2019

GENERAL TERMS AND CONDITIONS

FOR THE SALE OF INFINITE ACRES PRODUCTS AND SERVICES

Article 1 – Definitions

“Agreement” means the agreement between Infinite Acres and Client, including these General Terms and Conditions.

“Client” means the customer identified in the Agreement.

“Confidential Information” means all information disclosed by or on behalf of a Party (in

whatever medium including in written, oral, visual or electronic form and whether before or after the date of the Agreement), including all business, financial, commercial, technical, operational, organisational, legal, management and marketing information which is either marked as being confidential or which would reasonably be deemed to be confidential in the ordinary course of business.

“Effective Date” means the effective date set out in the Agreement.

“General Terms and Conditions” means these general terms and conditions for the sale of

Infinite Acres Products and Services.

“Hardware Product” means hardware product specified in the Agreement (e.g.

indoor growing equipment, containers, climate control systems, etc.)

“Infinite Acres” means the relevant Infinite Acres entity with which the contract is entered into and which invoices the relevant Products and/or Services.

“Initial Term” means the initial term of the Agreement, as specified in the Agreement.

“Part(y)(ies)” means Infinite Acres and/or Client.

“Products” means the Hardware Products, Software Products or other products specified in the Agreement.

“Project” means such project-related services and contributions as set out in the Agreement and/or accompanying project plan.

“Purchase Price” means the purchase price for the Products, as specified in the Agreement.

“Services” means the Infinite Acres services and/or Project performance specified in the Agreement.

“Service Fee” means the fees for the Services, as specified in the Agreement.

“Software Product” means the software product specified in the Agreement.

“Warranty” means the warranty as set out in article 10.1.

“Warranty Period” means the warranty period as set out in article 10.2.

Article 2 – Applicability

1. 1. These General Terms and Conditions shall apply to and are expressly incorporated into quotations, offers, orders, order confirmations, the Agreement and all subsequent agreements entered into between Infinite Acres and Client in connection with the sale of Products and/or Services.
   2. A quotation for the Products or Services given by Infinite Acres shall not constitute an offer and shall only be valid for a period of 20 business days from its date of issue.
   3. An order for the Products or Services by Client shall only be deemed to be accepted by Infinite Acres if accepted by Infinite Acres (i) in writing, (ii) by sending an invoice in connection with such order or (iii) by executing the order, at which point the Agreement shall come into existence.

2.3 The applicability of Client’s general terms and conditions is hereby expressly excluded.

Article 3 – Products

1. 1. The Products shall conform in all material respects to the specifications set out in the Agreement.
   2. Any samples, drawings, descriptive matter, or advertising issued by Infinite Acres and any descriptions or illustrations contained in the catalogues or brochures of Infinite Acres are issued or published for the sole purpose of giving an approximate idea of the Products but they shall not form part of the Agreement or have any contractual force.
   3. If the Hardware Products contain embedded software, Infinite Acres hereby grants a limited, perpetual, non-exclusive, royalty free license to use the embedded software for the sole purpose of the normal use of the Products.
   4. If Infinite Acres provides Client with Software Products, such Products are deemed licensed and not sold, and Client’s right to use these products shall be limited to a non-exclusive, non- transferable right to use the Software Product during the term of the Agreement for its internal business purposes and for the intended purpose only. In addition, Client right to use the Software Product shall be subject to the express usage parameters and other restrictionsset forth in the Agreement. Where applicable, specific license terms shall apply to Software Products, which terms will be included with the software or in the user registration process.
   5. Client shall not modify, adapt, alter, translate, or create derivative works from the Software Product, merge the Software Product with any other software or distribute, sublicense, lease, rent, loan, or otherwise transfer the Software Product to any third party.
   6. Client shall not reverse-engineer, decompile, disassemble, or otherwise attempt to derive the source code for the software in the Products, except if and to the extent that that the laws applicable in the jurisdiction of Client, regardless of a contractual prohibition to the contrary, give Client the right to do so in order to obtain information necessary to render the software interoperable with other software. In such case, however, Client must first request such information from Infinite Acres and Infinite Acres may, in its discretion, either provide such information to Client or allow Client access to the source code for the sole purpose of obtaining such information, subject to reasonable conditions, including a reasonable fee, on such use of the source code to ensure that Infinite Acres’s and its suppliers’ proprietary rights therein are protected.
   7. The Software Products may only be used in combination with the equipment, software and systems specified in the Agreement.
   8. Infinite Acres shall have no obligation to install, assembly, maintain or support the Products, unless the Parties agree otherwise in a separate agreement.

Article 4 – Services

1. 1. Infinite Acres shall provide the Services in a professional and adequate manner and shall use commercially reasonable efforts to provide the Services in accordance with the Agreement.
   2. Client will provide all assistance necessary to facilitate Infinite Acres’ performance of the Services, including prompt responses to Infinite Acres’ questions, prompt delivery of any items reasonably required to be furnished by Client, access to the premises and appropriate equipment, suitable working space, and reasonable access to Client’s network and software environment (if applicable).
   3. Infinite Acres will exclusively own any and all rights, title, and interest (including intellectual property rights) in and to any data generated and/or collected by Infinite Acres in performing the Services.

Article 5 – Delivery, Risk and Title

1. 1. Infinite Acres shall use commercially reasonable efforts to meet the agreed delivery or performance date. If Infinite Acres is, or is likely to be, unable to meet the delivery or performance date, Infinite Acres will promptly give Client written notice of the relevant circumstances together with a date upon which Infinite Acres reasonably expects to be able to deliver the Products or to perform the Services. Infinite Acres shall not be liable in any way for any loss or damage sustained by Client as a result of Infinite Acres’ failure to make delivery ofthe Products or performance of the Services on or before the agreed delivery date, nor will such failure constitute a breach of the Agreement.
   2. Delivery of Hardware Products is subject to the Incoterms of the International Chamber of Commerce which are in force at the relevant delivery date. Unless a specific other Incoterm and destination is agreed, Infinite Acres will deliver the Products within the Netherlands CARRIAGE PAID TO (CPT) named place of destination (as set out in the Agreement) and outside the Netherlands EX WORKS (EXW) De Lier.
   3. Infinite Acres will deliver the Software Product to Client by the delivery date specified in the Agreement in accordance with the delivery method set forth therein. The Software Product will be deemed irrevocably accepted upon delivery, unless the Agreement specifies that acceptance shall take place in accordance with a mutually agreed acceptance procedure.
   4. Title to Hardware Products shall pass to Client only after full payment of all amounts which Infinite Acres is entitled to claim from Client for the Products and Services delivered to Client pursuant to this Agreement as well as all amounts that Client is due to Infinite Acres for being in default of observing any payment term or any other term in the Agreement.
   5. Hardware Products delivered by Infinite Acres under retention of title may only be resold by Client within the scope of its normal business activities. Client is obliged to ensure that the Hardware Products remain or are rendered identifiable. Should Client be in default or should there be good reason to suspect that Client may default on any of its obligations, Infinite Acres will be entitled to remove the Hardware Products belonging to it from Client’s possession or from the possession of a third party holding the Products on behalf of Client, at Client’s expense.
   6. Client undertakes to insure and keep insured against loss, damage and theft all the Hardware Products delivered under retention of title and to make the insurance policy available for inspection by Infinite Acres on request.

Article 6 – On call deliveries

If it has been agreed that deliveries will occur on call and no on-call periods have been specified, Infinite Acres will be entitled – if no on-call deliveries have occurred three (3) months after the Effective Date – to request Client in writing, within eight (8) calendar days after the request was sent, to specify a period during which on-call deliveries will still occur. This period, calculated from the day of the request, may not exceed three (3) months or a shorter duration specified within the bounds of reason by Infinite Acres. After this period has lapsed and six (6) months after the Effective Date, Client will be in default without any warning and will have to bear storage and insurance costs.

Article 7 – Support during construction, installation and assembly

1. 1. If the Agreement includes installation or assembly activities, Client will ensure all facilities that will be installed by third parties and activities that will be carried out are available and installed and performed in such a way that the activities of Infinite Acres will not be delayed, impeded or affected as a result.
   2. Client will ensure that all information and documentation required for the execution of activities are made available to Infinite Acres on time and that all requisite permits are obtained on time.
   3. Client will ensure that Infinite Acres, upon arrival, will, as agreed, be able to commence its activities immediately and continue to do so without any interruption, and that all necessary safety and other precautionary measures have been taken and are enforced. Client will ensure at its own expense that all required auxiliary workers, auxiliary equipment, water, energy, heating and lighting are provided on time.
   4. Non-compliance with the obligations stipulated in the preceding paragraphs will entitle Infinite Acres to charge any costs arising in this regard to Client. In that case, Infinite Acres can no longer be bound to any applicable delivery dates and such delivery dates will be extended at least by the period that Infinite Acres was unable to work.

Article 8 – Price and payment

1. 1. Client shall pay Infinite Acres the Purchase Price and Service Fee, or if no Purchase Price or Service Fee is specified in the Agreement, Infinite Acres’ list prices valid at the time of shipment of the Products or performance of the Services.
   2. Purchase Prices and Service Fees are stated in Euro’s and are exclusive of VAT, other sales taxes and incidental costs and expenses.
   3. Any estimates of fees set forth in the Agreement are provided for general planning purposes only, and the actual fees due will be calculated based on the actual time and materials expended in performance of the Services.
   4. Unless other payment terms are specified in the Agreement, Client will pay all invoiced amounts within thirty (30) days after the date of invoice. If Client fails to make a timely payment under the Agreement:
      1. the Client shall be in breach of the Agreement, without any notice of default being required and all of Infinite Acres’s claims against Client shall become immediately due and payable;
      2. Client shall be obliged to pay the statutory interest rate for commercial debts on the outstanding amount and all judicial and extra-judicial costs incurred by Infinite Acres relating to the recovery and collection of any overdue amount;
      3. Infinite Acres reserves the right to suspend the delivery of the Products or the performance of the Services until all outstanding amounts (including interest and costs) are settled; and
      4. the costs of suspending and reactivating shall be borne by Client.
   5. All payments to be made by Client must be effected without set-off, withholding or suspension.

Article 9 – Additional Work

1. 1. If, at the request or with consent of Client, Infinite Acres has supplied additional Products or performed additional Services outside the scope of the Agreement, Client shall pay for these additional Products or Services in accordance with the agreed rates or, if no rates have been agreed between the Parties, in accordance with Infinite Acres’s list prices. Infinite Acres is not obliged to honour such a request and may require that the Parties enter into a separate agreement for these additional Products or Services.
   2. If Client requests for additional Products or Services, Infinite Acres shall inform Client at its request about the financial and operational implications for the performance of the Agreement. A request for additional Products or Services shall not constitute a reason for Client to terminate the Agreement.

Article 10 – Warranty

1. 1. Infinite Acres warrants that:
      1. during the Warranty Period the Hardware Products are free from substantive defects in workmanship and materials;
      2. during the Warranty Period, the Software Products will operate substantially as described in the Specifications; and that
      3. the Services will be performed with at least the same degree of skill and competence normally practiced by consultants performing the same or similar services.
   2. The Warranty Period for Hardware Products is twenty-four (24) months from the date of shipment and for Software Products ninety (90) days from delivery, unless set out otherwise in the Agreement. Shorter Warranty Periods apply to Products and components that are subject to wear and tear or those having a limited service life. The Warranty Period of such Products and components are as indicated by Infinite Acres on its price list. In any event, the Warranty Period of such Products of components shall never be longer than the expected service life.
   3. During the Warranty Period, Infinite Acres shall (i), at its option, either credit (in whole or in part) the Purchase Price of the defective Hardware Products, or repair or replace the defective (components of the) Hardware Products; or (ii) use commercially reasonable efforts to correct any reproducible nonconformity in the Software Products or, if Infinite Acres is unable to correct such nonconformity, Infinite Acres refund to Client the fees actually paid by Client to Infinite Acres for the affected Software Products, in which case Client’s right to use such Software Products will terminate. Infinite Acres shall re-perform, in a conforming manner, any nonconforming Services that are reported to Infinite Acres by Client in writing within sixty (60) days after the date of completion of such Services.
   4. The Warranties are in lieu of all other warranties, express or implied, including, but not limited to any statutory warranties, any implied warranties or warranties pertaining to merchantability or fitness for a particular purpose of the Products, which are hereby specifically disclaimed. The remedies set out in article 10.3 shall be Client’s sole and exclusiveremedy, and Infinite Acres’s sole liability, for claims based on breach of warranty or otherwise in relation to the nonconformity of the Products of Services.
   5. Client shall inspect the Products upon receipt for visual and fairly apparent defects and, within ten (10) business days after delivery, give written notice to Infinite Acres of any remedy claim under the Warranty based on such defects. Such notice shall include a specification of the basis of the claim in detail. Failing which Client shall be deemed to have lost its right to claim any remedy under the Warranty based on such visual and fairly apparent defects. Furthermore, pertaining to other defects, Client can no longer claim any remedy under the Warranty if Client has not notified Infinite Acres of such claim within ten (10) business days after it discovered the defect or reasonably should have discovered it, including a specification of the basis of such claim in detail.
   6. If Infinite Acres replaces (components of) the Products in order to fulfil its Warranty obligations, the replaced (components of) such Products will become the property of Infinite Acres. Client shall, promptly upon request by Infinite Acres, return the replaced (components of) such Products to Infinite Acres in their original packaging.
   7. The Warranty obligation will lapse if the defects are completely or partly the result of:
      1. improper, negligent or injudicious use, external causes such as fire or water damage, or
      2. if Client makes modifications or allows modifications to be made to the Products without Infinite Acres’ prior consent.

Article 11 – Liability

1. 1. Without prejudice to article 11.3, in no event, whether in contract, tort (including in either case negligence), misrepresentation (other than fraudulent misrepresentation), breach of statutory duty or otherwise, Infinite Acres shall be liable for any loss of profits, anticipated savings, revenue, business, loss or corruption of data, loss of use, loss of goodwill, loss due to delay or any indirect or consequential loss or damage whatsoever.
   2. Without prejudice to articles 11.1 and 11.3, Infinite Acres’ aggregate liability (including in relation to ‘ongedaanmakingsverbintenissen‘), whether in contract, tort (including in either case negligence), misrepresentation (other than fraudulent misrepresentation), breach of statutory duty or otherwise, shall be limited to: (i) the amount paid by Client to Infinite Acres (excluding VAT) for the Products or Services in respect of which such liability arises; or (ii) in relation to continuing performance contracts, the net price paid by Client in the three (3) months preceding the date first giving rise to liability.
   3. Nothing in the Agreement shall be deemed to exclude or limit Infinite Acres’s liability:
      1. in respect of loss or damage caused by wilful intent or intentional recklessness of Infinite Acres or Infinite Acres’ senior management;
      2. in respect of injuries to or death of any person, caused by Infinite Acres or InfiniteAcres’ officers, employees, agents or contractors; or
      3. in a manner that would be unenforceable or void as against mandatory applicable law.
   4. Any claim for loss or damages must be notified to Infinite Acres within three (3) months as from the date on which the damage was caused, failing which such claim is deemed to be waived.
   5. Infinite Acres shall not be liable for, and Client will indemnify Infinite Acres against claims from third parties that arise from or are in any way related to any information or advice provided by Infinite Acres to Client or its customers.
   6. Client will indemnify Infinite Acres against claims from third parties, including product liability claims as a result of a shortcoming in a product or system that Client has supplied to a third party and that (in part) comprised Products or is supplied by Infinite Acres, other than to the extent that Client proves that the damage has been caused by the aforementioned Products.

Article 12– Term and Termination

1. 1. Continuing performance contracts shall commence on the Effective Date and shall expire after the Initial Term. Following the Initial Term, the Agreement shall automatically renew for consecutive additional periods of one (1) year each (or such a period as Parties agree in writing), unless either Party gives the other Party written notice of its intention not to renew at least three (3) months prior to the date on which the Agreement would otherwise renew.
   2. Each Party may, without prejudice to any of its other rights arising hereunder, upon giving written notice to the other Party, terminate (‘ontbinden‘) the Agreement with immediate effect, if:
      1. the other Party commits a material breach of the Agreement, which breach, if capable of being remedied, is not cured within thirty (30) calendar days after written notice of the breach;
      2. the other Party has been granted provisional suspension of payment or is declared bankrupt or a resolution is passed or a petition is presented for the winding-up of the other party, such Party has called a meeting of or has entered into or has proposed to enter into an arrangement, scheme of composition with creditors; or
      3. a situation of force majeure has lasted for more than sixty (60) calendar days.

Article 13 – Intellectual Property

1. 1. Subject to the limited rights expressly granted in article 3, Infinite Acres and or its licensors reserve all rights, title and interest in and to the Products, including all related intellectual property rights. No rights are granted to Client hereunder, other than as expressly set forth herein.
   2. All changes, modifications or improvements made or developed with regard to the Products, whether or not made or developed at Client’s request, will be and remain the property of Infinite Acres.
   3. Infinite Acres will exclusively own any and all rights, title, and interest (including intellectual property rights) in and to any materials, documentation, software, websites or information resulting from the performance of the Services or developed for or made available to Client under or in relation to the Agreement.
   4. Infinite Acres will defend Client from any third-party claim, suit, or proceeding alleging that any Product, unmodified and as originally delivered by Infinite Acres, when used as permitted under this Agreement infringes any intellectual property rights (a “Claim”), and will pay all settlement amounts agreed to by the litigants or damages finally awarded by a court of competent jurisdiction. If Infinite Acres reasonably believes that any element of the Products is about to become the subject of a Claim, Infinite Acres may, at its option, (a) obtain a license to permit Client to use such Product in accordance with this Agreement; (b) modify such Product in a manner such that it is no longer infringing; or, if neither of the foregoing options is commercially feasible, (c) recover the Product in exchange for a refund of the Purchase Price (less a prorated deduction to reflect past beneficial use).
   5. In order for Infinite Acres to indemnify Client under article 13.4, Client must promptly notify Infinite Acres in writing of any Claim, tender control of the defence and settlement of such Claim to Infinite Acres and reasonably cooperate with Infinite Acres in such defence.

Article 14 – Confidentiality

1. 1. The receiving Party of Confidential Information shall use the same degree of care that it uses to protect the confidentiality of its own confidential information of like kind (but in no event less than reasonable care) and agrees:
      1. not to use any Confidential Information of the disclosing Party for any purpose outside the scope of the Agreement, and
      2. except as otherwise authorized by the disclosing Party in writing, to limit access to Confidential Information of the disclosing Party to those of its employees, affiliates, contractors and agents who need such access for purposes consistent with the Agreement and who have signed confidentiality agreements with the receiving Party containing protections no less stringent than those herein.
   2. The receiving Party may disclose Confidential Information of the disclosing Party if it is required by law or regulations to do so, provided the receiving Party gives the disclosing Party prior notice of such disclosure (to the extent legally permitted) and reasonable assistance, at the disclosing Party’s cost, if the disclosing Party wishes to contest the disclosure.
   3. If the Agreement expires or is terminated, the receiving Party shall promptly return or destroy all Confidential Information of the disclosing Party, provided however, that Recipient shall only be required to use commercially reasonable efforts to return or destroy any Confidential Information stored electronically, and neither Recipient nor its Representatives shall berequired to return of destroy any electronic copy of Confidential Information created pursuant to its or its Representatives’ standard electronic backup and archival procedures. If a Party believes that the return or destruction of all Confidential Information is not feasible, or if a Party is required by applicable law or accounting rules to retain a record copy of any Confidential Information for some period of time, such Party may retain a copy of the Confidential Information, which is to be maintained subject to the protections of this Agreement.
   4. The terms and conditions of the Agreement are confidential and may not be disclosed by either Party without the prior consent of the other Party.

Article 15 – Data Protection

1. 1. Client warrants that it has informed the persons whose data may be processed by Infinite Acres in the performance of the Services (“Data Subjects“) and that it holds the written consent from these Data Subjects insofar required by law. Client shall present the relevant consent to Infinite Acres on request.
   2. Insofar Infinite Acres processes personal data on behalf of Client and qualifies as a processor under the implementing legislation of EU Directive 95/46/EC or the EU General Data Protection Regulation, the processing of such personal data will be governed by the Data Processing Agreement in Annex 1.

Article 16 – Export Controls

1. 1. Client will ensure that all actions taken by Client in furtherance of fulfilment of this Agreement are in compliance with any applicable export control and/or import laws and regulations, including the EU export control legislation as well as the Export Administration Regulations (“EAR”) maintained by the United States Department of Commerce.
   2. Client shall comply with any applicable embargoes and trade sanction regimes, including those imposed and enforced by the United Nations, U.S., EU or any competent third country. Client will not, directly or indirectly, (re-)sell, deliver, supply, transfer, export or re-export Products or Services to (i) any sanctioned party listed and subject to the applicable sanction regimes or

(ii) any third party (beneficially) owned or controlled, directly or indirectly, by or, acting on behalf, of any such sanctioned party or (iii) any third party engaged, directly or indirectly, in activities where the Products or Services are or may be intended in their entirety or in part for proliferation of weapons of mass destruction or of their means of delivery.

Article 17 – Miscellaneous

1. 1. The Agreement constitutes the entire agreement between the Parties and supersedes any previous arrangement, understanding or agreement between them relating to the subject matter hereof.
   2. Neither Party may assign, transfer or dispose of any of its rights under the Agreement, either in whole or in part, without the prior written consent of the other Party. However, InfiniteAcres may assign the Agreement in its entirety to a successor in interest upon its merger, consolidation, acquisition, or sale or other transfer of all or substantially all of its business or assets without the prior written consent of Client.
   3. The invalidity or unenforceability of any provision of the Agreement shall not affect the validity or enforceability of the remainder of the Agreement and the Parties shall use all reasonable endeavours to agree within a reasonable time upon any lawful and reasonable variations to the Agreement which may be necessary in order to achieve, to the greatest extent possible, the same effect as would have been achieved by the invalid or unenforceable provision.
   4. No amendment to the Agreement is valid or binding, unless made in writing. However, Infinite Acres is entitled to amend these General Terms and Conditions, which amendment shall apply to the Agreement with effect of the date that such amendment is published on the website of Infinite Acres.
   5. A person who is not a party to the Agreement shall not have any rights under or in connection with it.
   6. Client shall not be an agent or a distributor of Infinite Acres, unless it is appointed pursuant to a separate agreement.
   7. This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of the Netherlands. All disputes arising in connection with the present agreement, or further agreements resulting therefrom, shall be settled in accordance with the Arbitration Rules of the Netherlands Arbitration Institute. The place of arbitration shall be The Hague, the Netherlands. The proceedings shall be conducted in the English language.

***

ANNEX 1 – DATA PROCESSING AGREEMENT

In this data processor agreement, (1) Client (is referred to as the “Controller” and (2) Infinite Acres is referred to as the “Processor”. Controller and Processor are jointly referred to as the “Parties”. Unless stated otherwise, the definitions set out in the General Terms and Conditions for the Sale of Infinite Acres Products and Services apply to this Annex 1.

BACKGROUND

(A) The Parties executed the Agreement and, in the course of exercising its obligations under the Agreement, the Processor may process certain personal data as a processor for or on behalf of the Controller, which the Parties wish to further address via the data processing agreement in this Annex 1 (the “DPA”).

THE PARTIES HEREBY AGREE AS FOLLOWS:

1. DEFINITIONS AND INTERPRETATION

   1. In this DPA the following words and phrases shall have the following meanings, unless as otherwise specified:”Data Subject” shall mean an identifiable person whose personal data will be processed under this DPA and who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic cultural or social identity;“Privacy Legislation” shall mean the European Commission Data Protection Directive (95/46/EC) and the Directive on Privacy and Electronic Communications (2002/58/EC), any national laws implementing such Directives and/or, when applicable, the Regulation (EU) 2016/679, and any legislation or regulation amending, supplementing or any of the foregoing from time to time;“Processing” shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alternation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;“Security Incident” shall mean any breach of technical and organisational security measures leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any personal data; and

      “sub-contract” and “sub-contracting” shall mean the process by which either party arranges for a third party to carry out its obligations under this DPA, and “Sub-Contractor” shall mean the party to whom the obligations are subcontracted.

   2. In the event of any inconsistency arising between the provisions of this DPA and the Agreement, the provisions of the Agreement shall prevail.

2. PROCESSING OBLIGATIONS

   1. The Processor shall only carry out those actions in respect of the personal data Processed on behalf of the Controller as are stipulated in the Agreement, this DPA or otherwise with prior written consent from the Controller.
   2. The Controller will ensure that its instructions for the Processing of personal data are in accordance with the Privacy Legislation which applies to the Processing of personal data under the Agreement.
   3. In the course of exercising its obligations, the Processor will not transfer, and must ensure that no Sub-Contractor transfers, any personal data to any country or territory outside the European Economic Area without the prior written consent of the Controller.

3. SECURITY

   1. Processor shall take such technical and organisational security measures as are required to protect personal data Processed by the Processor on behalf of the Controller against loss or other unlawful forms of Processing. Such measures will guarantee an adequate level of security, taking into account the risks involved with the Processing and the nature of the personal data.
   2. In addition to the general obligation set out under clause 3.1, such technical and organisational security measures shall include, as a minimum standard of protection, compliance with the security measures set out below under clause 3.2, and any further instructions or policies provided by the Processor from time to time.
   3. Processor, as a minimum requirement, shall give due consideration to the following types of security measures:
      • Information Security Management Systems;
      • Physical Security;
      • Access Control;
      • Security and Privacy Enhancing Technologies;
      • Awareness, training and security checks in relation to personnel; and
      • Incident/Response Management/Business Continuity.

4. SECURITY INCIDENTS

   1. The Processor shall take technical and organisational security measures to address obligations in Privacy Legislation with respect to Security Incidents.
   2. In case of any Security Incident, the Processor will notify the Controller as soon as reasonably possible and with initial details regarding the nature, period and affected Data Subjects of the Security Incident.
   3. The Controller acknowledges that the Processor must promptly take all necessary and appropriate corrective actions to remedy any deficiencies in its technical and organisational security measures, and Controller will provide reasonable assistance to Processor upon first request.

5. CONFIDENTIALITY

   1. The Processor agrees that it shall maintain the personal data in confidence and will ensure that its personnel have agreed to appropriate confidentiality obligations.
   2. Within 30 days following termination or expiry of this DPA the Processor shall, destroy all personal data unless i) prohibited from doing so by any applicable law or ii) further arrangements have been made with the Controller regarding the personal data.
   3. This clause 5 shall be considered without prejudice to any independent confidentiality obligations agreed between the Parties.

6. DATA SUBJECTS’ RIGHTS

   The Processor will reasonably co-operate with the Controller, subject to the Controller’s prior written instructions and/or consent, to allow Data Subjects to exercise any rights they might have, including rights of access to their personal data and rights to correct, update, delete, port or block personal data and the Processing thereof.

7. SUB-CONTRACTING

   1. The Controller acknowledges and agrees that Processor may sub-contract any of its obligations under this DPA by way of a written agreement with the Sub-Contractor which provides a similar level of protection in relation to the protection of the personal data as is imposed on the Processor under this DPA.
   2. The Processor will inform the Controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. Should Controller persist in its objection, it may, as its sole and exclusive remedy for such objection, terminate the Agreement under the condition that it pays all fees and charges for the remainder of the term of the Agreement.

8. AUDIT

   1. Upon first request, the Processor shall make available to the Controller information which is reasonably necessary to demonstrate compliance with the obligations laid down in this DPA andwill – if available – provide the Controller with certificates (such as, for example, ISO certifications) issued by independent third party auditors evidencing this.
   2. The Controller has the right to audit the Processor’s compliance with this DPA, up to one time per contractual year and at the Controller’s costs, if the Controller in its reasonable discretion believes that the right under clause 8.1 is not sufficient in an individual case, or a competent data protection authority requests this. At the selection of the Controller and the approval of the Processor, such audit will be either performed by i) the Processor or ii) a qualified, independent third party security auditor (the “Auditor“). In the course of such audit, the Auditor may enter the Processor’s facilities during normal business hours and without unreasonably impacting Processor’s business, in particular with no impact on the general IT security of the Processor, and examine Processor’s work routines, set ups and technical infrastructure.
   3. The Processor may claim remuneration for its efforts when performing and/or enabling audits. The Processor will support up to one man days’ time per audit free of additional cost for the Controller.

9. TERM AND TERMINATION

   1. This DPA will continue in full force and effect until expiry or termination of the Agreement.

[/vc_column_text][/vc_column][/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” scene_position=”center” text_color=”dark” text_align=”left” overlay_strength=”0.3″ shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_position=”all” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_link_target=”_self” column_shadow=”none” column_border_radius=”none” width=”1/1″ tablet_width_inherit=”default” tablet_text_alignment=”default” phone_text_alignment=”default” overlay_strength=”0.3″ column_border_width=”none” column_border_style=”solid” bg_image_animation=”none”][divider line_type=”No Line” custom_height=”50″][/vc_column][/vc_row]