GET STARTED
  • Master Subscription Agreement
  • SLA and Conditions of Use
  • Data Processing Agreement
  • Standard Clauses
  • Technical and Org. Measures

Master Subscription Agreement

THIS MASTER SUBSCRIPTION AGREEMENT (“MSA”) IS ENTERED BETWEEN THE COMPANY STATED IN THE ORDER FORM (“LICENSEE” OR “YOU”) AS A CUSTOMER AND 7PACE GMBH, A GERMAN LIMITED LIABILITY COMPANY WITH ITS REGISTERED SEAT AT SCHLEISSHEIMER STRASSE 75, 80797 MÜNCHEN, GERMANY (“LICENSOR” OR “7PACE”), AS LICENSOR OF AND SERVICE PROVIDER FOR 7PACE’S SOFTWARE (AS DEFINED BELOW). THE TERMS AND CONDITIONS OF THIS MSA WILL BE LEGALLY BINDING ON YOU UPON THE EFFECTIVE DATE. YOU AND 7PACE MAY HEREINAFTER BE INDIVIDUALLY REFERRED TO AS A “PARTY” AND COLLECTIVELY AS THE “PARTIES”.

1. Definitions

“Accessible Code” means source code that is unprotected and accessible.

“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with a subject entity. “Control”, for purposes of this definition, means direct or indirect ownership or control of more than fifty percent (50%) of the voting interests of the subject entity, or the right to direct the affairs of a subject entity.

“Aggregated Data” means statistical information related to use of the Software for internal and customer reporting purposes, but only in an aggregated form that does not identify Licensee or Authorized Users.

“Authorized User” means a natural person who accesses and uses the Software under a User License. The Authorized User is also referred to as “Named User”.

“Client Products” means Timetracker Software installed and operated on desktop computers or mobile devices, typically used as the user experience interface to the services offered by the Software.

“Cloud Products” means Timetracker Software hosted in the cloud.

“Customer Data” means any data, information or material you provide, submit or upload to the Software.

“Data Protection Laws” shall mean with respect to the EU, the GDPR and the law of any such member state implementing the GDPR, and with respect to any other country, any applicable data protection or privacy laws.

“Embedded Software” means any third party software licensed by Licensor from a third party and embedded in the Software.

“Fees” means all fees and expenses payable by the Licensee to Licensor in acquiring the Software and, as applicable, any Maintenance or User Licenses.

“GDPR” shall mean the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) as the same may be amended or replaced from time to time.

“License Plan” describes the product the user has purchased and its scope, e.g. on how many accounts, target machines or local hosts the Software can be installed or enabled.

“Maintenance” means the provision by Licensor to Licensee, of Software updates and/or enhancements made generally available to customers from time to time, and online technical support for the sole purpose of addressing technical issues relating to the use of the Software.

“Media” means all images, icons, text files, pdfs or other static non-code assets contained within the Software.

“Microsoft Products” means the ‘Microsoft Team Foundation Server’ (or the cloud variant ‘Visual Studio Team Services’) within which the Software runs.

“On Premise Products” means Timetracker Software hosted on servers maintained by Licensee, such as downloadable applications intended to be copied to and installed on physical or virtual servers.

“Paid License” means a license for which Fees have not been waived by Licensor.

“Protected Code” means any source code that is protected against access by Licensee and any third party without Licensor’s prior written permission and is otherwise not accessible under this MSA.

“Subscription” means Licensee’s acquisition of the Software under the subscription model offered by either a Reseller or Licensor.

“Reseller” means a third party selling and distributing Licensor services, products, or both, under authorization from the Licensor.

“Software” means Licensor’s “Timetracker” branded software that accompanies this MSA, which may include computer software, Accessible Code and Protected Code, associated media, Media, printed materials, electronic documentation, Internet-based services and Embedded Software.

“User License” means a license granted under this MSA to Licensee to permit an Authorized User to use the Software. The number of User Licenses granted to Licensee is dependent on the Fees paid by Licensee.

2. Grant of License; Licensee’s Obligations, Licensor’s Remedies

Upon Licensee’s acceptance of this MSA, and subject to the availability and conditions of use set out in Annex A, Licensor grants Licensee the right to use the Software subject to the following:

2.1 Paid License (Subscription)

2.1.1 Authorized (Named) Users

The license granted is subject to the condition that Licensee must ensure the maximum number of Authorized Users accessing and using the Software is not exceeding the number of User Licenses for which the necessary Fees have been paid to Licensor or Reseller. Licensee may acquire additional User Licenses at any time on payment of the appropriate Fees to Licensor or Reseller. The Paid licenses are valid only for the temporal period of the subscription and expire upon expiry of the subscription term.

2.1.2 Cloud Products

Licensee is allowed to enable and use the Software on either a single instance (also called ‘VSTS account’, ‘Azure DevOps organization’) or multiple instances, depending on the agreed License Plan.

2.1.3 On-premise Products

2.1.3.1 Application Servers

Licensee is allowed to install the Software to as many servers providing the Microsoft Products as defined in the License Plan to ensure service availability to Authorized Users. The operation of the Software, installed on servers which are solely offering services used by Authorized Users, is covered by User Licenses without extra Fees.

2.1.3.2 Backup

Licensee is permitted to copy the Software for data protection, archiving and backup purposes only and for no other purpose. Only the minimum number of backup copies may be made.

2.2 Trial License

Licensor may in its sole discretion provide evaluation copies of the Software, which may have limited functionality, to a Licensee to assess the Software. Any such evaluation copies will be provided under a Trial License that limits the period during which the Licensee may download, install, use and operate the Software (“Trial Period”) and limits the number of temporary users. On the expiry of the Trial Period the Software will cease to function. For on-premises products, the Licensee must remove and delete all copies of the Software in its possession.

2.3 Free License

2.3.1 Free License

The Software is also available to Licensee, subject to the restrictions set out below, as a free-of-charge product (“Free License”).

2.3.2 Restrictions

Free License Software must not be used under as an On-Premise Product, and Licensee, in addition to the limitations described in sections 2.4 below, may not make any copies of the Software under a Free License, safe that such copy is not technically required for accessing a browser-based application.

2.3.3 Limitations

Free License Software may, at Licensor’s discretion, come with limitations as regards the functionality, its availability, Maintenance and/or the maximum number of User Licenses.

2.3.4 Term and Termination

A Free License is granted to Licensee for an unlimited period of time. However, Licensor, in addition to its termination rights under section 6, may terminate a Free License at any time with 30 days prior notice to Licensee. Licensee may, in addition to its termination rights under section 6, terminate a Free License at any time without observing any notice periods.

2.3.5 Floating License Model

Licensee may at any time upon acquisition of a Free License, upgrade its Free License to a Paid License in accordance with section 2.1 above. Upon acceptance of such upgrade by Licensor, Licensee shall be granted the respective rights for a Paid License, and Licensee shall have the same rights and obligations towards Licensor as set out herein regarding Paid Licenses. Licensee may also, instead of declaring termination in accordance with section 6 below, return to a Free License upon 30 days prior notice to Licensor. Upon acceptance of such downgrade by Licensor, Licensee’s rights to the Software shall be limited to a Free License again, User Licenses restricted to the then current maximum number, and functionality of the Software, Software availability and Maintenance limited to the then current state for a Free License Software, and Licensee’s rights and obligations towards Licensor shall be reduced to those set out herein regarding Free Licenses.

2.4 General License Terms

2.4.1 Scope

Each license granted by the Licensor under this MSA is worldwide, non-exclusive and non-transferable, unless otherwise specified in writing.

Licensee must not (a) decompile, reverse engineer, disassemble, modify, adapt, create derivative works from, or otherwise attempt to derive, any part of or the whole of the Software; (b) sell, sublicense, distribute, reproduce, transmit, circulate, disseminate, translate or reduce to or from any electronic medium or machine readable form any part of or the whole of the Software or any data/information not owned by Licensee; (c) make the Software available by rental, timesharing, a subscription service, hosting or outsourcing; or (d) directly or indirectly access or use any Embedded Software independently of the rest of the Software.

2.4.2 Duration

Subject to the terms of this MSA and unless terminated earlier in accordance with this MSA, the term of any license granted hereunder shall be for (a) any Cloud Product, On Premise Product or Client Product the period of time agreed for the Paid License Subscription including any renewal, or (b), for a Trial License, the Trial Period, or (c) for a Free License, the term set out in section 2.3.4.

2.4.3 Protection Mechanisms

The Software includes license protection mechanisms that are designed to manage and protect the intellectual property rights of Licensor and its third party suppliers. Licensee must not modify, alter, attempt to defeat or defeat such protection mechanisms or the use rules that the protection mechanisms are designed to enforce. Any such violation by Licensee will result in the immediate termination of this MSA and any license granted to Licensee hereunder.

2.4.4 Permitted Computers

Except as otherwise agreed in writing by Licensor, Licensee is only allowed to install the Software and make the Software available for use on hardware systems owned, leased or controlled by the Licensee.

2.4.5 Responsibility for Non-controlled Systems

If Licensor permits Licensee to install the Software or make the Software available for use on hardware systems not owned, leased or controlled by Licensee (“Non-controlled Systems”), Licensee will ensure the terms of this MSA are complied with by users of such Non-controlled Systems and Licensee will indemnify Licensor for all costs, damages and loss Licensor suffers arising from such installation or use of the Software on Non-controlled Systems.

2.4.6 Restrictions of Use

In addition to the conditions and restrictions set out herein, Licensee, when using the Software, must not (a) send or store infringing, obscene, threatening, libelous or otherwise unlawful or tortious material to any Cloud Product; (b) send or store material containing viruses, worms, Trojan horses, spam or other harmful computer code, files, scripts, agents or programs to or from the Software; (c) interfere with or disrupt the integrity or performance of any Cloud Product or the data contained in it, including but not limited to engaging in denial of service attacks; (d) attempt to gain unauthorized access to any Cloud Product or its systems or networks; or (e) use the Software in violation of any applicable law including but not limited to Data Protection Laws. Licensee must not allow or tolerate any Authorized User or other third party to commit or engage in any of the actions set out in this section 2.3.6.

2.4.7 No Concurrent Use

Authorized Users must not share individual user accounts. Authorized User accounts only allow a single Named User (as to the Named User’s personal email address) to access the Software. Concurrent use is prohibited.

2.5 Use of the Software

You will: (a) be responsible for all activity occurring under your Authorized User accounts and your Authorized Users’ compliance with this MSA; (b) use commercially reasonable efforts to prevent unauthorized access to or use of the Software or Media, and notify Licensor promptly of any such unauthorized access or use in accordance with § 5 below; (c) use the Software and Media only in accordance with the documentation, this MSA and applicable laws and government regulations; and (d) without undue delay upon detection thereof, provide Licensor with all reasonably available information about any defect, malfunction, unexpected down-time, or any other non-conformance in the Software, any Client Product or Cloud Product, or Media so that Licensor may diagnose and remedy such non-conformance.

2.6 Bring Your Own Data

You will be responsible for any Customer Data that you upload in, process on, or add to the Software, and in particular, it is your sole responsibility to ensure that your Customer Data is collected and further processed in compliance with Data Protection Laws, if applicable. Your obligations under the GDPR, if applicable, are set out in further detail in the Data Processing Agreement (Annex B).

2.7 Compliance with Laws

You are solely responsible for, and agree to comply with, all applicable laws, statutes, ordinances, and other governmental authority, however designated, with respect to the use of and access to the Software.

2.8 Cooperation Duties

You shall support Licensor during the term of the MSA to a reasonable extent. Licensor shall not be liable for a failure to provide the Software or any service in accordance with this MSA to the extent that such failure is based on your failure to provide the cooperation or assistance pursuant to this section 2.7. Furthermore, in such event, the Parties shall (a) jointly agree on a revision of the originally agreed dates for the performance of any service, if any, and (b) you shall reimburse Licensor for the costs reasonably incurred due to your failure to provide the required cooperation or assistance. However, this shall not apply to the extent that Licensor failed to take the mitigation actions described hereinafter. If you fail to provide the cooperation or assistance pursuant to this section 2.7, Licensor shall (a) advise you of the required cooperation in advance, (b) notify you about your failure to provide the respective cooperation or assistance, and (c) use commercially reasonable endeavors to avoid or mitigate the impact of such omission by you on the provision of the Software or service.

2.9 Contacts

You will designate a contact person for the performance of this MSA, both for commercial and technical questions. You shall have the right to change any contact person only upon prior written notice to Licensor.

2.10 Suspension for Ongoing Harm

Licensor may with notice to Licensee suspend Licensee or any of Licensee’s Authorized Users’ access to the Software if Licensor reasonably concludes that Licensee’s instance of the Software or any specific Authorized User account is being used to engage in denial of service attacks, spamming, misappropriation of third party rights or illegal activity, and/or that use of Licensee’s instance of the Software or any specific Authorized User account is causing immediate, material and ongoing harm to Licensor or others. In the extraordinary event that Licensor suspends any such access to the Software, Licensor will use commercially reasonable efforts to limit the suspension to the offending portion or Authorized User account(s) of the Software and work with Licensee to resolve the issues causing such suspension, and, as appropriate in light of the circumstances, promptly provide the suspended Authorized User with a new Authorized User account to access the Software. Licensee agrees that Licensor shall not be liable for any suspension of the Software under the circumstances described in this section.

3. Fees

3.1 Payment Obligations

Licensor charges and collects payment in advance for use of the Software in accordance with the terms of the applicable Order Form. Licensee must pay all Fees by the due date and in the manner directed in the applicable Order Form.

3.2 Payment Term

All payments to Licensor shall be made in US Dollars within 30 days of receipt of invoice.

3.3 Adjustment of Fees

Unless otherwise set forth in an applicable Order Form, Licensor may adjust fees as appropriate on an annual basis. Adjustments shall be made to reflect changes in cost incurred for salaries and wages as well as purchasing IT services. However, adjustments may be considered initially as of the beginning of the renewal term and take effect from the date specified by Licensor, nonetheless no sooner than one month after your receipt of notification of the fee adjustment. If a fee is increased by more than 5% Licensee is entitled to terminate this MSA and any User License granted hereunder with effect from the entry into force of the increase. The termination must be made in writing promptly, but in no event later than 30 days upon receipt of notification of the increase.

3.4 Billing Information

You agree to provide Licensor with complete and accurate billing and contact information including (a) your legal company name, street address, (b) e-mail, name and telephone number of an authorized billing contact and Administrator(s), (c) your VAT and company registration codes, if any, (regardless of whether VAT is not applicable due to reverse-charge procedure), and (d) any purchase order or other numbers or references Licensor should state in its invoices. You agree to update this information within 30 days of any change to it. If you fail to provide or timely update any of the foregoing information, Licensor shall be entitled to use for any invoice the latest information provided by you; in such event, you have no claim whatsoever to dispute the invoice or delay payment of the invoice on the ground of missing or incorrect billing and/or contact information. All fees are billed in US Dollars unless otherwise specified in the applicable Order Form.

3.5 Late Payment and Suspension

Delinquent invoices are subject to the statutory interest rates on any outstanding balance and reimbursement of expenses incurred by the Licensor. If a payment is not disputed in good faith (and in addition to its other rights), Licensor reserves the right to terminate this MSA and any User License granted hereunder or suspend your access to the Software if any delinquent payment is not received by Licensor within thirty (30) days after notice to you of such delinquency. Notwithstanding the afore-said, Licensor, in such event, shall be entitled to make dependent pending deliveries of an advance payment and to withhold granting of further Authorized Users the rights of use to the Software.

3.6 Taxes; Fees

Licensor’s fees do neither include any taxes, levies, duties or similar governmental assessments of any nature, including, for example, value-added, sales, use or withholding taxes, assessable by any jurisdiction based on amounts paid or payable under this MSA (collectively, “Taxes”), nor include any fees imposed by banks, payment service providers or other parties involved in a payment procedure, including, for example, fees for cross-border transfer of money (collectively, “Payment Fees”). You are responsible for paying all Taxes associated with your use of the Software as well as all Payment Fees in connection with your payment of Licensor’s invoices. If Licensor has the legal obligation to pay or collect Taxes for which you are responsible under this section, Licensor will invoice you and you will pay that amount unless you provide Licensor with a valid tax exemption certificate authorized by the appropriate taxing authority. For the sake of clarity, Licensor is solely responsible for taxes assessable against Licensor based on its net income, property and employees.

3.7 Set-off

You may not set off any amount against invoices of Licensor unless Licensor has acknowledged in writing to owe you such an amount, or it has been held in an uncontested court decision that Licensor owes you such amount.

4. Maintenance

4.1 Supplemental Software and Services

This MSA applies to updates, supplements, add-on components, or Internet-based services components, of the Software that Licensor may provide to Licensee or make available to Licensee after the date Licensee obtains its initial copy of the Software (“Supplemental Software”), unless Licensor provides additional terms with any Supplemental Software.

4.2 Support Services

In addition to any support services Licensor, at its discretion, may offer to Licensee without any charges (e.g. help Licensee set up his on-premise instance, help building reports and help in using Licensor’s APIs for automated data exports), Licensor may offer further support services, and such services may be subject to the payment of additional Fees.

5. Breach by Licensee

5.1 General

If Licensee discovers that it has breached any of its obligations under this MSA, then Licensee must immediately report such breach to Licensor, in writing as required in section 20.

5.2 Breach of Additional Licenses

Where a breach involves the distribution or use of Software outside of the terms of the User License or any additional User License (including but not limited to the use and distribution of Embedded Software), Licensor, any third party owner of Embedded Software, or both are entitled (without prejudice to any other right or claim that Licensor or any third party owner of Embedded Software may have against Licensee) to charge Licensee, in addition to any other Fees payable by Licensee under this MSA, a fee calculated based on the number of prohibited distributions or uses multiplied by the respective list prices that Licensor and/or any third party owner of Embedded Software charges for the Software or Embedded Software respectively.

6. Term and Termination

6.1 Subscription Term

Concerning your use of the Software, this MSA commences on the date stated in the Order Form and will continue for the initial period set forth in the initial Order Form and all renewal terms.

6.2 Renewal Terms

At the expiry date this MSA will be automatically renewed for a 12 months renewal term unless Licensee terminates this MSA by means of 30 days written notice. The fees for any renewal term will be based on the contracted price excluding any given discount.

6.3 Termination for Cause

Either Party may terminate this MSA for cause: (a) upon at least 30 days’ written notice to the other Party of a material breach if such breach remains uncured at the expiration of such period; or (b) if the other Party (i) suspends, or threatens to suspend, payment of its debts or is unable to pay its debts as they fall due or admits inability to pay its debts or (being a company) is deemed unable to pay its debts; (ii) commences negotiations with all or any class of its creditors with a view to rescheduling any of its debts, or makes a proposal for or enters into any compromise or arrangement with its creditors; (iii) a petition is filed, a notice is given, a resolution is passed, or an order is made, for or in connection with the winding up of that other Party (being a company) other than for the sole purpose of a scheme for a solvent amalgamation of that other Party with one or more other companies or the solvent reconstruction of that other Party; (iv) an application is made to court, or an order is made, for the appointment of an administrator, or if a notice of intention to appoint an administrator is given or if an administrator is appointed, over that other Party (being a company); (v) the holder of a qualifying floating charge over the assets of that other Party (being a company) has become entitled to appoint or has appointed an administrative receiver; (vi) a person becomes entitled to appoint a receiver over the assets of that other Party or a receiver is appointed over the assets of that other Party; (vii) a creditor or encumbrancer of that other Party attaches or that other Party takes possession of, or a distress, execution, sequestration or other such process is levied or enforced on or sued against, the whole or any part of that other Party’s assets and such attachment or process is not discharged within 14 days; or (viii) that other Party suspends or ceases, or threatens to suspend or cease, carrying on all or a substantial part of its business.

6.4 Refund or Payment on Termination

If you terminate this MSA for cause, Licensor will issue you a prorated refund for payment previously received by Licensor corresponding to any period after the effective date of such termination. If the Licensor terminates this MSA for cause, you will pay any unpaid Fees covering the remainder of the then current term. In no event will any termination relieve you of the obligation to pay any Fees payable to Licensor for the period prior to the effective date of termination.

6.5 Handling of Customer Data upon Termination

If this MSA is terminated, Licensor will make available to you a file of the Customer Data within 30 days of termination if you so request at the time of termination. You agree and acknowledge that Licensor has no right or obligation to retain Customer Data more than 30 days after termination or expiration of this MSA and will destroy Customer Data in its possession or control 30 days after termination or expiration of this MSA, unless where Licensee or Licensor is aware of a statutory obligation that requires Licensor to retain some of the Customer Data.

6.6 No Access Upon Termination

Immediately upon termination of a User License granted under this MSA, or upon termination of this MSA in its entirety, Licensee must at its own cost cease permitting access to and procure that all Authorized Users affected by such termination immediately cease all use of the Software.

6.7 Termination of Non-paid Licenses

Unless agreed to the contrary between the Parties, and notwithstanding section 2.2 and 2.3 above, there shall be no restriction whatsoever for either Party to terminate a User License, if Licensor has waived its right to charge any Fees for such User License.

6.8 Survival

Sections 2.1.3.2, 3.5, 3.6, 3.7, 5, 6.4, 6.5, 6.6, 6.8, 7, 8, 9, 10.1, 11, 12, 13, 14, 15, 16, 17, 18, 19, and 20 shall survive any termination of this MSA.

7. Indemnification

7.1 Indemnification by Licensor

If the Software becomes, or in the opinion of Licensor may become, the subject of a claim of infringement of any third party’s intellectual property rights, Licensor may, at its option and in its discretion: (a) procure for Licensee the right to use the Software free of any liability; (b) replace or modify the Software to make it non-infringing; or (c) refund any license Fees related to this Software paid by Licensee. The foregoing states the sole liability of Licensor and the exclusive remedy of Licensee for any infringement of intellectual property rights by the Software or any other items provided by Licensor under this MSA. Licensor will indemnify and hold harmless Licensee against all costs, expenses, losses and claims made against Licensee as a result of any infringement of a third party’s intellectual property rights arising from the Licensee’s or its Authorized Users use of the Software. Licensee must notify promptly Licensor of the charge of infringement or of the legal proceeding, give Licensor sole control of the defense and related settlement negotiations, and Licensee must provide Licensor, at Licensor’s expense, with reasonable assistance and information, but no cost or expense shall be incurred for the account of Licensee without its prior written consent.

7.2 Indemnification by Licensee

Licensee will indemnify and hold harmless Licensor and its Affiliates, officers, directors, employees, attorneys and agents against all costs, expenses, losses and claims made against Licensor as a result of any infringement of a third party’s intellectual property rights or a violation of laws and/or regulations, including, but not limited to, Data Protection Laws or laws related to export controls arising from the Licensee’s or its Authorized User’s unauthorized use of the Software under this MSA. However, in such an event, Licensor reserves the right to suspend your access to the Software, if and inasmuch it is required to safeguard its own or the legitimate interests of other customers. The rights and remedies granted to Licensor under this section 7.2 shall only apply if you acted at least negligently and subject to the following: Licensor must notify promptly Licensee of the charge of infringement or of the legal proceeding, give Licensee sole control of the defense and related settlement negotiations, and Licensor must provide Licensee, at Licensee’s expense, with reasonable assistance and information, but no cost or expense shall be incurred for the account of Licensor without its prior written consent

8 Limitation of Liability

8.1 Limitations

Licensor shall not be liable to Licensee where faults arise from: (a) the possession, use, development, modification or maintenance of the Software (or any part thereof) by Licensee other than in accordance with this MSA, if the infringement would have been otherwise avoided; (b) misuse, incorrect use of or damage to the Software from whatever cause (other than any act or omission by); (c) any breach of Licensee’s obligations under this MSA; (d) any modification not authorized by Licensor resulting in a departure from this MSA; or (e) any operator error on the part of Licensee.

8.2 Limitation of Damages

Notwithstanding anything to the contrary in this MSA and except for liabilities arising from (a) the indemnity obligations under § 6 (indemnity), (b) the gross negligence or willful misconduct of a Party, (c) the German Product Liability Act (“Produkthaftungsgesetz” (ProdHaftG)), (d) injury to life, limb or health, or (e) the breach of a Party’s obligations under section 13 (IP), in no event shall (a) Licensor or its third party suppliers be liable with respect to any subject matter of this MSA under any contract; tort including negligence or strict liability; indemnity or other legal, contractual or equitable theory for any indirect, special, punitive, incidental or consequential damages, however caused and whether or not advised in advance of the possibility of such damages; damages for lost profits or lost data; or cost of procurement of substitute goods, technology or services; or (b) Licensor’s aggregate liability arising under, with respect to, or in connection with this MSA exceed the typically foreseeable damage.

8.3 No Liability Without Fault.

Any liability without fault for defects that already existed on the effective date (§ 536a para. 1 Alt. 1 German Civil Code (“Bürgerliches Gesetzbuch” (BGB)) shall be excluded, unless such defect relates to an expressly guaranteed feature or specification, or Licensor has maliciously concealed the defect.

9. Representations and Warranties

9.1 Mutual Representations and Warranties.

Each Party represents and warrants that: (a) it has the power to enter into and perform this MSA, (b) this MSA’s execution has been duly authorized by all necessary corporate action of the Party, (c) this MSA constitutes a valid and binding obligation on it, enforceable in accordance with its terms, (d) neither it nor its employees or agents has or have offered or will offer any illegal bribe, kickback, payment, gift, or thing of value in connection with this MSA, and (e) that it is not named on any U.S. government denied-party list.

9.2 Force Majeure.

Neither Party will be liable to the other for any delay or inability to perform its obligations or otherwise if such delay or inability arises from fire, natural disaster, pandemics, act of government, riot, civil disturbance, or any other cause beyond the reasonable control of such Party (“Force Majeure Event”). In such a Force Majeure Event, the time for performance will be extended for a period of time equal to the length of the delay or inability to perform. Either Party may terminate this MSA if the Force Majeure Event continues for more than eight (8) weeks.

9.3 Licensor’s Warranties.

Licensor warrants that, when used in accordance with the documentation, the Software will perform substantially in accordance with the documentation. In the event of defects or malfunctions attributable to Licensor, Licensor may, at Licensor’s option: (a) in the case of the Software repair or replace the Software; a delivery of updates or upgrades which do not contain the defect or of a patch which remedies the defect shall also be deemed subsequent performance; and (b) in the case of Maintenance resupply the Maintenance . If subsequent performance fails, Licensee may, at its discretion, reduce the price or, unless the defect only insignificantly impairs the contractual use of the Software or Maintenance, terminate this MSA for cause and claim a refund payment. Subsequent performance, however, shall only be deemed to have failed if you have given Licensor sufficient opportunity to remedy the defect within a reasonable period of time without the due success having been achieved. The provision of a provisional solution that circumvents the defect (“workaround”) shall be taken into account when determining the time limit.

9.4 Limitations of Warranties.

You acknowledge that Licensor does not control the transfer of data over communications facilities, including the Internet, and that the Software, used by means of a Cloud Product, may be subject to limitations, delays, and other problems inherent in the use of such communications facilities. In addition, Licensor shall not be liable if the use of the Software is impaired due to improper installation, operation or maintenance by you or a third-party on your behalf. In particular, any warranty shall be excluded for impairments caused by the fact that the Software is used under conditions that do not correspond to the hardware and software environment specified in the documentation.

10. Improving Licensor’s Products

10.1 Creation and Use of Aggregated Data.

Licensor is always striving to improve its products. In order to do so, Licensor needs to collect information about its users and to measure, analyze, and aggregate how its users interact with its products, such as usage patterns and characteristics of our user base. Licensor collects such information and uses the information as Aggregated Data as per its Privacy Policy.

10.2 Retirement of the Software.

The Software and the required Software environment are subject to technical progress and technological development, Licensor is, thus, permitted not only to provide Licensee with Supplemental Software in accordance with the terms of this MSA, but Licensor may, at its discretion while thoroughly taking into consideration the interest of Licensee, also decide to retire all or part of the Software upon providing Licensee with at least 90 days written notice (“Software Retirement Notification”). In such Software Retirement Notification, Licensor may, at its sole discretion, either offer to Licensee a new software designed to replace the retired Software, or terminate this MSA. Licensee, however, upon receipt of a Software Retirement Notification, may execute its ordinary termination rights as set out in this MSA.

11. Assignment

11.1 Licensee’s Assignment.

Licensee may assign this MSA to: (a) succeeding parties in the case of a merger, acquisition or change of control; or (b) if Licensee is a supplier to a government agency; provided, however, that in each case, (i) Licensor is notified in writing within 90 days of such assignment, (ii) the assignee agrees to be bound by the terms and conditions contained in this MSA, and (iii) upon such assignment Licensee makes no further use of the Software licensed under this MSA.

11.2 Licensor’s Assignment.

Licensor may assign its rights and obligations under this MSA without Licensee’s consent. Any permitted assignee shall be bound by the terms and conditions of this MSA.

12 Intellectual Property

12.1 Ownership and Reservation of Rights.

Licensor retains all rights, title and interest in and to the Software (other than Embedded Software), as well as all intellectual property rights (such as copyright, patent and trademark) in and to the Software not expressly granted to you in this MSA. The Software is protected by copyright and other intellectual property laws and treaties. The Licensee does not acquire any rights of ownership in the Software hereunder.

12.2 Embedded Software.

Licensor’s Software contains Embedded Software that is licensed from its respective third party owner. Additional obligations may apply to the use of Embedded Software by Licensee that is not in accordance with the use of the Software under this MSA. In such circumstances, Licensee must acquire any licenses and consents from the relevant third parties for Licensee’s use of any Embedded Software.

12.3 Licensee Shall Not Remove Markings.

Licensee may not remove any titles, trademarks or trade names, copyright notices, legends, or other proprietary markings on or in the Software. You are not granted any rights to any trademarks or service marks of the Licensor.

13. Privacy

13.1 Data Security.

Protecting the privacy of customers and Authorized Users is of high importance to the Licensor. Therefore, Licensor has integrated adequate technologies to ensure protection of personal data and Customer Data. For further detailed information please consult the Privacy Policy.

13.2 Cross-Border Processing.

Both Parties acknowledge and agree that by providing any personal data through to the Software, you consent to the transmission of such personal data across international borders, inside and outside the territories of the EU/EEA member states, as necessary for the processing of such personal data in accordance with Licensor’s standard business practices and this MSA. Licensor shall act in full compliance with all Data Protection Laws, in particular the GDPR, when procuring and processing personal data provided in the course of using the Software.

13.3 Controller-Processor Relationship.

Where the Licensor provides the Software to you, it may process personal data as a processor on your behalf, who will be the controller. The processing of personal data will be carried out in accordance with the obligations and information set forth in the Data Processing Agreement (Annex B) which is hereby incorporated by reference.

13.4 Publicity.

During the term of this MSA, you grant Licensor the right to include you as a customer in Licensor’s printed or online promotional materials, including your company logo. You can deny Licensor this right at any time by submitting a written request via email to support@7pace.com and requesting to be excluded from Licensor’s promotional material. Licensor shall act upon such request within thirty (30) calendar days, hence delete your company from its online promotional materials, and refrain from using your company in newly printed promotional material.

14. Export Restrictions

Licensee’s Responsibilities. The export of the Software from the country of original Subscription or granting access to such Software may be subject to control or restriction by applicable local law. Licensee is solely responsible for determining the existence and application of any such law to any proposed export and for obtaining any needed authorization. Licensee agrees not to export the Software and not to grant access to the Software from any country in violation of applicable legal restrictions on such export.

15. Governing Law and Exclusions

15.1 Governing Law and Venue.

This MSA and any disputes or claims arising out of or in connection with its subject matter or formation (including non-contractual disputes or claims) are governed by and construed in accordance with the laws of Germany with the exception of the United Nations Convention on Contracts for the Sale of Goods (CISG), and the Courts of Munich, Germany, shall be the competent court of jurisdiction.

16. Waiver

16.1 No Waiver.

If Licensor fails, at any time during the term of this MSA, to insist upon strict performance of any of Licensee’s obligations under this MSA, or if Licensor fails to exercise any of the rights or remedies to which it is entitled under this MSA, this shall not constitute a waiver of such rights or remedies and shall not relieve Licensee from compliance with such obligations. A waiver by Licensor of any default shall not constitute a waiver of any subsequent default.

16.2 Written form.

No waiver by Licensor of any of these terms and conditions shall be effective unless it is expressly stated to be a waiver and is communicated to the Licensee in writing.

17. No Partnership

Nothing in the MSA is intended to, or shall be deemed to, establish any agency, partnership or joint venture between any of the parties, constitute any party the agent of another party, nor authorize any party to make or enter into any commitments for or on behalf of any other party.

18. Entire Agreement

This MSA (and any addendum or amendment to this MSA which is included with the Software) is the entire agreement between Licensee and Licensor relating to the Software and they supersede all prior or contemporaneous oral or written communications, proposals and representations with respect to the Software or any other subject matter covered by this MSA.

19. Severability

19.1 Survival.

If any provision of the MSA (or part of a provision) is found by any court or administrative body of competent jurisdiction to be invalid, unenforceable or illegal, the other provisions shall remain in force.

19.2 Partial Survival.

If any invalid, unenforceable or illegal provision would be valid, enforceable or legal if some part of it were deleted, the provision shall apply with the minimum modification necessary to make it legal, valid and enforceable and to give effect to the commercial intention of the parties.

20 Notices

All notices to Licensor will be sent to:

7pace GmbH, Schleissheimer Str. 75, 80797 München, Germany, support@7pace.com.

All notices to Licensee will be sent to the physical address or the email address provided by Licensee upon Subscription to the Software.

ANNEX A: SERVICE LEVEL AGREEMENT AND CONDITIONS OF USE

THIS ANNEX A – SERVICE LEVEL AGREEMENT AND CONDITION OF USE (“SLA”) FOR THE 7PACE TIMETRACKER SOFTWARE FORMS AN INTEGRAL PART OF THE MSA ENTERED BETWEEN YOU AND 7PACE. UNLESS STATED TO THE CONTRARY HEREIN, THE PROVISIONS OF THE MSA AND IN PARTICULAR THE DEFINITIONS USED IN THE MSA SHALL APPLY.

1. Conditions of Use

Proper functioning of the Software is conditional upon your adherence to any required configurations, your use of supported platforms (supported platforms and tools are listed here: https://www.7pace.com/redir/requirements-cloud), your use of the Software in a manner that is consistent with the features and functionality of the Software, and your obeyance to any prescribed quotas to avoid our throttling of suspected abusive behavior (https://www.7pace.com/redir/fair-usage).

2. Service Levels for Paid License

However, this section B of the SLA is applicable only to Cloud Products, i.e. the cloud version of 7pace Timetracker for Azure DevOps (SaaS). This SLA does not apply to On Premise Products; any service credits granted for On Premise Products would rely on the configuration of the infrastructure where the On Premise Product is installed and, thus, requires an individual agreement between you and 7pace.

If we do not achieve and maintain the Service Levels as described in this section B of the SLA, then you may be eligible for a credit towards a portion of your monthly service fees. However, please note that we only grant credits to you if and as long and inasmuch as you have subscribed to a Paid License as described in section 2.1 of the MSA, In case of SLA changes, we will provide at least 90 days’ notice for adverse material changes to this SLA.

2.1 Definitions

“Downtime” is the total accumulated minutes for a given Company subscription, during which the Cloud Product is unavailable. A minute is considered unavailable for a given Authorized User if all continuous HTTP requests to perform operations, throughout the minute either result in an Error Code or do not return a response.
“Maximum Available Minutes” is the sum of all minutes, calculated as all minutes between 00:00 of the first day of a month and 23:59 of the last day of the same month.
“Monthly Uptime Percentage” for Authorized Users is calculated as Maximum Available Minutes less Downtime divided by Maximum Available Minutes in a billing month for a given Cloud Product. Monthly Uptime Percentage is represented by the following formula:
Monthly Uptime % = (Maximum Available Minutes – Downtime) / Maximum Available Minutes
“Service Level” means the performance metric(s) set forth in this SLA that 7pace agrees to meet in the delivery of the Cloud Product.
”Error Code” means an indication that an operation has failed, such as an HTTP status code in the 5xx range.
“Applicable Monthly Service Fees” means the total fees actually paid by you for a Service that are applied to the month in which a Service Credit is owed.
”Service Credit” is the percentage of the Applicable Monthly Service Fees credited to you following request approval.

2.2 Monthly Uptime Percentage

7pace gives you a 99.9% monthly uptime commitment for the Cloud Product (the “Service Level”). If the Cloud Product does not meet the Service Level, then Company can be entitled to a Service Credit to Company’s account.
Historical and current uptime of the Cloud Product is being published on 7pace’s status page: https://status.7pace.com.

2.3 Service Credit

If the Cloud Product does not meet the agreed Service Level, the Company may send a written request to 7pace support within thirty (30) days after the end of month, in which the Service Level was not met.
Service Credit may take the form of a refund or credit to Company’s account, cannot be exchanged into a cash amount, require Company to have paid any outstanding invoices, and expire upon termination of the MSA. Service Credit is the sole and exclusive remedy for any failure by 7pace to meet any obligations in this SLA.
A Service Credit is calculated based on the following rule:
10% of the amount Company paid for the Cloud Product in a calendar month where the Monthly Uptime Percentage for such Cloud Product was less than 99.9%.

2.4 Limitations

This SLA and any applicable Service Levels do not apply to any performance or availability issues:

  1. Due to Force Majeure Events;
  2. That are excluded from 7pace warranties in accordance with section 9.4 of the MSA;
  3. Caused by your use of a Cloud Product after we advised you to modify your use of the Cloud Product, if you did not modify your use as advised;
  4. That result from your failure to adhere to the cooperation duties as agreed in the MSA (especially as set forth in section 2.8 of the MSA);
  5. That result from your failure to adhere to any required configurations, use supported platforms (supported platforms and tools are listed here: https://www.7pace.com/redir/requirements-cloud), follow any policies for acceptable use, or your use of the Software in a manner inconsistent with the features and functionality of the Software (for example, attempts to perform operations that are not supported);
  6. That result from your attempts to perform operations that exceed prescribed quotas or that resulted from our throttling of suspected abusive behavior (https://www.7pace.com/redir/fair-usage).

ANNEX B: DATA PROCESSING AGREEMENT

THIS DATA PROCESSING AGREEMENT (“DPA”) IS ENTERED BETWEEN THE COMPANY STATED IN THE ORDER FORM (“COMPANY” OR “YOU”) AS A CONTROLLER AND 7PACE GMBH, A GERMAN LIMITED LIABILITY COMPANY WITH ITS REGISTERED SEAT AT SCHLEISSHEIMER STRASSE 75, 80797 MÜNCHEN, GERMANY (“7PACE”), AS A PROCESSOR CONCERNING THE PROCESSING OF PERSONAL DATA UNDER THE MSA. THE TERMS AND CONDITIONS OF THIS DPA WILL BE LEGALLY BINDING ON THE PARTIES UPON THE EFFECTIVE DATE. UNLESS STATED TO THE CONTRARY HEREINAFTER, THE DEFINITIONS OF THE MSA SHALL APPLY. FOR THE AVOIDANCE OF DOUBT, IN CASE OF A CONFLICT BETWEEN THE PROVISIONS OF THE PRESENT DPA AND THE MSA, THE FORMER SHALL PREVAIL.

1. General Responsibilities of the Parties

1.1 Controller-Processor Relationship

Providing you with the SaaS Solution requires processing of Company Data. If and in as much as such Company Data consists of or contains personal data within the meaning of Data Protection Laws, 7pace will act as a processor regarding such data, whereas you remain the controller regarding such data.

1.2 Your Responsibilities as a Controller

The SaaS Solution is provided by 7pace under a Software as a Service (SaaS) model, namely, Company brings its own Company Data and largely controls the upload and handles directly the use of such Company Data that has been uploaded into and processed with the SaaS Solution. Company agrees and understands that 7pace will not monitor Company Data or Company’s use of any such Company Data, unless Company submits an explicit written request to 7pace to access Company Data. In any other case, only Company knows which data comprise the Company Data. It is, therefore, the sole responsibility and liability of Company to ensure that Company Data is collected and transmitted to 7pace in compliance with applicable Data Protection Laws and, in particular, to have a legal basis for its processing and to properly inform data subjects of the collection and processing of their personal data.

1.3 7pace’s Responsibilities as a Processor

Acting as a processor, 7pace will process personal data on your behalf only in accordance with the provisions of the present DPA and the documented instructions received from Company. If 7pace is required to process personal data otherwise than as instructed by you under European Union or Member State law to which it is subject, it shall inform you before such processing occurs, unless the law requiring such processing prohibits 7pace from informing you on an important ground of public interest, in which case 7pace shall notify you as soon as that law permits it to do so. 7pace shall ensure and regularly check that, in its area of responsibility, which includes any sub-processors employed in accordance with the present DPA, the processing of personal data is carried out in accordance with the provisions of the present DPA, with applicable Data Protection Laws, and especially with the GDPR.

2. Details of the Processing

2.1 Specification of Details

The details of the processing are laid out in the following sections. However, if so required for a particular service under the MSA or due to the processing activities concerning which you are making use of the SaaS Solution, the Parties may provide further details in the respective MSA or a supplemental agreement to the MSA to further specify the details of the processing. In consideration of your responsibilities as a controller, also the responsibility to request such further specification remains with you. The foregoing shall apply without limitation if processing under the present DPA includes special categories of personal data.

2.2 Nature, Purpose and Subject Matter of the Processing

7pace will process personal data to provide the SaaS Solution as further specified in the MSA.

2.3 Duration of the Processing

7pace will generally process personal data for the duration of the MSA and the present DPA, unless otherwise agreed upon in writing.

2.4 Categories of Data Subjects

You may submit personal data to the SaaS Solution, the extent of which is determined and controlled by you, and such data may include personal data relating to the following categories of data subjects: Company’s employees, contractors, business partners or other individuals whose personal data is stored in and processed with the SaaS Solution

2.5 Types of Company’s Personal Data

You may submit personal data to the SaaS Solution, the extent of which is determined and controlled by you, and such data may include the following categories of personal data: First and last name, title, contact details (company, email, phone, physical business address), system access/usage/authorization data, contract data, invoice data, data concerning working hours, other project-related information.

3. Place of the Processing; Transfer to Third Countries

3.1 Place of the Processing

Company’s personal data will be processed by 7pace at its own or its authorized sub-contractor’s premises. Usually, any processing activities will, therefore, be carried out in the member states of the European Union or in another state that is party to the Agreement on the European Economic Area. However, to best serve customers around the world, 7pace has established a multi-national team of professionals around the globe. Thus, processing of Company Data may be carried out from locations in third countries

3.2 Transfer to Third Countries

Safe paragraph 3 below, any processing of Company’s personal data outside the EU/EEA shall be permitted only upon a respective instruction of Company and only if the conditions of Art 44 et seq. GDPR are met. Company hereby grants permission and instructs 7pace to process Company Data at its premises also in third countries, as set out in paragraph 1 above, if and to the extent that, at 7pace’s sole discretion, such processing in third countries is favorable to best serve Company’s needs and interests as a 7pace customer. For any processing of Company Data by 7pace in third countries, Module Two of the standard contractual clauses for the transfer of personal data to third countries, as approved by the European Commission from time to time, and attached hereto as Exhibit 1, shall apply.

3.3 Transfer to Third Countries

If (a) Company itself is located in a state outside the EU/EEA, and if (b) the European Commission has not issued an adequacy decision in accordance with Art. 45 GDPR concerning such state, and if (c), concerning the processing of Company’s personal data hereunder, the provisions of the GDPR do not apply to Company in accordance with Art. 3 para. 2 GDPR, either, Company acknowledges that the provisions of the GDPR will still apply to 7pace. In this respect, any transfer of Company’s personal data to the state in which Company is located, will be subject to Module Four of the standard contractual clauses for the transfer of personal data to third countries, as approved by the European Commission from time to time, and attached hereto as Exhibit 1.

4. Your Instructions

4.1 General Instructions

The Parties agree and you understand that the provisions of the present DPA comprise your general instructions concerning the processing of personal data under the MSA.

4.2 Specific Instructions

Individual instructions which deviate from the provisions of the present DPA or which impose additional requirements require 7pace’s prior consent and are made in accordance with the change procedure agreed in the MSA.

4.3 Compliance with Data Protection Laws

You shall ensure that your specific instructions with relation to Company Data comply with Data Protection Laws, and that the processing of Company Data in accordance with your instructions will not cause 7pace to be in breach of Data Protection Laws and, in particular, of the GDPR. If 7pace is of the opinion that a permissible specific instruction infringes applicable Data Protection Laws, it shall inform Company thereof as soon as possible. Furthermore, 7pace is entitled to suspend the execution of the instruction until you confirm the instruction.

4.4 Text Form

Specific instructions from Company shall in principle be issued in writing or at least in text form by the persons of Company authorized to do so in accordance with the present DPA. Oral instructions must be confirmed immediately in writing or in text form by the Company in order to be effective.

4.5 Authorized Contacts

The Parties may agree that instructions may only be given by Company’s authorized representative or his deputy, and that they may only be directed to the authorized recipient of instructions on the part of 7pace. The Parties shall then (a) document such agreement in writing or at least in text form, and (b) immediately notify each other in writing or at least in text form of any change in the respectively authorized persons or their permanent hindrance, appointing a substitute.

5. 7pace’s Representations

5.1 Employees

7pace employees: (i) who have access to personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (ii) shall process personal data only as instructed to by you, unless otherwise required to do so by data protection laws; and (iii) shall be provided training as necessary from time to time with respect to 7pace’s obligations under this DPA, under Data Protection Laws and, in particular, under the GDPR.

5.2 Copies; Data Backups

7pace shall not make any copies or duplicates of Company Data without your prior consent. However, copies are excluded from this, insofar as they are required to ensure proper data processing and to properly provide the SaaS Solution (including data backups), as well as insofar as copies are required to comply with statutory retention obligations.

5.3 Data Protection Officer

7pace shall appoint a competent and reliable data protection officer if and as long as the legal requirements for an appointment obligation are met. The contact details of such a data protection officer will be provided to the Company upon request.

6 Technical and Organizational Measures

6.1 Implementation and Maintenance

Prior to the commencement of the processing, 7pace shall implement the technical and organizational measures listed in Exhibit 2 and maintain them during the term of the present DPA. These are data security measures to ensure a level of protection appropriate to the risk regarding the confidentiality, integrity, availability and resilience of the systems which you have been able to check prior to the conclusion of the MSA, and have deemed them to be appropriate. The state of the art, the implementation costs and the type, scope and purposes of processing as well as the varying likelihood and severity for the rights and freedoms of natural persons within the meaning of Art. 32 para. 1 GDPR have been taken into account.

6.2 Alternative Measures

Since the technical and organizational measures are subject to technical progress and technological development, 7pace is permitted to implement alternative and adequate measures, provided that the safety level of the measures specified in Exhibit 2 is not compromised. 7pace shall document such changes. Material changes to the measures require the prior written consent of Company and must be documented by 7pace and made available to Company for examination.

7. Sub-Contracting

7.1 Pre-approved sub-processors

Company hereby grants authorization to 7pace to subcontract processing operations to the following sub-processors. Where applicable, data transfers to third countries outside the EU/EEA member states, are subject to adequate safeguards in accordance with Chapter 5 of the GDPR as listed in the table below.

Microsoft
United States of America
Application platform services
Cloud hosting services
Standard Contractual Clauses
Zendesk
United States of America
Help desk hosting and CRM services Binding Corporate Rules / Standard Contractual Clause
Appcues
United States of America
In-product messaging Standard Contractual Clauses
LaunchDarkly
United States of America,
Europe, Asia-Pacific
Product configuration management Standard Contractual Clauses
Leah Copeland
Canada
Customer support services Standard Contractual Clauses
Vanja Pletikosić
Croatia
Customer support services Standard Contractual Clauses
Aleksandr Belikov
Russia
Software development and customer support services Standard Contractual Clauses
Alexey Cherny
Russia
Software development and customer support services Standard Contractual Clauses
Anna Varetsa
Russia
Software development and customer support services Standard Contractual Clauses
Anton Drugalev
Russia
Software development and customer support services Standard Contractual Clauses
Dmitrii Vavel
Russia
Software development and customer support services Standard Contractual Clauses
Eugene Kolomytsev
Russia
Software development and customer support services Standard Contractual Clauses
George Minko
Russia
Software development and customer support services Standard Contractual Clauses
Igor Kamynin
Russia
Software development and customer support services Standard Contractual Clauses
Maxim Shestakov
Russia
Software development and customer support services Standard Contractual Clauses
Roman Kadkalo
Russia
Software development and customer support services Standard Contractual Clauses
Semyon Nazarenko
Russia
Software development and customer support services Standard Contractual Clauses
Sergey Ryabtsev
Russia
Software development and customer support services Standard Contractual Clauses
Yaroslav Borisov
Russia
Software development and customer support services Standard Contractual Clauses
Andrii Zatolokin
Ukraine
Software development and customer support services Standard Contractual Clauses
Pavlo Shaforostov
Ukraine
Software development and customer support services Standard Contractual Clauses
Andrea Moro
Spain
Product management and customer support services Standard Contractual Clauses

7.2 7pace’s liability

7pace shall impose privacy, confidentiality and data security obligations on any sub-processor that are at least as stringent as those set forth in the present DPA, and, in the absence of another transfer mechanism in accordance with Art. 44 et seqq. of the GDPR, it shall agree with any sub-processor that is established in a third country on Module Three of the standard contractual clauses for the transfer of personal data to third countries, as approved by the European Commission from time to time, and attached hereto as Exhibit 1. Where a sub-processor fails to fulfil its data protection obligations with respect to the processing of personal data, 7pace shall remain fully liable to the Company for the performance of that sub-processor’s obligations.

7.3 Appointment of sub-processors

7pace shall give Company notice in writing or in text form of the appointment of any new sub-processor. If, within thirty (30) days of receipt of that notice, Company notifies 7pace in writing or in text form of any reasonable objection to the proposed appointment, the Parties shall negotiate in good faith a mutually acceptable alternative. If no such alternative is agreed within two (2) months of the objection, the Company will have the right to terminate the MSA to the extent it relates to services which require use of the proposed sub-processor.

7.4 No sub-processing

The Parties agree that ancillary service providers of 7pace are no sub-processors within the meaning of Data Protection Laws; this includes in particular transport services of postal or courier companies, cash transport services, telecommunication services, security services and cleaning services. However, 7pace shall enter into customary confidentiality agreements with such service providers.

7.5 No Third-Party Beneficiary Rights

Company acknowledges and agrees that 7pace or its sub-processors are under no obligation to grant to Company in any sub-processor agreement third-party beneficiary rights as regards, without limitation, the appointment of sub-sub-processors, inspection and audit rights, or direct instructions

8. Assistance of Company

8.1 Investigations of a Supervisory Authority

Upon Company’s written request, 7pace will assist Company in the event of an investigation by or request from any regulator, including a supervisory authority, or similar authority, if and to the extent that such investigation or request relates to the SaaS Solution. 7pace will take steps reasonably requested by Company to assist Company in complying with any obligations in connection with such an investigation or request. If an investigation by or a request from any regulator, including a supervisory authority, or similar authority, affects 7pace itself, it shall inform Company hereof without undue delay if so permitted and shall cooperate within the course of such investigation or request.

8.2 Data Breaches

7pace shall inform the Company without delay if it discovers a violation of the protection of personal data in connection with the processing under the present DPA. If the Company is obliged by law to provide information due to a risk to the rights and freedoms of natural persons as a result of such a data-breach (in particular but not limited to the information duties according to Art. 33, 34 GDPR), 7pace shall assist Company in fulfilling its duties to provide information to the extent reasonable and necessary at the latter’s request; inasmuch as 7pace is not at fault for the incident, support shall be provided against a remuneration to be calculated in accordance with the MSA.

8.3 Data Protection Impact Assessment

7pace will cooperate and assist the Company with any data protection impact assessments which are referred to in Art. 35 GDPR or with any regulatory consultations that the Company is legally required to make in respect of such data protection impact assessment in accordance with Art. 36 GDPR, taking into account the nature of the Processing and the information made available to 7pace. Such assistance shall be made subject to a remuneration to be calculated in accordance with the MSA.

8.4 Data Subjects’ Requests

7pace shall notify Company without undue delay about any complaint, communication or request received directly by 7pace from a data subject and pertaining to his or her personal data, without responding to that request, unless 7pace has been otherwise authorized to do so by Company. 7pace shall provide Company with reasonable assistance in relation to any complaint, communication or request received from a data subject, subject to a remuneration to be calculated in accordance with the MSA.

9. Return or Deletion of Personal Data

9.1 Return or Deletion

Upon Company’s written request during the term of the MSA or upon termination or expiration of the MSA, and when 7pace is no longer required to retain all or part of personal data included in the Company Data in order to provide the SaaS Solution, 7pace shall, upon respective instruction of Company, return or destroy such personal data. If Data Protection Laws to which 7pace is subject prevent 7pace from returning or destroying all or part of personal data, 7pace warrants that it will guarantee the confidentiality of personal data and will not actively process personal data anymore, and will guarantee the return or destruction of personal data as requested by Company when the legal obligation to not return or destroy the personal data is no longer in effect.

9.2 Reporting

7pace shall draw up a report on any erasure or destruction of personal data, which shall be submitted to Company upon request.

10 Company’s Audit Rights

10.1 On-premise Audits

During normal business hours (Monday to Friday from 9 a.m. to 5 p.m. local time), Company is entitled to enter 7pace’s business premises in which personal data are processed on behalf of Company, at Company’s own expense, without disrupting operations and with strict confidentiality of 7pace’s trade secrets, in order to audit compliance with the present DPA. Company shall inform 7pace in good time (generally at least two weeks in advance) of all circumstances relating to the execution of an audit.

10.2 Number of Audits

As a rule, Company may carry out one inspection per calendar year. This does not affect Company’s right to carry out further audits in the event of special incidents.

10.3 Third-Party Auditors

If Company commissions a third party to carry out the audit, Company must oblige the third party in writing in the same way as Company is obligated towards 7pace under the present DPA. In addition, Company must oblige the third party to secrecy and confidentiality, unless the third party is subject to a professional obligation of secrecy. At the request of 7pace, Company shall provide the latter without delay with the confidentiality agreements concluded with the third party. Company must not appoint a competitor of 7pace to carry out the inspection.

10.4 Audit Reports

Instead of on-premise audits, the demonstration of compliance with the present DPA may also be verified by adherence to an approved code of conduct in accordance with Art. 40 GDPR, a certification under an approved certification mechanism in accordance with Art. 42 GDPR, the presentation of appropriate, up-to-date certificates, reports or report extracts from independent bodies (e.g. auditor, revision, data protection officer, IT security department, data protection auditors or quality auditors), and/or by a suitable certification after an IT security or data protection audit – e.g. according to DIN/EN ISO 27001 – (“Audit Report”), if and inasmuch as the Audit Report allows Company to convince itself in an appropriate way of 7pace’s compliance with the present DPA

10.5 Remuneration

If and inasmuch as 7pace did not force an audit by fault, support during such audit shall be provided against a remuneration to be calculated in accordance with the MSA.

11. Miscellaneous

11.1 Governing Law; Jurisdiction

The present DPA will be governed by the same law as the MSA, and the competent courts agreed between the Parties under the MSA shall have the sole jurisdiction concerning all conflicts arising out of or in connection with the present DPA as well.

11.2 Written Form Requirement

No modification or amendment of the present DPA shall be effective unless in writing and signed by the Parties.

11.3 Severability

If any provision in this Agreement is held by a court of competent jurisdiction to be invalid or unenforceable, all other provisions shall remain in full force and effect.

11.4 Term

This DPA will become effective as of the date the Parties have executed it and, notwithstanding expiry of the term of the MSA, will remain in effect until, and will automatically expire upon, deletion of all personal data by 7pace and/or any applicable sub-processors.

EXHIBIT 1: STANDARD CONTRACTUAL CLAUSES

SECTION I

Clause 1: Purpose and scope

  1. The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country.
  2. The Parties:
    1. the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
    2. the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)

    have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).

  3. These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
  4. The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

Clause 2: Effect and invariability of the Clauses

  1. These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
  2. These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

Clause 3: Third-party beneficiaries

  1. Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
    1. Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
    2. Clause 8 –Module Two: Clause 8.1(b), 8.9(a), (c), (d) and (e); Module Three: Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g); Module Four: Clause 8.1 (b) and Clause 8.3(b);
    3. Clause 9 – Module Two: Clause 9(a), (c), (d) and (e); Module Three: Clause 9(a), (c), (d) and (e);
    4. Clause 12 –Modules Two and Three: Clause 12(a), (d) and (f);
    5. Clause 13
    6. Clause 15.1(c), (d) and (e);
    7. Clause 16(e);
    8. Clause 18 – Modules Two and Three: Clause 18(a) and (b); Module Four: Clause 18.
  2. Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679

Clause 4: Interpretation

  1. Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
  2. These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
  3. These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5: Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6: Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7: Docking clause

  1. An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.
  2. Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.
  3. The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8: Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organizational measures, to satisfy its obligations under these Clauses.

MODULE TWO: Transfer controller to processor

8.1 Instructions

  1. The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract
  2. The data importer shall immediately inform the data exporter if it is unable to follow those instructions.

8.2 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I. B, unless on further instructions from the data exporter.

8.3 Transparency

On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.4 Accuracy

If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.

8.5 Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).

8.6 Security of processing

  1. The data importer and, during transmission, also the data exporter shall implement appropriate technical and organizational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymization, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymization, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organizational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
  2. The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  3. In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
  4. The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.

8.7 Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.

8.8 Onward transfers

The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:

  1. the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
  2. the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;
  3. the onward transfer is necessary for the establishment, exercise or defense of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
  4. the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.9 Documentation and compliance

  1. The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.
  2. The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.
  3. The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non- compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.
  4. The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
  5. The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.

MODULE THREE: Transfer processor to processor

8.1 Instructions

  1. The data exporter has informed the data importer that it acts as processor under the instructions of its controller(s), which the data exporter shall make available to the data importer prior to processing.
  2. The data importer shall process the personal data only on documented instructions from the controller, as communicated to the data importer by the data exporter, and any additional documented instructions from the data exporter. Such additional instructions shall not conflict with the instructions from the controller. The controller or data exporter may give further documented instructions regarding the data processing throughout the duration of the contract.
  3. The data importer shall immediately inform the data exporter if it is unable to follow those instructions. Where the data importer is unable to follow the instructions from the controller, the data exporter shall immediately notify the controller
  4. The data exporter warrants that it has imposed the same data protection obligations on the data importer as set out in the contract or other legal act under Union or Member State law between the controller and the data exporter.

8.2 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I. B., unless on further instructions from the controller, as communicated to the data importer by the data exporter, or from the data exporter.

8.3 Transparency

On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the data exporter may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.

8.4 Accuracy

If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to rectify or erase the data.

8.5 Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the controller and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a)

8.6 Security of processing

  1. The data importer and, during transmission, also the data exporter shall implement appropriate technical and organizational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymization, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymization, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter or the controller. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organizational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
  2. The data importer shall grant access to the data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  3. In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify, without undue delay, the data exporter and, where appropriate and feasible, the controller after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the data breach, including measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
  4. The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify its controller so that the latter may in turn notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.

8.7 Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards set out in Annex I.B.

8.8 Onward transfers

The data importer shall only disclose the personal data to a third party on documented instructions from the controller, as communicated to the data importer by the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:

  1. the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
  2. the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679;
  3. the onward transfer is necessary for the establishment, exercise or defense of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
  4. the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.

8.9 Documentation and compliance

  1. The data importer shall promptly and adequately deal with enquiries from the data exporter or the controller that relate to the processing under these Clauses.
  2. The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the controller.
  3. The data importer shall make all information necessary to demonstrate compliance with the obligations set out in these Clauses available to the data exporter, which shall provide it to the controller.
  4. The data importer shall allow for and contribute to audits by the data exporter of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. The same shall apply where the data exporter requests an audit on instructions of the controller. In deciding on an audit, the data exporter may take into account relevant certifications held by the data importer.
  5. Where the audit is carried out on the instructions of the controller, the data exporter shall make the results available to the controller.
  6. The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
  7. The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.

MODULE FOUR: Transfer processor to controller

8.1 Instructions

  1. The data exporter shall process the personal data only on documented instructions from the data importer acting as its controller.
  2. The data exporter shall immediately inform the data importer if it is unable to follow those instructions, including if such instructions infringe Regulation (EU) 2016/679 or other Union or Member State data protection law.
    The data importer shall refrain from any action that would prevent the data exporter from fulfilling its obligations under Regulation (EU) 2016/679, including in the context of sub-processing or as regards cooperation with competent supervisory authorities.
  3. After the end of the provision of the processing services, the data exporter shall, at the choice of the data importer, delete all personal data processed on behalf of the data importer and certify to the data importer that it has done so, or return to the data importer all personal data processed on its behalf and delete existing copies.

8.2 Security of processing

  1. The Parties shall implement appropriate technical and organizational measures to ensure the security of the data, including during transmission, and protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access (hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature of the personal data, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects, and in particular consider having recourse to encryption or pseudonymization, including during transmission, where the purpose of processing can be fulfilled in that manner.
  2. The data exporter shall assist the data importer in ensuring appropriate security of the data in accordance with paragraph (a). In case of a personal data breach concerning the personal data processed by the data exporter under these Clauses, the data exporter shall notify the data importer without undue delay after becoming aware of it and assist the data importer in addressing the breach.
  3. The data exporter shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

8.3 Documentation and compliance

  1. The Parties shall be able to demonstrate compliance with these Clauses.
  2. The data exporter shall make available to the data importer all information necessary to demonstrate compliance with its obligations under these Clauses and allow for and contribute to audits

Clause 9: Use of sub-processors

MODULE TWO: Transfer controller to processor

  1. The data importer has the data exporter’s general authorization for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least thirty (30) days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.
  2. Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
  3. The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
  4. The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
  5. The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

MODULE THREE: Transfer processor to processor

  1. The data importer has the controller’s general authorization for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least thirty (30) days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the controller with the information necessary to enable the controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s).
  2. Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the controller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
  3. The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement and any subsequent amendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
  4. The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
  5. The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Clause 10: Data subject rights

MODULE TWO: Transfer controller to processor

  1. The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorized to do so by the data exporter.
  2. The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organizational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
  3. In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.

MODULE THREE: Transfer processor to processor

  1. The data importer shall promptly notify the data exporter and, where appropriate, the controller of any request it has received from a data subject, without responding to that request unless it has been authorized to do so by the controller.
  2. The data importer shall assist, where appropriate in cooperation with the data exporter, the controller in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable. In this regard, the Parties shall set out in Annex II the appropriate technical and organizational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
  3. In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the controller, as communicated by the data exporter.

MODULE FOUR: Transfer processor to controller

The Parties shall assist each other in responding to enquiries and requests made by data subjects under the local law applicable to the data importer or, for data processing by the data exporter in the EU, under Regulation (EU) 2016/679.

Clause 11: Redress

  1. The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorized to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
  2. MODULE TWO: Transfer controller to processor

    MODULE THREE: Transfer processor to processor

  3. In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
  4. Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
    1. lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
    2. refer the dispute to the competent courts within the meaning of Clause 18.
  5. The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
  6. The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
  7. The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.

Clause 12: Liability

MODULE FOUR: Transfer processor to controller

  1. Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
  2. Each Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.
  3. Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
  4. The Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
  5. The data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability.

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

  1. Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
  2. The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
  3. Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub- processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
  4. The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
  5. Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
  6. The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
  7. The data importer may not invoke the conduct of a sub-processor to avoid its own liability.

Clause 13: Supervision

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

  1. [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
    [Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
    [Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
  2. The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14: Local laws and practices affecting compliance with the Clauses

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

MODULE FOUR: Transfer processor to controller(where the EU processor combines the personal data received from the third country-controller with personal data collected by the processor in the EU)

  1. The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorizing access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
  2. The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
    1. the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
    2. the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorizing access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards;
    3. any relevant contractual, technical or organizational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
  3. The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
  4. The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
  5. The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a). [For Module Three: The data exporter shall forward the notification to the controller.]
  6. Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organizational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation [for Module Three:, if appropriate in consultation with the controller]. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by [for Module Three: the controller or] the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.

Clause 15: Obligations of the data importer in case of access by public authorities

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

MODULE FOUR: Transfer processor to controller (where the EU processor combines the personal data received from the third country-controller with personal data collected by the processor in the EU)

15.1 Notification

  1. The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
    1. receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
    2. becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.

    [For Module Three: The data exporter shall forward the notification to the controller.]

  2. If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
  3. Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.). [For Module Three: The data exporter shall forward the information to the controller.]
  4. The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
  5. Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.

15.2 Notification

  1. The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
  2. The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request. [For Module Three: The data exporter shall make the assessment available to the controller.]
  3. The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
  4. SECTION IV – FINAL PROVISIONS

    Clause 16: Non-compliance with teh Clauses and termination

    1. The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
    2. In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
    3. The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
      1. the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
      2. the data importer is in substantial or persistent breach of these Clauses; or
      3. the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.

      In these cases, it shall inform the competent supervisory authority [for Module Three: and the controller] of such non- compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.

    4. [For Modules Two and Three: Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data.] [For Module Four: Personal data collected by the data exporter in the EU that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall immediately be deleted in its entirety, including any copy thereof.] The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
    5. Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.

    Clause 17: Governing law

    MODULE TWO: Transfer controller to processor

    MODULE THREE: Transfer processor to processor

    These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third- party beneficiary rights. The Parties agree that this shall be the law of Germany

    MODULE FOUR: Transfer processor to controller

    These Clauses shall be governed by the law of a country allowing for third-party beneficiary rights. The Parties agree that this shall be the law of Germany.

    Clause 18: Choice of forum and jurisdiction

    MODULE TWO: Transfer controller to processor

    MODULE THREE: Transfer processor to processor

    1. Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
    2. The Parties agree that those shall be the courts of Germany.
    3. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
    4. The Parties agree to submit themselves to the jurisdiction of such courts

    MODULE FOUR: Transfer processor to controller

    Any dispute arising from these Clauses shall be resolved by the courts of Germany.

    Appendix

    EXPLANATORY NOTE:
    It must be possible to clearly distinguish the information applicable to each transfer or category of transfers and, in this regard, to determine the respective role(s) of the Parties as data exporter(s) and/or data importer(s). This does not necessarily require completing and signing separate appendices for each transfer/category of transfers and/or contractual relationship, where this transparency can be achieved through one appendix. However, where necessary to ensure sufficient clarity, separate appendices should be used.

    ANNEX I

    A. LIST OF PARTIES

    MODULE TWO: Transfer controller to processor

    Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]

    1. Name: Company is the data exporter.
      Address: Company’s address is provided in the MSA.
      Contact person’s name, position and contact details: Company’s contact person’s name, position and contact details, including, where applicable, Company’s data protection officer and/or representative in the European Union are provided under the MSA.
      Activities relevant to the data transferred under these Clauses: The data exporter is a user of the SaaS Solution as defined in the 7pace DPA and MSA.
      Signature and date: These Clauses are incorporated into the DPA by reference, and the effective date of the DPA shall be considered the date of signature of these Clauses.
      Role (controller/processor): Controller
    2. [to be filled in only in the cases described in Clause 7 of the Clauses]

    Data importer(s): [Identity and contact details of the data importer(s), including any contact person with responsibility for data protection]

    1. Name: The data importer is 7pace.
      Address: 7pace’s address is provided in the MSA.
      Contact person’s name, position and contact details: 7pace’s contact person’s name, position and contact details are provided under the MSA.
      Activities relevant to the data transferred under these Clauses: 7pace is the provider of the SaaS Solution offering Services worldwide.
      Signature and date: These Clauses are incorporated into the DPA by reference, and the effective date of the DPA shall be considered the date of signature of these Clauses.
      Role (controller/processor): Processor
    2. [to be filled in only in the cases described in Clause 7 of the Clauses]

    MODULE THREE: Transfer processor to processor

    Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]

    1. Name: The data exporter is 7pace.
      Address: 7pace’s address is provided in the MSA.
      Contact person’s name, position and contact details: 7pace’s contact person’s name, position and contact details are provided under the MSA.
      Activities relevant to the data transferred under these Clauses: 7pace is the provider of the SaaS Solution offering Services worldwide, that sub-contracts parts of the Services to sub-processors in accordance with the provisions of these Clauses and the DPA.
      Signature and date: [to be filled in individually]
      Role (controller/processor): Processor
    2. [to be filled in only in the cases described in Clause 7 of the Clauses]

    Data importer(s): [Identity and contact details of the data importer(s), including any contact person with responsibility for data protection]

    1. Name: [to be filled in individually]
      Address: [to be filled in individually]
      Contact person’s name, position and contact details: [to be filled in individually]
      Activities relevant to the data transferred under these Clauses: [to be filled in individually]
      Signature and date: [to be filled in individually]
      Role (controller/processor): (Sub-)Processor
    2. [to be filled in only in the cases described in Clause 7 of the Clauses]

    MODULE FOUR: Transfer processor to controller

    Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]

    1. Name: The data exporter is 7pace.
      Address: 7pace’s address is provided in the MSA.
      Contact person’s name, position and contact details: 7pace’s contact person’s name, position and contact details, including, where applicable, 7pace’s data protection officer are provided under the MSA.
      Activities relevant to the data transferred under these Clauses: 7pace is the provider of the SaaS Solution offering Services worldwide.
      Signature and date: These Clauses are incorporated into the DPA by reference, and the effective date of the DPA shall be considered the date of signature of these Clauses.
      Role (controller/processor): Processor
    2. [to be filled in only in the cases described in Clause 7 of the Clauses]

    Data importer(s): [Identity and contact details of the data importer(s), including any contact person with responsibility for data protection]

    1. Name: Company is the data importer.
      Address: Company’s address is provided in the MSA.
      Contact person’s name, position and contact details: Company’s contact person’s name, position and contact details are provided under the MSA.
      Activities relevant to the data transferred under these Clauses: The data importer is a user of the SaaS Solution as defined in the 7pace DPA and MSA.
      Signature and date: These Clauses are incorporated into the DPA by reference, and the effective date of the DPA shall be considered the date of signature of these Clauses.
      Role (controller/processor): Controller
    2. [to be filled in only in the cases described in Clause 7 of the Clauses]

    B. DESCRIPTION OF TRANSFER

    MODULE TWO: Transfer controller to processor

    MODULE THREE: Transfer processor to processor

    MODULE FOUR: Transfer controller to controller

    Categories of data subjects whose personal data is transferred
    Data subjects are set out or referenced in the DPA.

    Categories of personal data transferred
    Categories of data are set out or referenced in the DPA.

    Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
    Special categories of data (if appropriate) are set out or referenced in the DPA.

    The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
    Company data are being transferred continuously during Company’s use of the SaaS Solution.

    Nature of the processing
    The personal data transferred will be subject to the processing activities set out in the 7pace DPA and MSA.

    Purpose(s) of the data transfer and further processing
    Provision, further development and maintenance of the SaaS Solution.

    The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
    Personal data will be retained in accordance with applicable laws at Company’s seat.

    For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
    [to be determined and filled in individually]

    COMPETENT SUPERVISORY AUTHORITY

    MODULE TWO: Transfer controller to processor

    Identify the competent supervisory authority/ies in accordance with Clause 13
    Company is to communicate to 7pace in writing its competent supervisory authority prior to the transfer of Company’s personal data to a third country.

    MODULE THREE: Transfer processor to processor

    Identify the competent supervisory authority/ies in accordance with Clause 13
    Bayerisches Landesamt für Datenschutzaufsicht.

    ANNEX II

    TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

    MODULE TWO: Transfer controller to processor

    The technical and organizational measures set out in Exhibit 2 to the DPA are hereby incorporated into this Annex II by this reference and are binding on the data importer as if they were set forth in this Annex II in their entirety.

    MODULE THREE: Transfer processor to processor

    The technical and organizational measures shall be determined in each individual case between 7pace and its sub-processors considering the provisions of the DPA and the following explanatory note issued by the European Commission:

    EXPLANATORY NOTE:
    The technical and organizational measures must be described in specific (and not generic) terms. See also the general comment on the first page of the Appendix, in particular on the need to clearly indicate which measures apply to each transfer/set of transfers.
    Description of the technical and organizational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

    [Examples of possible measures:
    Measures of pseudonymization and encryption of personal data
    Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services
    Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
    Processes for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processing
    Measures for user identification and authorization Measures for the protection of data during transmission Measures for the protection of data during storage
    Measures for ensuring physical security of locations at which personal data are processed Measures for ensuring events logging
    Measures for ensuring system configuration, including default configuration Measures for internal IT and IT security governance and management Measures for certification/assurance of processes and products
    Measures for ensuring data minimization Measures for ensuring data quality Measures for ensuring limited data retention Measures for ensuring accountability
    Measures for allowing data portability and ensuring erasure]

    For transfers to (sub-) processors, also describe the specific technical and organizational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter.

    ANNEX III

    LIST OF SUB-PROCESSORS [not applicable]

EXHIBIT 2: Technical and Organizational Measures

Confidentiality (art. 32 para. 1 lit. b GDPR)

Access control

Unauthorized access shall be prevented, the term being understood spatially.

Technical or organizational measures for access control, in particular also for the legitimation of authorized persons:

All personal data used by 7pace is stored in databases hosted by third-party processors (Microsoft, Zendesk). No personal data is stored on 7pace premises and 7pace employees have no physical access to these systems. The data processing locations and offices of 7pace are secured against unauthorized access; the offices are locked by key and only certain personnel have a copy. The individual computers used by 7pace staff to potentially access personal data are encrypted and also secured with strong passwords and biometrics when available.

System access control

The intrusion of unauthorized persons into the data processing systems shall be prevented.

Technical (password / password protection) and organizational (user master record) measures regarding user identification and authentication:

Access to personal data is limited to the 7pace employees who require it in the exercise of their functions. The access is limited via accounts protected by strong passwords and 2-factor authentication is mandatory when offered as an option by the system used. The communication between these systems and 7pace is encrypted. Accounts are disabled immediately upon termination.

Admission control

Unauthorized activities in data processing systems outside the authorizations granted shall be prevented.

Demand-oriented design of the authorization concept and access rights as well as their monitoring and logging:

Logging to track access and actions performed by 7pace employees is configured in the third-party systems as available. Access and the type of activities that can be performed (read, modification and deletion) is further limited by the usage of roles and permissions in these third-party systems.

Separation control

Data collected for different purposes shall also be processed separately.

Measures for the separate processing (storage, modification, deletion, transfer) of data for different purposes:

Payment processing and customer management related data are stored and processed in separate third-party cloud-based systems where the access is limited to a few key 7pace employees. Test and production environments are separated and segregated and only a few key employees have access rights to the production data.

Pseudonymization (Art. 32 para. 1 lit. a GDPR; Art. 25 para. 1 GDPR)

The processing of personal data in such a way that the data can no longer be assigned to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to appropriate technical and organizational measures.

The servers used by 7pace may collect log files that contain data related to the events that data subjects’ activity is triggering. Data is stored temporarily and contains IP address, date, time, browser data and URL. This data is stored pseudonymized, erased periodically and is not brought into relation with other data.

Integrity (Art. 32 para. 1 lit. b GDPR)

Transfer control

Measures to ensure that personal data cannot be read, copied, modified or removed without authorization during electronic transfer or during their transport or storage on data carriers, and that it is possible to check and establish to which bodies personal data is to be transferred by data transmission devices.

Measures during transport, transfer and transmission or storage on data carriers (manual or electronic) as well as during subsequent verification:

All communication between the systems used by 7pace is encrypted and data at rest is also encrypted. Personal data cannot be transferred from its original location by developers that act as sub-processors, only accessed.

Input control

The traceability and documentation of data management and maintenance must be guaranteed.

Measures for retrospectively examining whether and by whom data have been entered, modified or removed (deleted):

Event Logging

7pace collects following logs in temporary storage as a helpful resource for analyzing application performance and triaging issues:

  • Web Server Logs (IIS).
    • Retention is up to 14 days
    • Logs can contain following information:
      • User email
      • Accessed path and HTTP method
      • Timestamp
      • User agent string
      • IP address
  • Application trace logs
    • Retention is up to 14 days
    • Logs can contain following information:
      • Untraceable part of the username or email
      • Timestamp
      • Action performed
      • Other diagnostic information
  • Application error tracing logs
    • Created as needed, temporary in nature
    • Logs can contain following information:
      • Timestamp
      • Exception call stack
  • SQL Server audit logs

Availability and resilience (Art. 32 para. 1 lit. b GDPR)

Availability control

The data must be protected against accidental destruction or loss.

Measures for data backup (physical / logical):

Timely restorability (Art. 32 para. 1 lit. c GDPR)

The database creates full backups every week, differential backups every 12 hours, and transaction log backups every 5 to 10 minutes. The backups are then kept in read-only access geo-redundant storage blobs that are replicated to a paired data center for protection against a datacenter outage.

The data backup and recovery procedures implemented for our systems allows for a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 72hrs.

Procedures for regular testing, assessing and evaluating (Art. 32 para. 1 lit. d GDPR; Art. 25 para. 1 GDPR)

Data protection management; Incident response management; Data protection friendly default settings (Art. 25 para. 2 GDPR); Job control:

No order processing within the meaning of Art. 28 GDPR without the corresponding instruction of the Controller, e.g.: Clear contract design, formalized or under management, strict selection of service provider, obligation to examine in advance, subsequent inspections.

Procedures for regular testing, assessing, and evaluating of the above are outlined in the following 7pace policies. All 7pace employees and freelancers are made aware of the existence of these policies and are informed of updates to these policies:

  • 7pace Confidentiality Policy;
  • 7pace Data Protection Policy;
  • 7pace Incident Management Policy;
  • 7pace Mobile Device Policy;
  • 7pace Remote Work Policy;
  • 7pace Security Policy.

The addition of a new processor or sub-processor requires an evaluation by 7pace and acceptance by the controller in accordance with the DPA. Sub-processors with access to personal data are bound by a Data Processing Agreement.

The technical and organizational measurements implemented at and by Microsoft and Zendesk are governed by the ISO 27001 standard. The measures put in place are evaluated yearly and confirmed by 3rd party audit and certification.