of the Cloud Service falls below 95% in each of three or more consecutive calendar months during a Term. Client may subscribe to maintenance notification emails informing Client of scheduled service disruptions in advance. Client and any Affiliate holding a Subscription may also subscribe to a paid Service Level Agreement, in which case the remedies set out in that Service Level Agreement apply in lieu of the remedies in this Section 3.4.

3.5 User Accounts. Client is responsible for all actions taken through its User accounts and for each User’s compliance with this Agreement. Client must require its Users to protect the confidentiality of their passwords and login credentials. Client will promptly notify the Service Provider if it suspects or knows of any fraudulent activity affecting its accounts, passwords or credentials, or if any of them is compromised.

3.5.1 Authority to Use Credentials. Client represents and warrants that each individual who creates, accesses or uses an Account or any login credential is duly authorized to act on behalf of the applicable Customer of Record. The Service Provider may rely on that representation and, save for its obligations under Section 7.5 and the Data Processing Addendum, has no obligation to verify the internal authority, employment status, contractor or agency relationship, or ownership arrangements between the Customer of Record and any individual using the Account.

3.5.2 Credentials Do Not Establish Ownership. Email addresses, usernames, passwords and other access credentials are provided solely to enable access to the Services. They do not of themselves establish ownership of an Account, confer any right, title or interest in Client Data, or determine the Customer of Record, and a credential that is not uniquely associated with a specific legal entity does not, standing alone, determine the customer relationship. Any administrative role available within the Licensed Product is a permissions setting governing the actions an administrator may perform within the Account; it is not a statement of legal ownership of the Account or the Client Data and does not alter the Customer of Record.

3.6 Enhancements. The Service Provider will make no change to the Product during the Term that materially diminishes the utility of the Licensed Product for Client’s authorized use. Notwithstanding the foregoing, the Service Provider may make any change to the Product to prevent service interruptions, to enhance the quality or delivery of the Product or Services, to render it non-infringing, or as required to comply with Applicable Laws or security obligations. Any such change will be made available to Client as part of the Services provided under Client’s then-current Subscription. The Service Provider may make enhancements to the Product at any time and may either include the enhancement as part of the Services provided under Client’s then-current Subscription or offer Client an upgraded Subscription to access and use such enhancement.

3.7 Professional Services. The Service Provider will provide Professional Services as a paid service described in a statement of work or Order Form if agreed by the Parties. The procurement of Professional Services will set forth: (a) the Professional Services to be performed; (b) any specifications or other requirements; (c) applicable fees; (d) any assumptions or conditions; and (e) any other terms mutually agreed. The Service Provider retains all right, title and interest in and to the Professional Services performed on its Licensed Product, including all Proprietary Rights therein, and Client retains all right, title and interest in and to the Client Data, the Professional Services performed on its Client Data, and all derivative works thereof. Client’s usage rights in the results of such Professional Services are the same as the rights granted under this Agreement with respect to the Service to which such Professional Services pertain.

4. Proprietary Rights

4.1 Licensed Product. Subject to the licenses granted herein, the Service Provider retains all right, title and interest it may have in and to the Licensed Product, including all Proprietary Rights therein, whether developed before or after the Effective Date. Nothing in this Agreement grants to Client any right of ownership or any other Proprietary Right in or to the Licensed Product.

4.2 Feedback. Client and Client’s Affiliates may, at their option, provide suggestions, ideas, enhancement requests, recommendations or feedback regarding the Licensed Product or Support Services (“Feedback”). The Service Provider may use and incorporate Feedback in its products and services without compensation or accounting to Client, provided that neither the Service Provider nor its use of the Feedback identifies Client as the source. Feedback is not confidential to Client. Client has no obligation to provide Feedback, and all Feedback is provided “as is” and without warranty of any kind. For the avoidance of doubt, Feedback does not include Client Data, and this Section confers no right in respect of Client Data.

5. Warranties

5.1 Licensed Product. The Service Provider represents and warrants that:

(a) the Licensed Product will conform, in all material respects, to the Product Addendum and Documentation;

(b) it will use current industry standard practices designed to detect and protect the Product against applicable vulnerabilities that pose a risk to the Licensed Product, and against viruses, Trojan horses, worms, spyware, adware and other harmful code designed or used for unauthorized access to, use, disclosure, modification or destruction of information within the Product, or for interference with or harm to the operation of the Product or any system, network or data, including by regularly scanning the Product for malware and other security vulnerabilities with up-to-date scanning software; and

(c) the Licensed Product, and Client’s use of it as permitted under this Agreement, will not be subject to any license or other terms requiring any Client Data, Client Materials, or any software, documentation, information or other materials integrated, networked or used by Client with the Product to be disclosed or distributed in source form, licensed for the purpose of making derivative works, or made redistributable.

5.2 Support Services. The Service Provider represents and warrants that Support Services will be performed in a professional manner, with the level of care, skill and diligence exercised by experienced and knowledgeable professionals performing similar services, and in accordance with the Product Addendum and Documentation.

5.3 Remedies. If any Product or Service fails to conform to the foregoing warranties, the Service Provider will promptly, at its sole expense, correct the Product and re-perform the Services as necessary to conform to the warranties. If the Service Provider does not do so within a reasonable time not exceeding 30 days (the “Cure Period”), then as Client’s sole remedy and the Service Provider’s exclusive liability under this Section (without affecting any other right or remedy available to Client under Section 9), Client may, at any time within 30 days following the conclusion of the Cure Period, elect to terminate the Subscription and this Agreement without further liability. Upon such termination the Service Provider will refund to Client any Fees prepaid to the Service Provider, prorated for the portion of the Subscription unused at the time Client reported the breach of warranty, together with any service credits then due under a Service Level Agreement in force between the Parties.

5.4 Warranty Exclusions. The Service Provider has no liability or obligation with respect to any warranty to the extent the breach of that warranty results directly from any of the following:

(a) use of the Product by Client in violation of this Agreement or Applicable Law;

(b) modification of the Licensed Product not provided or performed by the Service Provider or its Personnel;

(c) use of the Product by Client in combination with third-party equipment not sold, or third-party software not licensed, to Client by the Service Provider under this Agreement; or

(d) use by Client of the Product in conflict with the Product Addendum and applicable Documentation, to the extent the nonconformity would not have occurred but for such non-conforming use.

5.5 Compliance with Laws. Each Party represents and warrants that it will comply with all Applicable Laws in its performance under this Agreement. Any collection, use, storage, processing or transfer of Personal Data by the Service Provider will be undertaken on the instruction of Client, and Client will provide instructions only in compliance with all Applicable Laws, including all Data Protection Laws governing the collection, maintenance, transmission, dissemination, use and destruction of Personal Data.

5.6 Power and Authority. Each Party represents and warrants that:

(a) it has full power and authority to enter into and perform this Agreement, and the execution and delivery of this Agreement have been duly authorized;

(b) this Agreement and such Party’s performance will not breach any other agreement to which it is a party or by which it is bound, nor violate any obligation owed by it to any third party; and

(c) it holds all rights in relation to the Product, Services and Documentation necessary to grant the rights it purports to grant under this Agreement.

5.7 Disclaimer. EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN THIS AGREEMENT, THE LICENSED PRODUCT AND SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE”, AND EACH PARTY DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR THAT THE LICENSED PRODUCT WILL BE ERROR-FREE OR UNINTERRUPTED. The Service Provider does not warrant that the Licensed Product will meet all of Client’s current or future functional requirements or feature requests, or that the operation of the Licensed Product will be uninterrupted or error free.

5.8 Additional Warranties. The Service Provider represents and warrants that (a) it has and will maintain all licenses, consents and permissions necessary for the performance of its obligations under this Agreement during the Term; and (b) its use of Third Party Services in providing the Licensed Product and the Services will comply with the terms applicable to those Third Party Services, to the extent necessary for the performance of its obligations under this Agreement.

6. Confidentiality

6.1 Confidential Information. “Confidential Information” means any nonpublic information directly or indirectly disclosed by either Party (the “Disclosing Party”) to the other Party (the “Receiving Party”), or accessible to the Receiving Party pursuant to this Agreement, that is designated as confidential or that, given its nature or the circumstances of its disclosure, reasonably should be considered confidential, including technical data, trade secrets, know-how, research, inventions, processes, designs, drawings, strategic roadmaps, product plans, product designs and architecture, security information, marketing plans, pricing and cost information, business plans, customer and supplier information, employee and User information, business processes, other technical, financial or business information, and any third-party information the Disclosing Party is required to maintain as confidential. Confidential Information does not include information which: (a) was publicly known or generally available prior to the time of disclosure; (b) becomes publicly known or generally available after disclosure through no fault of the Receiving Party; (c) is in the possession of the Receiving Party, without restriction as to use or disclosure, at the time of disclosure by the Disclosing Party; (d) was lawfully received, without restriction as to use or disclosure, from a third party not itself under an obligation of confidentiality or restriction on use; or (e) is developed by the Receiving Party independently of this Agreement and without use of or reference to the Disclosing Party’s Confidential Information or Proprietary Rights. Except for rights expressly granted in this Agreement, each Party reserves all rights in and to its Confidential Information.

6.2 Confidentiality Obligations. Each Party will maintain as confidential, and will avoid disclosure and unauthorized use of, the Confidential Information of the other Party, using such precautions and the same degree of care that a prudent person would exercise to protect its own confidential information of a like nature, and to prevent the unauthorized, negligent or inadvertent use, disclosure or publication of, or access to, such Confidential Information. Each Party may disclose the other Party’s Confidential Information only to those of its employees, officers, representatives, contractors, subcontractors and advisers (“Representatives”) who need to know it for the permitted purpose, provided that: (a) it informs such Representatives of the confidential nature of the Confidential Information before disclosure; and (b) it procures that its Representatives comply with the obligations set out in this Section as if they were a party to this Agreement, and it remains liable at all times for any failure of its Representatives to comply. Except as necessary for the proper use of the Product, the exercise of a Party’s rights, the performance of a Party’s obligations, or as otherwise permitted under this Agreement, neither Party will use the Confidential Information of the other Party for any purpose. Each Party will promptly notify the other if it becomes aware of any unauthorized use or disclosure of the other Party’s Confidential Information and will reasonably cooperate to limit such disclosure.

6.3 Compelled Disclosure. A Receiving Party may disclose Confidential Information to the extent required by law, including regulatory requirement, discovery request, subpoena, court order or governmental action, provided that it gives reasonable prior notice to the Disclosing Party to the extent permitted by Applicable Law (and, where prior notice is not permitted, notice as soon as it is legally permitted) to enable the Disclosing Party to intervene and to seek a protective order, confidential treatment or other appropriate remedy. Disclosure pursuant to a legal requirement does not render the information non-confidential, and the Receiving Party’s obligations with respect to the Disclosing Party’s Confidential Information are not changed or lessened by such disclosure. Where Client Data is the subject of such a request, Section 7.9 applies in addition to this Section. Notwithstanding any provision herein, if Client is a government agency or entity, Client will comply with all Applicable Laws with respect to disclosure of public information.

6.4 Bribery. A Party subject to anti-bribery laws may, provided it has reasonable grounds to believe that the other Party is involved in activity that may constitute the criminal offense of bribery, disclose applicable Confidential Information to the extent necessary to inform the applicable regulator of the alleged bribery without first informing the other Party of such disclosure.

7. Service Obligations and Responsibilities

7.1 Acceptable Use; Data Categories.

7.1.1 Client will not intentionally use the Licensed Product or Cloud Service to: (a) store, download or transmit infringing or illegal content, or any virus, Trojan horse or other harmful code; (b) engage in phishing, spamming, denial-of-service attacks, or fraudulent or illegal activity; (c) interfere with or disrupt the integrity or performance of the Product or the data contained in it, or of the Service Provider’s systems or networks, or circumvent the security features of the Product; or (d) perform penetration testing, vulnerability testing or other security testing on the Product, or otherwise attempt to gain unauthorized access to the Product or any of the Service Provider’s systems or networks.

7.1.2 Permitted and Excluded Data Categories.

(a) Permitted Categories. The categories of Personal Data that the Licensed Product is designed and approved to Process are specified in the applicable Product Addendum and, in respect of Personal Data, in the Data Processing Addendum. Client’s use of the Licensed Product to Process those categories is permitted under this Agreement. Where the applicable Product Addendum specifies that the Licensed Product is designed to Process special categories of Personal Data, or categories of Personal Data attracting heightened protection under applicable Data Protection Law, Client may Process those categories subject to the Data Processing Addendum and to Client’s compliance with Section 7.2.2.

(b) Excluded Categories. Client will not use the Licensed Product to Process the following (“Excluded Data”) unless the Parties have executed a separate written agreement expressly permitting it: (i) medical records, patient information or other health information subject to sector-specific healthcare privacy or security legislation, other than a health-related attribute expressly identified as supported in the applicable Product Addendum; and (ii) payment card data, other than Client’s own payment instrument used to pay Fees to the Service Provider.

(c) Client Responsibility. Client remains responsible under Section 7.2.2 for obtaining all consents, authorizations, legal bases and notices required for the Personal Data it submits. The Service Provider has no additional responsibility in respect of Excluded Data submitted contrary to this Section.

7.1.3 Suspension for Misuse or Non-Payment. The Service Provider may suspend Client’s or a User’s right to access or use any portion or all of the Cloud Service immediately upon notice to Client if: (a) the Service Provider, after reasonable due diligence given the nature and severity of the issue, reasonably determines that (i) Client’s or a User’s misuse of the Cloud Service poses a material risk to the security or operation of the Service Provider’s systems, the Cloud Service, or the systems or data of any other customer, or (ii) Client’s or a User’s use of the Cloud Service violates this Section 7.1 or is illegal or fraudulent; or (b) Client fails to pay any undisputed Fees within 30 days after notice of past due amounts in accordance with Section 12. To the extent reasonably practicable, the Service Provider will limit any suspension under subsection (a) to that necessary to mitigate the applicable risk. The Service Provider will promptly restore the Cloud Service upon resolution of the issue or payment of the outstanding amounts, as applicable.

7.1.4 Competing Claims to Account Authority. Where the Service Provider receives competing claims to authority over, access to, or control of an Account, and a claim is supported by reasonable documentary evidence of the claimant’s authority or interest, the Service Provider may take the least restrictive measure it reasonably considers necessary to preserve the Account and the Client Data pending resolution, preferring in order: restriction of administrative changes and of the export or deletion of Client Data; reset of credentials with re-verification of administrators; and suspension of access in whole or in part. The Service Provider will not act on an unsupported assertion. While any such measure is in effect the Service Provider will continue to apply Section 7.5 and the Data Processing Addendum, will not delete Client Data, and any period running under Section 7.2.4 is suspended.

The Service Provider may determine the Customer of Record under Section 14.14 from the objective records available to it, including any executed Order Form, the Account profile and billing records; where the Account holds Personal Data relating to individuals connected with one claimant, that fact weighs in favour of that claimant. The Service Provider may require reasonable evidence of authority and may condition restoration of access on that evidence, on a written agreement between the claimants, or on an order of a court of competent jurisdiction. It will notify each claimant of any measure taken and its basis.

The Service Provider has no obligation to adjudicate a dispute between Client and any third party and is not liable for any action taken in good faith under this Section. A measure taken under this Section does not relieve Client of any payment obligation accrued before it takes effect, and does not affect any provision that by its nature survives suspension or termination.

7.2 Client Data and Client Materials.

7.2.1 Client is and will continue to be the sole and exclusive licensee, permitted user or owner of, and will retain all right, title and interest it may have in and to, the Client Materials, Client Data and other Confidential Information of Client, including all Proprietary Rights therein. Nothing in this Agreement grants to the Service Provider any right of ownership or other Proprietary Right in or to the Client Data, Client Materials or Confidential Information of Client.

7.2.2 Client will obtain all necessary consents, authorizations and rights, and provide all necessary notices and disclosures, in order to provide Client Data to the Service Provider and for the Service Provider to use Client Data in the performance of its obligations under this Agreement, including any access or transmission to third parties with whom Client shares or permits access to Client Data.

7.2.3 Client Data and Client Materials are Confidential Information of Client. Client grants to the Service Provider a nonexclusive, nontransferable (except in connection with an assignment permitted under Section 13.2), revocable license, under all Proprietary Rights, to reproduce and use Client Materials and Client Data solely for the purpose of, and to the extent necessary for, performing the Service Provider’s obligations under this Agreement. In no event will the Service Provider access, use or disclose to any third party any Client Data or Client Materials for any purpose other than providing the Product and Services to Client and performing its obligations under this Agreement. To the extent Client Data constitutes Personal Data, the Service Provider’s Processing of it is additionally governed by the Data Processing Addendum, and the Service Provider will Process such Personal Data only on Client’s documented instructions as provided in that Addendum. The Service Provider will not aggregate, anonymize or create any data derivative of Client Data other than as necessary to provide the Licensed Product and Services and to perform its obligations under this Agreement, or as permitted by Section 7.4.3.

7.2.4 Retention. During the Term, Client may review, export and delete the Client Data made accessible in the Licensed Product’s user interfaces or, upon request for Professional Services, receive an export of specified Client Data, including any derivative of Client Data not accessible in those interfaces. The Service Provider retains Client Data only as long as necessary to provide the Services, comply with Applicable Laws, and fulfill its contractual obligations, and subject to the following limits:

(a) Client Data is deleted on Client’s instruction, other than data contained in logs and in encrypted backup and disaster recovery copies, which is deleted automatically on expiry of the applicable period;

(b) following closure of Client’s Account, Client Data is deleted within 30 days, or within any longer period expressly agreed in an agreement signed by the Parties, up to a maximum of 90 days; and

(c) Client Data contained in encrypted backup and disaster recovery copies is deleted or overwritten in the ordinary course and in any event no later than twelve (12) months from the date of the deletion instruction or Account closure, and is not accessed or used during that period for any purpose other than restoration of the Cloud Service.

The Service Provider publishes a retention schedule describing the periods it applies to each category of Client Data. That schedule is provided for information, is updated from time to time to reflect current practice, and does not form part of this Agreement. The limits in this Section prevail.

Client may request a report of retained data by contacting the Service Provider’s support team. Client may request deletion of any Client Data, except data contained in logs and encrypted backups which is deleted automatically in accordance with the published retention schedule and Applicable Law.

7.3 Reserved.

7.4 Use of Other Data. Nothing in this Agreement restricts: (a) the Service Provider’s use of System Data, or of data derived from System Data, that does not include any Proprietary Rights of Client and does not identify, or permit identification, association or correlation, alone or in conjunction with other data, of or with (i) Client, its Affiliates, Users, customers, suppliers or other persons interacting with Client and its Affiliates using the Product through the Cloud Service, or any Confidential Information of Client disclosed to the Service Provider, or (ii) any device used to access or use the Product as originating through Client or its Affiliates or interacting with Client or its Affiliates; or (b) either Party’s use of any data, records, files, content or other information relating to any third party that is collected, received, stored or maintained by that Party independently of this Agreement.

7.4.1 No Secondary Use of Personal Data. Notwithstanding Section 7.4, the Service Provider will not use Client Data constituting Personal Data, or any data derived from it, for any independent business purpose of the Service Provider, including profiling, advertising, marketing, benchmarking across customers or resale, and will not disclose Personal Data to any third party for any such purpose. The Service Provider will not use Personal Data for the training, fine-tuning or development of artificial intelligence or machine learning models except with Client’s prior written consent, and where such consent is given, only using that Client’s Personal Data and only for the purpose of providing the Services to that Client. For the avoidance of doubt, this Section does not restrict the Service Provider’s use of System Data as provided in Section 7.4(a), nor the use of De-identified Data permitted by Section 7.4.3, nor the Service Provider’s use of data collected, received, stored or maintained independently of this Agreement as provided in Section 7.4(b), nor the use of business contact details permitted by Section 7.4.2, nor the Service Provider’s Processing of Personal Data to detect security incidents, prevent fraud, provide support to Client, or maintain the security, integrity and operation of the Licensed Product.

7.4.2 Business Contact Details. Section 7.4.1 does not apply to business contact details Processed by the Service Provider as an independent Controller in accordance with Section 1.3.2 of the Data Processing Addendum. Nothing in this Section permits the disclosure of Client Data to any third party for advertising purposes, and this Section does not apply to Personal Data relating to Users or to the individuals to whom Client issues credentials.

7.4.3 De-identified Data. The Service Provider may create data from Client Data that does not identify, and cannot reasonably be linked to, Client, its Users or any individual (“De-identified Data”), and may use it only to operate, secure, maintain and improve the Services and to produce aggregate statistics about their use and performance. De-identified Data will not include photographs, images of a person or biometric data in any form. Use of De-identified Data to train artificial intelligence or machine learning models remains subject to Section 7.4.1. The Service Provider will not attempt to re-identify De-identified Data or permit any third party to do so, and may retain it after termination.

7.5 Security. The Service Provider represents and warrants to Client that it will, consistent with current industry standard practices, implement and maintain a security program: (a) to maintain the security and confidentiality of Client Data; and (b) to maintain the availability and integrity of Client Data and to protect Client Data from known or reasonably anticipated threats or hazards to its security, including accidental loss and unauthorized use, access, alteration or disclosure.

7.5.1 Security Program. The Service Provider’s information security program will include: (a) appropriate administrative controls, including communication of applicable information security policies and information security and confidentiality training; (b) physical security of facilities where Client Data is processed or stored; (c) controls limiting access to the Service Provider’s systems and to Client Data, including a password policy for Personnel accessing Client Data; and (d) regular testing and evaluation of the effectiveness of the security program.

7.5.2 Systems Access. The Service Provider will: (a) safeguard Client Data in a controlled environment consistent with current industry standards; (b) establish, maintain and enforce the security access principles of segregation of duties and least privilege with respect to Client Data; (c) maintain a list of systems where Client Data is processed and stored and a list of Personnel with access to those systems; (d) maintain current industry standard policies and processes limiting access to Client Data, including a requirement that a unique individual user identifier be used for each User accessing Client Data and that user identifiers not be shared; and (e) require that all Personnel use strong passwords.

7.5.3 Data Storage and Authentication. The Service Provider will implement and maintain at all times during the Term: (a) logical separation of Client Data from the Service Provider’s data and third-party data; (b) encryption of Client Data at rest and in transit to or from computing environments owned or operated by or for the Service Provider in support of the Cloud Service, using industry standard encryption methods; (c) controls ensuring that the Service Provider enforces multi-factor authentication for all remote connections to Service Provider systems that access Client Data; and (d) enforcement of multi-factor authentication on all administrative user accounts provisioned to Client within the Licensed Product, which neither Client nor an individual administrator can disable. Where Client authenticates its administrators through its own identity provider, that provider governs the applicable authentication policy and Client is responsible for maintaining a policy appropriate to the sensitivity of the Client Data.

7.5.4 Data Destruction. Without prejudice to Section 7.2.4, the Service Provider will not retain Client Data or Client Materials for longer than commercially required to fulfill its obligations under this Agreement following the expiration or termination of this Agreement, except as provided in this Agreement or by Applicable Law. All Client Data and Client Materials maintained by the Service Provider will be securely and permanently deleted or destroyed in accordance with current industry standards for data destruction and media sanitization.

7.5.5 Logging. The Service Provider will maintain logs and records for industry standard retention periods enabling it to audit each User’s access to Client Data, including (i) logging of successful and unsuccessful sign-on attempts and (ii) audit trails capturing activity and actions performed within the Licensed Product during a User’s session.

7.5.6 Personnel. Access to Client Data will be restricted to authorized Personnel on a need-to-know basis. Personnel having access to Client Data will be bound by a written agreement with the Service Provider containing requirements and restrictions no less protective than those set forth in this Agreement. Each such member of Personnel must pass a background check consistent with current industry standards before being granted access to Client Data. Personnel who fail to adhere to applicable information security policies are subject to disciplinary process. The Service Provider will provide information security and confidentiality training to all Personnel authorized to access Client Data, which will be (i) consistent with industry standards, (ii) designed at a minimum to educate such Personnel on maintaining the security, confidentiality and integrity of Client Data, and (iii) provided no less than annually. The Service Provider will maintain a process by which authorized Personnel and other User accounts are created and deleted in a secure and timely manner.

7.5.7 Business Continuity. The Service Provider will maintain plans and risk controls, consistent with current industry standards, for continuity of its performance under this Agreement (the “Business Continuity Plan”), including safeguards designed to resume the Cloud Service, and to recover and make available Client Data, in line with the recovery time and recovery point objectives stated in Appendix 2 of the Data Processing Addendum following any significant interruption or impairment of the Cloud Service. The Service Provider will implement the backup procedures necessary to support its recovery point objective. The Service Provider will review the Business Continuity Plan on a regular basis and update it in response to changes within its organization and to industry standards.

7.5.8 Reports, Risk Assessments and Audits. The Service Provider will maintain retention policies for reports, logs, audit trails and related documentation in accordance with current industry standards throughout the Term. On request, the Service Provider may respond to a security questionnaire by providing its completed standard industry security assessment questionnaire or the other materials described in Section 12.5 of the Data Processing Addendum. Where Client requires completion of its own questionnaire or self-assessment security compliance review, the Service Provider will complete reasonable requests and may, at its option, charge its then-current fees or any fees agreed in an Order Form or statement of work. The Service Provider will conduct regular industry-standard penetration testing or other appropriate security testing and security assessments verifying its security program, and will remedy material issues identified from such testing and audits in a timely manner. Where an audit or inspection concerns the Service Provider’s Processing of Personal Data, the procedure, frequency, notice period and report-based alternatives set out in the Data Processing Addendum apply.

7.6 Data Protection.

7.6.1 Each Party will comply with all applicable Data Protection Laws in relation to its performance under this Agreement. The Parties will consider in good faith the implementation of any code of practice or best practice guidance issued by a relevant authority as it applies to applicable Data Protection Laws.

7.6.2 The Service Provider and Client agree to the terms and conditions of the Data Processing Addendum, which is incorporated into this Agreement. Client represents and warrants that it will not transfer Personal Data to the Service Provider under this Agreement unless the transfer complies with all applicable Data Protection Laws, and Client will be responsible for liabilities relating to such transfer arising from its own act or omission, or to the extent such transfer continues after Client has been notified by the Service Provider of a material non-conformance.

7.6.3 The Service Provider represents and warrants that the Product contains the functionality necessary to enable Client to use the Product in compliance with Client’s obligations under applicable Data Protection Laws.

7.6.4 If Client’s use of the Licensed Product becomes, or in either Party’s reasonable good-faith opinion is likely to become, in violation of the Data Processing Addendum or Section 7.6.3 in a manner that would prohibit or interfere with Client’s use of the Licensed Product, the Service Provider will at its option either: (a) modify or replace the affected Licensed Product at its sole expense so that it is no longer at risk of violating applicable Data Protection Law and is reasonably comparable in functionality, interoperability and levels of performance; or (b) notify Client that it cannot do so on a commercially reasonable basis and offer Client a new Product Addendum or Subscription pricing reflecting the increased cost of compliance or the reduced functionality, interoperability or performance. If the Parties cannot accomplish either on a commercially reasonable basis, either Party may suspend the affected Processing immediately and terminate this Agreement for cause on 30 days’ notice, in which case the Service Provider will refund to Client any Fees prepaid, prorated for the unused portion of the Subscription.

7.7 Remedies. Each Party agrees that in the event of a breach or threatened breach of this Section 7, the non-breaching Party is entitled to injunctive relief against the breaching Party in addition to any other remedy available to it.

7.8 Security Incident Notification.

7.8.1 The Service Provider will notify Client promptly, and in any event no later than 24 hours after verifying, or 72 hours after discovering, whichever is earlier, any breach of security involving Client Data or Client Confidential Information transferred to or Processed by the Service Provider or the Cloud Service (a “Security Incident”). Notice will be given to Client’s account owner. The Service Provider will cooperate with Client in every reasonable way to prevent further compromise, unauthorized use or disclosure. The notification will include, to the extent then available: (a) the nature of the Security Incident; (b) the categories and approximate number of individuals and records affected; (c) the likely consequences of the Security Incident; (d) the measures taken or proposed to address it and mitigate its effects; and (e) the name and contact details of the Service Provider’s responsible contact. Where the full particulars are not available within 24 hours, the Service Provider will provide initial notification within that period and supply the remaining particulars as they become available, without further undue delay. The notification periods in this Section are set so as to enable Client to meet its own notification obligations under Applicable Law.

7.8.2 The Service Provider will designate a Security Incident team leader, who will document the responsive actions taken and conduct a post-incident review of those actions in order to make changes to business practices relating to the Service Provider’s security program. The Service Provider will provide Client with a written report on the Security Incident once its investigation has progressed sufficiently to do so, including the root cause where determined and the remediation completed and planned. The Service Provider will provide Client with regular updates regarding its investigation. Client is responsible for keeping its account owner contact details current.

7.8.3 In addition to the Service Provider’s liabilities under Section 9.5, the Service Provider is responsible for all costs it incurs in investigating and responding to each Security Incident, unless the Security Incident resulted from the acts, omissions, instructions, unauthorized disclosure, misconfiguration or misuse of the Licensed Product by Client, its Affiliates or its Representatives. In such case, Client is responsible for the Service Provider’s reasonable costs of investigation, response, remediation and other cooperation reasonably requested by and provided to Client, at the hourly rates set out in an applicable Order Form or statement of work or, where none is agreed, at the Service Provider’s then-current rates. The Service Provider will reasonably cooperate with Client in complying with Client’s obligations under Applicable Law pertaining to investigating and responding to a Security Incident, and will not charge Client for such cooperation in respect of a Security Incident attributable to the Service Provider.

7.8.4 The Service Provider’s obligation to report or respond to a Security Incident under this Section is not an acknowledgement of fault or liability. Client must promptly notify the Service Provider of any possible misuse of its accounts or authentication credentials, or any security incident relating to its use of the Licensed Product or Third Party Services, and the Service Provider is not liable for losses, damages or improper Processing of Client Data resulting from a failure to do so. The Service Provider will cooperate in any reasonable investigation of a Security Incident by Client where required by law or requested by Client.

7.9 Governmental and Law Enforcement Requests.

7.9.1 If the Service Provider receives a request from any governmental, regulatory, judicial or law enforcement authority for access to or disclosure of Client Data, the Service Provider will, to the extent legally permitted, promptly notify Client before responding and will provide Client with the information reasonably necessary to enable Client to seek a protective order or other appropriate relief. Where the Service Provider is legally prohibited from giving prior notice, it will give notice as soon as it is legally permitted to do so.

7.9.2 The Service Provider will not disclose Client Data in response to any such request unless legally compelled to do so. Where compelled, the Service Provider will disclose only the minimum amount of Client Data necessary to satisfy the request, will require the requesting authority to pursue the request with Client directly wherever that is a lawful option, and will use reasonable efforts to challenge any request that is overbroad, unlawful, or inconsistent with applicable Data Protection Law.

7.9.3 The Service Provider does not provide any governmental, law enforcement or intelligence authority with direct, unmediated or unrestricted access to Client Data, and has not implemented, and will not implement, any facility, interface or process enabling such access. The Service Provider has not disclosed any cryptographic key, or any other means of decrypting Client Data, to any governmental, law enforcement or intelligence authority, and will not do so voluntarily. Any demand for a cryptographic key or other means of decrypting Client Data will be handled in accordance with Sections 7.9.1 and 7.9.2.

7.9.4 Records. The Service Provider maintains an internal record of any disclosure of Client Data made to a governmental, regulatory, judicial or law enforcement authority. Client is notified of any such disclosure affecting its Client Data in accordance with Section 7.9.1.

8. Limitations of Liability

8.1 Disclaimer; General Cap. EXCEPT AS SPECIFICALLY PROVIDED HEREIN, IN NO EVENT WILL (a) EITHER PARTY BE LIABLE FOR ANY INDIRECT, SPECIAL, PUNITIVE, INCIDENTAL OR CONSEQUENTIAL DAMAGES, INCLUDING COSTS OF REPLACEMENT GOODS OR SERVICES, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; AND (b) SUBJECT TO SECTIONS 8.2, 8.3 AND 8.4, EITHER PARTY’S AGGREGATE LIABILITY UNDER THIS AGREEMENT, WHETHER BASED IN CONTRACT, TORT OR OTHER LEGAL THEORY, EXCEED THE FEES AND OTHER AMOUNTS PAID AND REQUIRED TO BE PAID UNDER THIS AGREEMENT IN THE 12 MONTHS PRECEDING THE EVENT GIVING RISE TO THE DAMAGES.

8.2 Exception for Willful Misconduct or Fraud. NOTHING IN THIS AGREEMENT LIMITS LIABILITY FOR GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, OR FOR ANY LIABILITY WHICH CANNOT LEGALLY BE LIMITED, INCLUDING LIABILITY FOR (a) DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE AND (b) FRAUD OR FRAUDULENT MISREPRESENTATION.

8.3 Exception for Certain Liabilities. SUBJECT TO SECTION 8.4, THE AGGREGATE LIMITATION ON LIABILITY SET FORTH IN SECTION 8.1(b) DOES NOT APPLY TO THE OBLIGATIONS OF THE SERVICE PROVIDER UNDER SECTION 9.1, THE OBLIGATIONS OF CLIENT UNDER SECTION 9.2, OR EITHER PARTY’S OBLIGATIONS UNDER SECTION 6, SECTION 7.6 OR SECTION 7.8.

8.4 Special Cap for Security Incidents.

8.4.1 THE AGGREGATE LIMITATION ON LIABILITY SET FORTH IN SECTION 8.1(b) DOES NOT APPLY TO, AND SECTION 8.4.2 INSTEAD APPLIES TO, ALL AMOUNTS PAYABLE BY THE SERVICE PROVIDER IN RESPECT OF A SECURITY INCIDENT, TO THE EXTENT THE SECURITY INCIDENT RESULTS FROM BREACH OF THE SERVICE PROVIDER’S OBLIGATIONS UNDER THIS AGREEMENT OR FROM A VIOLATION BY THE SERVICE PROVIDER OF APPLICABLE DATA PROTECTION LAWS ABSENT THE INSTRUCTION OF CLIENT, INCLUDING THE COSTS AND THE GOVERNMENTAL FINES AND PENALTIES SPECIFIED IN SECTION 9.5 AND ANY AMOUNTS PAYABLE UNDER SECTION 7.8 OR SECTION 9.1(b) IN RESPECT OF THAT SECURITY INCIDENT.

8.4.2 THE SERVICE PROVIDER’S AGGREGATE LIABILITY UNDER SECTION 8.4.1, WHETHER BASED IN CONTRACT, TORT OR OTHER LEGAL THEORY, WILL NOT EXCEED (IN LIEU OF AND NOT IN ADDITION TO THE AMOUNT SET FORTH IN SECTION 8.1) THE GREATER OF (a) FIVE TIMES THE FEES PAID UNDER THIS AGREEMENT IN THE 12 MONTHS PRECEDING THE EVENT GIVING RISE TO THE DAMAGES, AND (b) THE MINIMUM AGGREGATE LIMIT OF CYBER LIABILITY INSURANCE REQUIRED UNDER SECTION 11.1.3.

8.5 Higher Limits by Written Agreement. The Parties may agree to increased liability limits for specific claims, including under Section 8.4.2, by written addendum signed by both Parties. Any such increase applies solely as set forth in that addendum and does not modify the limits in this Agreement for other claims.

8.6 Data Processing Agreements. The exclusions and limitations of liability in this Section 8 apply to all liability under or in connection with any data processing agreement between the Parties, including the Data Processing Addendum, unless that agreement expressly sets different limits on, or exclusions of, liability, or expressly states that its liability provisions apply notwithstanding any limitation of liability in this Agreement, and except to the extent this would contradict the standard contractual clauses or the UK International Data Transfer Addendum incorporated by the Data Processing Addendum.

9. Indemnification

9.1 Service Provider Indemnity. The Service Provider will, at its expense, indemnify, defend and hold harmless Client, its Affiliates and Representatives, and their respective officers, directors, employees and agents (collectively, “Client Indemnified Parties”) from and against any and all claims, actions, proceedings and suits brought by a third party, including governmental investigations (“Claims”), to the extent arising out of or alleging: (a) infringement, misappropriation or violation of any Proprietary Rights by the Licensed Product which the Service Provider permitted Client to use under this Agreement; (b) any unauthorized access to, use or disclosure of Client Data to the extent resulting from breach of the Service Provider’s obligations under this Agreement; (c) a willful violation by the Service Provider of applicable Data Protection Laws absent the instruction of Client; or (d) a breach by the Service Provider of Section 5.5. The Service Provider will pay all damages and amounts finally awarded by a court of competent jurisdiction or agreed in settlement in accordance with Section 9.3, and any governmental fines and penalties assessed against Client in any such Claim.

9.2 Client Indemnity. Client will, at its expense, indemnify, defend and hold harmless the Service Provider, its Affiliates and their respective officers, directors, employees, agents and Representatives (collectively, “Service Provider Indemnified Parties”) from and against any and all reasonable Claims to the extent arising out of or alleging: (a) infringement, misappropriation or violation of any Proprietary Rights by Client Materials or Client Data which Client permitted to be used by the Service Provider under this Agreement; (b) any unauthorized or unlawful receipt, Processing, transmission or storage of Client Data or Client Materials by the Service Provider in the performance of its obligations as permitted under this Agreement, resulting from breach of Client’s obligations under Section 7.2.2, Section 7.6.2 or Section 5.5, save to the extent such breach is caused by an act or omission of the Service Provider; or (c) any dispute between Client and a third party regarding authority over, access to, ownership of, or control of an Account, including any competing claim to be the Customer of Record, save to the extent such Claim arises from the Service Provider’s own negligence or breach of this Agreement. Client will pay all costs, damages and amounts finally awarded by a court of competent jurisdiction or agreed in settlement in accordance with Section 9.3, and any governmental fines and penalties assessed against the Service Provider in any such Claim.

9.3 Process. Each party seeking indemnification under this Section 9 (each an “Indemnified Party”) will give the other Party (the “Indemnifying Party”) prompt notice of each Claim for which it seeks indemnification, provided that failure or delay in providing such notice will not release the Indemnifying Party from any obligation except to the extent the Indemnifying Party is prejudiced by such failure. The Indemnified Parties will provide reasonable cooperation in the defense of each Claim at the Indemnifying Party’s request and expense. The Indemnifying Party will keep the Indemnified Parties informed of the status of each Claim. An Indemnified Party may participate in the defense of a Claim at its own expense. The Indemnifying Party will control the defense or settlement of the Claim, provided that it will not, without the Indemnified Parties’ prior written consent, enter into any settlement that (i) includes any admission of guilt or wrongdoing by any Indemnified Party; (ii) imposes any financial obligation on any Indemnified Party that it is not obligated to pay under this Section 9; (iii) imposes any non-monetary obligation on any Indemnified Party; or (iv) does not include a full and unconditional release of the Indemnified Parties. The Indemnifying Party will ensure that any settlement it enters into is made confidential, except where not permitted by Applicable Law.

9.4 Infringement Remedy. In addition to the Service Provider’s obligations under Section 9.1, if the Licensed Product is held, or in the Service Provider’s opinion is likely to be held, to infringe, misappropriate or violate any Proprietary Rights, or if an injunction is obtained or in the Service Provider’s opinion is likely to be obtained that would prohibit or interfere with Client’s use of the Licensed Product, the Service Provider will at its option and expense either: (a) procure for Client the right to continue using the affected Licensed Product in accordance with the license granted under this Agreement; or (b) modify or replace the affected Licensed Product so that it is reasonably comparable in functionality, interoperability, security and performance and does not infringe, misappropriate or violate any third-party Proprietary Rights. If the Service Provider cannot accomplish either on a commercially reasonable basis, it will notify Client and either Party may terminate the Subscription and this Agreement, in which case the Service Provider will refund to Client any Fees prepaid, prorated for the unused portion of the Subscription.

9.5 Security Incident Remedy. In addition to the Service Provider’s obligations under Section 9.1, in the event of any Security Incident, to the extent resulting from breach of the Service Provider’s obligations under this Agreement or from a violation by the Service Provider of applicable Data Protection Laws absent the instruction of Client, the Service Provider will pay the applicable governmental fines and penalties and other reasonable and documented out-of-pocket costs directly incurred by Client for: (a) investigating and responding to the Security Incident; (b) providing notification to affected individuals and to applicable governmental and industry regulatory agencies as required by law; (c) providing credit monitoring or identity theft services to affected individuals as required by law; and (d) mitigation or remediation within the Licensed Product required by regulatory agencies as a result of the Security Incident.

9.6 Limitations.

9.6.1 The Service Provider has no liability or obligation under this Section 9 with respect to any infringement Claim to the extent solely attributable to: (a) modification of the Licensed Product not performed by or on behalf of the Service Provider or its Personnel; (b) use of the Product by Client in combination with third-party products, services, equipment, content, code or software not provided by the Service Provider, at the instruction of Client, where the alleged violation would not have occurred but for such combination; (c) use of the Licensed Product by Client in breach of this Agreement; or (d) acts or omissions of the Indemnified Party, including willful patent infringement.

9.6.2 Client has no liability or obligation under this Section 9 with respect to any infringement Claim to the extent solely attributable to: (a) modification of the Client Materials or Client Data not provided or authorized by Client or its Personnel; or (b) use of the Client Materials or Client Data by the Service Provider that is not permitted under this Agreement.

9.6.3 This Section 9 states the entire liability of the Service Provider with respect to infringement, misappropriation or violation of Proprietary Rights of third parties by any Licensed Product or any use of it by Client, and the entire liability of Client with respect to infringement, misappropriation or violation of Proprietary Rights of third parties by any Client Materials or Client Data or any use, receipt, storage or Processing of them by the Service Provider.

10. Term and Termination

10.1 Term. This Agreement commences on the Subscription Start Date of each Subscription and continues in full force and effect until that Subscription has ended (the “Initial Term”), unless terminated earlier as provided in this Agreement. This Agreement renews for additional terms (each a “Renewal Term”) with each Subscription renewal unless a Party gives notice of non-renewal in accordance with the applicable Product Addendum.

10.2 Termination for Cause. Either Party may terminate this Agreement if the other Party: (a) fails to cure a material breach within 30 days after receiving notice of the breach; (b) materially breaches this Agreement in a manner that cannot be cured; (c) dissolves or ceases conducting business without a successor; (d) makes an assignment for the benefit of creditors; or (e) becomes the debtor in insolvency, receivership or bankruptcy proceedings continuing for more than 60 days. In addition, either Party may terminate an affected Subscription if a Force Majeure Event prevents the Product from materially operating for 30 or more consecutive days, in which case the Service Provider will pay Client a prorated refund of prepaid Fees for the remainder of the Term. A Party must notify the other of its reason for termination. A Client that is a Government Entity has the additional termination right set out in Section 13.17.4. Termination by the Service Provider under this Section does not prejudice Client’s right, or the Service Provider’s obligation, to extract or assist with the retrieval or deletion of Client Data as set forth in Section 10.3.2.

10.3 Effect of Termination.

10.3.1 Upon termination or expiration of a Subscription, Client’s right to use the Product licensed under that Subscription terminates and Client’s access to the Product and Services provided under it may be disabled. Termination or expiration of any Subscription does not terminate or modify any other Subscription purchased by Client. Upon termination of this Agreement, all of Client’s Subscriptions under it terminate immediately.

10.3.2 Retrieval and Deletion of Client Data. Client may export, at no additional charge, all Client Data available through the Licensed Product’s export functions, including Personal Data and logs, in CSV format, at any time during the Term. Client’s access ends on termination or expiration, but during the thirty (30) days that follow, or any longer period agreed under Section 7.2.4(b) (the “Export Period”), the Service Provider will re-enable administrator access on request so that Client can export its Client Data. Data for which the Licensed Product provides no export function, such as card templates, and exports in any other format, are available as Professional Services under Section 3.7, save that where Client elects return of Personal Data under Section 10.3.3(a), the Service Provider will provide any Personal Data not available through the export functions at no charge. The Service Provider will assist Client, as reasonably requested, in validating whether the retrieval or deletion was successful. Client Data will be provided in a standard, non-proprietary comma-separated values (CSV) format. Following delivery to Client of the Client Data and Client’s confirmation of receipt, or Client’s retrieval or deletion of the Client Data and the Service Provider’s validation of it, the Service Provider may permanently delete and remove the Client Data, and will do so in any event by the end of the Export Period. The Service Provider will, on Client’s request, certify such deletion and removal to Client in writing.

10.3.3 Personal Data Return and Deletion. Upon termination or expiration of a Subscription, and subject to any legal obligation to retain data:

(a) at Client’s written election, the Service Provider will either return Personal Data in accordance with Section 10.3.2 or, by the end of the Export Period, securely delete all Personal Data from its production systems;

(b) Personal Data held in encrypted backup and disaster recovery copies is not separately extractable and is deleted or overwritten on expiry of the backup cycle, and in any event no later than twelve (12) months from the effective date of termination; during that period such copies remain encrypted, are not used for any Processing, and remain subject to the confidentiality and security obligations of this Agreement;

(c) deletion will use methods consistent with recognized standards for media sanitization;

(d) the Service Provider will certify deletion in writing on Client’s request;

(e) the Service Provider will instruct its sub-processors to delete Personal Data; and

(f) any Personal Data that cannot be returned or deleted because Applicable Law requires its retention will remain subject to the confidentiality, privacy and security obligations of this Agreement, will be isolated from active Processing and used for no purpose other than the retention required, and the Service Provider will notify Client of the requirement and of the period for which it applies.

The Service Provider may retain data derived from Client Data that has been irreversibly anonymized such that it no longer constitutes Personal Data and cannot reasonably be re-identified, whether alone or in combination with other data, for the purposes permitted by Section 7.4.3. The Service Provider will not attempt to re-identify such data and will not permit any third party to do so. Such anonymized data does not constitute Client Data for the purposes of this Section.

10.3.4 Sections 4 (Proprietary Rights), 6 (Confidentiality), 7.2.1, 7.4.1, 7.9.4, 8 (Limitations of Liability), 9 (Indemnification), 10.3 (Effect of Termination), 11 (Insurance), 12.3 (Taxes), 13 (General) and 14 (Definitions), together with all other provisions that may reasonably be construed as surviving expiration or termination, survive the expiration or termination of this Agreement for any reason. The non-use and non-disclosure obligations of Section 6 expire five years following expiration or termination of this Agreement, except with respect to, and for as long as, any Confidential Information constitutes a trade secret.

10.3.5 The Service Provider will submit invoices for all known outstanding Fees accrued upon termination and any Fees accruing thereafter in accordance with Sections 10.2 and 10.3 and Section 12.

10.3.6 Each Party, as recipient, will return or destroy the other Party’s Confidential Information in its possession or control and, in the case of destruction, will confirm such destruction to the other Party.

10.3.7 Upon termination or expiration of this Agreement, the Service Provider will offer Client a statement of work for Professional Services, at Client’s request, to support migration to a replacement provider of similar services, to the extent such support does not disclose or transfer any Proprietary Rights or Confidential Information of the Service Provider.

11. Insurance

11.1 Coverages. The Service Provider will, at its own cost and expense, obtain and maintain the following insurance coverage during the Term and for one year thereafter:

11.1.1 Commercial General Liability insurance, including premises-operations, property damage, products and completed operations, contractual liability, and personal and advertising injury, with limits of not less than $2,000,000 per occurrence, $4,000,000 general annual aggregate, and $4,000,000 products and completed operations annual aggregate;

11.1.2 Professional Liability insurance in an amount of not less than $2,000,000 per occurrence, covering liabilities for financial loss resulting from actual or alleged acts, errors or omissions by the Service Provider or its Personnel in rendering Services under this Agreement, including in rendering computer or information technology services, and covering proprietary rights infringement (excluding patent infringement), data damage, destruction or corruption, failure to protect privacy, unauthorized access, unauthorized use, and transmission of malicious code; and

11.1.3 Cyber Liability or Technology Errors and Omissions insurance with limits of not less than $2,000,000 each claim and $2,000,000 annual aggregate, providing protection against liability for: (a) system attacks; (b) denial or loss of service attacks; (c) spread of malicious software code; (d) unauthorized access to and use of computer systems; (e) liability arising from loss or disclosure of personal or corporate confidential data; (f) cyber extortion; (g) breach response and management; (h) business interruption; (i) invasion of privacy; and (j) defense of any regulatory action involving a breach of applicable Data Protection Laws.

11.2 Evidence. The Service Provider will provide Client with a certificate of insurance evidencing the coverages required by this Section upon Client’s written request, and will notify Client if any such coverage is cancelled or reduced below the limits stated.

12. Payment and Taxes

12.1 Fees and Invoices. Unless otherwise stated, all Fees are quoted in U.S. Dollars and are exclusive of taxes. Except as expressly provided in this Agreement, Fees are non-refundable. The Service Provider will invoice Fees applicable to the Subscription and related usage once per invoice period in advance, commencing on the Subscription Start Date. Any Fees or credits incurred after an invoice is issued will be included in the next invoice. Professional Services may be invoiced separately during performance. Invoices will be sent by email to the billing contact supplied during registration, which Client may update from time to time.

12.2 Payment. Client will pay the Service Provider the Fees and any applicable taxes set out in each invoice in the currency quoted. If no currency is specified, the currency is U.S. Dollars. If Client provides credit card information for payment, Client authorizes the Service Provider to charge that card for undisputed Fees as invoiced. If Client pays by ACH or international wire, Client is responsible for any wire transfer or currency conversion fees.

12.3 Taxes. Each Party is responsible for taxes on its own income and employees. Client is responsible for paying all sales, use, GST, VAT and other taxes associated with its Subscription. Where a reverse charge, self-assessment or similar mechanism applies under local law and the Service Provider is not itself legally required to collect the relevant tax, Client is solely responsible for self-assessing, reporting and remitting such taxes directly to the relevant tax authority, and the Service Provider has no obligation to collect or remit them on Client’s behalf. Client will provide the Service Provider with a valid VAT, GST or equivalent tax registration number where one is required in order to apply such a mechanism. If the Service Provider has a legal obligation to pay or collect taxes for which Client is liable, the Service Provider will invoice Client and Client will pay the invoiced tax amount unless a valid tax exemption certificate authorized by the appropriate taxing authority is provided.

12.4 Pricing Changes. The Service Provider may change the Fees, with effect from the start of a Renewal Term, by written notice given at least ninety (90) days before the change takes effect. The Fees for the same plan, features and quantity will not increase in any twelve-month period by more than the greater of five percent (5%) and the percentage change in the Consumer Price Index for All Urban Consumers (CPI-U) published by the U.S. Bureau of Labor Statistics for the most recent twelve-month period available when notice is given (the “Annual Limit”). Where the Service Provider has not applied the full Annual Limit in a previous twelve-month period, the unused portion may be applied later, provided that the Fees do not increase by more than ten percent (10%) in any twelve-month period. These limits do not apply to any discount identified in the Order Form as introductory, one-time or limited to a stated period, or to changes in Fees resulting from a change in Client’s plan, features, quantity or usage; where Client’s quantity or usage changes, the Fees follow the applicable volume tier. The Service Provider may discontinue a plan at the end of a Subscription Period on the same notice, in which case Client may renew on any available plan. Fees for third-party services passed through at cost and identified as such in the Order Form, such as SMS delivery charges, may change during a Subscription Period on thirty (30) days’ written notice. If a change under this Section is unacceptable to Client, Client may terminate the affected Subscription, and the Service Provider will refund any prepaid Fees, prorated for the unused portion.

12.5 Payment Disputes. If Client has a good-faith disagreement about amounts charged on an invoice, Client must notify the Service Provider of the dispute during the payment period for that invoice and must pay all undisputed amounts when due. The Parties will work together to resolve the dispute within 15 days after the end of the payment period. If no resolution is agreed, each Party may pursue any remedy available under this Agreement or Applicable Laws.

13. General

13.1 Governing Law and Venue. This Agreement, and any dispute or claim arising out of or in connection with it or its subject matter or formation, including non-contractual disputes or claims, is governed by and interpreted according to the laws of the Commonwealth of Massachusetts, without regard to its conflict of laws principles, except that any claim arising solely under a non-waivable provision of law applicable to Client in its capacity as a Government Entity is governed by the law of Client’s jurisdiction. Each Party irrevocably agrees that any legal action or proceeding relating to this Agreement will be instituted solely in the state and federal courts located in Boston, Massachusetts, except that any claim arising solely under a non-waivable provision of law applicable to Client in its capacity as a Government Entity will be instituted solely in the competent courts of Client’s jurisdiction. Each Party irrevocably submits to the jurisdiction of such courts and waives any objection to venue. The United Nations Convention on Contracts for the International Sale of Goods does not apply to this Agreement. “Government Entity” has the meaning given in Section 13.17.

13.2 Assignment. Neither Party may assign or transfer this Agreement, or any right under it, or delegate any duty, without the prior written consent of the other Party, which will not be unreasonably withheld, delayed or conditioned. Notwithstanding the foregoing, and without the other Party’s consent, the Service Provider may assign this Agreement in its entirety and delegate its obligations to an Affiliate or to any entity acquiring all or substantially all of the assets related to the Licensed Product, and Client may assign this Agreement in its entirety to an Affiliate or to any entity acquiring all or substantially all of the assets related to Client’s account or Client’s entire business, in each case whether by sale of assets, sale of stock, merger or otherwise. In the case of any permitted assignment, the assigning Party will provide prior written notice to the other Party. Any attempted assignment, transfer or delegation in contravention of this Section is null and void. This Agreement inures to the benefit of the Parties and their permitted successors and assigns.

13.3 Entire Agreement. This Agreement constitutes the entire agreement between the Parties relating to its subject matter, and there are no other representations, understandings or agreements between the Parties relating to that subject matter. This Agreement is solely between Client and the Service Provider. The terms of this Agreement will not be changed, amended, modified or waived during any Term unless in writing and signed by authorized representatives of the Parties. NEITHER PARTY WILL BE BOUND BY, AND EACH SPECIFICALLY OBJECTS TO, ANY PROVISION DIFFERENT FROM OR IN ADDITION TO THIS AGREEMENT, WHETHER PROFFERED ORALLY OR IN ANY QUOTATION, PURCHASE ORDER, INVOICE, SHIPPING DOCUMENT, ONLINE TERMS AND CONDITIONS, ACCEPTANCE, CONFIRMATION OR CORRESPONDENCE, UNLESS SPECIFICALLY AGREED IN WRITING SIGNED BY BOTH PARTIES.

13.4 Export and Sanctions. Each Party will comply with all applicable customs, export control and sanctions laws and regulations of the United States and of any other country in which, in the case of Client, Client or its Users use the Product or Services, and in the case of the Service Provider, the Service Provider provides the Product or Services. Each Party certifies that neither it nor its Personnel appears on any relevant list of prohibited or restricted persons maintained by a competent governmental authority. Neither Party will export, re-export, ship or otherwise transfer the Licensed Product, Services or Client Data to any country subject to an embargo or other sanction by the United States or other applicable jurisdiction.

13.5 Force Majeure. Neither Party is liable for any failure or delay in the performance of its obligations, in whole or in part, on account of riot, fire, flood, earthquake, explosion, epidemic, war, strike or labor dispute not involving the Party claiming force majeure, embargo, civil or military authority, act of God, governmental action or other cause beyond its reasonable control and without the fault or negligence of that Party or its Personnel, where the failure or delay could not have been prevented or circumvented through the use of alternate sourcing, workaround plans or other reasonable precautions (a “Force Majeure Event”). If a Force Majeure Event continues for more than 30 days, Client may cancel the unperformed portion of the Subscription and receive a pro rata refund of Fees prepaid for that unperformed portion. Force Majeure does not excuse payment obligations for Fees properly accrued and invoiced before the Force Majeure Event.

13.6 Government Rights. As defined in FAR 2.101, the Product and Documentation are “commercial products” and “commercial computer software” and, consistent with FAR 12.212 and DFARS 227.7202, any use, modification, reproduction, release, performance, display or disclosure of such commercial computer software or commercial computer software documentation by the U.S. Government is governed solely by the terms of this Agreement and is prohibited except to the extent expressly permitted by this Agreement.

13.7 Headings. Headings are for reference purposes only and do not explain, modify, amplify or aid in the interpretation, construction or meaning of the provisions of this Agreement.

13.8 No Third-Party Beneficiaries. Except as specified in Section 9 with respect to Client Indemnified Parties and Service Provider Indemnified Parties, nothing in this Agreement confers upon any person other than the Parties and their respective successors and permitted assigns any right, remedy, obligation or liability.

13.9 Notices. To be effective, notice under this Agreement must be given in writing. Each Party consents to receiving electronic communications and notifications from the other Party in connection with this Agreement. Each Party may receive notices: (a) by email to the address designated by that Party as its notice address, deemed received upon successful transmission as evidenced by a delivery confirmation from the sender’s email service, unless the sender receives a bounce-back or error message; (b) by personal delivery; (c) by registered or certified mail, return receipt requested; or (d) by nationally recognized courier service. Notice is deemed received: (i) if sent by email, at the time of delivery confirmation; (ii) if by personal delivery, when left at the proper address; and (iii) if by registered or certified mail, at 10:00 a.m. on the second Business Day after posting. Client will keep the notice address and account owner contact details for its Account current. This Section does not apply to service of proceedings or other documents in any legal action or alternative dispute resolution process.

13.10 Non-Waiver. Any failure or delay by either Party in exercising or partially exercising any right, power or privilege under this Agreement is not a waiver of that right, power or privilege. No waiver by either Party of a breach of any term, provision or condition constitutes a waiver of any succeeding breach of the same or any other provision. No waiver is valid unless executed in writing by the Party making it.

13.11 Publicity. Neither Party will issue any publicity material or press release referring to the other Party or its Affiliates, or use any trade name, trademark, service mark or logo of the other Party or its Affiliates in any advertising, promotion or otherwise, without the other Party’s prior written consent.

13.12 Relationship of the Parties. The relationship of the Parties is that of independent contractors. Nothing in this Agreement creates or implies an agency relationship, joint venture, partnership, or employer and employee relationship between the Parties. Each Party assumes sole and full responsibility for its own acts and those of its Personnel. Neither Party has authority to make commitments or enter into contracts on behalf of, bind, or otherwise oblige the other Party.

13.13 Severability. If any term or condition of this Agreement is held invalid or unenforceable to any extent by a court of competent jurisdiction, the remainder of this Agreement is not affected, and each term and condition remains valid and enforceable to the fullest extent permitted by law.

13.14 Subcontracting. The Service Provider may use Subcontractors in its performance under this Agreement, provided that: (a) the Service Provider remains responsible for all of its duties and obligations, and the use of any Subcontractor will not relieve or reduce any liability of the Service Provider or cause any loss of warranty; and (b) the Service Provider is directly liable for any act or omission of a Subcontractor to the same degree as if performed by the Service Provider, such that a breach by a Subcontractor is deemed a breach by the Service Provider. Upon request, the Service Provider will identify to Client any Subcontractor having access to Client Data and provide such other information reasonably requested about the subcontracting. Client’s right to object to a Subcontractor that Processes Personal Data, and the consequences of an objection, are set out in the Data Processing Addendum.

13.15 Counterparts. This Agreement may be executed in any number of counterparts, each of which is deemed an original and all of which together constitute one and the same agreement. Signature pages transmitted by facsimile, in Portable Document Format, or by electronic signature are treated as originals, fully binding and with full legal force and effect, and the Parties waive any right to object to such treatment.

13.16 Additional Terms for Certain Clients. Additional terms apply to certain Clients as set out in the addenda below. Each applies where its own terms provide, and once applicable takes precedence over this MSA in accordance with Section 1.3.

13.16.1 The Student Data Protection Addendum applies where Client is an educational agency or institution and Processes student data through the Licensed Product. It applies whether or not Client is also a Government Entity, and applies to privately operated as well as publicly operated institutions.

13.16.2 A Government Entity Addendum applies where Client is a Government Entity and the Parties have executed such an addendum. The terms in Section 13.17 apply to every Government Entity whether or not a Government Entity Addendum is in force.

13.16.3 Any other addendum applies where Client is subject to a requirement arising from its sector, or from the jurisdiction in which it is established or operates, that the Parties have addressed in that addendum.

13.17 Government and Public Sector Clients.

13.17.1 Application. This Section applies where Client is a government, state, provincial, territorial, municipal, tribal or other public sector entity, or an agency, instrumentality, department, authority, school district, public educational institution or political subdivision of any of them (a “Government Entity”). This Section applies where Client is identified as a Government Entity in the Order Form and, irrespective of such identification, where Client is a Government Entity as a matter of applicable law. Where a Government Entity Addendum is in force under Section 13.16, that addendum prevails over this Section to the extent of any conflict.

13.17.2 Reservation of Immunity. Nothing in this Agreement constitutes a waiver, express or implied, of any sovereign, governmental, official or other immunity, defense, or limitation of liability available to Client under applicable law, and Client reserves all such immunities and defenses. Nothing in this Section relieves Client of its obligation to pay Fees properly due for Services received.

13.17.3 Indemnification. Client’s indemnification and defense obligations under Section 9.2 apply only to the extent authorized by applicable law, and no provision of this Agreement obligates Client to indemnify or defend the Service Provider beyond what is so authorized. Where Client is prohibited by law from indemnifying the Service Provider, Client remains responsible for its own acts and omissions to the extent permitted by applicable law. The Service Provider’s obligations under Section 9.1 are unaffected by this Section.

13.17.4 Non-Appropriation. Client’s payment obligations in respect of any fiscal period beyond the current fiscal period are contingent upon the lawful appropriation or allocation of funds sufficient to continue this Agreement. If such funds are not appropriated or otherwise made available for an applicable fiscal period, Client may terminate this Agreement or the affected Subscription on written notice, without penalty or early termination charge and without further liability other than for amounts properly due for Services received before the effective date of termination. Client will notify the Service Provider as soon as reasonably practicable after it becomes aware that such funds are unlikely to be appropriated or allocated. This Section is available only where funds have genuinely not been appropriated or allocated, and is not a right of termination for convenience.

13.17.5 Public Records and Freedom of Information. Where Client is subject to a public records, open records, freedom of information, right to information or similar law and receives a request implicating the Service Provider’s Confidential Information, Client will, to the extent permitted by law and without prejudicing any statutory response deadline, give the Service Provider prompt written notice of the request and a reasonable opportunity to seek protective treatment or to identify material it considers exempt from disclosure. Nothing in this Section restricts, conditions or delays Client’s compliance with its disclosure obligations under applicable law, and disclosure made by Client in compliance with those obligations does not constitute a breach of Section 6.

13.17.6 Governing Law. The governing law and venue applicable to a claim arising solely under a non-waivable provision of law applicable to Client in its capacity as a Government Entity is set out in Section 13.1.

13.17.7 Precedence. In respect of a Government Entity, this Section prevails over any conflicting provision of this MSA, subject to any Government Entity Addendum under Section 13.16 and to the order of precedence in Section 1.3.

14. Definitions

14.1 “Account” means the Cloud Service account provisioned to Client through which Client accesses the Licensed Product.

14.2 “Affiliate” means, with respect to any entity, any other entity that controls, is controlled by, or is under common control with such entity. “Control” means ownership of at least fifty percent of the equity or beneficial interests of the entity, or the right to vote for or appoint a majority of its board of directors or other governing body, and includes any other entity with respect to which Client or any of its Affiliates has management or operational responsibility.

14.3 “Applicable Laws” means all applicable international, national, federal, state and local laws, ordinances, rules, regulations and orders, as amended from time to time.

14.4 “Cloud Provider” means each third-party infrastructure provider, and the local entity of that provider operating in a given Cloud Provider Region, engaged by the Service Provider to host the Cloud Service. The Cloud Providers engaged from time to time are identified on the sub-processor list referenced in the Data Processing Addendum. Any change to the Cloud Providers is subject to the notification and objection rights set out in the Data Processing Addendum.

14.5 “Cloud Provider Region” means the named geographic region, and the country in which the corresponding data center is located, in which the Service Provider hosts the Cloud Service for a given Client. The Cloud Provider Regions available from time to time, and whether each is a physically or logically separated partition, are published by the Service Provider and made available to Client.

14.6 “Business Day” means a day, other than a Saturday or Sunday, on which banks are open for general business in Boston, Massachusetts.

14.7 “Business Hours” means 9:30 a.m. to 6:00 p.m. Eastern Time on any Business Day.

14.8 “Client Data” means all data, records, files, information and content, including text, sound, video and images, that is (a) input or uploaded by Client or its Users to, or collected, received, transmitted, Processed or stored by Client or its Users using, the Product or Cloud Service in connection with this Agreement, including Personal Data; (b) provided by Client to the Service Provider in connection with this Agreement by a means other than the Product or Cloud Service, whether stored within the Licensed Product or elsewhere; or (c) generated or derived from the foregoing.

14.9 “Client Materials” means any property, item or material, and any Proprietary Rights therein, including Client Data, furnished by Client to the Service Provider for the Service Provider’s use in performing its obligations under this Agreement.

14.10 “Cloud Service” means access to and use of the Product, or a component of the Product, as deployed and hosted in the Service Provider’s Computing Environment, together with any software or other technology provided or made accessible by the Service Provider in connection with it that Client is required or has the option to use in order to access and use the Product.

14.11 “Computing Environment” means the computing infrastructure and systems used to provide the Product via the Cloud Service.

14.12 “Contractor” means any third-party contractor of Client, or other third party performing services for Client, including outsourcing suppliers.

14.13 “Controller” means the entity that determines the purposes and means of the Processing of Personal Data, and includes the equivalent term under any applicable Data Protection Law.

14.14 “Customer of Record” means the legal entity that is the subscriber to the Services and on whose behalf Client Data is Processed, determined in the following order of precedence: (a) the legal entity identified as Client in an Order Form or other agreement executed or counter-signed by both Parties; (b) failing (a), the legal entity identified as the subscriber in the Account profile in accordance with the applicable Product Addendum, being the entity on whose behalf the Client Data in the Account is Processed; and (c) failing (a) and (b), the legal entity identified in the Account’s business or billing information. Payment of Fees by a person other than the Customer of Record, including by an employee, officer, contractor, consultant, systems integrator, reseller, purchasing agent or other agent, does not constitute that person the Customer of Record and confers no right, title or interest in the Account, the Licensed Product or the Client Data. The identity of the individual who created the Account, and the identity of any person holding or controlling a login credential, are not determinative. For a free trial or otherwise unpaid Account, the Customer of Record is determined under (b) or (c), subject to confirmation by the Service Provider upon conversion to a paid Subscription. The Customer of Record is the Controller of Personal Data held in the Account for the purposes of the Data Processing Addendum.

14.15 “Data Protection Law” means all data protection, privacy and data security laws and regulations applicable to the Processing of Personal Data under this Agreement in any jurisdiction in which Client operates or in which data subjects are located, together with any binding guidance or codes of practice issued under them, in each case as amended or replaced from time to time. The specific laws applicable to a given Processing activity, and the corresponding obligations of the Parties, are addressed in the Data Processing Addendum.

14.16 “Data Processing Addendum” means the data processing addendum entered into between the Parties, together with any data transfer addendum or international data transfer mechanism incorporated into it.

14.17 “Documentation” means the user guides, manuals, instructions, specifications, notes, printed updates, read-me files, release notes and other materials relating to the Product, its use, operation or maintenance, together with all enhancements, modifications, derivative works and amendments to those documents provided by the Service Provider under this Agreement.

14.18 “Fees” means the amounts payable for the Product and the Cloud Service as set out in the applicable Order Form, Product Addendum or Subscription Pricing Schedule.

14.19 “International Data Transfer Mechanism” means the safeguards that a jurisdiction requires parties transferring Personal Data across international borders to adopt in order to make the transfer lawful. “Transfer” in this context means to disclose or move Personal Data from a storage location in one jurisdiction to another, or to permit a party in one jurisdiction to access Personal Data stored in another jurisdiction where such a mechanism is required.

14.20 “Licensed Product” means the Product, the Documentation, and any other item, material or deliverable that the Service Provider provides, or is obligated to provide, as part of a Subscription.

14.21 “Order Form” means a quote, order form or other ordering document executed or counter-signed by both Parties setting out the Subscription purchased, the Fees and the Term.

14.22 “Personal Data” means any Client Data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable natural person, and includes the equivalent term under any applicable Data Protection Law.

14.23 “Personnel” means a Party’s or its Affiliates’ directors, officers, employees, non-employee workers, agents, auditors, consultants, contractors and subcontractors, and any other person performing services on behalf of that Party, excluding the other Party and its Personnel.

14.24 “Process”, “Processed” and “Processing” mean any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means.

14.25 “Processor” means an entity that Processes Personal Data on behalf of a Controller, and includes the equivalent term under any applicable Data Protection Law.

14.26 “Product” means the computer software and associated data, content and services identified in the applicable Product Addendum that the Service Provider provides, or is obligated to provide, as part of a Subscription, including any patch, bug fix, correction, remediation of security vulnerabilities, update, upgrade, modification, enhancement, derivative work, new release or new version of the foregoing.

14.27 “Product Addendum” means the description of the Product and related product information published or provided by the Service Provider, including Support Services and the policies and procedures incorporated or referenced in it, and including the specification of the categories of Personal Data the Licensed Product is designed to Process.

14.28 “Proprietary Rights” means all intellectual property and proprietary rights throughout the world, whether now known or hereafter discovered or invented, together with any renewals, extensions or revivals, including: (a) patents and patent applications; (b) copyrights, neighboring rights and mask work rights; (c) trade secrets; (d) trademarks, trade names, service marks and logos; (e) rights in data and databases; (f) registered designs and unregistered design rights; and (g) analogous rights throughout the world.

14.29 “Security Incident” has the meaning given in Section 7.8.1.

14.30 “Sensitive Data” means the following categories of data: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data; biometric data Processed for the purpose of uniquely identifying a natural person; data concerning health; data concerning a natural person’s sex life or sexual orientation; government-issued identification numbers; payment card and financial account information; an unencrypted identifier in combination with a password or access code permitting access to an account; and precise geolocation. Classification of data as Sensitive Data does not of itself preclude its Processing through the Licensed Product; Section 7.1.2 governs which categories the Licensed Product is approved to Process and which are excluded.

14.31 “Services” means all services and tasks that the Service Provider provides, or is obligated to provide, under this Agreement, including the Cloud Service and the Support Services.

14.32 “Subcontractor” means any third party to whom the Service Provider delegates any of its duties or obligations under this Agreement.

14.33 “Subscription” means a subscription for specified features, integrations, usage pricing and use capacity purchased by Client and fulfilled by the Service Provider for the licensing and provision of the Product as a Cloud Service in the Service Provider’s Computing Environment.

14.34 “Support Services” means the support and maintenance services for the Product that the Service Provider provides, or is obligated to provide, as described in the Product Addendum.

14.35 “System Data” means data and data elements, other than Client Data, collected by the Product, the Cloud Service or the Computing Environment regarding configuration, environment, usage, performance, vulnerabilities and security of the Product or Cloud Service, which may be used to generate logs, statistics and reports regarding performance, availability, integrity and security.

14.36 “Term” means the Initial Term together with each Renewal Term.

14.37 “Third Party Services” means any third-party product, platform, service, equipment, content, code or software used in combination with a Licensed Product.

14.38 “User” means any person, software program or computer system authorized by Client or any of its Affiliates to access and use the Product as permitted under this Agreement, including Contractors of Client or its Affiliates.