Vixiees Software Terms and Conditions of Use

GENERAL AGREEMENT

Company providing the SaaS service: Vixiees Tech-Hub, S.L., with Tax ID (CIF) B44570174 and registered office at C/ Lepant 270, 08013 Barcelona (Spain) (hereinafter, “Vixiees”). The user of the service or services (hereinafter, the “CLIENT”) accepts the terms and conditions detailed in this agreement. Use of the service implies full acceptance of these terms and conditions.

1. Scope of Application

1.1. This agreement and the Vixiees platform are intended exclusively for businesses and professionals. The application is not intended for consumers or individual users. The CLIENT represents and warrants that it is contracting as a business or professional for the purposes of applicable law.

2. License to Use and Intellectual Property

2.1. Vixiees grants the CLIENT a non-exclusive, non-transferable, non-sublicensable, and revocable license to use the Vixiees software, limited to the term of the agreement and to web access via the assigned credentials.

2.2. All intellectual and industrial property rights over the software, platform, brand, logos, source code, documentation, interfaces, models, know-how, and any improvements or derivative developments belong exclusively to Vixiees or its licensors. No right other than the license to use described herein is transferred to the CLIENT.

2.3. The CLIENT undertakes not to reverse engineer, decompile, disassemble, resell, sublicense, copy, modify, assign, or create derivative works from the platform, unless expressly permitted by mandatory applicable law.

2.4. The data, contacts, recordings, transcripts, content, and databases that the CLIENT enters or generates through the use of the platform are and shall remain the property of the CLIENT. Vixiees will process them solely under the terms established in Annex 2 (DPA).

2.5. The CLIENT acknowledges that the access URLs to the contracted product are the property of Vixiees.

3. Data Protection

3.1 As it is necessary, for the provision of the services described in this Agreement, to process personal data, and in compliance with the provisions of Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), it is necessary to execute a specific agreement regarding Data Protection that formalizes the relationship between the Client, as Data Controller, and Vixiees Tech-Hub S.L., as Data Processor. In this regard, the processing of personal data resulting from the provision of the service will be governed by the Data Processing Agreement (DPA) in Annex 2, which forms an integral part of this agreement.

3.2 Likewise, pursuant to the aforementioned regulations, the legal representatives of the signatory parties accept the processing of personal data collected in this Agreement for purposes related to the services described herein and its administrative accounting management. The lawfulness of this processing is based on Article 6(1)(b) of the GDPR, as processing is necessary for the performance of a contract to which the data subject is party.

3.3 Personal data will be retained for the duration of the contractual relationship. Once this relationship ends, your data may continue to be retained to comply with any applicable legal obligations and to address potential claims until the maximum statute of limitations for actions arising from this relationship expires. Once the limitation periods have expired, the personal data will be erased.

3.4 The CLIENT may exercise the rights of access, rectification, erasure, and objection, restriction of processing, data portability, and the right not to be subject to automated individual decision-making (including profiling), by sending a request with the subject line “Data Protection” to the email address: dpo@vixiees.com or contact@vixiees.com, from the same account provided to us, indicating their contact details.

3.5 If the parties consider that their rights have been infringed, they may exercise the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

3.6 Please be advised that the Data Protection Officer is: Grupo Datcon Sur S.L.U. C/ Dr. Duarte Acosta 7, 11500, El Puerto de Santa María, Cádiz.

4. Call Recordings and Artificial Intelligence

4.1. The platform allows the CLIENT’s communications to be recorded, transcribed, and analyzed. It is the sole responsibility of the CLIENT to obtain consent from call participants for the recording and processing of their data, as well as to comply with the disclosure obligations arising under applicable law.

4.2. The maximum retention period for recordings and transcripts on the platform is 6 months, after which Vixiees will proceed with their deletion unless the CLIENT expressly contracts for a longer retention period.

4.3. Vixiees does not use the CLIENT’s data, recordings, transcripts, or content to train Artificial Intelligence models, whether proprietary or third-party.

4.4. The CLIENT undertakes to use the Artificial Intelligence features in compliance with applicable regulations, in particular Regulation (EU) 2024/1689 (Artificial Intelligence Act), refraining from making fraudulent use of them or engaging in any of the practices prohibited by said Regulation.

5. Technical Support and Inquiries

5.1. Vixiees will provide technical or administrative/sales support as established on the websites related to the contracted product.

5.2. The response time is a maximum of 24 hours for incidents and technical or functional support, excluding Saturdays, Sundays, and official public holidays in Spain.

5.3. The service will be provided during Vixiees’ business hours: Monday to Friday from 9:00 AM to 6:00 PM (Peninsular Spain time).

5.4. Maintenance services, updates, and bug fixes are performed remotely. They do not include travel to the CLIENT’s facilities.

6. Billing and Payments

6.1. All applicable prices, rates, and financial terms will be published at all times in the pricing section within the Vixiees application. Such information forms an integral part of the agreement.

6.2. Prices will always be published exclusive of taxes. Applicable taxes (VAT or other equivalents) will be added to the invoice based on the default country of the CLIENT’s account.

6.3. Payment is billed on a monthly basis. On the registration date, an invoice will be issued corresponding to the prorated amount for the remaining days of the month; subsequent invoices will be issued within the first five (5) days of each month. Payment will be made by SEPA transfer or credit/debit card.

6.4. Vixiees may adjust prices and financial terms by up to a maximum of 10% annually, with at least 90 days’ prior notice to the CLIENT. Once this period has elapsed without express objection from the CLIENT, the new terms will be deemed accepted.

6.5. In the event of a chargeback, delay, or non-payment after 5 days from the invoice date, Vixiees may suspend the service until payment is confirmed. In the event of a returned direct debit/chargeback, an additional fifteen (15) € + VAT will be charged to the CLIENT for bank fee costs.

6.6. After repeated delays or non-payments, Vixiees may request a security deposit from the CLIENT in an amount equal to the current fee.

6.7. If Vixiees must cancel a service due to non-payment, it will not be liable for any damages that may be caused to the CLIENT or its customers.

7. Term and Termination of Service

7.1. The duration of the agreement will depend on the conditions agreed upon at the time of contracting and on keeping the associated payments up to date.

7.2. There is no lock-in contract or minimum commitment period. The CLIENT may terminate the service at any time directly from their account within the application. No prior written notice or additional request is required.

7.3. Fees already invoiced or paid will not be refunded, regardless of the time during the month at which the termination occurs.

7.4. Termination will be effective once processed by the system and, in any event, within 72 hours from the request submitted in the application.

7.5. The CLIENT will be entitled to request a copy of its data within 72 hours following the effective termination, in accordance with the provisions of the DPA (Annex 2). Vixiees will deliver the data in a technically feasible format, which may include, among others, CSV files, audio files, and transcripts. The subsequent proper handling of the data will be the CLIENT’s responsibility.

7.6. In the hypothetical event that Vixiees cancels the service without the CLIENT having breached any of the conditions described herein, the amount corresponding to the prorated portion of the unused period will be refunded.

8. Termination for Breach

8.1. Either party may terminate this agreement for material breach by the other party, upon prior written notice identifying the breach and granting a period of 30 calendar days for its remedy. Once the period has elapsed without a remedy, the agreement will be automatically terminated.

8.2. Notwithstanding the foregoing, cases of non-payment (clause 6) and unlawful use or misuse of the platform (clauses 9 and 10) will be governed by the specific suspension or immediate cancellation mechanisms provided for in the corresponding clauses, without requiring a cure period.

9. Acceptable Use of the Platform

9.1. The CLIENT undertakes to use the platform only for the purposes permitted under this agreement and in full compliance with applicable law. The following are expressly prohibited:

• using the platform for illegal, fraudulent purposes, or contrary to public order and morality;

• hosting or transmitting illegal content, including child pornography or copyrighted content (music, video, software) without a license;

• using the service to perform SPAM or send unsolicited mass emails, SMS, or WhatsApp messages;

• reverse engineering, decompiling, disassembling, copying, reselling, or creating derivative works;

• performing load tests, benchmarking, scraping, or unauthorized mass data extraction;

• circumventing platform security mechanisms or technical limits;

• creating fake accounts, sharing credentials, or allowing access to unauthorized third parties;

• subleasing or assigning the service to other clients or third parties unless expressly provided in the specific terms.

10. Immediate Suspension for Misuse

10.1. Vixiees reserves the right to suspend or terminate the service immediately and without prior notice in the event of receiving any complaint, notice, request from a competent authority, or reasonable evidence of misuse or unlawful use of the platform by the CLIENT.

10.2. The interruption of the service may occur prior to any clarification. Explanations, claims, and eventual reinstatement will be handled after the suspension.

10.3. Liability towards third parties for misuse, hosted content, or communications sent through the platform will fall entirely on the CLIENT, who will hold Vixiees harmless against any claim, sanction, or damage arising from such use.

11. Warranties and Service Level Agreement (SLA)

11.1. Vixiees will be responsible for the proper functioning of the contracted product, resolving any incident resulting from its malfunction as quickly as possible.

11.2. Vixiees guarantees a monthly platform availability level of 99% (uptime), calculated on a calendar monthly basis and excluding previously scheduled maintenance windows, force majeure events, and incidents attributable to third-party providers or to the CLIENT itself.

11.3. Vixiees is not responsible for the malfunction of the service due to problems associated with its suppliers, nor for incidents resulting from misuse by the CLIENT, in which case it may invoice the corresponding costs.

11.4. Vixiees does not warrant the suitability of the services for the specific needs of the CLIENT. Unsuitability shall not be grounds for termination of the contract or non-payment of fees.

11.5. The CLIENT must report any incident to info@vixiees.com or through the channels indicated on the website related to the subscribed product.

11.6. Vixiees will make backup copies every 24 hours of CLIENT databases with which the service can be restored in the event of a serious incident. The foregoing does not exempt the CLIENT from maintaining its own backup processes. Specific retention and restoration terms will be governed, where applicable, by the DPA.

11.7. The CLIENT must use all available means to prevent access by unauthorized third parties and must ensure password secrecy, changing them at the slightest suspicion of compromise.

12. Technical Requirements

12.1. The Vixiees platform is optimized for the latest versions of the Google Chrome browser. Other browsers may work, but Vixiees does not guarantee full compatibility or an optimal experience outside of that environment.

12.2. The CLIENT is responsible for having the appropriate Internet connection, hardware, and configuration for using the service.

13. Developer API

13.1. The uses, technical limits, call quotas, and other terms applicable to the Vixiees API are published at https://developers.vixiees.com and must be consulted there by the CLIENT, forming an integral part of this contract.

14. Certifications and Security

14.1. Vixiees has successfully passed a CASA application security assessment conducted by an external laboratory, with no pending vulnerabilities, demonstrating the implementation of standard security controls over the provided service. Vixiees does not currently hold ISO 27001, SOC 2, or equivalent certifications.

15. Liabilities and Limitation of Liability

15.1. Vixiees will not be liable for loss of profits, lost revenue, loss of data, or indirect or consequential damages arising from the use, operation, or performance of the software.

15.2. Without prejudice to the CLIENT’s mandatory statutory rights, Vixiees’ maximum aggregate liability for any claims arising out of or related to this contract will be limited to the amount actually paid by the CLIENT to Vixiees during the twelve (12) months immediately preceding the event giving rise to liability.

15.3. Vixiees will not be liable for failure to perform its obligations if its performance has been prevented, interfered with, or delayed by circumstances beyond its reasonable control, including, but not limited to, force majeure events, acts of God, strikes, riots, lockouts, acts of war, epidemics, official acts or regulations, fires, communication failures, power failures, lightning, earthquakes, floods, and disasters.

15.4. Vixiees is not responsible for any misuse of the platform with third-party services (for example Facebook, WhatsApp, or others), and no compensation of any kind may be claimed for this.

15.5. The service means access to the platform and the use of the functionalities designed by Vixiees. Any other functionality related to third-party integrations, which are not owned by Vixiees, has no direct relationship with Vixiees, which assumes no liability for any issues arising from their use.

16. Amendments

16.1. The terms of this contract may be modified by Vixiees, with 90 days’ advance notice given via the means it deems necessary. If the CLIENT does not expressly reject the change during this period, it will be understood that the modifications are accepted.

17. Assignment of the Contract

17.1. The CLIENT may not assign this contract, in whole or in part, to a third party without the prior written consent of Vixiees.

17.2. Vixiees may assign the contract to any entity in its group or to third parties in the context of corporate transactions (mergers, spin-offs, asset sales, etc.), giving notice to the CLIENT.

18. Number Portability

18.1. Upon termination of the service, the CLIENT may request the porting of telephone numbers to another operator. Vixiees will not charge fees for releasing numbers; if costs attributable to third parties (wholesale operators or others) arise during the process, such costs will be fully passed on to the CLIENT.

19. Server Content

19.1. Vixiees will not be responsible for the content and data hosted in the database of Vixiees’ virtual server provider, as they are the property of the CLIENT.

100. The CLIENT is notified that the server hosting the information and web applications is located in Europe, within the territory of the European Union, which the CLIENT unequivocally accepts.

20. Client and Users

20.1. Definitions:

Client: the account to which the subscription is assigned and under which the contracted users are created.

User: the individual users contained within an account who access the contracted product.

The minimum configuration is 1 Client / 5 Users.

21. Use of the CLIENT’s Name and Logo

21.1. The CLIENT authorizes Vixiees to include its company name and logo in Vixiees’ client list and on its website. If the CLIENT wishes to opt out, it may notify info@vixiees.com at any time.

22. Surviving Clauses

22.1. The clauses relating to intellectual property (clause 2) and the residual obligations regarding personal data processing set forth in Annex 2 (DPA), as well as any other clauses that by their nature should remain in effect after the termination of the contract, will survive the termination of this contract for any reason.

23. Jurisdiction and Applicable Law

23.1. This contract is governed by Spanish law.

23.2. Both parties submit to the Courts and Tribunals of Barcelona (Spain) for the resolution of any dispute that may arise, expressly waiving any other jurisdiction that may correspond to them.

24. Order of Precedence

24.1. In the event of a conflict between the different documents forming the contractual relationship, the following order of precedence will apply:

• 1st Specific Conditions (Annex 1).

• 2nd Data Processing Agreement (Annex 2, DPA).

• 3rd General Conditions of this contract.

• 4th Prices and conditions published within the application.

Notes

The contracted service includes access to Vixiees features as configured in the application. Other features (integrations, calls, messages, AI, etc.) that incur an additional cost are not included in the fixed pricing of the service and are detailed within the application and, where applicable, in the specific conditions.

ANNEX 1 — SPECIFIC CONDITIONS

1. Financial Terms

1.1. All financial terms applicable to the contracted services (license fee, included call packages, extra minute rates, SMS, WhatsApp, recordings, transcripts, solutions based on Artificial Intelligence, and other additional services) are published and updated in the pricing section within the Vixiees application.

1.2. Said financial terms form an integral and inseparable part of this contract and will be those in effect at the time of accrual, without prejudice to clause 6.4 of the General Conditions regarding the 10% annual cap and the 90-day prior notice.

1.3. Prices will be published exclusive of taxes. Applicable taxes will be added to the invoice based on the default country of the CLIENT’s account.

2. Definition of Sales Agent

2.1. The term “Sales Agent” applies exclusively to those users who engage in any type of communication with contacts registered in the Vixiees system or use the task system.

2.2. Users who do not carry out direct communications (Supervisors, IT personnel, managers, or other equivalent profiles) will not be classified as Sales Agents and, accordingly, will not be subject to the corresponding license fee.

3. Use of Telephony and Related Services

3.1. The minute packages included per license, additional services (recording, transcription, AI, etc.), and costs for excess usage will be those published within the application.

3.2. To calculate the minutes used during the contractual period, Vixiees will add the total minutes used by all active accounts under the CLIENT’s subscription and divide them by the number of active sales agents, in order to determine the average usage per agent.

3.3. The proportion of inbound calls received by the CLIENT shall not exceed 5,000 minutes per contracted telephone line. Any excess will be charged according to the rates published in the application.

3.4. If the CLIENT exceeds the contracted pricing on additional services, Vixiees will charge additional fees for excess usage. These charges may be made daily, within a maximum of 24 hours from completion.

3.5. Vixiees will notify the CLIENT by email before the total minutes included in their package are exhausted, in order to allow them, if required, to opt for a higher package.

4. SMS and WhatsApp Service

4.1. Applicable SMS rates will be those published in the application. An SMS segment is defined as up to a maximum of 160 characters; messages exceeding this length will be billed as additional segments.

4.2. Meta, as the owner of WhatsApp, is solely responsible for establishing and pricing the costs associated with each conversation window. The CLIENT may check the updated costs at any time on the official Meta-WhatsApp website.

4.3. Vixiees acts solely as a technology provider (Tech Provider) and assumes no liability for the costs applied by Meta or for their variations.

4.4. The CLIENT is solely responsible for the content, destination, and purpose of such communications, as well as for ensuring that it has an appropriate legal basis for processing personal data and sending communications, whether it be prior, express, and informed consent from recipients or any other legal basis permitted by applicable law.

4.5. The CLIENT undertakes to comply with information obligations and to enable appropriate opt-out mechanisms or unsubscribe options from commercial communications, and to comply at all times with applicable regulations regarding data protection and information society and electronic commerce services.

5. Geographic Scope and Contracted Territory

5.1. The financial terms and rates apply to the contracted territory, defined as the country chosen by the CLIENT during initial contracting as the account's default country.

5.2. If the CLIENT requires phone numbers or frequently makes communications (calls, SMS, WhatsApp) from or to numbers in other countries, it must request information from Vixiees regarding the applicable international rates.

6. Future Services

150. All financial conditions stipulated apply only to the services and products currently offered by Vixiees. Any new or modified product or service in the future will be communicated and agreed upon via a contractual update or annex.

ANNEX 2 — DATA PROCESSING AGREEMENT (DPA)

This Data Processing Agreement forms an integral part of the SaaS Service Agreement entered into between:

• The CLIENT, hereinafter “the Data Controller”, and

• Vixiees Tech-Hub, S.L., hereinafter “the Data Processor”.

For the purposes of Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD), and applicable regulations:

• The CLIENT acts as the Data Controller, determining the purposes and means of the processing of personal data hosted on the platform.

• Vixiees acts as the Data Processor, processing such data solely on behalf of the Controller and exclusively for the provision of the contracted services.

1. PURPOSE OF DATA PROCESSING

These clauses authorize the Data Processor to process, on behalf of the Data Controller, the personal data necessary to provide the services described in the main agreement and, where appropriate, on behalf of other companies in the Controller’s group to which services are also provided, as detailed in Annex I to this DPA.

The Controller undertakes to notify the Processor of the details of any third parties (companies in its group) using the application under the granted license, as well as any structural modifications (mergers, spin-offs, hive-downs) relevant to data protection. The Controller will assume all consequences resulting from the failure to provide this notification.

The processing will consist of accessing, viewing, and, where appropriate, modifying data resulting from the use of the license and the provision of associated services.

2. IDENTIFICATION OF AFFECTED INFORMATION

All personal data contained in the application is made available to the Processor, which may include:

• Identifying data of the Controller’s contacts (first name, last name, email, telephone number).

• Professional details (company, job title).

• Communications, including voice recordings and transcripts.

• Metadata derived from the use of AI features (summaries, tags).

• Data of the Controller’s own users/employees with access to the platform.

The categories of data subjects include business contacts, clients, or leads of the Controller and its authorized employees or contractors.

The Controller declares that the data accessed by the Processor has been obtained lawfully and in compliance with data protection regulations.

3. DURATION

This agreement has a term equal to that of the main contract entered into between the parties.

Upon termination, the Processor will return to the Controller or transfer to another Processor designated by the latter all personal data, and delete any copies in its possession. However, it may keep the data blocked to address administrative or legal liabilities.

4. OBLIGATIONS OF THE DATA PROCESSOR

The Processor and all its staff undertake to:

a. Use the personal data solely for the purpose covered by this assignment. It may not use it for its own purposes. In particular, the Processor will not use the Controller’s data, recordings, transcripts, or content to train proprietary or third-party Artificial Intelligence models.

b. Process the data in accordance with the Controller’s instructions. If the Processor considers that an instruction infringes the GDPR or other data protection regulations, it will immediately inform the Controller.

c. Maintain a written record of all categories of processing activities carried out on behalf of the Controller (contact details of the parties, categories of processing, international transfers, technical and organizational measures).

d. Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in compliance with Article 32 of the GDPR.

e. Not disclose the data to third parties, except with the express authorization of the Controller or where legally permissible. However, the Controller authorizes the Processor to disclose the data to the other entities in the corporate group to which the Controller belongs, with the Controller guaranteeing the lawfulness of the disclosure and the relevant consents.

f. Subcontract with the authorized providers referred to in clause 8 of this DPA, who will observe the same security measures. To subcontract any other service, the Processor will notify the Controller in writing; if the Controller does not object within two calendar days, the subcontracting may take place.

The subcontractor, who also has the status of Data Processor, is likewise obliged to comply with the obligations established in this document for the Data Processor and with instructions issued by the controller. It is the responsibility of the initial processor to regulate the new relationship, so that the new processor is subject to the same terms (instructions, obligations, security measures…) and formal requirements as itself, with regard to the proper processing of personal data and guaranteeing the rights of affected data subjects. In the event of non-compliance by the sub-processor, the initial processor will remain fully liable to the controller for the performance of obligations.

g. Observe the duty of confidentiality and professional secrecy regarding the data to which it has access, with this obligation surviving the termination of the contract.

h. Ensure that authorized personnel have the necessary knowledge regarding personal data protection and commit in writing to maintain confidentiality.

i. Notification of security breaches: the Processor will notify the Controller, without undue delay, of any personal data security breaches of which it becomes aware, providing at least the nature of the breach, the contact details of the DPO or contact point, the likely consequences, and the measures taken. Notification will not be required if the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

j. Data subject rights: when affected individuals exercise their rights with the Processor, it will inform the Controller immediately and, in any event, no later than the next business day following receipt of the request.

k. Make available to the Controller all information necessary to demonstrate compliance with its obligations, permitting inspections or audits. The parties will agree in advance on the date, time, and terms, with at least 30 days’ notice. The cost of resources, time, and personnel of the Processor for such inspections will be quoted independently and borne by the Controller.

l. Assist the Controller in implementing the security measures necessary to ensure the ongoing confidentiality, integrity, availability, and resilience of systems; quickly restore availability and access to data in the event of an incident; and regularly test, assess, and evaluate the effectiveness of the implemented measures.

m. Assist the Controller with data protection impact assessments, where applicable, and prior consultations with the Spanish Data Protection Agency.

n. Perform backups of the Controller’s databases every 24 hours, without prejudice to the Controller’s duty to maintain its own backup processes.

o. Destination of data: destroy the data once provision of services is completed. However, it may keep a blocked copy for as long as liabilities arising from performance may exist.

5. OBLIGATIONS OF THE DATA CONTROLLER

a. Provide the Processor with access to the data in order to provide the contracted service.

b. Implement appropriate technical and organizational measures and demonstrate that the processing complies with current legislation.

c. Carry out a risk analysis and, where applicable, an impact assessment on the processing operations to be performed by the Processor.

d. Ensure compliance with the GDPR throughout the processing.

e. Supervise the processing, including necessary checks and audits.

f. Ensure that the Data Protection Officer, or failing that, the Security Officer, is appropriately and timely involved in all related matters.

g. Obtain consent from communication participants in cases of recording and transcription, and inform end customers about the processing of their personal data, including the use of AI technology where applicable. The Processor is held harmless from any liability arising from the Controller’s breach of these duties.

h. Have a valid legal basis when using the platform for sending electronic commercial communications (including but not limited to SMS, instant messaging such as WhatsApp, or other equivalent services) to guarantee full compliance with applicable regulations on data protection and information society and electronic commerce services. The Controller also undertakes to comply with information obligations to recipients, provide mechanisms to opt out of commercial communications, and be able to demonstrate compliance with these obligations at any time. The Data Processor will not be liable for the Controller’s use of the platform regarding the sending of electronic communications, nor for the consequences arising from the Controller’s failure to comply with applicable regulations in this matter.

i. Use the AI-based tools and solutions provided by the Processor in compliance with Regulation (EU) 2024/1689 (Artificial Intelligence Act), refraining from fraudulent use or engaging in prohibited practices.

6. GENERAL CLAUSES

a. Failure by either party to enforce its rights shall not be construed as a future waiver thereof.

b. The legal relationship between the parties regarding data protection is governed solely by this Agreement, superseding any prior agreement on the same subject matter.

c. Both parties agree to comply with legal provisions in force from time to time regarding personal data protection.

d. The Processor will not be liable for the consequences towards third parties of following the Controller’s instructions.

e. If any provision is found to be void, the remainder of the agreement will remain unaffected.

f. This Agreement does not constitute a partnership, joint venture, agency, or employment contract between the parties.

7. NOTICES

a. Any notice between the parties will be in writing and by any means that certifies receipt.

b. Any change of address must be communicated to the other party immediately.

8. AUTHORIZED SUB-PROCESSORS

The Controller expressly authorizes the Processor to engage, as sub-processors, the providers detailed below. All of them implement the technical and organizational measures required by the GDPR and are subject to contractual obligations equivalent to those of the Processor.

All servers used for processing are located within the European Union. Any addition or replacement of a sub-processor will be communicated to the Controller through the usual channels with reasonable advance notice, and the Controller may object within the period indicated in clause 4.f above.

Additionally, the Controller authorizes the Data Processor to engage external collaborators to provide auxiliary services for development, maintenance, technical support, or other functions necessary for the proper performance of the contracted services.

Said collaborators may, where necessary, access personal data on behalf of the Processor, acting at all times under its authority and in accordance with its instructions, and remaining subject to confidentiality obligations and security measures equivalent to those set forth in this Agreement.

In cases where such collaborators are located outside the European Economic Area, the Data Processor guarantees that access to personal data is carried out subject to appropriate safeguards in accordance with applicable personal data protection regulations.