End User Terms of Service Effective Date: 29 January 2021

These End User Terms of Service (the “User Terms”) govern your access and use of Taskworld’s internal communication, workplace productivity, and collaboration tools and platform (the “Services”). Please read them carefully. If an organization or other third party that we refer to in these User Terms as “Customer” has authorized you to access and use the Services, these User Terms apply to you as an end-user of the Services.

These User Terms constitute a legally binding agreement between you, the user (“You,” “your” or “User”), and the applicable Taskworld entity (as defined in section 13) (“We,” “us” or “Taskworld”). If you access or use the Services or continue accessing or using the Services after being notified of a change to the User Terms, you confirm that you have read, understand, and agree to be bound by these User Terms.

1- Eligibility. You must be at least 18 years of age to use the Service. By agreeing to these User Terms, you represent and warrant to us: (i) that you are at least 18 years of age; (ii) that you have not previously been suspended or removed from the Service; and (iii) that your registration and your use of the Service is in compliance with any and all applicable laws and regulations.

2- Account Registration. To access most features of the Service, you must register for an account. When you register for an account, you may be required to provide us with some information about yourself (such as your name, e-mail address, or other contact information). You agree that the information you provide to us is accurate and that you will keep it accurate and up-to-date at all times. When you register, you will be asked to provide a password. You are solely responsible for maintaining the confidentiality of your account and password. You agree to accept responsibility for all activities that occur under your account. If you have reason to believe that your account is no longer secure, then you must immediately notify us at support@taskworld.com.

3- Customer. The Customer has separately agreed to our Customer Terms of Service or entered into a written agreement with us (in either case, the “Customer Agreement”) that permits the Customer to grant the right to use the Services to Customer's employees, consultants, contractors, and agents (each invitee granted access to the Services, including you, is an "Authorized User"). As between Customer and us, you agree that it is solely Customer’s responsibility to (a) inform you and any Authorized Users of any relevant customer policies and practices and any settings that may impact the processing of User Content (as defined below); (b) obtain any rights, permissions or consents from you and any Authorized Users that are necessary for the lawful use of User Content and the operation of the Services; (c) ensure that the transfer and processing of User Content under the User Terms are lawful; and (d) respond to and resolve any dispute with you and any authorized user relating to or based on User Content, the Services or customer’s failure to fulfill these obligations.

4- User Content. The Service allows users to create tasks and post other content, including messages, reviews, photos, video, images, folders, data, text, and other types of works (collectively, “User Content”) and to publish User Content on the Service. You acknowledge that the Customer retains copyright and any other proprietary rights in the User Content that you post to the Service.

a- Limited License Grant to Taskworld.

• By posting or publishing User Content, you grant Taskworld a worldwide, non-exclusive, royalty-free right and license (with the right to sublicense) to host, store, transfer, display, perform, reproduce, and modify your User Content, in whole or in part, in any media formats and through any media channels (now known or hereafter developed).

b- Limited License Grant to Other Users.

• By posting and sharing User Content with another user of the Service, you hereby grant that user a non-exclusive license to access and use such User Content as permitted by these User Terms and the functionality of the Service.

c- User Content Representations and Warranties.

• You are responsible for your User Content and the consequences of posting or publishing User Content. By posting and publishing User Content, you affirm, represent, and warrant that:
• you are the creator and owner of, or have the necessary licenses, rights, consents, and permissions to use and to authorize Taskworld and users of the Service to use and distribute your User Content as necessary to exercise the licenses granted by you in this section 4 and in the manner contemplated by Taskworld and these User Terms; and your User Content, and use of your User Content as contemplated by these User Terms, does not and will not: (i) infringe, violate, or misappropriate any third-party right, including any copyright, trademark, patent, trade secret, moral right, privacy right, right of publicity, or any other intellectual property or proprietary right; or (ii) slander, defame, libel, or invade the right of privacy, publicity or other property rights of any other person.

d- User Content Disclaimer. We are under no obligation to edit or control User Content that you or other users post or publish and will not be in any way responsible or liable for User Content. Taskworld may, however, at any time and without prior notice, screen, remove, edit, or block any User Content that in our sole judgment violates these User Terms or is otherwise objectionable. You understand that when using the Service you will be exposed to User Content from a variety of sources and acknowledge that User Content may be inaccurate, offensive, indecent or objectionable. You agree to waive, and hereby do waive, any legal or equitable rights or remedies you have or may have against Taskworld with respect to User Content. We expressly disclaim any and all liability in connection with User Content. If notified by a user or content owner that User Content allegedly does not conform to these User Terms, we may investigate the allegation and determine in our sole discretion whether to remove the User Content, which we reserve the right to do at any time and without notice.

5- Prohibited Conduct. By using the Service you agree not to:

a- use the Service for any illegal purpose, or in violation of any applicable law;

b- violate, or encourage others to violate, the rights of third parties, including by infringing or misappropriating third party intellectual property rights;

c- post, upload, or distribute any User Content or other content that is unlawful, defamatory, libelous, inaccurate, or that a reasonable person could deem to be objectionable, profane, indecent, pornographic, harassing, threatening, embarrassing, hateful, or otherwise inappropriate;

d- interfere with security-related features of the Service, including without limitation by (i) disabling or circumventing features that prevent or limit use or copying of any content, or (ii) reverse engineering or otherwise attempting to discover the source code of any portion of the Service except to the extent that such activity is expressly permitted by applicable law;

e- interfere with the operation of the Service or any user’s enjoyment of the Service, including without limitation by (i) uploading or otherwise disseminating viruses, adware, spyware, worms, or other malicious code, (ii) making unsolicited offers or advertisements to other users of the Service, (iii) attempting to collect, personal information about users or third parties without their consent; or (iv) interfering with or disrupting any networks, equipment, or servers connected to or used to provide the Service, or violating the regulations, policies, or procedures of such networks, equipment, or servers;

f- perform any fraudulent activity including impersonating any person or entity, claiming false affiliations, accessing the Service accounts of others without permission, or falsifying your age or date of birth;

g- sell or otherwise transfer the access granted by these User Terms or any Materials (as defined in section 12 below) or any right or ability to view, access, or use any Materials; or

h- attempt to do any of the foregoing in this section 5, or assist or permit any persons in engaging in any of the activities described in this section 5.

6- Third-Party Services and Linked Websites. Taskworld may provide tools through the Service that enable you to export information, including User Content, to third party services, including through features that allow you to link your account on Taskworld with an account on the third-party service, or through our implementation of third party buttons (such as “like” or “share” buttons). By using these tools, you agree that we may transfer such information to the applicable third-party service. Such third party services are not under our control, and we are not responsible for their use of your exported information. The Service may also contain links to third-party websites. Such linked websites are not under our control, and we are not responsible for their content.

7- Software. The terms of this Section 7 govern your acquisition and use of downloadable software (including mobile applications, tablet applications, and associated media and printed materials, the “Software“) to access and use the Services.

a- Third-Party Accounts. In order to download the Software, you may be required by the third party who is distributing or providing you access to the Software (e.g., Google, Amazon, Apple) (each, a “Distributor“) to create an account. You are solely responsible for maintaining the security of any logins, passwords, or other credentials that you select or that are provided to you to access your account with any Distributor. Your use of any account with a Distributor is subject to any terms, conditions, and policies, including privacy policies, of that Distributor. Taskworld is not responsible for any act or omission of any Distributor.

b- License to the Software. Subject to your compliance with all terms and conditions set forth in these User Terms, Taskworld hereby grants to you a limited, non-exclusive, non-transferable, non-sublicensable, non-assignable, revocable license to download, install, and use the Software (in object code format) for its intended purpose and solely in accordance with the user manuals and written instructions provided by Taskworld and the User Terms. This limited license does not include any right to modify, distribute, prepare derivative works of, or grant sublicenses to use the Software. Furthermore, in order to protect the trade secrets and proprietary know-how contained in the Software, you will not decompile, disassemble, or reverse engineer the Software. Users with paid subscriptions (e.g., a Professional or Enterprise subscription) may have the right to use and access premium features and functionalities of the Service that are not available to users with free subscriptions.

c- Access to the Software. Taskworld does not provide you with the equipment to use the Software. You are responsible for all fees charged by third parties to access and use the Software (e.g., charges by mobile carriers).

8- Termination of Use; Discontinuation and Modification of the Service. If you violate any provision of these User Terms, your permission to use the Service will terminate automatically. Additionally, Taskworld, in its sole discretion, may terminate your user account on the Service or suspend or terminate your access to the Service at any time, with or without notice. We also reserve the right to modify or discontinue the Service at any time (including, without limitation, by limiting or discontinuing certain features of the Service) without notice to you. We will have no liability whatsoever on account of any change to the Service or any suspension or termination of your access to or use of the Service. You may terminate your account at any time by contacting customer service at support@taskworld.com or online in Taskworld app in Account Settings section. If you terminate your account, you will remain obligated to pay all outstanding fees, if any, relating to your use of the Service incurred prior to termination. If you or we terminate your account, you must immediately destroy all copies of the Software and all of its component parts.

9- Privacy Policy; Additional User Terms.

a- Privacy Policy. Please read the Taskworld Privacy Policy carefully for information relating to our collection, use, storage and disclosure of your personal information. The Taskworld Privacy Policy is hereby incorporated by reference into, and made a part of, these User Terms.

b- Additional Terms. Your use of the Service is subject to any and all additional terms, policies, rules, or guidelines applicable to the Service or certain features of the Service that we may post on or link to on the Service (the “Additional User Terms“), such as end-user license agreements for any downloadable applications that we may offer, or rules applicable to particular features or content on the Service, subject to section 10 below. All such Additional User Terms are hereby incorporated by reference into, and made a part of, these User Terms.

10- Modification of these User Terms. We reserve the right, at our discretion, to change these User Terms on a going-forward basis at any time. Please check these User Terms periodically for changes. If a change to these User Terms materially modifies your rights or obligations, you will be required to accept such modified terms in order to continue to use the Service. Material modifications are effective upon your acceptance of such the modified User Terms. Immaterial modifications are effective upon publication. For the avoidance of doubt, disputes arising under these User Terms will be resolved in accordance with these User Terms in effect that the time the dispute arose.

11- Ownership; Proprietary Rights. The Service is owned and operated by Taskworld. The visual interfaces, graphics, design, compilation, information, data, computer code (including source code or object code), products, Software, services, and all other elements of the Service (the “Materials“) provided by Taskworld are protected by all relevant intellectual property and proprietary rights and applicable laws. All Materials contained in the Service are the property of Taskworld or our third-party licensors. Except as expressly authorized by Taskworld, you may not make use of the Materials. Taskworld reserves all rights to the Materials not granted expressly in these User Terms.

12- Limitations of Liability. In no event will Taskworld be liable under or in connection with these User Terms under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability, and otherwise, for any: (a) consequential, incidental, indirect, exemplary, special, enhanced, or punitive damages; (b) increased costs, diminution in value or lost business, production, revenues, or profits; (c) loss of goodwill or reputation; (d) use, inability to use, loss, interruption, delay, or recovery of any data, or breach of data or system security; or (e) cost of replacement goods or services, in each case regardless of whether Taskworld was advised of the possibility of such losses or damages or such losses or damages were otherwise foreseeable. In no event will Taskworld's aggregate liability arising out of or related to these User Terms under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability, and otherwise exceed US$100.

13- Severability. If any provision of these User Terms is invalid, illegal, or unenforceable in any jurisdiction, such invalidity, illegality, or unenforceability will not affect any other term or provision of these User Terms or invalidate or render unenforceable such term or provision in any other jurisdiction. Upon such determination that any term or other provision is invalid, illegal, or unenforceable, the Parties shall negotiate in good faith to modify these User Terms so as to effect their original intent as closely as possible in a mutually acceptable manner in order that the transactions contemplated be consummated as originally contemplated to the greatest extent possible.

14- Assignment. User may not assign any of its rights or delegate any of its obligations hereunder, in each case whether voluntarily, involuntarily, by operation of law or otherwise, without the prior written consent of Taskworld. Any purported assignment or delegation in violation of this section will be null and void. No assignment or delegation will relieve the assigning or delegating Party of any of its obligations hereunder. These User Terms are binding upon and inures to the benefit of the Parties and their respective permitted successors and assigns.

15- Taskworld Contracting Entity. All references to ‘Taskworld’, under the User Terms and what law will apply in any dispute or lawsuit arising out of or in connection with the User Terms, will depend on where the Customer is domiciled as set forth below:

Worldwide (except as provided below) Governing Law: Singapore Taskworld Singapore Pte. Ltd (UEN 201913899M) 18 Boon Lay Way, #05-95, Tradehub 21, Singapore - 609966

United States Governing Law: Delaware Taskworld Inc. 28 Valley Road, Suite 1 Montclair, NJ 07042 USA

European Union Governing Law: Ireland Taskworld Software Limited Joyce House, 22/23 Holles Street Dublin D02YP92 Ireland

Thailand Governing Law: Thailand Taskworld Co. Ltd. Park Ventures Ecoplex, Unit 1808-1810, 18th Floor, 57 Wireless Road, Lumpini Pathumwan, Bangkok 10330, Thailand

16- Disputes. Any dispute arising out of or in connection with these User Terms, including any question regarding its existence, validity or termination, shall be referred to and finally resolved by arbitration administered by the Singapore International Arbitration Centre in accordance with the Arbitration Rules of the Singapore International Arbitration Centre for the time being in force, which rules are deemed to be incorporated by reference in this clause. The seat of the arbitration shall be Singapore. The Tribunal shall consist of one arbitrator. The language of the arbitration shall be English.

17- Entire Agreement. These User Terms, together with any other documents incorporated herein by reference, constitutes the sole and entire agreement of the Parties with respect to the subject matter of these User Terms and supersedes all prior and contemporaneous understandings, agreements, and representations and warranties, both written and oral, with respect to such subject matter. In the event of any inconsistency or conflict between these User Terms and the terms of the Customer Agreement, the terms of the Customer Agreement shall control. Non-English translations of these User Terms are provided for convenience only. In the event of any ambiguity or conflict between translations, the English version is authoritative and shall control.

Effective Date: 29 January 2021

These Customer Terms of Service (the “Customer Terms”) govern a Customer’s access and use of Taskworld’s internal communication, workplace productivity, and collaboration tools and platform (the “Services”). A “Customer” is an individual, entity, or organization (including a partnership) that procures a paid or free trial subscription(s) to access and use the Services on behalf of its Authorized Users (as defined below).

These Customer Terms and any Order Form(s) (as defined in section 1(a)) (the “Agreement”) constitute a legally binding agreement between the applicable Taskworld entity (as defined in section 11(g)) (“Taskworld”) and the Customer.

Each party acknowledges that it has read this Agreement, understands it, and agrees to be bound by its terms, and that the person signing on its behalf has been authorized to do so. The person executing this Agreement on Customer’s behalf represents that he or she has the authority to bind Customer to these terms and conditions.

1- Access and Use of the Services

a- Provision of Access. Subject to the terms and conditions of this Agreement and the User Terms of Service, Taskworld grants Customer a non-exclusive, non-transferable (except in compliance with section 11(e)) right to access and use the Services during the Term, solely for use by Customer's employees, consultants, contractors, and agents (i) who are authorized by Customer to access and use the Services under the rights granted to Customer pursuant to this Agreement and (ii) for whom access to the Services has been purchased hereunder (the "Authorized Users"). Such use is limited to the total number of Authorized Users set forth in the Services interface or subscription order form entered into between Customer and Taskworld (each, an “Order Form”). Taskworld shall provide to Customer the necessary passwords and network links or connections to allow Customer to access the Services.

b- Documentation License. Subject to the terms and conditions contained in this Agreement, Taskworld grants to Customer a non-exclusive, non-sublicensable, non-transferable (except in compliance with section 11(e)) license to use the Taskworld's user manuals and guides relating to the Services provided by Taskworld to Customer either electronically or in hard copy form (“Documentation”) during the Term solely for Customer's internal business purposes in connection with its use of the Services.

c- Use Restrictions. Customer shall not use the Services for any purposes beyond the scope of the access granted in this Agreement. Customer shall not at any time, directly or indirectly, and shall not permit any Authorized Users to: (i) copy, modify, or create derivative works of the Services or Documentation, in whole or in part; (ii) rent, lease, lend, sell, license, sublicense, assign, distribute, publish, transfer, or otherwise make available the Services or Documentation; (iii) reverse engineer, disassemble, decompile, decode, adapt, or otherwise attempt to derive or gain access to any software component of the Services, in whole or in part; (iv) remove any proprietary notices from the Services or Documentation; or (v) use the Services or Documentation in any manner or for any purpose that infringes, misappropriates, or otherwise violates any intellectual property right or other rights of any person, or that violates any applicable law.

d- Reservation of Rights. Taskworld reserves all rights not expressly granted to Customer in this Agreement. Except for the limited rights and licenses expressly granted under this Agreement, nothing in this Agreement grants, by implication, waiver, estoppel, or otherwise, to Customer or any third party any intellectual property rights or other rights, title, or interest in or to the Taskworld IP (as defined in 5(a))

e- Suspension. Notwithstanding anything to the contrary in this Agreement, Taskworld may temporarily suspend Customer's and any Authorized User's access to any portion or all of the Services if: (i) Taskworld reasonably determines that (A) there is a threat or attack on any of the Taskworld IP; (B) Customer's or any Authorized User's use of the Taskworld IP disrupts or poses a security risk to the Taskworld IP or to any other customer or vendor of Taskworld; (C) Customer, or any Authorized User, is using the Taskworld IP for fraudulent or illegal activities; (D) subject to applicable law, Customer has ceased to continue its business in the ordinary course, made an assignment for the benefit of creditors or similar disposition of its assets, or become the subject of any bankruptcy, reorganization, liquidation, dissolution, or similar proceeding; or (E) Taskworld's provision of the Services to Customer or any Authorized User is prohibited by applicable law; (ii) any vendor of Taskworld has suspended or terminated Taskworld's access to or use of any third-party services or products required to enable Customer to access the Services; or (iii) in accordance with section 5(a)(iii) (any such suspension described in subclause (i), (ii), or (iii), a “Service Suspension”). Taskworld shall use commercially reasonable efforts to provide written notice of any Service Suspension to Customer and to provide updates regarding resumption of access to the Services following any Service Suspension. Taskworld shall use commercially reasonable efforts to resume providing access to the Services as soon as reasonably possible after the event giving rise to the Service Suspension is cured. Taskworld will have no liability for any damage, liabilities, losses (including any loss of data or profits), or any other consequences that Customer or any Authorized User may incur as a result of a Service Suspension.

f- Aggregated Statistics. Notwithstanding anything to the contrary in this Agreement, Taskworld may monitor Customer's use of the Services and collect and compile Aggregated Statistics. "Aggregated Statistics" means data and information related to Customer's use of the Services that is used by Taskworld in an aggregate and anonymized manner, including to compile statistical and performance information related to the provision and operation of the Services. As between Taskworld and Customer, all right, title, and interest in Aggregated Statistics, and all intellectual property rights therein, belong to and are retained solely by Taskworld. Customer acknowledges that Taskworld may compile Aggregated Statistics based on Customer Data (as defined in section 5(b)) input into the Services. Customer agrees that Taskworld may (i) make Aggregated Statistics publicly available in compliance with applicable law, and (ii) use Aggregated Statistics to the extent and in the manner permitted under applicable law; provided that such Aggregated Statistics do not identify Customer or Customer's Confidential Information.

g- Privacy Policy. The privacy policy which is incorporated by reference, is located at https://taskworld.com/terms-privacy-security/privacy/ (“Privacy Policy”) applies only to the Services and does not apply to any third-party website or service linked to the Services or recommended or referred to through the Services or by Taskworld’s staff.

2- Customer Responsibilities.

a- General. Customer must comply with the Agreement and ensure that its Authorized Users comply with the Agreement and the User Terms. Customer is responsible and liable for all uses of the Services and Documentation resulting from access provided by Customer, directly or indirectly, whether such access or use is permitted by or in violation of this Agreement.

b- Authorized Users. Each Authorized User must agree to the User Terms to activate their subscription and use the Services. Customer is responsible for all acts and omissions of Authorized Users, and any act or omission by an Authorized User that would constitute a breach of the User Terms or this Agreement if taken by Customer will be deemed a breach of this Agreement by Customer. Customer shall use reasonable efforts to make all Authorized Users aware of this Agreement's provisions as applicable to such Authorized User's use of the Services, and shall cause Authorized Users to comply with such provisions. As between Taskworld and Customer, Customer agrees that it is solely Customer’s responsibility to (a) inform any Authorized Users of any relevant customer policies and practices and any settings that may impact the processing of Customer Data (as defined in section 5(b)); (b) obtain any rights, permissions or consents from any Authorized Users that are necessary for the lawful use of Customer Data and the operation of the Services; (c) ensure that the transfer and processing of Customer Data under the User Terms is lawful; and (d) respond to and resolve any dispute with between Authorized Users relating to or based on Customer Data, the Services or Customer’s failure to fulfill these obligations.

c- Third-Party Products. Taskworld may, from time to time, make Third-Party Products available to Customer. For purposes of this Agreement, such Third-Party Products are subject to their own terms and conditions. If Customer does not agree to abide by the applicable terms for any such Third-Party Products, then Customer should not install or use such Third-Party Products. “Third-Party Products" means any third-party products provided with or incorporated into the Services.

3- Fees and Payment.

a- Fees. Customer shall pay Taskworld the fees ("Fees") as set forth in the Services interface “check-out” or via a subscription order form entered into between Customer and Taskworld. Customer shall make all payments hereunder in advance. Payment obligations are non-cancelable and, except as expressly stated in this Agreement, fees paid are non-refundable. For clarity, in the event Customer downgrades any subscriptions from a paid plan to a free plan, Customer will remain responsible for any unpaid fees under the paid plan, and Services under the paid plan will be deemed fully performed and delivered upon expiration of the initial paid plan subscription term. If Taskworld agrees to invoice Customer by email, full payment must be received as per the due date mentioned on the invoice. If Customer fails to make any payment when due, without limiting Taskworld's other rights and remedies: (i) Taskworld may charge interest on the past due amount at the rate of 1.5% per month calculated daily and compounded monthly or, if lower, the highest rate permitted under applicable law; (ii) Customer shall reimburse Taskworld for all reasonable costs incurred by Taskworld in collecting any late payments or interest, including attorneys' fees, court costs, and collection agency fees; and (iii) if such failure continues for ten (10) days or more, Taskworld may suspend Customer's and its Authorized Users' access to any portion or all of the Services until such amounts are paid in full.

b- Taxes. All Fees and other amounts payable by Customer under this Agreement are exclusive of taxes and similar assessments. Customer is responsible for all sales, use, and excise taxes, and any other similar taxes, duties, and charges of any kind imposed by any governmental or regulatory authority on any amounts payable by Customer hereunder, other than any taxes imposed on Taskworld's income.

4- Confidential Information. From time to time during the Term, either Party may disclose or make available to the other Party information about its business affairs, products, confidential intellectual property, trade secrets, third-party confidential information, and other sensitive or proprietary information, whether orally or in written, electronic, or other form or media, and whether or not marked, designated, or otherwise identified as "confidential" (collectively, "Confidential Information"). Confidential Information does not include information that at the time of disclosure is: (a) in the public domain; (b) known to the receiving Party at the time of disclosure; (c) rightfully obtained by the receiving Party on a non-confidential basis from a third party; or (d) independently developed by the receiving Party. The receiving Party shall not disclose the disclosing Party's Confidential Information to any person or entity, except to the receiving Party's employees who have a need to know the Confidential Information for the receiving Party to exercise its rights or perform its obligations hereunder. Notwithstanding the foregoing, each Party may disclose Confidential Information to the limited extent required (i) in order to comply with the order of a court or other governmental body, or as otherwise necessary to comply with applicable law, provided that the Party making the disclosure pursuant to the order shall first have given written notice to the other Party and made a reasonable effort to obtain a protective order; or (ii) to establish a Party's rights under this Agreement, including to make required court filings. On the expiration or termination of the Agreement, the receiving Party shall promptly return to the disclosing Party all copies, whether in written, electronic, or other form or media, of the disclosing Party's Confidential Information, or destroy all such copies and certify in writing to the disclosing Party that such Confidential Information has been destroyed. Each Party's obligations of non-disclosure with regard to Confidential Information are effective as of the Effective Date and will expire five years from the date first disclosed to the receiving Party; provided, however, with respect to any Confidential Information that constitutes a trade secret (as determined under applicable law), such obligations of non-disclosure will survive the termination or expiration of this Agreement for as long as such Confidential Information remains subject to trade secret protection under applicable law.

5- Intellectual Property Ownership; Feedback.

a- Taskworld IP. Customer acknowledges that, as between Customer and Taskworld, Taskworld owns all right, title, and interest, including all intellectual property rights, in and to the Services, the Documentation, and any and all intellectual property provided to Customer or any Authorized User in connection with the foregoing (“Taskworld IP”). For the avoidance of doubt, Taskworld IP includes Aggregated Statistics and any information, data, or other content derived from Taskworld's monitoring of Customer's access to or use of the Services, but does not include Customer Data.

b- Customer Data. Taskworld acknowledges that, as between Taskworld and Customer, Customer owns all right, title, and interest, including all intellectual property rights, in and to the information, data, and other content, in any form or medium, that is submitted, posted, or otherwise transmitted by or on behalf of Customer or an Authorized User through the Services (“Customer Data”). Customer grants to Taskworld a non-exclusive, royalty-free, worldwide license to reproduce, distribute, and otherwise use and display the Customer Data and perform all acts with respect to the Customer Data as may be necessary for Taskworld to provide the Services to Customer, and a non-exclusive, perpetual, irrevocable, royalty-free, worldwide license to reproduce, distribute, modify, and otherwise use and display Customer Data incorporated within the Aggregated Statistics.

c- Feedback. If Customer or any of its employees or contractors sends or transmits any communications or materials to Taskworld by mail, email, telephone, or otherwise, suggesting or recommending changes to the Taskworld IP, including without limitation, new features or functionality relating thereto, or any comments, questions, suggestions, or the like ("Feedback"), Taskworld is free to use such Feedback irrespective of any other obligation or limitation between the Parties governing such Feedback. Customer assigns to Taskworld on Customer's behalf, and on behalf of its employees, contractors and/or agents, all right, title, and interest in, and Taskworld is free to use, without any attribution or compensation to any party, any ideas, know-how, concepts, techniques, or other intellectual property rights contained in the Feedback, for any purpose whatsoever, although Taskworld is not required to use any Feedback.

6- Warranty Disclaimer. The Taskworld IP is provided "AS IS," and Taskworld hereby disclaims all warranties, whether express, implied, statutory, or otherwise. Taskworld specifically disclaims all implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement, and all warranties arising from course of dealing, usage, or trade practice. Taskworld makes no warranty of any kind that the Taskworld IP, or any products or results of the use thereof, will meet customer's or any other person's requirements, operate without interruption, achieve any intended result, be compatible or work with any software, system, or other services, or be secure, accurate, complete, free of harmful code, or error free. Taskworld does not warrant that your use of the services will satisfy or ensure compliance with any legal obligations or laws or regulations.

7- Indemnification.

a- Taskworld Indemnification.

i- Taskworld shall indemnify, defend, and hold harmless Customer from and against any and all losses, damages, liabilities, costs (including reasonable attorneys' fees) ("Losses") incurred by Customer resulting from any third-party claim, suit, action, or proceeding ("Third-Party Claim") that the Services, or any use of the Services in accordance with this Agreement, infringes or misappropriates such third party's intellectual property rights, provided that Customer promptly notifies Taskworld in writing of the claim, cooperates with Taskworld, and allows Taskworld sole authority to control the defense and settlement of such claim.

ii- If such a claim is made or appears possible, Customer agrees to permit Taskworld, at Taskworld's sole discretion, to (A) modify or replace the Services, or component or part thereof, to make it non-infringing, or (B) obtain the right for Customer to continue use. If Taskworld determines that neither alternative is reasonably available, Taskworld may terminate this Agreement, in its entirety or with respect to the affected component or part, effective immediately on written notice to Customer.

iii- This section 7(a) will not apply to the extent that the alleged infringement arises from: (A) use of the Services in combination with data, software, hardware, equipment, or technology not provided by Taskworld or authorized by Taskworld in writing; (B) modifications to the Services not made by Taskworld; or (C) Customer Data.

b- Customer Indemnification. Customer shall indemnify, hold harmless, and, at Taskworld's option, defend Taskworld from and against any Losses resulting from any Third-Party Claim that the Customer Data, or any use of the Customer Data in accordance with this Agreement or the User Terms, infringes or misappropriates such third party's intellectual property rights and any Third-Party Claims based on Customer's or any Authorized User's (i) negligence or willful misconduct; (ii) use of the Services in a manner not authorized by this Agreement; (iii) use of the Services in combination with data, software, hardware, equipment, or technology not provided by Taskworld or authorized by Taskworld in writing; or (iv) modifications to the Services not made by Taskworld, provided that Customer may not settle any Third-Party Claim against Taskworld unless Taskworld consents to such settlement, and further provided that Taskworld will have the right, at its option, to defend itself against any such Third-Party Claim or to participate in the defense thereof by counsel of its own choice.

c- Sole Remedy. This 7 sets forth Customer's sole remedies and Taskworld's sole liability and obligation for any actual, threatened, or alleged claims that the services infringe, misappropriate, or otherwise violate any intellectual property rights of any third party. In no event will Taskworld's liability under this section 7 exceed US$100.

8- Limitations of Liability. In no event will Taskworld be liable under or in connection with this Agreement under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability, and otherwise, for any: (a) consequential, incidental, indirect, exemplary, special, enhanced, or punitive damages; (b) increased costs, diminution in value or lost business, production, revenues, or profits; (c) loss of goodwill or reputation; (d) use, inability to use, loss, interruption, delay, or recovery of any data, or breach of data or system security; or (e) cost of replacement goods or services, in each case regardless of whether Taskworld was advised of the possibility of such losses or damages or such losses or damages were otherwise foreseeable. In no event will Taskworld's aggregate liability arising out of or related to this Agreement under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability, and otherwise exceed the total amount paid by customer hereunder in the 12 months preceding the last event giving rise to liability. The foregoing will not limit customer’s payment obligations under the “Fees and Payment” section above.

9- Term and Termination

a- Term. Unless Customer’s subscription is terminated in accordance with this Agreement or unless otherwise provided for in an Order Form, Customer’s access and use of the Services will automatically renew unless either Party gives the other Party written notice of non-renewal at least 30 days prior to the expiration of the then-current term

b- Termination. In addition to any other express termination right set forth in this Agreement:

i- Taskworld may terminate this Agreement, effective on written notice to Customer, if Customer: (A) fails to pay any amount when due hereunder, and such failure continues more than 30 days after Taskworld's delivery of written notice thereof; or (B) breaches any of its obligations under section 2(c) or section 4;

ii- either Party may terminate this Agreement, effective on written notice to the other Party, if the other Party materially breaches this Agreement, and such breach: (A) is incapable of cure; or (B) being capable of cure, remains uncured 30 days after the non-breaching Party provides the breaching Party with written notice of such breach; or

iii- terms.customer_tos.line3.9.3.3

c- Effect of Expiration or Termination. Upon expiration or earlier termination of this Agreement, Customer shall immediately discontinue use of the Taskworld IP (Intellectual Property) and, without limiting Customer’s obligations under 4, Customer shall delete, destroy, or return all copies of the Taskworld IP (Intellectual Property) and certify in writing to the Taskworld that the Taskworld IP (Intellectual Property) has been deleted or destroyed. No expiration or termination will affect Customer’s obligation to pay all Fees that may have become due before such expiration or termination or entitle Customer to any refund.

d- Data Deletion. Upon expiration or earlier termination of this Agreement, Taskworld will not have any obligation to maintain or provide any Customer Data and may thereafter, unless legally prohibited, delete all Customer Data in our systems or otherwise in our possession or under our control.

e- Survival. This section 11(de) and sections 3, 4, 5, 6, 7, 8, and 10 survive any termination or expiration of this Agreement. No other provisions of this Agreement survive the expiration or earlier termination of this Agreement.

10- Free Trials. If the Customer registers for a free trial for any of the Services, Taskworld will make such Services available to the Customer on a trial basis free of charge until the earlier of (a) the end of the free trial period for which the Customer registered to use the applicable Service(s); (b) the start date of any subscription to such Service purchased by Customer for such Service(s); or (c) termination of the trial by Taskworld in its sole discretion. Trial terms and conditions may appear on the trial registration web page. Any such additional terms and conditions are incorporated into this Agreement by reference and are legally binding. Any Customer Data that the Customer enters into a Service, and any configurations or customizations made to a Service by or for Customer, during the free trial will be permanently lost unless Customer purchases a subscription to the same service as covered by the trial, purchase the applicable Service, or export such Customer Data, before the end of the trial period.

11- Miscellaneous.

a- Publicity. Customer grants us the right to use Customer’s company name and logo as a reference for marketing or promotional purposes on our website and in other public or private communications with our existing or potential customers, subject to Customer’s standard trademark usage guidelines as provided to us from time-to-time. We don’t want to list customers who don’t want to be listed, so Customer may send us an email to support@taskworld.com stating that it does not wish to be used as a reference.

b- Force Majeure. In no event shall Taskworld be liable to Customer, or be deemed to have breached this Agreement, for any failure or delay in performing its obligations under this Agreement (except for any obligations to make payments), if and to the extent such failure or delay is caused by any circumstances beyond Taskworld's reasonable control, including but not limited to acts of God, flood, fire, earthquake, explosion, war, terrorism, invasion, riot or other civil unrest, strikes, labor stoppages or slowdowns or other industrial disturbances, or passage of law or any action taken by a governmental or public authority, including imposing an embargo.

c- Amendment. Taskworld may amend these Customer Terms from time to time by posting an amended version on this website or by such other method of notification as Taskworld may designate. Any material revisions to these Customer Terms will become effective on the date set forth in our notice, and all other changes will become effective on the date we publish the change. If the Customer uses the Services after the effective date of any changes, that use will constitute the Customer’s acceptance of the revised terms and conditions.

d- Waiver. No waiver by any Party of any of the provisions hereof will be effective unless explicitly set forth in writing and signed by the Party so waiving. Except as otherwise set forth in this Agreement, (i) no failure to exercise, or delay in exercising, any rights, remedy, power, or privilege arising from this Agreement will operate or be construed as a waiver thereof, and (ii) no single or partial exercise of any right, remedy, power, or privilege hereunder will preclude any other or further exercise thereof or the exercise of any other right, remedy, power, or privilege.

e- Severability. If any provision of this Agreement is invalid, illegal, or unenforceable in any jurisdiction, such invalidity, illegality, or unenforceability will not affect any other term or provision of this Agreement or invalidate or render unenforceable, such term or provision in any other jurisdiction. Upon such determination that any term or other provision is invalid, illegal, or unenforceable, the Parties shall negotiate in good faith to modify this Agreement so as to effect their original intent as closely as possible in a mutually acceptable manner in order that the transactions contemplated be consummated as originally contemplated to the greatest extent possible.

f- Assignment. Customer may not assign any of its rights or delegate any of its obligations hereunder, in each case whether voluntarily, involuntarily, by operation of law or otherwise, without the prior written consent of Taskworld. Any purported assignment or delegation in violation of this section will be null and void. No assignment or delegation will relieve the assigning or delegating Party of any of its obligations hereunder. This Agreement is binding upon and inures to the benefit of the Parties and their respective permitted successors and assigns.

g- Equitable Relief. Each Party acknowledges and agrees that a breach or threatened breach by such Party of any of its obligations under 4 or, in the case of Customer, section 1(c), would cause the other Party irreparable harm for which monetary damages would not be an adequate remedy and agrees that, in the event of such breach or threatened breach, the other Party will be entitled to equitable relief, including a restraining order, an injunction, specific performance, and any other relief that may be available from any court, without any requirement to post a bond or other security, or to prove actual damages or that monetary damages are not an adequate remedy. Such remedies are not exclusive and are in addition to all other remedies that may be available at law, in equity, or otherwise.

h- Taskworld Contracting Entity. All references to ‘Taskworld, under the Customer Terms and what law will apply in any dispute or lawsuit arising out of or in connection with the Agreement, will depend on where the Customer is domiciled as set forth below:

Worldwide (except as provided below) Governing Law: Singapore Taskworld Singapore Pte. Ltd (UEN 201913899M) 18 Boon Lay Way, #05-95, Tradehub 21, Singapore - 609966

United States Governing Law: Delaware Taskworld Inc. 28 Valley Road, Suite 1 Montclair, NJ 07042 USA

European Union Governing Law: Ireland Taskworld Software Limited Joyce House, 22/23 Holles Street Dublin D02YP92 Ireland

Thailand Governing Law: Thailand Taskworld Co. Ltd. Park Ventures Ecoplex, Unit 1808-1810, 18th Floor, 57 Wireless Road, Lumpini Pathumwan, Bangkok 10330, Thailand

i- Disputes. Any dispute arising out of or in connection with this Agreement, including any question regarding its existence, validity, or termination, shall be referred to and finally resolved by arbitration administered by the Singapore International Arbitration Centre in accordance with the Arbitration Rules of the Singapore International Arbitration Centre for the time being in force, which rules are deemed to be incorporated by reference in this clause. The seat of the arbitration shall be Singapore. The Tribunal shall consist of one arbitrator. The language of the arbitration shall be English.

j- Notices. All notices, requests, consents, claims, demands, waivers, and other communications hereunder (each, a "Notice") must be in writing and addressed to the Parties above in section 11(g) (or to such other address that may be designated by the Party giving Notice from time to time in accordance with this section). All Notices must be delivered by personal delivery, internationally recognized overnight courier (with all fees pre-paid), or email to support@taskworld.com (with confirmation of transmission). Except as otherwise provided in these Customer Terms, a Notice is effective only: (i) upon receipt by the receiving Party; and (ii) if the Party giving the Notice has complied with the requirements of this section.

k- Entire Agreement. This Agreement, together with any other documents incorporated herein by reference, constitutes the sole and entire agreement of the Parties with respect to the subject matter of this Agreement and supersedes all prior and contemporaneous understandings, agreements, and representations and warranties, both written and oral, with respect to such subject matter. In the event of any inconsistency or conflict between these Customer Terms and the terms of any Order Form, the terms of the Order Form shall control. Non-English translations of this Agreement are provided for convenience only. In the event of any ambiguity or conflict between translations, the English version is authoritative and shall control.

Taskworld Privacy Policy

Introduction

Taskworld respects your privacy and is committed to protecting your personal data. If you have any questions or concerns about our policy, or our practices with regards to your personal information, please contact us at privacy@taskworld.com.

This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

1- Important information and who we are This Privacy Policy applies to all information collected through Taskworld’s websites such as Taskworld.com (the “Websites”), desktop and mobile applications (the “Apps”) and online workplace productivity tools and platform (the “Services”) and other interactions (e.g., customer service inquiries, etc.) you may have with Taskworld.

This Privacy Policy does not apply to any third party applications or software that integrate with the Services through the Taskworld platform, or any other third party products, services or businesses.

In addition, this Privacy Policy does not apply when we provide Services under contract with an organization (for example, your employer or another entity or person) and that organization controls the information processed by the Services

This App is not intended for children and we do not knowingly collect data relating to children.

It is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them.

The practices described in this policy are subject to applicable laws in the places in which we operate. This means that we only engage in the practices described in this policy in a particular country or region if permitted under the laws of those places.

Controller

Taskworld is made up of different legal entities, details of which can be found here. When we mention "Taskworld", we are referring to the relevant company in the Taskworld Group responsible for processing your data Taskworld Singapore Pte. Ltd. is the controller responsible for this App.

We have appointed a data protection officer (DPO). If you have any questions about this privacy policy, please contact them using the details set out below.

Contact details Our full details are:

Full name of legal entity: Taskworld Singapore Pte. Ltd.

Name of DPO: Available of Request privacy@taskworld.com

Email address: privacy@taskworld.com

Postal address: 18 Boon Lay Way, #05-95, Tradehub 21, Singapore – 609966

You have the right to make a complaint at any time to your respective authority. The Personal Data Protection Commission (PDPC) is the Singapore supervisory authority for data protection issues (www.pdpc.gov.sg). We would, however, appreciate the chance to deal with your concerns before you approach the PDPC so please contact us in the first instance.

Changes to the privacy policy and your duty to inform us of changes

We keep our privacy policy under regular review. This version was last updated on September 29, 2020. It may change and if it does, these changes will be posted on this page and, where appropriate, notified to you when you next start the App or visit one of our Websites. The new policy may be displayed on-screen and you may be required to read and accept the changes to continue your use of the App or the Services.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.

Third party links

Our Apps or Websites may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. Please note that these websites and any services that may be accessible through them have their own privacy policies and that we do not accept any responsibility or liability for these policies or for any personal data that may be collected through these websites or services, such as Contact and Location Data. Please check their terms and policies before you submit any personal data to these websites or use these services.

2- The data we collect about you We may collect, use, store and transfer different kinds of personal data about you as follows:

Identity Data includes first name, last name, username or similar identifier, title, date of birth and gender.

Contact Data includes billing address, email address and telephone numbers.

Financial Data includes bank account and payment card details. Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.

Device Data includes the type of mobile device you use, a unique device identifier (for example, your Device's IMEI number, the MAC address of the Device's wireless network interface, or the mobile phone number used by the Device), mobile network information, your mobile operating system, the type of mobile browser you use, time zone setting, and other related information.

Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Websites.

Content Data includes information stored on your Device, including coworker' lists, login information, photos, videos or other digital content.

Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.

Usage Data includes information about how you use our website, products and services.

Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

Job Applicant Data includes data provided by job applicants or others on our website or offline means in connection with employment opportunities, which also may be subject to an additional relevant local recruitment privacy policy.

We also collect, use and share Aggregated (Anonymized) Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific App feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

3- How is your personal data collected? We will collect and process the following data about you:

Information you give us. This is information (including Identity, Contact, Financial, and Marketing and Communications Data) you consent to giving us about you by filling in forms on the App, or by corresponding with us (for example, by email or chat). It includes information you provide when you register to use the App, download or register an App, subscribe to any of our Services, search for an App or Service, share data via an App's social media functions, enter a promotion or survey, request marketing to be sent to you, give us feedback or contact us, and when you report a problem with an App or our Services.

Information we collect about you and your device. Each time you visit one of Websites or use one of our Apps we will automatically collect personal data including Device, Content and Usage Data. We collect this data using cookies, server logs and other similar technologies. Please see our cookie policy for further details.

Information we receive from other sources including third parties and publicly available sources. We will receive personal data about you from various third parties and public sources as set out below:

Device Data from the following parties:

• analytics providers such as Google based outside the EU;
• advertising networks;
• and search information providers.

Contact, Financial and Transaction Data from providers of technical and payment services such as Stripe, Braintree, ChargeDesk based outside the EU; Identity and Contact Data from data brokers or aggregators; and Identity and Contact Data from publicly available sources.

Cookies

We use cookies and other tracking technologies to distinguish you from other users of the App, the distribution platform (Appstore) or Websites and to remember your preferences. This helps us to provide you with a good experience when you use the App or browse any of our Websites and also allows us to improve the App and Our Sites. For detailed information on the cookies we use, the purposes for which we use them and how you can exercise your choices regarding our use of your cookies, see our cookie policy.

4- How we use your personal data We will only use your personal data when the law allows us to do so. Some laws require us to explain the lawful basis upon which we process your personal information. With respect to these laws, we process personal information about you for one or more of the following circumstances:

• Where you have consented before the processing.
• Where we need to perform a contract we are about to enter or have entered with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.

Generally, we do not rely solely on consent as a legal basis for processing your personal data although we will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

Purposes for which we will use your personal data

Purpose / Activity:

• To install the App and register you as a new App user Type of Data:
• Identity, Contact, Financial, Device, Technical Lawful basis for processing:
• Your consent

Purpose / Activity:

• To deliver Services including managing payments and collecting money owed to us Type of Data:
• Identity, Contact, Financial, Transaction, Device, Technical, Marketing and Communications, Location Lawful basis for processing:
• Your consent. Performance of a contract with you. Necessary for our legitimate interests (to recover debts due to us)

Purpose / Activity:

• To manage our relationship with you including notifying you of changes to the App or any Services Type of Data:
• Identity, Contact, Financial, Profile, Marketing and Communications, Job Applicant Data Lawful basis for processing:
• Your consent. Performance of a contract with you. Necessary for our legitimate interests (to keep records updated and to analyse how customers use our products/ Services) Necessary to comply with legal obligations (to inform you of any changes to our terms and conditions)

Purpose / Activity:

• To enable you to participate in a free trial, promotion or complete a survey Type of Data:
• Identity, Contact, Device, Technical, Profile, Marketing and Communications Lawful basis for processing:
• Your consent. Performance of a contract with you. Necessary for our legitimate interests (to analyse how customers use our Services and to develop them and grow our business)

Purpose / Activity:

• To administer and protect our business and this App including troubleshooting, data analysis and system testing Type of Data:
• Identity, Contact, Device, Technical Lawful basis for processing:
• Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security)

Purpose / Activity:

• To deliver relevant content and advertisements to you.
• To make recommendations to you about goods or services which may interest you.
• To measure and analyse the effectiveness of the advertising we serve you.
• To monitor trends so we can improve the App

Type of Data:

• Identity, Contact, Device, Technical, Content, Profile, Usage, Marketing and Communications, Location Lawful basis for processing:
• Consent. Necessary for our legitimate interests (to develop our products/Services and grow our business)

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

Promotional offers from us

We may use your Identity, Contact, Device, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

You will receive marketing communications from us if you have requested information from us or purchased services from us and you have not opted out of receiving that marketing.

Third-party marketing

We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.

Opting Out

You can ask us or third parties to stop sending you marketing messages at any time by logging into the App or Website and checking or unchecking relevant boxes to adjust your marketing preferences or by following the opt-out links on any marketing message sent to you or by contacting us at any time.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a Service provided to you.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our cookie policy.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5- Disclosures of your personal data

When you consent to providing us with your personal data, we will also ask you for your consent to share your personal data with the third parties set out below for the purposes set out in the table [Purposes for which we will use your personal data]:

• Internal Third Parties as set out in the Glossary.
• External Third Parties as set out in the Glossary.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

6- International transfers

Many of our external third parties are based outside the EEA so their processing of your personal data may involve a transfer of data outside the EEA.

Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.

Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

7- Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

All information you provide to us is stored on our secure servers. We utilize a PCI-DSS certified third party credit card payment processing company to collect payment information, including your credit card number, billing address, and phone number. In such circumstances, the third party service provider, and not Taskworld, stores your payment information on our behalf in accordance with PCI Data Security Standards.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator when we are legally required to do so.

8- Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances you can ask us to delete your data: see Your legal rights below for further information.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9- Your legal rights

These rights differ based upon local data protection laws in your country, state, or territory, but these rights may include one or more of the following:

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

a- if you want us to establish the data's accuracy;

b- where our use of the data is unlawful but you do not want us to erase it;

c- where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or

d- you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Importantly, these rights are not absolutely guaranteed and there are several exceptions where we may not have an obligation to fulfill your request. Please consult your local data protection laws to determine what rights may be available to you and which exceptions may apply.

You also have the right to ask us not to continue to process your personal data for marketing purposes.

How do I submit a request?

To make a request or exercise any of the rights set out above, please contact us at privacy@taskworld.com.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

10- Glossary

Lawful basis Consent means processing your personal data where you have signified your agreement by a statement or clear opt-in to processing for a specific purpose. Consent will only be valid if it is a freely given, specific, informed and unambiguous indication of what you want. You can withdraw your consent at any time by contacting us.

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.

Third parties

Internal third parties Other companies in the Taskworld Group acting as joint controllers or processors and who are based in the United States, Germany, France, Japan, South Korea, and Thailand and provide IT and system administration services and undertake leadership reporting.

External third parties Service providers acting as processors based in the United States and Singapore who provide IT and system administration services.

Professional advisers [acting as processors or joint controllers] including lawyers, bankers, auditors and insurers based in the United States and Singapore who provide consultancy, banking, legal, insurance and accounting services.

Data Security

The security of your data and information is one of our top concerns at Taskworld. That is why we go to the greatest lengths to make sure that all collected data is private and secured.

Your Data is Safe

Taskworld uses state-of-the-art technology to ensure that your data is stored in secure locations. Among these measures are:

• Access to your account by encrypted password only
• Information is hosted on Amazon Web Servers in a facility with monitored access
• Personal and system data regularly backed up
• Prompt release of important system updates and repairs

Control Your Privacy

We also allow you to protect your information from other site members. You can:

• Disconnect from any colleague at any time as long as neither of you has an active task between each other
• Choose to make little or none of your profile information visible to all Taskworld users with advanced privacy settings to limit either only visible to yourself or to your colleagues only

Amazon Web Services Hosted Data

All of your data is hosted on Amazon Web Services. Amazon’s data centers are staffed around-the-clock by security guards and access is by authorization only. Storing their information in multiple physical, geographic locations allows clients to be assured that, even in the case of catastrophe, error or natural disaster, systems and data can be fully recovered quickly.

For more information, go to: https://aws.amazon.com/

Questions about Security? Send us your question at support@taskworld.com

Cookies and Automated Data Collection

At Taskworld we take our customers Privacy seriously and as such limit our use of cookies and other automated data collection mechanisms to those that allow us to better serve our customers; to better understand your use of our Service; and to enable us to develop new features and content, based on aggregate data.

We partner with selected 3rd party vendors to provide this service, such as Google Analytics for aggregate demographic data, and Intercom for support purposes and live-chat (during business hours) with our support staff.

You can find more information about Cookies at: www.allaboutcookies.org.

What are Cookies?

A Cookies is a text file that contains a small amount of information which is downloaded to your browser from the site you are visiting. The server that places cookies into your browser is able to then read the information on the cookie that it set. Cookies are usually classified as either “session” or “persistent”. Session Cookies will only stay on your device until you close your browser. Persistent cookies will remain until they are explicitly deleted or expire.

Different cookies are used to perform different functions:

Essential Cookies: Some cookies are essential and enable you to move around the Services and use their features, such as accessing secure areas of the Services. Without these cookies, we cannot enable appropriate content based on the type of device you are using.

Functionality Cookies: These cookies allow us to remember choices you make on our websites (such as your preferred language or the region you are in).

Personalization Cookies: We also use cookies to change the way our Services behave or look in order to personalize your experience from information we infer from your behavior on our Services or information we may already know about you because, for example, you are a registered user. These cookies may be used to tailor the Services or the content, look and feel delivered to you on subsequent sessions to our Services. For example, if you personalize webpages, or use specific parts of the Services, a cookie helps our webpage server recall your specific information. When you next use the Services, the information you previously provided can be retrieved, so you can easily use the Services features that you previously chose.

Analytics Cookies: We use our own cookies and/or third-party cookies and other identifiers (such as web beacons) to see how you use our Services in order to enhance their performance and develop them according to the preferences of our customers and visitors. For example, cookies and web beacons may be used to: maintain a consistent look and feel across our Services; track and provide trend analysis on how our users interact with our Services; track errors and measure the effectiveness of our promotional campaigns.

Advertising Cookies: These cookies record your visit to our Services, your opening and review of our emails, the pages you have visited, and the links you have clicked. They gather information about your browsing habits and remember that you have visited a website. We or our service providers may use this information to make advertisements more relevant to you.

Cross-Device Cookies: Sometimes, we may use cookies in combination with the information we collect — for instance, usernames, IP addresses and unique mobile device identifiers — to locate or try to locate the same unique users across multiple browsers or devices (such as smartphones or tablets), or work with service providers that do this, in order to save your preferences across devices and analyze usage of the Services.

Third-Party Cookies

Please note that third parties (including for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies on our Services. We used trusted partners like DoubleClick and Google AdWords to help us service advertising. We also use Google Analytics on our Services to help us analyze how our Services are used, and help us improve the product. Google Analytics uses performance cookies to track visitor interactions. For example, by using cookies, Google can tell us which pages our users view, which are most popular, what time of day our websites are visited, whether visitors have been to our websites before, what website referred the visitor to our websites, and other similar information.

We have little control over these “third party” cookies, so we suggest that you check the respective privacy policies for these external services to help you understand what data these organizations hold about you and what they do with it.

Google AdWords: https://support.google.com/adwords/answer/2549116?hl=en

Google Analytics: http://www.google.com/analytics/learn/privacy.html

Google Tag Manager: https://www.google.com/analytics/tag-manager/faq/

Controlling Cookies

There are a number of ways you can manage what cookies are set on your devices. Essential cookies, however, cannot be disabled. If you do not allow certain cookies to be installed, the Services may not be accessible to you and/or the performance, features, or Services of the website may be compromised.

If you wish to gain greater control over Cookies in your browser, please read the browser settings section for your browser, below.

Consenting to Cookies

When you visit the Taskworld's Marketing page, a popup banner will appear informing you on the use of cookies and provides a direct link to this information page. If you confirm your acceptance of cookies by closing the popup banner, or if you continue to browse the webpage, it is considered that your consent has been obtained. The cookie acceptance banner will no longer display on your screen.

This allows Taskworld, for example, to monitor the traffic patterns of users from one page within our Websites to another, to deliver or communicate with cookies, to understand whether you have come to our Websites from an online advertisement displayed on a third-party website, to improve site performance, and to measure the success of marketing campaigns. In many instances, these technologies are reliant on cookies to function properly, and so declining cookies will impair their functioning.

You may still choose at any time to delete or disable all or part of these cookies using your browser or professional platforms for this purpose, with the exception of the functional cookies necessary for the site to function, as indicated below.

The saving of a cookie on a device is governed by user-defined settings for the user’s browsing software. If you have accepted the saving of cookies by your browser, they will be integrated into the pages and content you have viewed and may be temporarily stored in a dedicated location on your device.

Browser Settings

You can disable and/or delete most types of cookies by using your browser settings. Please note that if you use your browser settings to block all cookies you may not be able to access parts of our or others’ services. The following links provide information on how to modify the cookies settings on some popular browsers:

Apple Safari http://support.apple.com/kb/PH5042

Google Chrome https://support.google.com/chrome/bin/answer.py?hl=en&answer=95647&p=cpn_cookies

Microsoft Internet Explorer http://windows.microsoft.com/en-US/windows7/How-to-manage-cookies-in-Internet-Explorer-9

Mozilla Firefox http://support.mozilla.org/en-US/kb/Cookies

Cross-Device Cookies

If you wish to opt out of our ability to track you across devices, you may install the Google Analytics Opt-out Browser Add-on by clicking here.

Do Not Track Signals

There is no uniform or consistent standard or definition for responding to, processing, or communicating Do Not Track signals. At this time the Taskworld Services do not function differently based on a user’s Do Not Track signal. For more information on Do Not Track signals, see All About Do Not Track.

Cookie Policy Update

We may update this Cookie Policy from time to time in order to reflect, for example, changes to the cookies we use or for other operational, legal or regulatory reasons. We will notify you of any changes by posting the new Policy on our Website with a new effective date.

The date at the top of this Cookie Policy indicates when it was last updated.

More Information

If you have any questions about how we use cookies, you can contact us at privacy@taskworld.com.

Agreement on Data Processing Pursuant to Art. 28 of the EU General Data Protection Regulation (GDPR)

Between

• hereinafter referred to as "Client" - and

Taskworld Deutschland GmbH

Friedrichstrasse 171, 10117,

Berlin, Germany

• hereinafter referred to as "Contractor" -
• Client and Contractor each hereinafter referred to as a "Party" and jointly referred to as the "Parties" -

1- Subject matter of the contract and contents of the order

a- The object of the contract results from the agreement concluded between the parties on the provision of a service by the Contractor to the Client, to which reference is made here (hereinafter referred to as “performance agreement”). This contract for processing (the “Contract”) specifies the data protection obligations of the contracting parties. This contract shall apply to all activities related to the pro-cessing where the Contractor or his employees may come into contact with personal data provided to the Contractor by the Client.

b- The type of data processed, the categories of data subjects, and the type and purpose of the collection, processing and use of personal data by the Contractor for the Client are specified in detail in Appendix 1 to this contract.

c- Unless otherwise expressly stipulated in this contract, the contractually agreed data pro- cessing shall be performed exclusively in Germany, a member state of the European Union or another state party to the Agreement on the European Economic Area (EEA). Any relocation to a third country may take place only if the special conditions of Art. 44 et seq. of the GDPR are fulfilled.

2- Technical and organisational measures

The Contractor shall provide the security pursuant to Art. 28 para. 3 lit. c, 32 GDPR in particular in conjunc- tion with Art. 5 para. 1, para. 2 GDPR. Overall, the measures to be taken are data security measures and mea- sures to ensure a level of security appropriate to the risk in terms of confidentiality, integrity, availability and resilience of the systems. The state of the art, the implementation costs and the type, scope and purpose of the processing as well as the variable probability and severity of the risk to the rights and freedoms of natural persons within the meaning of Art. 32 para. 1 GDPR must be taken into account. The Contractor shall document the individual measures in a measure concept in Appendix 2.

a- The technical and organisational measures are subject to technical progress and ongoing development. In this respect, the Contractor is permitted to implement alternative adequate measures. In doing so, the safety level of the defined measures must not be undercut. Any significant changes must be documented.

b- The Contractor shall regularly monitor the internal processes as well as the technical and organisational measures to ensure that the processing in his sphere of responsibility is carried out in accor- dance with the requirements of the applicable data protection law and that the rights of the data subject are protected.

3- Rectification, limitation and erasure of data

a- The Contractor may not rectify, delete or restrict the processing of the data processed on behalf of the Client without authorisation, but only in accordance with documented instructions from the Client. If a person concerned directly addresses the Contractor in this respect, the Contractor shall immediately forward this request to the Client.

b- The Contractor shall support the Client with suitable technical and organisational measures to ensure the rights of affected parties to be forgotten, to rectification, to data portability and to access to information. For support services which are not owed according to the performance agreement, the Contractor can claim remuneration.

4- Quality assurance and other duties of the Contractor

a- The Contractor shall only employ personnel for the performance of the work who are under an obligation of confidentiality and who have been familiarised beforehand with the data protection provisions relevant to them. The Contractor and any person subordinated to the Contractor who has access to personal data may process such data only in accordance with the instructions of the Client, including the powers granted in this contract and in the performance agreement, unless they are legally obliged to process them.

b- The Contractor shall support the Client in complying with the obligations set out in Articles 32-36 GDPR regarding the security of personal data, reporting obligations in the event of data breakdowns, data protection impact assessments and prior consultations. These include, among others:

• the obligation to immediately report violations of personal data to the client,
• the obligation to support the client within the scope of his duty to inform the affected parties and to make all information relevant in this context immediately available to him,
• assisting the Client in his data protection impact assessment,
• the support of the client within the framework of prior consultation with the regulatory authority.

c- For support services which are not included in the performance agreement or which are due to misconduct on the part of the Client, the Contractor may claim remuneration.

5- Subcontracting relationships

a- For the purposes of this provision, subcontracting is defined as services which relate directly to the provision of the principal service. This does not include auxiliary services which the contractor uses like, for example, telecommunications services, postal/transport services, maintenance and user services or the disposal of data storage media as well as other measures to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data processing systems. The Contractor is, however, obliged, even in the case of outsourced ancillary services, to make appropriate contractual agreements in accordance with the law and to take control measures in order to guarantee data protection and the security of the Client’s data.

b- The Customer agrees to the contracting of subcontractors under the condition of a contractual agreement between the Contractor and the subcontractor in accordance with Art. 28 para. 4 GBPR. The consent expressly includes, proviso of the aforementioned conditions, the use of the subcontractors named below.

c- The Contractor makes use of infrastructure and platform services of the Amazon Web Services platform operated by Amazon Web Services, Inc. for the provision of the software solution in accordance with the performance agreement. The processing is done on a server of Amazon, Inc. in Frankfurt / Main (Germany). Contracts exist between Taskworld and Amazon Web Services Inc., regarding the use of the Amazon Web Services service and processing, which oblige Amazon Web Services Inc. to protect personal data. Detailed information from Amazon Web Services Inc. about Amazon Web Services Inc.’s compliance with data protection requirements can be found at https://aws.amazon.com/compliance/gdpr-center/?nc1=h_ls.

d- The Contractor shall inform the Client in advance of any intended change with regard to the involvement or replacement of other processors. The Customer may object to this change vis-à-vis the Contractor within 14 days of receipt of the information by the Client. An objection may not be lodged without an interest of the Client which outweighs the interests of the Contractor.

e- If the subcontractor performs the agreed service outside the EU/EEA, the Contractor shall ensure the legal admissibility of data protection by taking appropriate measures.

6- Control rights of the Client

a- The Client shall have the right, in consultation with the Contractor, to carry out inspections or to have them carried out by inspectors to be appointed in each case. The Client shall have the right to convince himself of the Contractor’s compliance with this contract at the Contractor’s premises by means of random checks, which are generally to be notified in good time.

b- The Contractor shall ensure that the Client can satisfy himself that the obligations of the Contractor pursuant to Art. 28 GDPR are being complied with. The Contractor undertakes to provide the Client upon request with the necessary information and, in particular, to prove the implementation of the technical and organisational measures.

c- Evidence of such measures, which do not only involve the specific order, can be provided by

• Compliance with approved rules of conduct pursuant to Art. 40 GDPR,
• Certification according to an approved certification procedure in accordance with Art. 42 GDPR,
• Current certificates, reports or report extracts from independent entities (e.g. chartered accountants, internal auditors, data protection officers, IT security department, data protection auditorium, quality audit),
• A suitable certification through an IT security or data protection audit (for example according to BSI IT-Grundschutz).

d- The Contractor can claim remuneration for the facilitation of controls by the Client.

7- Powers of instruction of the Client

a- Oral instructions shall be confirmed by the Client without delay (at least in text form).

b- The Contractor shall inform the Client immediately if he is of the opinion that an instruction violates data protection regulations. The Contractor is entitled to suspend the execution of the respective instruction until it is confirmed or amended by the Client.

8- Deletion and return of personal data

a- Copies or duplicates of the data shall not be made without the knowledge of the Client. Excluded from this are backup copies, insofar as they are necessary to guarantee proper data processing, as well as the storage of data, which is necessary with regard to compliance with statutory storage obligations.

b- Upon completion of the contractually agreed work or earlier upon request by the Client - at the latest upon termination of the performance agreement - the Contractor shall surrender to the Client all documents in his possession, processing and usage results as well as data stocks created in connection with the contractual relationship or, after prior consent, destroy them in accordance with data protection regulations. The same applies to test and scrap material. The deletion log shall be provided on request. The Contractor’s obligations under this Clause 8.2 shall not apply if there is an obligation to store personal data under EU law or the law of Member States of the EU.

c- Documentation which serves as proof of data processing in accordance with the order shall be stored by the Contractor in accordance with the respective statutory periods beyond the end of the contract. He may hand them over to the Client to discharge him upon termination of the contract.

9- Duration of order, termination

a- The duration of this order corresponds to the duration of the performance agreement and also includes the period after the end of the performance agreement until the complete return or deletion of the data provided to the Contractor by the Client in connection with the execution of the main contract.

b- The right of each contracting party to terminate this order without notice for good cause shall remain unaffected.

10- Applicable Law, Place of Performance, Place of Jurisdiction

a- German law shall apply to this contract.

b- Place of performance is Hamburg.

c- The exclusive place of jurisdiction for any disputes arising from this contract shall be Hamburg.

11- Miscellaneous

a- Amendments, supplements and additions to this contract shall only be valid if agreed in writing between the contracting parties. This shall also apply to any amendment of this provision of the contract.

b- Should any provision of this contract be or become invalid, this shall not affect the validity of the remainder of the contract. The invalid provision shall be deemed replaced by a valid provision which comes as close as possible to the economic purpose of the invalid provision. The same shall apply in the event of a contractual gap.

Appendices:

Appendix 1: Type and purpose of processing, type of data, group of data subjects

Annex 2: Technical and organisational measures

Taskworld Deutschland GmbH

Friedrichstrasse 171, 10117,

Berlin, Germany

Company Address Fred Mouawad Managing Director Date: 25th May, 2018

Appendix 1 - Type and purpose of processing, type of data, group of data subjects

Affected persons and groups of persons: Affected persons and groups of persons In particular:

• Users of the software solution provided
• Contractual partners of the Client
• Employees of the Client
• Prospective clients.

Type of data or categories of data: Type of data or categories of data In particular:

• Person master data
• Communication data (e.g. telephone, e-mail)
• Contract master data
• Contract billing and payment data
• Customer history
• Planning and control data.

Recipients:

• Contractor
• Subcontractors

Type and purpose of processing: Provision of software with storage space via the Internet; provision of IT services, in particular support services

Appendix 2 - Technical and organisational measures

Note: Taskworld Deutschland GmbH (hereinafter referred to as “Taskworld”) processes personal data within the scope of this contract exclusively for the fulfilment of service and support obligations arising from the service agreement. All data is stored on the Amazon Web Services platform (see clause 5.2 of the contract; hereinafter referred to as the “AWS platform”). Taskworld accesses the data via a laptop or desktop computer provided for this purpose through the employee entrusted with the service provision. A contract exists between Taskworld and Amazon Web Services, Inc. regarding the use of the Amazon Web Services service. Detailed information from Amazon, Inc. regarding Amazon, Inc.’s compliance with the data protection re-quirements can be found at https://aws.amazon.com/compliance/gdpr-center/?nc1=h_ls. In the following the technical and organizational measures of Taskworld are described.

1- Confidentiality (Art. 32 para. 1 lit. b GDPR) a- Access control No unauthorized access to data processing equipment:

• The only computer with access to the Client’s data shall be kept in locked rooms.
• Access to these rooms is only granted to the employee responsible for support as long as the computer is switched on.
• The computer is additionally secured by a Kensington lock.
• Only the employee responsible for support has a key to the Kensington lock.

b- Data media control No unauthorized reading, copying, modification or deletion of data media:

• External data media used for data backup are stored separately and secured by an additional lock.
• Only employees have the key to the data medium.

c- Access, storage and user control No unauthorized reading, copying, modification or deletion within the system:

• Only one computer shall be set up with access to the Customer’s data, which shall be used exclusively for the purpose of providing support services for the Contractor’s software solution.
• This computer is secured with a qualified password consisting of at least 8 characters, including at least one special character and one number.
• The password is changed every 2 months.
• If the employee is absent from the computer, the password lock is activated immediately.
• External backup copies on data media are also password protected.
• The same password must not be used for the computer and the data carrier.
• Access to data processing systems is permitted only to the employee responsible for support.
• This is ensured by a user profile with password protection.
• There are no further authorizations for accessing data processing systems.

d- Separability Separate processing of data collected for different purposes:

• The data of the client is accessed exclusively within the scope of the order and for the purpose of the support service.
• The Contractor’s employee providing support processes the Client’s data separately from other data. This is ensured by setting up client accounts.

2- Integrity (Art. 32 para. 1 lit. b GDPR)

a- Transport control No unauthorized reading, copying, modification or removal during electronic transmission or transport:

• Date are transmitted/transferred exclusively encrypted and via German servers.
• A transmission/transfer to external data media is carried out exclusively via protected local connections.
• Each transmission of data is logged.
• A transmission/transfer is carried out only for the purpose of backup or for data processing in accordance with the order.

b- Input control Checks to determine whether and by whom personal data have been entered into the data processing systems, or modified, or removed:

• Only one employee of the Contractor is entrusted with the processing of personal data of the Client within the scope of support.
• The employee logs every data entry, change or removal.
• The logs are summarized for each support process and processed in a suitable manner for subsequent review.
• The processed logs are made available to the Client on request.

c- Data integrity No damage to data due to system malfunctions

• The integrity of the data is guaranteed by external backup copies on data media.
• Data processing systems shall be set up within the framework of technical facilities in such a way as to prevent damage to or loss of data.

3- Availability and Resilience (Art. 32 para. 1 lit. b GDPR) a- Availability control Protection against accidental or deliberate destruction or loss:

• The computer used for the support services is equipped with virus protection and a firewall, which are constantly updated.
• To back up the data, a backup is created at regular intervals on an external data medium.
• The uninterruptible power supply to the computer and the availability of the data are ensured by using modern hardware, which is maintained regularly.

b- Rapid recoverability (Art. 32 para. 1 lit. c GDPR);

• After a malfunction of the data processing systems, all system components are immediately checked for errors and it is determined whether data has been damaged.
• If the data has been damaged or lost, the data will be recovered from an external data carrier.
• A report on the extent and remedy of the failure will be prepared for future reference.

c- Reliability Availability of all functions of the system and error message:

• All data processing systems are regularly updated, checked for errors and maintained. There are regular checks whether the systems used correspond to the current technical standard.

4- Procedures for Regular Review, Assessment and Evaluation (Art. 32 para. 1 lit. d GDPR; Art. 25 para. 1 GDPR)

a- Data protection management:

• All employees of the contractor are informed about data protection topics and obliged to comply with data protection regulations.
• The Contractor’s management shall verify at regular intervals whether the internal procedures comply with data protection requirements and shall take appropriate measures to ensure this.
• The management is continuously advised by a lawyer on data protection aspects.
• Access to the Client’s data by the Contractor’s employees shall take place exclusively within Germany and via German servers.

b- Incident-Response Management:

• In the event of a security incident that could affect the data processing systems, the Contractor’s management shall be informed immediately by their employees.
• A data backup is performed if a security incident is suspected on a separate data medium after each data entry or change.

c- Data protection-friendly default settings (Art. 25 para. 2 GDPR)

• When selecting the hardware and software used, the Contractor shall ensure that they are compatible with the requirement of data minimisation.
• When software is installed, components which are not necessary for the use of the software and which can lead to an impairment of the Client’s data are not used.

d- Order control

No order data processing within the meaning of Art. 28 GDPR without corresponding instructions from the Client:

• The Contractor’s employee shall be contractually obliged to process the data in accordance with the Client’s instructions.
• The powers of the Contractor shall be clearly and exhaustively regulated by contract.
• Orders and support requests are documented in text form in order to be able to trace the order situation later.
• The employee responsible for support maintains direct contact with the Client.