DATA PROCESSING ADDENDUM

This data processing Addendum (“DPA”), forms part of, and is subject to Terms of Service, Privacy Policy, or other written or electronic terms of service or Service agreement including Non-Disclosure Agreement, User Agreement, etc. between Xecurify or its Affiliate that is party to such agreement (“Xecurify”) and the Customer defined thereunder, together with all Customer Affiliates who are signatories on an Order Form for their own Service pursuant to such Agreement (such agreement, the “Agreement”).

WHEREAS

(A) Customer acts as a Data Controller. Xecurify offers a suite of Software-as-Service (SaaS) applications, products and services provided as Xecurify-hosted or Self Hosted Services.

(B) Customer wishes to contract certain Services, which may include processing of Customer’s Personal Data to Xecurify.

(C) This Data Processing Addendum (the “DPA”) explains Xecurify’s privacy and security commitments and enables it to demonstrate compliance with applicable Privacy Laws.

(D) The parties agree to comply with the following provisions with respect to Personal Data, each acting reasonably and in good faith.

1. Definitions and Interpretations

All capitalized terms not defined herein shall have the meaning set forth in the Agreement.

1. a. "Affiliate" means any person or entity directly or indirectly controlling, controlled by, or under common control with a Party. For the purpose of this definition, "control" (including, with correlative meanings, the terms "controlling", "controlled by" and "under common control with") means the power to manage or direct the affairs of the person or entity in question, whether by ownership of voting securities, by contract or otherwise.
2. b. “Authorized Employee” means an employee of Xecurify who has a need to know or otherwise access Personal Data to enable Xecurify to perform its obligations under this DPA or the Agreement.
3. c. “Authorized Individual” means an Authorized Employee or Subprocessor.
4. d. "EEA Personal Data” means that subset of Personal Data consisting of personal data (as defined in GDPR) pertaining to residents of the European Economic Area (EEA), Switzerland, and the United Kingdom.
5. e. “Data Subject” means the identified or identifiable person to whom Personal Data relates.
6. f. "Data Protection Laws" means all laws and regulations, including laws and regulations of the European Union, the European Economic Area and their member states, Switzerland, the United Kingdom, and the United States and its states, applicable to the Processing of Personal Data under the Agreement.
7. g. “GDPR” means Regulation (EU) 2016/679 , the General Data Protection Regulation, and all issued implementing regulations, as and when effective.
8. h. “Personal Data” means any information relating to (i) an identified or identifiable natural person and, (ii) an identified or identifiable legal entity (where such information is protected similarly as personal data or personally identifiable information under applicable Data Protection Laws and Regulations), where for each (i) or (ii), such data is Customer Data.
9. i. “Processing” (including its root word, “Process”) means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
10. k. “Controller” means the entity which determines the purposes and means of the Processing of Personal Data.
11. l. “Processor” means the entity which Processes Personal Data on behalf of the Controller.
12. m. “Subprocessor” means an authorized third-party appointed by or on behalf of Xecurify to Process Personal Data.
13. n. “Standard Contractual Clauses” means the contract terms set forth in the annex to the European Commission’s decision 2021/914 of 4 June 2021 containing Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679
14. o. “Services” means all services that the Customer requests Xecurify to perform under the Agreement that involves Processing of Personal Data.
15. g. “Service Breach” means the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data Processed by Xecurify or its Subprocessors.

2. Customer Processing of Personal Data

1. 2.1 Customer Responsibilities:

   Customers shall, at all times Process Personal Data, and provide instructions for the Processing of Personal Data in compliance with the Data Privacy Laws. Customers shall ensure that its Instructions comply with all laws, rules and regulations applicable in relation to the Personal Data and that the Processing of Personal Data in accordance with Customer’s Instructions will not cause Xecurify to be in breach of the Data Privacy Laws. Customer is solely responsible for the accuracy, quality and legality of (i) Personal Data provided to Xecurify by or on behalf of Customer, (ii) the means by which Customer acquired any such personal Data, and (iii) the Instructions it provides to Xecurify regarding the Processing of such Personal Data. Customer shall not provide or make available to Xecurify any Personal Data in violation of the Agreement or which is otherwise inappropriate for the nature of the Service, and shall indemnify Xecurify from all claims and losses in connection therewith.




2. 2.2 Xecurify Responsibilities:

   Xecurify shall Process Personal Data only (i) for purposes set forth in the Agreement, (ii) in accordance with the terms and conditions set forth in this DPA and any other documented Instructions provided by Customer, and (iii) in compliance with the Directive and the GDPR. Customer hereby instructs Xecurify to Process Personal Data in accordance with the foregoing and as part of any Processing initiated by Customer in its use of Service.

3. Data Processing Detail

1. 3.1 Data Subjects:

   Customer may transfer Personal Data to Xecurify, the extent of which is determined in Customer’s sole discretion, and which may include Personal Data relating to: the following categories of Data Subjects: (i) the Customer's Authorized Individuals, employees, contractors or other Representatives, and (ii) Customer’s end users/customers.




2. 3.2 Processing Purpose:

   The Personal Information Customer provides is used for such purposes as answering questions, improving the content of the website,customizing the content, and communicating with the Visitors about Xecurify’s Services, including releases. This information helps to categorize the question, track potential problems and trends and customize Xecurify’s support responses to better serve the Customer. Xecurify shall keep Personal Data confidential and shall only Process Personal Data on behalf of and in accordance with Customer’s documented instructions for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Form(s); (ii) Processing initiated by Users in their use of the Service; and (iii) Processing to comply with other documented, reasonable instructions provided by Customer (for example, via email) where such instructions are consistent with the terms of the Agreement.
   Xecurify shall not be required to comply with or observe Customer’s instructions if such instructions would violate the GDPR or other EU law or EU member state data protection provisions.




3. 3.3 Scope of Processing:

   The subject-matter of the Processing of Personal Data by Xecurify is the performance of the Service pursuant to the Agreement, Identity and access management and related services pursuant to the Agreement. The duration of the Processing shall be for the Term of the Agreement. Personal Data within the Service post-termination of the Agreement will be retained and deleted in accordance with the Documentation. Sub-processors may only Process Personal Data as necessary for the performance of the Service pursuant to the Agreement and for the duration of the Agreement.




4. 3.4 Categories of Data:

   The Customer may transfer the following types of Personal Data for the purposes set out in this DPA:

   1. a. Identification and contact data (e.g. name, address, GPS location, contact details);
   2. b. General organizational data (such as your department, job title, area of responsibility);
   3. c. IT data (IP addresses, cookies data and usage data);
   4. d. Device specific Information(e.g. hardware model, operating system, web browser version, as well as unique device identifiers);
   5. e. Connection information (e.g. name of your mobile operator or ISP, browser type, language and time zone, and mobile phone number); and
   6. f. Other information voluntarily disclosed by Customer.

4. Data Subject Requests

To the extent legally permitted, Xecurify shall promptly notify Customer if Xecurify receives a request from a Data Subject to exercise the Data Subject's right of access, right to rectification, restriction of Processing, erasure (“right to be forgotten”), data portability, object to the Processing, or its right not to be subject to an automated individual decision making (“Data Subject Request”). Factoring into account the nature of the Processing, Xecurify shall assist Customer by appropriate organizational and technical measures, in so far as this is possible, for the fulfillment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws and Regulations. In addition, to the extent Customer, in its use of the Service, does not have the ability to address a Data Subject Request, Xecurify shall, upon Customer’s request, provide commercially reasonable efforts to assist Customer in responding to such Data Subject Request, to the extent that Xecurify is legally authorized to do so, and the response to such Data Subject Request is required under Data Protection Laws and Regulations. To the extent legally permitted, Customer shall be responsible for any costs arising from Xecurify’s provision of such assistance.

5. Authorized Employees/Xecurify Personnel

Xecurify shall use commercially reasonable measures to ensure the reliability and training of any employee, agent or contractor of any Authorized Employee or its personnel who may access the Personal Data. Xecurify shall ensure that Authorized Employees or its personnel are aware of the Confidential Information nature of the Personal Data and are bound by confidentiality agreements to Xecurify, during and after their engagement with Xecurify. Xecurify shall use commercial reasonable measures to limit access to Personal Data to only Authorized Individuals.

6. Subprocessor

1. 6.1: Customer acknowledges and agrees that Xecurify may (1) engage the Subprocessors mentioned below to this Agreement to access and Process Personal Data in connection with the Service and (2) continue to use those Subprocessors already engaged at the date of this Agreement, subject to Xecurify’s compliance with the obligations herein.
2. 6.2: Xecurify shall ensure that all Subprocessors have executed confidentiality agreements that prevent them from disclosing or otherwise Processing any Personal Data both during and after their engagement by Xecurify.
3. 6.3: Xecurify shall ensure that each Subprocessor is governed by a written contract that imposes data protection obligations at least as protective as this Agreement.

7. Xecurify’s Sub-processors

Customer acknowledges and agrees that (a) Xecurify’s Affiliates may be retained as Sub-processors; and (b) Xecurify and Xecurify’s Affiliates respectively may engage third-party Sub-processors in connection with the provision of the Service. Xecurify shall provide notification of a new Sub-processor(s) before authorizing any new Subprocessor(s) to process Personal Data in connection with the provision of the applicable Service.
Xecurify’s Subprocessor : Amazon Web Service(AWS)

8. Right to object to a new Sub-processor

In order to exercise its right to object to Xecurify’s use of a new Sub-processor, Customer shall notify Xecurify promptly in writing within ten (10) business days after receipt of Xecurify’s notice in accordance with the mechanism set out above. In the event Customer objects to a new Sub-processor, and that objection is not unreasonable, Xecurify will use reasonable efforts to make available to Customer a change in the Service or recommend a commercially-reasonable change to Customer’s configuration or use of the Service to avoid Processing of Personal Data by the objected-to new Subprocessor without unreasonably burdening the Customer. If Xecurify is unable to make available such change within a reasonable time period, which shall not exceed thirty (30) days, Customer may terminate the applicable Order Form(s) with respect only to those aspects of the Service which cannot be provided by Xecurify without the use of the objected-to new Sub-processor by providing written notice to Xecurify. Xecurify will refund Customer any prepaid fees covering the remainder of the term of such Order Form(s) following the effective date of termination with respect to such terminated Service.

9. Sub-processors and the Standard Contractual Clauses

Customer acknowledges and agrees that Xecurify may engage Sub-processors as described in this Section for the fulfillment of Xecurify’s obligations under Clause 9(a) of the Standard Contractual Clauses. The parties agree that the copies of the Sub-processor agreements that must be provided by Xecurify to Customer pursuant to Clause 9(c) of the Standard Contractual Clauses may have all commercial information, or clauses unrelated to the Standard Contractual Clauses or their equivalent, removed by Xecurify beforehand to protect business secrets or other confidential information; and, that such copies will be provided by Xecurify, in a manner to be determined in its discretion, only upon request by Customer.

10. Liability of Sub-processor

Xecurify shall be liable for the acts and omissions of its Sub-processors to the same extent Xecurify would be liable if performing the services of each Sub-processor directly under the terms of this DPA, except as otherwise set forth in the Agreement.

11. Security

Xecurify shall maintain appropriate organizational and technical measures for protection of the security (including protection against unauthorized or unlawful Processing, and against unlawful or accidental destruction, alteration or damage or loss, unauthorized disclosure of, or access to, Customer Data), confidentiality, and integrity of Customer Data. Xecurify regularly monitors compliance with these measures. Xecurify will not materially decrease the overall security of the Service during a subscription term.

12. Notifications Regarding Customer Data

Xecurify has in place reasonable and appropriate security incident management policies and procedures, and shall notify Customer without undue delay after becoming aware of the unlawful or accidental destruction, alteration or damage or loss, unauthorized disclosure of, or access to, Customer Data, including Personal Data, transmitted, stored or otherwise Processed by Xecurify or its Sub-processors of which Xecurify becomes aware (hereinafter, a “Customer Data Incident”). Xecurify shall make reasonable efforts to identify the cause of such Customer Data Incident, and take those steps as Xecurify deems necessary and reasonable in order to remediate the cause of such a Customer Data Incident, to the extent that the remediation is within Xecurify’s reasonable control. The obligations set forth herein shall not apply to incidents that are caused by either Customer or Customer’s Users.

13. Return of Customer Data

Xecurify shall return Customer Data to Customer and, to the extent allowed by applicable law, delete Customer Data, unless the retention of the data is requested from Xecurify according to mandatory statutory laws.

14. Authorized Affiliate

The parties agree that, by executing the DPA, the Customer enters into the DPA on behalf of itself and, as applicable, in the name and on behalf of its Authorized Affiliate(s), thereby establishing a separate DPA between Xecurify and each such Authorized Affiliate, subject to the provisions of the Agreement. Each Authorized Affiliate agrees to be bound by the obligations under this DPA and, to the extent applicable, the Agreement. An Authorized Affiliate is not and does not become a party to the Agreement, and is only a party to the DPA. All access to and use of the Service by Authorized Affiliate(s) must comply with the terms and conditions of the Agreement and any violation thereof by an Authorized Affiliate shall be deemed a violation by Customer.

15. Communication

The Customer that is the contracting party shall be responsible for coordinating all communication with Xecurify under this DPA, and shall be entitled to transmit and receive any communication in relation to this DPA on behalf of its Authorized Affiliate(s).

16. Confidentiality

Xecurify takes reasonable steps to ensure the reliability of its staff and any other person acting under its supervision who may come into contact with, or otherwise have access to and Process, Personal Data; ensure persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; and ensure that such personnel are aware of their responsibilities under this Data Protection Addendum and any Data Protection Laws (or Company’s own written binding policies are at least as restrictive as this Data Protection Addendum).

17. Standard Contractual Clauses

The Standard Contractual Clauses apply to: (i) the legal entity that has executed the Standard Contractual Clauses as a data exporter and its Authorized Affiliates and, (ii) all Affiliates of Customer established within the European Economic Area, Switzerland and the United Kingdom, which have signed Order Forms for the Service. For the purpose of the Standard Contractual Clauses the aforementioned entities shall be deemed “data exporters.” If necessary to fulfill its legal obligations, Customer may share a copy of the attached Standard Contractual Clauses with Data Subjects.

18. Audits

Subject to the confidentiality obligations set forth in the Agreement, Xecurify performs internal security audits periodically, and upon the request from the customer, can make available the audit reports to the customer.. Customers can perform third party security audits through independent Third Party Auditors of their choice, charges and expenses for such audits shall be borne by the customer. Before the commencement of any such audit, Customer and Xecurify shall mutually agree upon the scope, timing, and duration of the audit.

19. Limitation of Liability

The total liability of each of Customer and Xecurify (and their respective employees, directors, officers, affiliates, successors, and assigns), arising out of or related to this Agreement, whether in contract, tort, or other theory of liability, shall not, when taken together in the aggregate, exceed the limitation of liability set forth in the Agreement.
Claims from one party due to the other party’s non-compliance with this DPA shall be subject to the same limitations as in the Customer Use Agreement. In assessing whether the limitation is reached, claims under this Agreement and the Customer Use Agreement shall be viewed in conjunction, and the limitation in the Customer Use Agreement shall be viewed as a total limitation.

This Data Processing Addendum (DPA) is between you (‘Customer’, ‘client’, ‘you’, the ‘Controller’) and Xecurify Inc. (DBA miniOrange Security Software Private Limited, referred to herein as ‘miniOrange’, ‘Xecurify’, the ‘Processor’ or ‘we’).

PLEASE READ THIS AGREEMENT BEFORE USING ANY XECURIFY SOFTWARE OR SERVICES. BY DOWNLOADING, INSTALLING, OR USING ANY XECURIFY SOFTWARE OR SERVICES, YOU (“the Customer”) SIGNIFY ACCEPTANCE OF AND AGREE TO THE TERMS AND CONDITIONS OF THIS AGREEMENT.

“Customer” or “you” agree to the terms of this Agreement. If you are entering into this Agreement on behalf of a company or other legal entity, you represent that you have the authority to bind such entity and its Affiliates to this Agreement. If you do not have such authority, or if you do not agree with these terms and conditions, you must not accept this Agreement and may not use the Service. This Agreement is effective as of the date that you accept it.

1. Introduction

Our primary goal is to have a secure connection between people and technology. miniOrange believes in creating products and services that are secure, resilient, and assured. This agreement will let you know all the security policies and measures taken to protect the personally Identifiable Information. We have implemented various security measures to protect all personal information in accordance with industry standards.

2. miniOrange Roles and Responsibilities

Please note that this data processing addendum applies to clients or customers or you who are using miniOrange Products or services to provide Cloud and in-house based Solutions. These solutions will particularly require personal information about you or your employees to provide you with appropriate security.

Provided, miniOrange processes this data as a Data Processor when instructed, and the personal data is provided by its clients or you (or their representatives) to process the personal information. miniOrange will not be responsible for the privacy of the customer's or your personal information that is not described in this privacy policy.

3. Personal Data collection

This section applies to how miniOrange collects personal information in the following ways.

a. We collect the information about:

1. You create an account or register with us, such as Name, email address, contact information, Company Name, and Designation.

2. When you contact our customer support, we collect information such as name, email address, and phone number to contact you back for resolving the queries. The Personal Information you provide is used for such purposes as answering questions, improving the content of the website, customizing the content, and communicating with the website visitors about miniOrange’s Services, including specials and new features. This information helps us to categorize the question, track potential problems and trends, and customize our support responses to better serves you.

3. When you use our services, we also collect device-specific information (e.g., mobile and desktop) from you in order to provide the Services. Device-specific information includes attributes (e.g., hardware model, operating system, web browser version, as well as unique device identifiers), connection information (e.g., name of your mobile operator or ISP, browser type, language and time zone, and mobile or phone number) ; and device locations (e.g. internet protocol addresses and Wi-Fi). This information is particularly useful for providing you with the services.

4. We send your agreement details, such as signature and payment details, and use third-party payment processing services to collect the payments. This information will include your billing address, billing name, and credit card details, in order to receive payment for some products and services.

5. We may use some third-party services to improve our functionalities. These services may require cookies, sessions, and metadata to be stored on our part. Cookies are stored in Xecurify’s browsers. Sessions are stored on our servers or in cookies. Metadata is stored on the servers of our third-party service providers (currently AWS), according to their policies, and data shall be duly encrypted. This type of data will allow us to understand what type of individuals are using our services, products, and websites.

6. We also have to collect the device data to understand the different types of users on different devices at different locations, which will allow us to improve our website, products, and services. These third-party service providers are only used to collect some limited information to improve our services, not to use or disclose for other purposes.

b. Sub-processors

miniOrange uses AWS as a sub-processor for hosting the cloud solution. miniOrange cloud solution is hosted on AWS on the US Server located in North Virginia and the EU Server located in Stockholm, Sweden. Look at AWS EU data protection from here - https://aws.amazon.com/compliance/eu-data-protection/. miniOrange does not assign any other sub-processors unless required or authorized by the company.

In case of any change, modification, upgradation, addition, substitution, etc. in the sub-processors, all the change information is conveyed to the customer or you via a notification email. The Customer shall have the right to object in writing to any changes to the Controller’s or sub-processors within ten (10) business days following receipt of notice of such change. If you and miniOrange cannot mutually agree to a reasonable resolution to the Customer’s objection, either party may terminate the Agreement (including the service) upon written notice to the other party within thirty (30) days of the date of notification of the change.

4. Security & Confidentiality of Collected Data

miniOrange maintains and uses reasonable administrative, organizational, technical, and physical safeguards to protect your information from loss, destruction, misuse, unauthorized access, or disclosure, as required by the applicable Data Protection Laws. These technologies help ensure that your data is safe, secure, and only available to you and to those you provided authorized access (e.g., your users).

A. Security Practices

1. a. miniOrange takes several steps to secure data. For all queries, retrievals, and bulk updates, the miniOrange service returns or updates only validated data. All miniOrange system responses to a request are subject to any access restrictions in place for that customer and their miniOrange registered users. This user/customer relationship is revalidated on every request to ensure that only authorized users within the customer’s subdomain view the data.
2. b. Our state-of-the-art encryption technology protects customer data both at rest and in transit to the user’s browser, leaving no weak spots for attackers. miniOrange encrypted DB instances provide an additional layer of data protection by securing your data from unauthorized access to the underlying storage. We use Amazon RDS encryption to increase data protection of applications deployed in the cloud and to fulfill compliance requirements for data-at-rest encryption.
3. c. miniOrange uses Amazon KMS (key management service) to encrypt data symmetrically. This uses cryptographic keys for our applications and is a useful technique for data encryption. miniOrange uses different versions of RSA, DSA, TRIPLE-DES, AES, and HMAC as required.
4. d. All access to miniOrange uses the HTTPS protocol. Customers are assigned their own domains, sub-domains, and cookies.
5. e. miniOrange uses strong encryption to secure sensitive customer data, such as unique SAML keys that are created for authentication. We also store and encrypt credentials that users submit for secure browser applications (apps), configured within their SSO environment.
6. f. miniOrange does not implement any proprietary encryption. Customer data encryption is performed at the application layer. The use of application-level encryption protects sensitive data, even in the event of partial compromise.
7. g. miniOrange encrypts the customer's confidential data in the database. The encryption is performed using symmetric encryption 256-bit AES with exclusive keys. Customer-exclusive symmetric keys ensure data segregation.
8. h. Amazon Web Services (AWS) - provides the infrastructure that hosts miniOrange’s Identity-as-a-Service platform. AWS SOC 2 report is available here: https://aws.amazon.com/artifact/.
9. i. For more information on security practices: https://www.miniorange.com/terms-and-policies/security-practices.

B. Confidentiality of Processing.

1. a.1 We shall ensure that all persons it authorizes to process personal data under this Agreement, including its employees, agents, contractors, and sub-processors, are bound by appropriate obligations of confidentiality with respect to such personal data. In particular:
2. a.2 We shall ensure that such persons are informed of the confidential nature of the Personal Data and have received appropriate training regarding their responsibilities for protecting Personal Data under this Agreement and applicable Data Protection Laws;
3. a.3 We shall ensure that access to Personal Data is limited to those individuals who require such access to perform the obligations under this Agreement;
4. a.4 We shall ensure that such persons are subject to written confidentiality agreements imposing confidentiality obligations that survive the termination of their engagement; and
5. a.5 We shall take reasonable steps to ensure the reliability and integrity of any person who may have access to the Personal Data.

Reference to “Data Protection Laws” under this Agreement shall include reference to the EU GDPR, the Digital Personal Data Protection Act 2023 (DADPA), and any other data protection law applicable to the processing of personal data under this Agreement.

5. Information collected on behalf of Customers using our Services.

We collect information under the direction of our customers and have no direct relationship with the individual Users/employees whose personal data we processes.We work with our customers to help them provide notice to their employees or individuals concerning the purpose for which personal information is collected. We collect information for our customers.

If an employee or representative of one of our customers no longer likes to use our service/s, they may do so by contacting us directly. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data, should direct their query to the client or us. If the client’s Customer requests that we delete the data, we will respond to their request within 10 business days.

We will retain Personal Information we process on behalf of our customers for as long as needed to provide services to our customers, unless instructed otherwise by the customer or the owner of the personal data. We will retain and use this Personal Information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, i.e. in accordance with the applicable Data Protection Laws.

6. Data Subject Rights

a. Notification of Requests

1. We shall promptly notify you if we receive any request from a Data Subject in relation to Personal Data processed under this Agreement, including but not limited to requests to access, rectify, erase, restrict, object to Processing of Personal Data, or exercise rights to data portability (“Data Subject Request”).

b. No Direct Response Without Instructions-

1. We will not respond to any Data Subject Request without your prior instructions, unless legally required to do so under applicable law. In such a case, we shall, to the extent permitted by law, inform you of that legal requirement before responding.

c. Assistance to you-

1. We shall provide reasonable assistance to you, taking into account the nature of the Processing, by implementing appropriate technical and organizational measures, to enable you to fulfill your obligations to respond to Data Subject Requests under applicable Data Protection Laws.

7. Data Retention

We retain personal information we collect from you where we have an ongoing legitimate interest to do so (for example, to comply with applicable legal, tax, or accounting requirements, to enforce our agreements, or comply with our legal obligations).

When we have no ongoing legitimate interest need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing, until deletion is possible.

When processing Subscriber Data on behalf of our Subscribers, we will retain Subscriber Data for as long as the Subscriber instructs us to and/or as required by applicable law.

8. Data Breaches

We notify you without undue delay and in any event within twenty-four (24 hours) of becoming aware of a Personal Data Breach affecting Personal Data. We will provide all available details and cooperate with you to investigate and respond to the breach, including assisting with any legal or regulatory notifications required under Data Protection Laws.

9. Dispute Resolution and Complaints

The Parties shall cooperate to promptly resolve any disputes or complaints arising under this Agreement, including any inquiries or complaints from Data Subjects or supervisory authorities. If resolution is not reached within thirty (10) days, either Party may pursue remedies in accordance with the US law and Wyoming jurisdiction provisions of this Agreement.

10. Legal Bases for Processing Personal Data (for the United Kingdom and European Economic Area, and other relevant jurisdictions)

If you are an individual in the United Kingdom, the European Economic Area (EEA), or of another relevant jurisdiction, we collect and process information about you only where we have a legal basis for doing so under applicable laws. The legal bases depend on the products and services that your organization has purchased from Xecurify, how such products and services are used, and how you choose to interact and communicate with Xecurify’s websites, systems, and whether you attend Xecurify events. This means we collect and use your Personal Data only where:

1. a. We need it to operate and provide you with our products and services, provide customer support and personalized features, and to protect the safety and security of our products and services;
2. b. We have a legitimate interest (which shall not legally be overridden by your data protection interests and rights, in accordance with the GDPR), such as for research and development, to provide information to you about our products and services that you and your organization requested, and to protect our legal rights and interests;
3. c. You give us consent to do so for a specific purpose, or we need to comply with a legal obligation.
4. d. If you have consented to our use of Personal Data for a specific purpose, you have the right to change your mind at any time, but this will not affect any processing that has already taken place. Where we are using your Personal Data because we or another entity (for example, your employer) has a legitimate interest in doing so, you have the right to object to that use.
5. e. If we de-identify any Personal Data for further use, we commit to maintain and use the information in de-identified form and will not attempt to re-identify the information, except to determine if our de-identification processes satisfy applicable legal requirements.

11. Indemnity and Limitation of Liability

1. a. Indemnity by Customer

The Customer (Data Controller) shall indemnify, defend, and hold harmless the Service Provider (Data Processor), its affiliates, officers, employees, and agents (“Indemnified Parties”) from and against all direct losses, claims, liabilities, damages, penalties, costs, and expenses (including reasonable legal fees) suffered or incurred by the Indemnified Parties, arising from or in connection with:

1. any breach by the Customer of this Data Processing Addendum or applicable Data Protection Laws;
2. the Customer’s instructions, where such instructions infringe any law or regulation or the rights of any third party;
3. the negligence, bad faith, or willful misconduct of the Customer, its employees, or agents.

2. b. Exclusion of Indirect Losses

The Service Provider shall not be liable to the Customer, whether in contract, tort (including negligence), or otherwise, for any:

1. loss of profit, loss of business or contracts, loss of goodwill, loss of anticipated savings, or loss or corruption of data,
2. or any indirect, special, incidental, punitive, exemplary, or consequential damages arising out of, or in connection with, this Data Processing Addendum—even if advised of the possibility of such losses.
3. c. Limitation of Liability

To the extent permitted by applicable law and except for liabilities that cannot be excluded or limited (as provided below), the total aggregate liability of the Service Provider under or in connection with this Data Processing Addendum (whether in contract, tort, negligence, breach of statutory duty, or otherwise) shall be limited to the total fees paid or payable by the Customer to the Service Provider under this DPA in the twelve (12) months immediately preceding the event giving rise to the liability.

4. d. Nothing in this Agreement shall:

(i) limit or exclude either Party’s liability for death or personal injury resulting from its own negligence;

(ii) limit or exclude liability for fraud or fraudulent misrepresentation;

(iii) limit or exclude any liability that cannot be limited or excluded under applicable law.

5. e. Data Breach Liability

The Service Provider’s liability for a personal data breach (as defined under applicable Data Protection Laws) shall be limited as specified above unless such breach is directly and solely caused by the gross negligence or willful misconduct of the Service Provider.

12. Termination

This Agreement shall be effective from the date when it is accepted, after which date the terms of the MSA shall also become effective. This Agreement shall continue in effect throughout the duration of the MSA and until the MSA or the services are terminated, whichever occurs in the latest.

1. a. Also, either party may terminate the Agreement by giving to the other party not less than 30 days' written notice of termination.
2. b. Either party may terminate this Agreement immediately by giving written notice of termination to the other party if the other party commits a material breach of this Agreement, subject to applicable law.
3. c. Either party may terminate this Agreement immediately by giving written notice of termination to the other party if: the other party:
1. (i) Dissolved;
2. (ii) Ceases to conduct all (or substantially all) of its business;
3. (iii) Is or becomes unable to pay its debts as they fall due;
4. (iv) Is or becomes insolvent or is declared insolvent; or
5. (v) Convenes a meeting or makes or proposes to make any arrangement or composition with its creditors;
4. d. An administrator, administrative receiver, liquidator, receiver, trustee, manager, or similar is appointed over any of the assets of the other party;
5. e. An order is made for the winding up of the other party, or the other party passes a resolution for its winding up (other than for the purpose of a solvent company reorganization where the resulting entity will assume all the obligations of the other party under this Agreement);

13. Effects of termination

Upon the termination of this Agreement, all of the provisions of this Agreement shall cease to have effect, save that the following provisions of this Agreement shall survive and continue to have effect (in accordance with their express terms or otherwise indefinitely): Clauses 3, 7, and 10.

Except to the extent expressly provided otherwise in this Agreement, the termination of this Agreement shall not affect the accrued rights of either party.

14. Notices

Any notice from one party to the other party under this Agreement must be given by one of the following methods: (a) delivered personally; (b) sent by courier; (c) sent by recorded signed-for post; (d) sent by email; or (e) submitted using recipient party’s online contractual notification facility.

The parties’ contact details for notices shall be those under Clause 17, unless either one of the parties informs the other party otherwise (in writing).

15. Standard Contractual Clauses

The Standard Contractual Clauses (“SCCs”) apply to a) the legal entity that has executed the Standard Contractual Clauses as a data exporter and its Authorized Affiliates and, b) all Affiliates of Customers established within the European Economic Area, Switzerland, and the United Kingdom, which have signed Order Forms for the Service. For the Standard Contractual Clauses, the aforementioned entities shall be deemed “data exporters.” If necessary to fulfill its legal obligations, Customer may share a copy of the attached Standard Contractual Clauses with Data Subjects. The applicable version of the SCC’s shall be the version issued in 2021 by means of Commission Implementing Decision EU 2021/914.

16. Governing Law

These Terms and any dispute arising out of or related to these Terms shall be governed by the laws of the State of Wyoming, USA, without regard to its conflict of laws rules.

17. Changes in the Agreement

We will notify you when we change this Agreement. We may change this Agreement from time to time. If we make significant changes in the way we treat your personal information or to the Agreement, we will provide notice by posting on the Website or sending an email before the change becomes effective, unless such amendment is in accordance with law or mandated by the applicable supervisory authority for data protection. In the event that you disagree with the amendments to this Agreement, you may notify us accordingly and terminate use of the services.

18. Contact

If you would like to contact us with questions or concerns about our privacy policies and practices, you may contact us via any of the following methods:

Email us at: info@Xecurify.com Or call us at +1 978 658 9387

Or you can fill out a form with your question/concern: https://www.miniorange.com/contact.

NOW, THEREFORE, THIS AGREEMENT WITNESSETH AND IT IS HEREBY AGREED BY AND BETWEEN THE PARTIES HERETO AS FOLLOWS: