Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other agreement (the “Agreement”) between N.P.O Systems Ltd. (“Solid Vibes”, the “Processor”) and the Customer (the “Controller”).

It applies automatically to team and enterprise Workspaces, and to any other business Customer that asks for it, whenever Solid Vibes processes Customer Personal Data on the Customer's behalf. No signature is needed; a countersigned copy is available from [email protected].

It does not apply to personal data Solid Vibes processes as a controller for its own purposes (for example account administration, billing, security, communications and the purposes in the Privacy Policy).

If the Customer is itself a processor, it confirms that its instructions, including appointing Solid Vibes as a sub-processor, are authorised by the relevant controller.

“Data Protection Laws” means all data-protection laws that apply to the processing, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the Israeli Protection of Privacy Law 5741-1981 and its regulations, and US state privacy laws such as the California Consumer Privacy Act as amended (“CCPA”).

“Customer Personal Data” means personal data in Your Content or about Members that Solid Vibes processes on the Customer's behalf to provide the Service.

“Sub-processor” means a third party Solid Vibes engages to process Customer Personal Data. “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

“SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914; “UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner. Terms such as controller, processor, data subject, processing, business, service provider and supervisory authority have the meanings given in the Data Protection Laws.

The Customer is the controller (or a processor acting for a controller) and Solid Vibes is its processor. Under the CCPA, the Customer is the business and Solid Vibes is its service provider.

Solid Vibes processes Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA, the Customer's configuration of the Service and its Members' use of it are the Customer's complete instructions, which include processing to provide, secure, support and maintain the Service, to develop and improve Solid Vibes' products and services, and to create aggregated or de-identified data that no longer identifies anyone. Additional instructions require written agreement and may carry fees.

Solid Vibes may also process Customer Personal Data where required by law; it will tell the Customer before doing so unless the law prohibits it.

Solid Vibes will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws. It may then suspend the affected processing (other than secure storage). If the parties cannot agree a solution within thirty (30) days, the Customer may terminate the affected part of the Service as its sole remedy; fees for the period before termination remain payable.

The Customer is responsible for the lawfulness of the Customer Personal Data and its instructions, for having a lawful basis and giving any notices required, and for the accuracy of the data.

No sale, no sharing, no marketing. Solid Vibes does not sell or share (as those terms are defined in the CCPA) Customer Personal Data, does not use it for advertising or partner offers, does not combine it with other data except as permitted for service providers, and does not use it outside the direct business relationship with the Customer. Solid Vibes certifies that it understands and will comply with these restrictions.

The Service is not designed for special-category data, government identifiers or payment-card data. The Customer will not submit them unless an Order Form expressly allows it.

Solid Vibes limits access to Customer Personal Data to personnel who need it to provide, support, secure, maintain and improve the Service, and only to the extent needed for the task.

All such personnel are bound by written confidentiality obligations, receive data-protection and security training, and use individual accounts with multi-factor authentication. Changes made through internal administration tools are recorded in audit logs.

The Customer gives Solid Vibes general authorisation to engage the Sub-processors listed on the sub-processor page, and their replacements under this section.

Solid Vibes will impose on each Sub-processor, by written contract, data-protection obligations that provide at least the same level of protection as this DPA, and remains liable to the Customer for each Sub-processor's performance.

Solid Vibes informs the Customer of new or replacement Sub-processors by updating the sub-processor page, and by email to Customers that have asked for notices. The Customer may object on reasonable data-protection grounds within fourteen (14) days. If Solid Vibes does not address the objection, the Customer's sole remedy is to stop using the affected part of the Service or terminate it, without refund.

Copies of Sub-processor agreements may be redacted for confidential commercial information before being shared.

Solid Vibes is established in Israel, which benefits from an adequacy decision of the European Commission and is recognised by the UK and Switzerland. Solid Vibes and its Sub-processors may process Customer Personal Data in any country where they operate. Transfers to adequate countries need no further safeguard.

EEA transfers. For transfers of Customer Personal Data from the EEA to a country without an adequacy decision, the SCCs are incorporated by reference: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where it is a processor. Clause 7 (docking) applies; in Clause 9 option 2 (general authorisation) applies with the notice period in this DPA; the optional language in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland; and Annexes I to III are completed by Schedule 1 of this DPA.

UK and Swiss transfers. For UK transfers the UK Addendum applies, with Tables 1 to 3 completed by this DPA and either party able to end it as provided in its Section 19. For Swiss transfers the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner as the competent authority.

Solid Vibes may instead rely on another lawful transfer mechanism, such as the EU–US Data Privacy Framework for certified Sub-processors. Where a transfer mechanism is invalidated, the parties will cooperate in good faith to adopt an alternative.

Government access. If Solid Vibes receives a legally binding request from a public authority for Customer Personal Data, it will (unless prohibited) notify the Customer promptly, review the request's legality, challenge it where there are reasonable grounds, and disclose only the minimum required.

Solid Vibes implements and maintains the technical and organisational measures described in Schedule 2 and on the Security page, appropriate to the risk. It may update them, but will not materially reduce the overall security of the Service.

The Customer is responsible for using the Service's security features appropriately, including managing Members, roles, share links, passkeys and two-step verification.

Solid Vibes will notify the Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, as far as known, the nature of the incident, the data and data subjects affected, likely consequences and the measures taken or proposed. Information may be provided in phases.

Solid Vibes will take reasonable steps to contain, investigate and mitigate the incident, and will reasonably assist the Customer with notifications it must make. Notification is not an admission of fault or liability.

Unsuccessful attempts that do not compromise security (for example pings, port scans or failed log-ins) are not Security Incidents. This section does not apply to incidents caused by the Customer or its Members.

Except where Data Protection Laws require it, the Customer will not make any public statement, regulatory notice or communication to data subjects that identifies Solid Vibes in connection with an incident without first consulting Solid Vibes and, where the law permits, giving it a reasonable opportunity to comment, and will limit any such disclosure to what is required.

The Service lets the Customer access, correct, export and delete Customer Personal Data itself. If Solid Vibes receives a request from a data subject about Customer Personal Data, it will refer the data subject to the Customer and will not respond itself except to confirm the referral or as required by law.

Taking into account the nature of the processing and the information available to it, Solid Vibes will reasonably assist the Customer with requests it cannot fulfil itself, data-protection impact assessments and prior consultations with supervisory authorities. Assistance beyond the Service's self-serve features may be charged at Solid Vibes' then-current rates.

On written request, Solid Vibes will make available the information reasonably necessary to demonstrate compliance with this DPA, such as its security documentation, completed security questionnaires and, when available, third-party audit reports or certifications. These are Solid Vibes' Confidential Information.

If that information is not sufficient to meet the Customer's obligations under Data Protection Laws, or a supervisory authority requires it, the Customer (or an independent auditor that is not a competitor of Solid Vibes and is bound by confidentiality) may conduct an audit, no more than once in any twelve (12) months, on at least thirty (30) days' written notice, during business hours, for a duration and scope agreed in advance, and without disrupting operations or accessing other customers' data.

The Customer bears the costs of any audit, including its auditor's fees and Solid Vibes' reasonable time and expenses at its then-current rates. Audit results may be used only to assess compliance with this DPA and may not be disclosed without Solid Vibes' written consent, except as required by law.

The Customer can export Customer Content with the Service's export features at any time before the Agreement ends; that export is the return of Customer Personal Data. After the Agreement ends, Solid Vibes deletes Customer Personal Data from the live Service within a reasonable period.

Copies in backups are deleted as backups roll off on their normal schedule, and are protected from further processing until then.

Solid Vibes may retain Customer Personal Data where required by law, or to establish, exercise or defend legal claims, in which case this DPA continues to protect it for as long as it is retained.

Each party's liability arising out of or relating to this DPA, including the SCCs to the extent the law allows, is subject to the limitation of liability in the Agreement. References to a party's liability mean the aggregate liability of that party and its affiliates.

This DPA lasts as long as Solid Vibes processes Customer Personal Data under the Agreement. A Customer's affiliates permitted to use the Service under the Agreement may rely on it through the Customer, which remains responsible for coordinating all communications.

Either party may propose changes to this DPA required by a change in Data Protection Laws on forty-five (45) days' notice; the parties will negotiate in good faith, and if they cannot agree within thirty (30) days either party may terminate the affected part of the Service.

If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data. If it conflicts with the SCCs, the SCCs prevail.