TERMS OF SERVICES – BUSINESS

As of July 23, 2018

These terms and conditions (this “Agreement“) are between the company identified within this sign-up page (“Customer“) and Upflex, Inc., a Delaware corporation (“Upflex“).

This Agreement sets forth the terms and conditions under which a Customer may use Upflex website/app, including all information, tools and services available from this site to you, the Customer, conditioned upon your acceptance of all terms, conditions, policies and notices stated here. Customer’s use of Upflex is subject to this Agreement, as may be modified or updated by Upflex from time to time, effective upon posting of an updated version of the Agreement at www.upflex.com/legal/business, as well as the terms of Service posted at www.upflex.com/legal/user. Upflex will provide Customer with a notice of any such modifications or updates via email and/or the Dashboard, and Customer is responsible for regularly reviewing this Agreement. Continued use of Upflex website / app after any such modifications or updates shall constitute Customer’s consent to such changes.

1. DEFINITIONS

Active Account” has the meaning set forth in Section 2.3.

Administrator” has the meaning set forth in Section 3.1.

Upflex Business Account” means an enterprise business portal for the Upflex Service provided by Upflex to the Customer that  Account Administrator name and contact details, Subscription information and history, billing information and history, interaction records, and payment information and history.

Customer User” means an individual authorized to use Upflex Services  in connection with use of the Upflex Services, and linked to Customer Billing via that individual’s Active Account, each as identified by Customer to Upflex as set forth in this Agreement.

Dashboard” has the meaning set forth in Section 3.1.

Dashboard Data” has the meaning set forth in Section 3.1.

Data Protection Law” means all laws and regulations applicable to the personal data under the Agreement, including as applicable the laws and regulations of the European Union, the European Economic Area and their member states, Switzerland and the United Kingdom, including the EU General Data Protection Regulation (2016/679) (“GDPR”).

End User Terms” means the terms and conditions applicable to all users of the Upflex Service, available at www.Upflex.com/legal/user, as may be updated by Upflex from time to time.

Linking Data” has the meaning set forth in Section 2.4.

Monthly Statement” has the meaning set forth in Section 5.2.

Monthly Billing” has the meaning set forth in Section 5.2.

Personal Data” means any information Customer obtains from Upflex in connection with this Agreement that can reasonably be used to identify an individual, including but not limited to Dashboard Data as defined in Section 3.1, or that may otherwise be considered personal data.

Proposed User” has the meaning set forth in Section 2.3.

Service Fee” means the service fees applicable to User Charges and/or Customer’s use of the Upflex Services, if any, as set forth on the account creation form associated with this Agreement or otherwise agreed to between Upflex and Customer.

Term” has the meaning set forth in Section 6.1.

Upflex App” means Upflex’s mobile application or website (upflex.com) required for use of the Upflex Service, as may be updated by Upflex from time to time.

Upflex Service” means Upflex’s technology platform that, when used in conjunction with the Upflex App, enables users to request on-demand office space from independent providers.

User Charges” means charges incurred by Customer Users for office space obtained through the use of the Upflex Service, including any applicable taxes or other charges that may be due for a particular use of the Upflex Service.

The terms “controller“, “data subject“, “personal data“, “processing“and “processor” as used in this Agreement have the meanings given in the GDPR.

2. PROVISION OF SERVICES

2.1 Access to Services.

A Customer corporate account can be established by Signing up directly on Upflex website or Upflex Account Manager will establish a customer corporate account  The person who submits the Sign Up Form is the Account Administrator. In concluding this Agreement, the Account Administrator represents and warrants they: (i) are an authorized representative of Customer and have full legal authority to bind Customer to this Agreement; (ii) have read and understand this Agreement; and (iii) agree on Customer’s behalf to this Agreement in its entirety. If the Account Administrator does not, or is not able to make the foregoing representations and warranties, they must not click the “I Accept” button as they are prohibited from registering an Upflex Account in Customer’s name.  

As part of the corporate account, Customer agrees to provide and maintain during the Term one or more valid Customer credit card numbers (the “Customer Card“) that may be charged for Upflex services as set forth herein. Using such corporate account, Customer, at its discretion, may permit Customer employees ( referred to as Customer User) with an Active Account to employ Customer Billing when using the Upflex Service. Customer acknowledges a Customer User employing Customer Billing will be incurring User Charges to the account of Customer, and not to the Customer User’s personal account or credit card, and Customer agrees to pay all User Charges incurred under Customer Upflex Account, as well as any applicable Services Fees, in accordance with the terms and conditions of this Agreement. Subject to Customer’s compliance with this Agreement, Upflex agrees to use reasonable efforts to provide the Upflex Service, web / app access to Customer and the Customer Users as set forth herein.

2.2 [RESERVED]

2.3 Active Account Required.

(a) Customer acknowledges and agrees that before an employee authorized by Customer (“Proposed User“) can employ the Upflex Service pursuant to this Agreement, such Proposed User must (1) install or access the Upflex App on a compatible mobile device, (2) register for and maintain during the Term an active personal user account for the Upflex Service, which registration requires the entry of certain Proposed User personal data, and (3) confirm the mobile number provided during the registration process (“Active Account“). Upflex’s collection and use of any personal data to establish an Active Account shall be as set forth on the Upflex Privacy Policy, available at www.upflex.com/legal/privacy, as may be updated by Upflex from time to time.

(b) Customer acknowledges that certain Proposed Users may be suspended or banned from use of the Upflex Service due to future or past violations of the End User Terms (“Violations“), and that Upflex has no obligation or liability related to a Proposed User that is unable to obtain or maintain an Active Account for the purposes of Upflex services hereunder due to Violations.

2.4 User Account Linking

(a) To enable Upflex Services a Proposed User with an Active Account, Customer must provide Upflex with (1) such Active Account holder’s full name, (2) the Active Account holder’s email address on the top level domain of Customer (e.g., [email protected]), and (3) other identifying information about the Active Account holder as reasonably requested by Upflex (“Linking Data“). Upflex will use the Linking Data provided by Customer for the purpose of (x) authenticating the identified Active Account holder and linking such Active Account with the Customer Billing option to establish the Active Account holder as a Customer User, and (y) verifying the Customer Upflex Account status of such Customer User from time to time during the Term (for more information see Annex 1). All Proposed Users invited to enable Upflex services will receive an email to download the Upflex app.  Upon completing the Account activation steps the Proposed User account will be linked to the Customer Upflex Business Account. The Customer User shall be provided the option,to book desks, meeting rooms and private offices, to apply User Charges to the Customer Upflex Business account via the Customer credit card on file.

(b) Customer acknowledges that the verification and linking described in Section 2.4(a) will require Upflex to contact each such Proposed User using the Linking Data, and Customer agrees to inform, and get all necessary consents from, each Proposed User for Upflex to contact such Proposed User for the purpose of implementing the Upflex services  option in the applicable Active Account. Customer shall ensure that Linking Data provided to Upflex is accurate and complete, and Upflex shall not be liable to Customer, a Customer User, a Proposed User or any other party with respect to inaccurate or incomplete Linking Data supplied by Customer.

(c) Customer agrees to (1) notify each Proposed User that by linking Proposed User’s personal Active Account with Customer’s account for Upflex Billing that Upflex will provide Customer with detailed booking information for the charges to Customer’s account, and (2) to obtain any necessary consent from each Customer User for Upflex to share detailed booking information with Customer.

(d) A Customer User’s personal account may be unlinked from Customer’s account and the Upflex service option at any time by (1) Customer unlinking such Customer User through the Dashboard, or (2) the Customer User deleting the Upflex Service option from the Active Account.

2.5 Responsibility for User Activity.

Customer agrees that (a) Customer is responsible for all User Charges incurred by Customer Users on a then-current authorized Customer User list via the Upflex Account portal  option, regardless of whether such User Charge was authorized between Customer User and Customer and (b) User Charges may be subject to price changes at any time. Further, Customer agrees that Upflex shall not be responsible for User Charges incurred by a Customer User after Customer has attempted removal of such Customer User from the Upflex Service option to the extent Customer provides incomplete or inaccurate Customer User removal information via the Dashboard. Finally, as between Customer and Upflex, Customer shall be responsible for the User Charges incurred due to fraudulent or other unpermitted activity on the part of Customer User’s use of Customer Billing for the Upflex Service. Customer shall notify Upflex promptly upon discovery of fraudulent or unpermitted activity occurring under Customer’s account.

2.6 Restrictions.

Customer agrees to, and to cause all Customer Users to, use the Upflex Service and Upflex App solely as set forth in this Agreement and the End User Terms; provided, however, that in the event of a conflict between this Agreement and the End User terms with respect to Customer or any authorized Customer User employing Upflex Account  with the Upflex Service, the terms of this Agreement shall control. Upflex reserves the right to suspend participation in Customer Billing to Customer and/or any Customer Users for violations of this Agreement or the End User Terms. In the event that a Customer User’s Active Account is suspended or terminated pursuant to the End User Terms, such Customer User’s access to Upflex service shall also be suspended. Customer shall not, and shall not authorize others to, (a) decompile, disassemble, reverse engineer or otherwise attempt to derive the source code or underlying technology, methodologies or algorithms of the Upflex Service or Upflex App, except to the extent allowed by applicable law, (b) sublicense, lease, rent, sell, give, or otherwise transfer or provide the Upflex Service or Upflex App to any unaffiliated third party, (c) upcharge, increase or otherwise modify the User Charges as calculated through the Upflex App for any usage of the Upflex Service or (d) impose any additional fees or charges on a Customer User related to use of the Upflex Service. Upflex reserves all rights not expressly granted to Customer or Customer Users under this Agreement.

3. ACCOUNT ADMINISTRATION

3.1 Customer Dashboard.

Customer shall be provided with access to Upflex’s browser-based online dashboard (“Dashboard“). Upflex’s primary contact with Customer shall be by way of Customer’s administrator set forth on the account creation form associated with this Agreement (“Administrator“). Upflex will inform the Administrator of Dashboard login credentials. The Dashboard will enable Customer to (a) view a current list of all Proposed Users who have been invited to, and Customer Users who have linked to, Customer Billing, (b) provide additional Linking Data to invite additional Proposed Users, (c) revoke any Customer User’s access to Customer Billing, (d) view detailed usage information, which may include, without limitation, Customer User name together with locations, duration, fees (“Dashboard Data“) and prepare and review activity reports using Dashboard Data, (e) disable all current Customer Users of Customer Billing, (f) manage and update the Customer Card on file, all customer payment information resides in Stripe but we allow Customer to update and manage their credit card information from the Upflex Business Account Portal  (g) review and manage payment statements, as applicable, (h) settle outstanding balances on the Customer account, and (i) view current, appoint new, and remove Administrators (for more information see Annex 2 ). Customer agrees to use Dashboard Data solely for legitimate business purposes including, but not limited to, business expense processing, accounting, and budgeting purposes. Upflex reserves the right to add, remove and update features and functionality of the Dashboard at any time.

3.2 Administration.

Customer may appoint additional administrators at its discretion, and Upflex will cooperate with Customer to inform new administrators of Dashboard login credentials. Customer agrees to (a) maintain all Dashboard login credentials in confidence, (b) only permit the lead Administrator and Customer’s other authorized administrators to access the Dashboard, and (c) update all information of the lead Administrator and other authorized administrators to ensure that it is current, accurate, and complete. Customer shall limit access to Dashboard Data to only those Customer personnel who have a legitimate business need to access such Dashboard Data. Customer shall be responsible for all activity that occurs under its Dashboard login credentials.

3.3 Customer User Updates.

It is Customer’s sole responsibility to keep and maintain an accurate list of current authorized Customer Users entitled to access Customer Billing via the Dashboard. Upflex may review the current list of Customer Users from time to time via the Dashboard to maintain and support the Upflex App and Upflex Service and ensure compliance with this Agreement.

4. PRIVACY AND DATA SECURITY

4.1 Roles of Parties

Upflex is the data controller of the Personal Data (which includes Dashboard Data) and the processor of Linking Data. The processing of Linking Data is further detailed in Annex 1. Customer is the data controller of the Linking Data and (joint)controller of the Dashboard Data. The processing of Dashboard Data is further detailed in Annex 2. Upflex determines the purposes and means of processing for the Personal Data and Customer determines the purposes and means of processing the Linking Data and Dashboard Data. Each Party will individually inform data subjects and allow data subjects to exercise their rights under the GDPR (if applicable); and will comply with the obligations applicable to it under the Data Protection Law with respect to the processing of Personal Data, Dashboard Data and Linking Data.

4.2 Data Restrictions.

Customer agrees that any Personal Data obtained in connection with this Agreement shall be used solely in connection with the use of the Upflex Services, and for no other purpose, unless expressly authorized in writing by Upflex. Customer shall not use Personal Data in any way that harms Upflex or that benefits a competitor of Upflex. Customer agrees that it shall not disclose Personal Data to any third parties, except as necessary to use the Upflex Services. Customer shall not rent or sell Personal Data for any purpose.

4.3 Security.

Customer agrees to implement appropriate legal, technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against unauthorized loss, destruction, damage, alteration, or disclosure, as well as any breach or attempted breach of Customer security measures (“Information Security Incident“). Customer shall promptly notify Upflex in the event that Customer learns or has reason to believe that an Information Security Incident has occurred including at least: (1) the nature of the breach of security measures; (2) the types of potentially compromised Personal Data; (3) the duration and expected consequences of the Information Security Incident; and (4) any mitigation or remediation measures taken or planned in response to the Information Security Incident. Upon any such discovery, Customer will (a) take all reasonable steps to investigate, remediate, and mitigate the effects of the Information Security Incident, and (b) provide Upflex with assurances reasonably satisfactory to Upflex that such Information Security Incident will not recur. Additionally, if and to the extent any Information Security Breach occurs as a result of an act or omission of Customer, and if Upflex determines that notices (whether in Upflex’s or Customer’s name) or other remedial measures are warranted, Customer will, at Upflex’s request and at Customer’s cost and expense, undertake the aforementioned remedial actions.

5. FEES AND PAYMENTS

5.1 Fees.

In consideration of Upflex’s provision of the Upflex Services and Upflex Business Account as set forth herein, Customer shall pay to Upflex all User Charges and any applicable Services Fees Upflex may charge for certain functionality and features (collectively, the “Fees“) on the terms set forth below.

Upflex offers three types of inventory that Customer User’s can book.

  • Desks
  • Private Offices
  • Meeting Rooms

Upflex charges a standardized fee for usage of desk.   Meeting room & Private office fees vary depending on the number of attendees and duration of the booking session.   The fee schedule for the various inventory type are provided by the Upflex Account Manager.

Upflex charges customer  either (a) by direct charge to a Customer credit card, or (b) if Upflex has approved monthly billing for Customer, subject to a monthly statement delivered by Upflex to Customer on a monthly basis.

Session Duration

All booking sessions must be minimum of one hour or otherwise stipulated by the venue

If the Customer employee checks out earlier then an hour the Customer User will still be charged for the full hour or the stipulated minimum time commitment specified by the venue

A Customer User must check In via the Upflex App or by the Customer service to start their session time and Check Out at the end each session.  If the Customer User forgets or does not check out the Customer will be charged a check out fee of $56 per session.

Cancelation

Customer User’s must cancel any bookings within 24 hours of a user’s booking in order receive a full refund.  The Customer will be charged the full amount of the booked session if the Customer User cancels after the 24 hour window.  

5.2 Payment Terms.

Subject to terms and conditions determined by Upflex in its sole discretion. Upflex provides Customers with 3 payment terms. Pay as you Go, Monthly Subscription and Net 30 terms.   

Pay as you Go

Upflex shall charge the Customer  for Fees at the end of each Customer User’s booking session utilizing Customer Billing information on file.

Prepaid Monthly Subscription

Customers can purchase a Upflex monthly subscription for a set number of hours.  Customer will pay the monthly subscription at the start of the billing cycle and Customer User’s usage fees will be deducted from the monthly hours purchased.  Upflex will automatically bill the Customer separately for any overage of usage at the same rate as the monthly subscription price.

Net 30 Terms

Customer may qualify to receive net 30 monthly statements (each, a “Monthly Statement“) for Fees incurred by Customer Users during the preceding month (“Monthly Billing“). If Customer qualifies for, and elects to participate in, Monthly Billing through the Dashboard, Fees shall be billed to Customer monthly as set forth in an applicable Monthly Statement, and each such Monthly Statement shall be payable in full by Customer within 30 days of receipt of such Monthly Statement.

Unless otherwise indicated on a Customer User receipt, all Fees are exclusive of applicable taxes, and Customer agrees to be responsible for the payment of any such taxes assessed on Fees, including, but not limited to, all sales, use, VAT or similar taxes, except for taxes based on Upflex’s income. All payments shall be processed in United States dollars. All payments are nonrefundable except as may be expressly provided otherwise herein.

5.3 Nonpayment.

Upflex reserves the right to immediately charge the Customer Card in the event that any Monthly Statement has not been paid as of the applicable due date. Upflex reserves the right to immediately suspend Customer’s account and suspend any or all Customer Users in the event of any unpaid Fees by Customer due to past due Monthly Statements (as applicable), an invalid credit Customer Card on the Customer account, or a rejected Customer Card transaction. Upflex further reserves the right to pursue any and all remedies available to it under applicable law, including reporting Customer to applicable credit reporting agencies, in the event of any unpaid Fees hereunder. Establishing a Customer account after full payment of late Fees shall be at Upflex’s sole discretion. All late payments shall bear interest at 3% per month or the maximum allowed by applicable law, if less than 3%.

6. TERM AND TERMINATION

6.1 Term.

This Agreement shall commence on the Effective Date and shall remain in effect until terminated as set forth herein (the “Term“).

6.2 Termination.

Either party may terminate this Agreement with or without cause upon five days’ advance written notice to the other party. All outstanding payment obligations and Sections 4-100 of these Terms shall survive the termination of this Agreement.

7. WARRANTY AND DISCLAIMER OF LIABILITY

7.1 Mutual Warranties.

Each party represents and warrants that: (a) such party has the full right, power and authority to enter into this Agreement; and (b) such party’s acceptance of this Agreement, as well as such party’s performance of the obligations set forth in this Agreement, does not and will not violate any other agreement to which such party is a party.

7.2 Customer Warranties.

Customer represents and warrants that: (a) Customer has all rights and permissions necessary to provide Upflex with the Linking Data and any other information provided to Upflex hereunder in connection with the Upflex Service and Upflex Business Account; (b) Customer has obtained legally-adequate consent from Proposed Users and Customer Users as necessary to provide Upflex with any personal data in connection with the Upflex Service, (c) Customer has notified, and obtained legally adequate consent from, Proposed Users and Customer Users that Upflex will provide Customer with detailed information regarding the usage of office space that is charged to Customer’s account, and (d) Customer is in compliance, and shall remain in compliance during the Term of the Agreement, with all applicable local, city, state, federal, national, and international laws, rules and regulations relating to data protection, privacy, identity theft, data breach, consumer protection, and data security, and any applicable industry standards relating to privacy and data security.

7.3 Disclaimer of Warranties.

EXCEPT AS EXPRESSLY PROVIDED HEREIN, UPFLEX PROVIDES THE UPFLEX SERVICE AND UPFLEX APP “AS IS”AND WITHOUT WARRANTY. UPFLEX DOES NOT WARRANT THAT THE FUNCTIONS CONTAINED IN THE UPFLEX SERVICE AND UPFLEX APP WILL MEET CUSTOMER’S REQUIREMENTS OR THAT THE OPERATION OF THE UPFLEX SERVICE OR UPFLEX APP WILL BE UNINTERRUPTED OR ERROR FREE. UPFLEX HEREBY DISCLAIMS ALL OTHER WARRANTIES WITH RESPECT TO THIS AGREEMENT, WHETHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, (A) ANY IMPLIED OR STATUTORY WARRANTIES COVERING THE UPFLEX SERVICE OR THE UPFLEX APP, AND (B) ANY IMPLIED WARRANTIES OF MERCHANTABILITY, NONINFRINGEMENT OR FITNESS FOR A PARTICULAR PURPOSE.

8. LIMITATIONS OF LIABILITY

OTHER THAN WITH RESPECT TO A BREACH OF CONFIDENTIALITY, (A) IN NO EVENT SHALL UPFLEX OR CUSTOMER BE LIABLE FOR ANY INDIRECT, PUNITIVE, INCIDENTAL, EXEMPLARY, SPECIAL OR CONSEQUENTIAL DAMAGES, OR FOR LOSS OF BUSINESS OR PROFITS, SUFFERED BY THE OTHER PARTY OR ANY THIRD PARTY ARISING OUT OF THIS AGREEMENT, WHETHER BASED ON CONTRACT, TORT OR ANY OTHER LEGAL THEORY, EVEN IF UPFLEX OR CUSTOMER (OR THEIR AGENTS) HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND (B) IN NO EVENT SHALL EITHER PARTY BE LIABLE UNDER THIS AGREEMENT FOR ANY DIRECT DAMAGES IN AN AMOUNT EXCEEDING THE GREATER OF (X) $100,000, AND (Y) THE TOTAL FEES PAYABLE BY COMPANY TO UPFLEX HEREUNDER.

9. PROPRIETARY RIGHTS.

9.1 No Publicity.

Neither party may use or reference the other party’s name, logo, trademarks or service marks in a press release or otherwise without the prior consent of such other party in each instance.

9.2 Ownership.

Upflex and its affiliates are and shall remain the owners of all right, title and interest in and to the Upflex Service, Upflex App, and Dashboard Data including any updates, enhancements and new versions thereof, and all related documentation and materials provided or available to Customer or any Proposed User or Customer User in connection with this Agreement.

10. GENERAL CONDITIONS

10.1 Governing Law.

This Agreement shall in all respects be interpreted, construed in accordance with, and governed by the internal laws of the State of Delaware, without regard to its principles regarding conflict of laws. In the event of any litigation between the parties related to this Agreement, the parties agree to submit to personal and exclusive jurisdiction for such action in the State Courts for the County of New York, New York or the United States District Court for the Southern District of New York.

10.2 Notices.

Any notice required or permitted to be delivered to Customer by this Agreement shall be posted to the Customer’s Dashboard. Any notice required or permitted to be delivered to Upflex by this Agreement shall be submitted via email at [email protected]

10.3 Force Majeure.

Nonperformance of either party under this Agreement shall be excused to the extent and during the period that performance is rendered impossible by strike, fire, flood, earthquakes, governmental acts or orders or restrictions, failure of suppliers, or contractors, or any other reason where failure to perform is beyond the reasonable control and not caused by the negligence of the non-performing party.

10.4 Severability.

If any provision or provisions of this Agreement shall be held to be invalid, illegal or unenforceable, the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired thereby.

10.5 Assignment.

This Agreement is not transferable and may not be assigned by Customer, in whole or in part, without the prior written consent of Upflex, provided that Customer may assign this Agreement without such consent, but with notice to Upflex, in connection with a merger or a sale of all of the equity or assets of Customer. Subject to the foregoing, this Agreement shall be binding upon all successors and assigns of a party.

10.6 Attorney’s Fees.

In any litigation between the parties, the prevailing party shall be entitled to reasonable attorney fees and all costs of proceedings incurred in enforcing this Agreement.

10.7 Headings.

Section headings are for convenience only and shall not be considered in the interpretation of this Agreement.

10.8 Independent Contractor.

Upflex and Customer are and shall remain independent contractors. Neither party is the representative or agent of the other and neither party has any power to assume any obligations on behalf of the other. Customer hereby represents that the individual clicking to accept this Agreement is authorized by Customer to bind, and does hereby bind, Customer to the terms hereof.

——–

GDPR

Annex 1 – Data Processing Agreement Linking Data

1. PROCESSING OF LINKING DATA

1.1. Roles of Parties. For purposes of this Agreement, Upflex is processor of Linking Data, and Customer is controller.

1.2. Compliance with Laws. Each Party shall, and is responsible for, its compliance with applicable Data Protection Laws in connection with the processing of Linking Data.

1.3. Limitation on Processing. Upflex shall not process any Linking Data in connection with the performance of its responsibilities under this Agreement, except (1) such Linking Data as is necessary to perform such responsibilities, and solely for the purpose of performing such responsibilities (including to the extent required to satisfy legal requirements relating thereto); or (2) as otherwise instructed in writing by Customer.

2. RIGHTS AND OBLIGATIONS UPFLEX

2.1. Audits. Upon Customer’s written request, Upflex shall provide Customer, at Upflex’s expense, with the results of the most recent data security compliance reports or any audit performed by or on behalf of Upflex that assesses the effectiveness of Upflex’s information security program, system(s), internal controls, and procedures relating to the processing of Linking Data (e.g., SSAE16, SOC report or other).

2.2. Regulatory investigation. Upflex also will assist Customer (at Customer’s expense) in the event of an investigation or audit by a supervisory authority to the extent that such investigation or audit relates to Upflex’s processing of Linking Data.

2.3. Notice. Customer may issue additional instructions or amend the instructions as provided in this Agreement, when necessary, as a result of changes in or amendments to Data Protection Law, as may take place from time to time.

2.4. Data Subject Rights. Upflex shall forward any data subject request from a data subject relating to Linking Data, to Customer. Upflex shall provide all reasonable cooperation necessary to fulfill a data subject request from a data subject.

3. RIGHTS AND OBLIGATIONS OF UPFLEX

3.1. Upflex Personnel. Upflex shall limit access to Linking Data by its employees or agents (Personnel) to those Personnel who require access to Linking Data to perform their roles and responsibilities in connection with Upflex’s processing of Linking Data.

3.2. Providing information. At Customer’s request, Upflex shall provide Customer with an overview of the information referred to in Article 30 (1) GDPR in relation to Linking Data processed by Upflex. At Customer’s request, Upflex shall also provide Customer with the excerpts of the record relating to the processing of Linking Data in accordance with Art. 30 (2) GDPR.

3.3. Security and Confidentiality Measures. Each party shall take and maintain appropriate technical, physical and organizational measures to secure and maintain the confidentiality of Linking Data, and to protect Linking Data against Information Security Incidents. Such measures shall be in accordance with Article 32 GDPR. Each Party will document compliance with its obligations under Article 32 GDPR as relates to the processing of Linking Data.

3.4. Changes to Security Measures. Each party may change or supplement the measures described in the prior Section during the term of this Agreement, provided that such changes do not materially lessen the security of such measures and that such measures remain in compliance with applicable Data Protection Laws, including Art. 32 GDPR.

3.5. Cooperation. Upflex will provide reasonable cooperation and assistance to Customer as Customer may reasonably require to allow Customer to comply with its obligations under Articles 32 through 36 GDPR, including in relation to data security, data breach notification, data protection impact assessments, prior consultation with supervisory authorities, the fulfilment of data subjects’ rights, and any enquiry, notice or investigation by a supervisory authority.

4. DATA SECURITY INCIDENTS

4.1. Notice. Upflex shall notify Customer within 48 hours of discovering that an information security incident has occurred or is reasonably likely to occur.

4.2. Notice requirements. The notice required under Section 4.1 shall include:

(i) a description of the security breach, including the date and time the security breach was discovered; (ii) an overview of the affected Linking Data; (iii) the number of affected data subjects; (iv) expected consequences of the information security incident; and (v) a description of the measures taken by Upflex to limit such consequences.

4.3. Information Security Incident Response. Upflex shall provide reasonable assistance to Customer to comply with its obligations under Data Protection Laws, including Articles 33 and 34 GDPR.

5. TRANSFER OF LINKING DATA OUTSIDE THE EEA

5.1. Transfer. See clause 4.5 of the Agreement.

6. SUB-PROCESSORS

6.1. Obligations. Upflex only sub-process Linking Data to sub-processor that have entered into an agreement that imposes obligations on the sub-processor that are no less restrictive than those imposed on Upflex under this Agreement.

6.2. Compliance with Data Protection Law. Upflex is responsible for ensuring the compliance of sub-processors with applicable Data Protection Law in connection with the processing of Linking Data.

7. SURVIVAL

7.1. Termination and Survival. This Agreement and all provisions herein shall survive so long as, and to the extent that, Upflex processes or retains Linking Data

8. RETENTION

Prohibited Processing. Upflex shall retain Linking Data for only so long as necessary to perform its obligations under the Agreement, unless otherwise required under applicable laws. Upon termination or expiration of the Agreement or earlier as requested by Customer, Upflex shall deliver to Customer or destroy all Linking Data, except for such information as must be retained under applicable law.

Annex 2 – Data Sharing Agreement Dashboard Data

1. ROLES AND RESPONSIBILITIES

1.1. Roles of Parties. Each Party:       

1.1.1. is an independent controller of Dashboard Data under the Data Protection Law;       

1.1.2. will individually determine the purposes and means of its processing of Dashboard Data;        1.1.3. will individually inform data subjects and allow data subjects to exercise their rights under the GDPR (if applicable);        

1.1.4. will inform the other Party of an information security incident; and        

1.1.5. will comply with the obligations applicable to it under the Data Protection Law with respect to the processing of Dashboard Data.

1.2. Restrictions.

Section 1.1 will not affect any restrictions on either Party’s rights to use or otherwise process Dashboard Data under the Agreement.

2. SCOPE

2.1. Applicable Law. This Annex 2 only applies to the extent that the Data Protection Law applies to the processing of Dashboard Data. 2.2. Scope. This Annex will only apply to the processing of Dashboard Data.

2.3. Data Processing Agreement. This Agreement will not affect any separate terms between Upflex and Customer reflecting a controller-processor relationship.

2.4. Communications. Customer will send any communications or notices required under this Agreement in writing, which includes by e-mail, to [email protected] and the designated contact person under the Agreement.

3. DATA TRANSFERS

3.1. Data Transfers. See clause 4.5 of the Agreement.

4. LIABILITY

4.1.The liability of the Parties under or in connection with this Agreement will be subject to the exclusions and limitations of liability in the Agreement.

5. PRIORITY

5.1. Conflict. If there is any conflict or inconsistency between this Annex 2 and the Agreement then, subject to Sections 4.2 (Data Restrictions) and 2.4, the terms of this Agreement will govern.