Edora Cloud

Terms of Service Agreement

Version 2.2, November 2024

By using the Edora Service or software applications (collectively, the “Edora Service” or the “Service”), you, as the customer (the “Customer”), enter into a binding agreement (the “Agreement”) with Edora A/S (“Edora”).

The Agreement includes these terms governing the use of the Service together with Appendices A through G (the “Appendices”).

The Agreement covers, among other matters, availability, privacy and security obligations, and other terms governing use of the Service. By using the Service, the Customer accepts this Agreement.

Definitions

Appendix A defines key terms and expressions used in these terms.

The Service

Edora will use the efforts necessary to provide the Service as described in Appendices B, C and D. The Customer may use the Service solely for the Customer’s internal business purposes and to provide the Customer’s own services to its users (the “Users”), subject to (a) payment of the agreed fees to Edora and (b) the Customer’s compliance with the terms and conditions set out in this Agreement, the Product Documentation and any other documents referenced in the Agreement or the Product Documentation.

Operational Obligations

Support

Edora will provide the Customer with technical support for the Service in accordance with the support terms in Appendix C.

Service Terms

Edora will provide the Service in accordance with the service terms in Appendix D.

User Data and Usage Data

The parties will comply with the obligations relating to User Data and Usage Data described in Appendix E.

The Customer’s General Responsibilities

By using the Service, the Customer agrees to comply with all applicable laws and this Agreement. Among other things, the Customer must not:

host unlawful content, such as child sexual abuse material or content that infringes copyright;
use the Service to carry out cyberattacks such as DDoS attacks, phishing or hacking;
misuse resources, for example for unauthorised cryptocurrency mining;
breach data protection law, including by sharing sensitive personal data without a lawful basis;
distribute malware through the platform;
expose the Service to security breaches by circumventing system controls or using inadequate security configurations;
use the Service for unlawful trade, including through black markets; or
use the Service for extremist propaganda or other unlawful activities.

The Customer is solely responsible for all communications and support relating to the Service vis-à-vis Users and other third parties to whom the Customer grants access to the Service. The Customer accepts that Edora is not responsible for networks, computers, software, hardware or other services and equipment, including a sufficient internet connection, required for the Customer and the Users to access the Service. Edora does not warrant that the Customer’s equipment is compatible with the Service.

The Customer is solely responsible for all activity under its subscription to the Service and must comply with all applicable local, national and international laws, treaties and regulations in connection with its use of the Service, including rules concerning data protection, privacy, international communications and the transmission of technical and/or personal data. Edora reserves the right to charge the Customer for reasonable costs and expenses incurred by Edora in ensuring that the Customer fulfils the obligations above.

Relationship with the General Data Protection Regulation

In this Agreement, the terms “Personal Data,” “Controller,” “Processor” and “Processing” have the same meanings as under the EU General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the “Regulation”). In addition to the provisions of Appendix E, the following applies to Personal Data processed under the Agreement:

(a) With respect to Personal Data included in the Customer’s data and processed by Edora in connection with the Agreement (the “Personal Data”), the parties agree that the Customer is the Controller and Edora is the Processor.

(b) Edora may process Personal Data only in accordance with the Customer’s instructions and this Agreement. Edora may process and disclose Personal Data only where reasonably necessary under the Agreement or to the extent required by law.

(d) Edora must implement appropriate technical and organisational measures in connection with the processing of Personal Data to ensure confidentiality, prevent unauthorised or unlawful processing, and protect Personal Data against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access.

(e) Taking into account the costs of implementation, technological developments and the nature of the processing, Edora must implement measures that ensure a level of security appropriate to the potential harm resulting from unauthorised or unlawful processing or accidental loss, destruction of, or damage to Personal Data. Edora must notify the Customer of any security breach without undue delay after becoming aware of it.

(f) Edora acknowledges that the Customer’s Personal Data is inherently confidential and must, unless otherwise instructed by the Customer:

process Personal Data solely in connection with the Agreement and not for any other purpose;
process Personal Data in accordance with the Customer’s instructions or as agreed in writing with the Customer;
take reasonable steps to ensure that each Edora employee and/or subcontractor involved in processing Personal Data is informed of its confidential nature;
take reasonable steps to ensure that neither Edora nor any of its employees or subcontractors publishes, discloses or reveals Personal Data to a third party unless required under the Agreement or pursuant to the Customer’s written instructions;
not process or transfer Personal Data outside the European Economic Area (EEA) without the Customer’s prior consent; and
take reasonable steps to ensure that Edora does not transfer Personal Data outside its usual place of business except (1) in accordance with the Agreement, (2) by written agreement with the Customer, (3) for transfer to off-site backup or (4), in a disaster situation, for transfer to storage at a designated disaster recovery site.

(g) Edora may disclose Personal Data to subcontractors to the extent necessary for the administration of the Service, on terms no less restrictive than those set out in this Agreement.

(h) Edora must notify the Customer without undue delay of:

any legally binding request from a law enforcement or other relevant authority for disclosure of Personal Data, unless such notice is prohibited; and
any request received directly from a data subject.

(i) Edora must assist the Customer in taking any action considered necessary or appropriate to address complaints or allegations of non-compliance with the Regulation.

The Customer’s Service Terms

If the Customer provides a publicly available service based on the Service, the Customer agrees to protect Users’ Personal Data through a publicly available policy that describes the Customer’s data-handling practices, complies with all applicable laws and regulations, and does not conflict with this Agreement. The Customer is solely responsible for enforcing the Customer’s service terms and any other agreement between the Customer and its Users. The Customer must notify Edora immediately if the Customer becomes aware of a User’s breach of applicable service terms or guidelines for the Service and must describe all actions that the Customer has taken or intends to take in connection with that breach.

Edora’s Service Terms

If the Customer provides a publicly available service based on the Service, the Customer must (1) incorporate Edora’s service terms, including Edora’s privacy policy, into its own service terms in an enforceable manner and (2), where reasonably required by Edora, enable Edora’s own service terms to be presented directly to Users in the manner specified by Edora.

Where Edora requires its service terms to be presented directly to Users, the specific implementation and presentation must be agreed between the parties and must, at a minimum, include: (a) direct links to Edora’s service terms and a mechanism enabling Users to accept them in an enforceable manner; (b) consent and acceptance provisions provided by Edora; and (c) continued availability of Edora’s service terms to Users throughout the term of the Agreement. At Edora’s request, the Customer must immediately suspend or terminate any User’s access to the Service in response to that User’s breach of applicable service terms.

Enforcement

Edora reserves the right, at its sole discretion, either (a) to suspend or terminate, or require the Customer to suspend or terminate, any User in response to a breach or suspected breach of applicable service terms; or (b) to access, retain or disclose User Data or Usage Data where required under applicable law, including the Regulation, or where such access, retention or disclosure is reasonably necessary to: (i) comply with the law; (ii) enforce Edora’s service terms; (iii) respond to claims that User Data or Usage Data infringes a third party’s rights; (iv) respond to the Customer’s requests for technical support; or (v) protect the rights, property or personal safety of Edora, Edora’s customers or the public.

Security Measures

The Customer undertakes to comply with the security measures in Appendix F.

Escalation

In the event of any dispute arising out of or relating to this Agreement, the person responsible for the Agreement at each party must meet online or in person no later than ten business days after receiving a written request from the other party to resolve the dispute. The responsible persons must engage constructively in negotiations with a view to resolving the dispute.

If the responsible persons cannot reach a mutually satisfactory resolution within ten days after receipt of the written notice, the dispute must be referred to a management representative from each party. Neither party may commence proceedings against the other, except to seek interim injunctive relief where necessary, while the responsible persons or management representatives are mutually attempting to resolve the dispute.

Payment Terms

Each party bears its own costs necessary to comply with this Agreement.

Service Fees

Each month, the Customer must either (a) pay Edora the applicable fees for the Service as published and updated from time to time on edoracloud.com, or (b) pay the agreed fees for the Service specified in a separate purchase order or contract.

Payment

Payment is due net 30 days from the invoice date. Late payments accrue interest at one and a half per cent (1.5%) per month or at the rate applicable from time to time under the Danish Interest Act. The stated service fees exclude VAT and other taxes and charges, which are the Customer’s responsibility. The Customer will continue to be charged service fees during any termination notice or suspension period. If payments outstanding to Edora exceed three (3) months, Edora reserves the right to notify the Customer’s Users that their service may be shut down or migrated to another service.

Term and Termination

This Agreement takes effect on its effective date and continues until terminated. After the initially agreed period, the Agreement renews automatically for successive periods and remains in force until (a) either party terminates the Agreement by giving 90 days’ written notice or (b) the Agreement is otherwise terminated as set out herein. In connection with termination, the parties agree to comply with the requirements for the Termination Period in Appendix G.

A party may terminate the Agreement on shorter written notice to the other party if the other party (a) commits a material breach of the Agreement and fails to remedy that breach within 30 days after receiving written notice; (b) becomes insolvent or is dissolved; (c) files for bankruptcy; or (d) enters into a composition or similar voluntary arrangement with its creditors.

Edora may also suspend the provision of the Service, in whole or in part and with immediate effect, as a result of (a) a third-party claim alleging facts that would constitute a breach of the Customer’s obligations under the Agreement or (b) a court order or order from any regulatory authority requiring Edora temporarily or permanently to cease performing its obligations under the Agreement. If a suspension under this paragraph continues for more than six (6) months, Edora may terminate the Agreement, in whole or in part, with immediate effect.

Effect of Termination

At the end of the Termination Period, (a) the Service and any licences granted under the Agreement terminate, and (b) each party must return or destroy all copies of and extracts from the other party’s Confidential Information.

Intellectual Property Rights

This Agreement does not transfer any intellectual property or other proprietary rights to the Customer. The Customer agrees that all rights in the Service, including any part provided to the Customer and its Users, belong to Edora and its subcontractors and licensors. The Service and every part of it may be used by the Customer solely under and in accordance with this Agreement.

Restrictions on the Customer’s Use of the Service

The Customer must not (a) license, sublicense, sell, resell, transfer, assign, distribute or otherwise commercially exploit or make the Service available to any third party, except as expressly permitted under the Agreement for the Customer’s Users; (b) modify or create derivative products or services based on the Service; or (c) reverse engineer the Service.

Warranties, Disclaimers and Indemnification

Each party warrants and represents as of the date hereof that (a) it is a company duly incorporated and validly existing; (b) it has all necessary corporate authority to execute, deliver and perform the Agreement; and (c) execution and delivery of the Agreement and completion of the transactions contemplated herein do not conflict with or breach any condition or obligation in another agreement binding on that party in a manner that prevents or will prevent that party from fully performing its obligations or exercising its rights under the Agreement. Edora warrants and represents that it will perform the Service with due care and will endeavour to perform it in accordance with Appendices B, C and D.

Disclaimer

UNLESS EXPRESSLY STATED OTHERWISE IN THE AGREEMENT, ALL MATERIALS AND DELIVERABLES PROVIDED UNDER THE AGREEMENT ARE PROVIDED “AS IS,” AND EACH PARTY HEREBY DISCLAIMS, TO THE EXTENT PERMITTED BY APPLICABLE LAW, ALL WARRANTIES, REPRESENTATIONS AND CONDITIONS, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING ALL IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, TITLE AND NON-INFRINGEMENT. NEITHER EDORA NOR ITS AFFILIATES MAKES ANY WARRANTY OR REPRESENTATION REGARDING CONTENT OR INFORMATION MADE AVAILABLE BY OR THROUGH THE SERVICE, WHETHER THEY OR ANY THIRD PARTY WILL RELEASE UPDATES OR IMPROVEMENTS TO THE SERVICE, OR WHETHER THE FUNCTIONS OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE. NEITHER EDORA NOR ITS AFFILIATES IS LIABLE FOR THE DELETION, CORRECTION, DESTRUCTION, DAMAGE, LOSS OR FAILURE TO STORE USER DATA OR FOR ANY LOSS OR DAMAGE ARISING OUT OF OR IN CONNECTION WITH THE CUSTOMER’S FAILURE TO COMPLY WITH THE AGREEMENT.

The Customer agrees to indemnify and hold Edora harmless against any loss, cost, claim and expense incurred by Edora arising out of or relating to (a) Customer Content on the Service; (b) the Customer’s or its Users’ use of the Service in a manner not permitted by Edora or outside the scope of the Agreement; (c) the Customer’s improper disclosure of User IDs, User Data or Usage Data or the Customer’s failure to comply with applicable law; or (d) the Customer’s breach of or failure to comply with the Agreement or other applicable service terms or guidelines established by Edora.

Limitation of Liability

THE PARTIES ARE LIABLE IN ACCORDANCE WITH THE GENERAL RULES OF DANISH LAW. HOWEVER, UNDER NO CIRCUMSTANCES WILL EITHER PARTY BE LIABLE TO THE OTHER FOR LOSS OF BUSINESS, CONSEQUENTIAL LOSS OR OTHER INDIRECT LOSS, INCLUDING LOSS OF DATA AND OPERATING LOSS, SUBJECT, HOWEVER, TO APPENDIX D ON THE SERVICE LEVEL AGREEMENT. IN ALL CIRCUMSTANCES, THE PARTIES’ TOTAL LIABILITY IS LIMITED TO THE FEES PAID BY THE CUSTOMER FOR THE SERVICE DURING THE 12 MONTHS PRECEDING THE ASSERTION OF THE CLAIM.

Each party acknowledges that the limitation of liability above is an essential element of the agreement between the parties and that the prices and other terms of the Agreement would be materially different without that limitation.

General

Assignment

The Customer may not assign the Agreement or any right or obligation arising under it without Edora’s prior written consent. Edora may freely assign any right or obligation under the Agreement to any of its affiliates.

Governing Law

This Agreement is governed by and construed in accordance with Danish law.

Confidentiality

A party must keep strictly confidential all information received from the other party in connection with the performance of the Agreement and must not disclose that information to a third party or use it for any purpose other than performing the Agreement without the other party’s prior written consent. The confidentiality obligation does not apply to information that is publicly available, is received by a party in good faith from a third party, is developed independently by a party without use of the other party’s information, or is disclosed in order to comply with a legal obligation.

The confidentiality obligation survives termination of the Agreement.

Force Majeure

Neither party is liable for failure to perform its obligations where the failure results from circumstances beyond that party’s control which the party should not reasonably have taken into account when signing the Agreement and should not reasonably have avoided or overcome, including strikes, lockouts, terrorism and public health crises in the form of pandemics. Force majeure includes the force majeure event itself and its direct consequences, including material supply-chain disruptions.

Delay resulting from force majeure may be claimed only for the number of days for which the force majeure situation actually lasts.

Force majeure may be invoked only if the affected party notifies the other party no later than five business days after the force majeure event occurs. At the same time, the affected party must state the expected duration of the situation.

The parties must also, to the extent possible and using reasonable resources, cooperate in good faith on the continued performance of the Agreement, including management of the force majeure situation.

While force majeure is invoked, the party not affected by force majeure may withhold performance of obligations corresponding to the other party’s failure to perform and may terminate the Agreement without notice if the force majeure situation lasts more than 60 business days.

Entire Agreement and Amendments

The Agreement constitutes the entire agreement between the parties concerning the Service and supersedes all previous agreements relating to it. The Agreement may be amended only by a written agreement signed by both parties.

Interpretation

In the event of a conflict, the Agreement prevails over the Appendices.

Appendix A – Definitions

“Termination Period” means the period beginning 60 days before the effective expiry or termination of the Agreement.

“User” means a person who has access to a service provided by the Customer through the Service.

“User Data” means a User’s data, including virtual images, data stored by virtual servers on shared block storage, information and documents submitted through the Service, and other documents associated with a User’s account.

“User ID” means a User’s credentials when used by that User to access the Service.

“Usage Data” means data or information collected or received by a party concerning a User’s use of the Service.

“Controller” means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.

“Force Majeure” means an event beyond the parties’ reasonable control, including natural disasters, cyberattacks, war, acts of terrorism, riots, embargo restrictions, work stoppages, strikes, pandemics or similar events.

“Confidential Information” means any information marked as confidential or that may reasonably be regarded as confidential, including information from a party or its affiliates relating to their business, affairs, finances, products, development, marketing, technology, pricing, performance, relationships, trade secrets, know-how, employees, customers and suppliers, including the subject matter of the Agreement and User Data. Confidential Information does not include information that can be demonstrated to have been lawfully in the receiving party’s possession or independently developed by the receiving party at the time of disclosure; that is or becomes public knowledge without an improper act or omission by the receiving party; that is subsequently disclosed to the receiving party by a party legally entitled to make that disclosure; or that is approved for release in writing.

“Customer Content” means trademarks, service marks, logos or content belonging to the Customer and its affiliates, used in or in connection with the Service, and provided by the Customer to Edora for use in accordance with the Agreement.

“Product Documentation” means the product documentation available on edoracloud.com, as updated by Edora from time to time.

“Service” means all services described in Appendix B and provided by Edora in accordance with the Agreement.

“Service Fee” means the monthly fee payable by the Customer for the Service.

“Service Period” means one month unless a different period is specified in a separate purchase order.

“Service Terms” means the specific terms, conditions, guidelines or policies governing use of the Service.

“TSR” means the Customer’s technical support representative responsible for opening support cases with Edora.

Appendix B – The Service

The Service

The Service is a Denmark-based Infrastructure as a Service offering with related services such as Kubernetes clusters, Windows and Linux servers, and additional services.

Use and Administration of the Service

Edora provides APIs and administrative interfaces in accordance with the Product Documentation. The Customer may create and administer user accounts and virtual servers and otherwise use the Service in compliance with Edora’s technical requirements. The Customer is solely responsible for creating, modifying or deleting Users and virtual servers for the Customer’s services. Migration of existing User Data to the Service is not included in the Agreement.

Changes to the Service

As the provider of the Service, Edora has final decision-making authority and is responsible for the design, programming and modification of the Service. Edora may implement or install security updates, updates and service packs as required and at its discretion (“Service Updates”). Service Updates may modify the functionality of the Service, including by removing non-critical features. If Edora anticipates that a Service Update may have a material adverse impact on the Service, Edora will give the Customer reasonable notice.

Service Communications

The Customer acknowledges that Edora may communicate directly with the Customer’s Users regarding service-related matters.

Appendix C – Support Policy

A. The Customer’s Obligations

As a condition of Edora providing technical support, the Customer must comply with the following:

Valid Service Agreement

Edora provides technical support only to customers with a valid service agreement. A service agreement consists either of a separate written agreement between the Customer and Edora or of the Customer selecting the service agreement checkbox in the web interface for the systems for which technical support is requested.

The Customer’s Support Obligations

Before submitting a support request to Edora, the Customer must first make a reasonable and qualified effort to resolve local support issues itself, including errors, bugs, malfunctions or network connectivity issues.

Support Request

If the issue remains unresolved, an authorised and qualified TSR of the Customer may submit a written request for technical support (a “Request”) through the online support tool provided by Edora. The Customer must provide the information requested, including (a) a proposed appropriate urgency level; (b) a description of the issue, configuration and Customer network; (c) relevant data; and (d) contact details for the qualified TSR, including a relevant telephone number, and remain available to answer questions and assist Edora’s support personnel as required.

B. Edora Support

Subject to the terms and conditions of the Agreement, Edora provides technical support as follows:

Online Documentation and Web-Based Help

Edora makes standard help documents available to the Customer. These may also be made directly available to the User or used in connection with the Customer’s technical support obligations. Before escalating a support request to Edora, the Customer must use local support resources in an attempt to resolve the issue.

Technical Support Service

Upon receipt of a valid support request, Edora provides technical support to the Customer’s designated qualified TSR. All Requests must be submitted to Edora through the designated web interface. Edora reserves the right to reject any Request not submitted by an authenticated, qualified TSR of the Customer. Edora communicates with the Customer’s qualified TSR through the web interface or, at Edora’s discretion, by SMS or telephone.

Classification of Requests

Edora classifies each support request according to severity, and that classification forms the basis for support under the Agreement. Edora takes the Customer’s proposed classification into account. A support request submitted without a proposed classification will, by default, be classified as “Normal.”

Response Times

Response time means the time taken by Edora’s support personnel to contact the Customer and acknowledge receipt of a support request. The support incident may be resolved or unresolved at that time. All times apply 24 hours a day.

Initial response times depend on the assigned urgency and criticality of the support request.

Urgency level	Description	Response time
Immediate	Production system outage affecting multiple Users	1 hour
Urgent	Important functionality is unavailable, no workaround exists, and multiple Users are reproducibly affected	3 hours
High	Important functionality failure with a possible workaround	6 hours
Normal	Minor issues and functionality failures	24 hours
Low	General questions	48 hours

The initial response to a support request consists of Edora receiving and acknowledging the Request and may not include a resolution. During work on the Request, Edora communicates with the Customer’s qualified TSR where relevant. Edora communicates the final resolution to a qualified TSR. The Customer acknowledges that the Service may not be perfect or error-free and that, despite reasonable efforts, Edora may be unable to answer or resolve every support request. Edora makes no promise, warranty or assurance that every Customer support request can be resolved.

Maintenance and Upgrades

Edora will endeavour to give the Customer timely notice of uptime, maintenance, upgrades and configuration changes that will materially affect the Service. Advance notice is not required, however, for changes made by Edora for security reasons or in an emergency.

Languages

All support provided by Edora is available in Danish or English.

Appendix D – Service Level Policy

1. Service Level

Edora will use its best and reasonable efforts to maintain the servers and infrastructure supporting the Service at 99.9% availability during each calendar month, as described below. If the Customer experiences a service issue defined below and the issue results from Edora’s failure to provide the stated availability, the Customer is entitled to the Service Credits described below.

2. Definitions

“Downtime” means that the Customer cannot access the Service or material parts of it.

“Downtime Period” means the duration of the test periods in which Downtime occurred, as measured by Edora. Intermittent Downtime lasting less than ten minutes is not counted in any Downtime Period.

“Scheduled Downtime” means a period of Downtime of which Edora informs the Customer at least five days before it begins. Scheduled Downtime does not constitute Downtime under this service level agreement and is not counted in any Downtime Period.

“Service Credit” means:

(a) the fee for two days of the Service credited on a monthly invoice if Service Availability for the preceding calendar month is between 98.5% and 99.9%;

(b) the fee for four days of the Service credited on a monthly invoice if Service Availability for the preceding calendar month is between 95.0% and 98.5%; or

(c) the fee for six days of the Service credited on a monthly invoice if Service Availability for the preceding calendar month is below 95.0%.

“Service Availability” means the total number of minutes in a calendar month minus the number of minutes of Downtime occurring across all Downtime Periods in that month, divided by the total number of minutes in the calendar month.

3. Service Level Terms

Eligibility for a Service Credit

To receive any of the Service Credits described above, the Customer must:

(a) have a valid service agreement for the relevant servers or services;

(b) not be in arrears with payments to Edora under the Agreement; and

(c) submit a written refund request through Edora’s online support tool. Edora must receive the request during the month immediately following the month in which the Customer becomes eligible for a Service Credit.

A Service Credit request must include the Customer’s account name and the dates and times when the server was unavailable. Failure to comply with these requirements results in the Customer forfeiting its right to the Service Credit.

Issuance

Edora compares the information provided by the Customer with the Service Availability data maintained by Edora. A Service Credit is issued if Edora’s monitoring data confirms that Service Availability qualifies for that Service Credit.

Maximum Service Credit

The maximum aggregate Service Credits that Edora may issue to the Customer for all Downtime Periods occurring in a single month cannot exceed six days.

Exclusions

Downtime does not include, in whole or in part:

(i) Downtime caused by factors beyond Edora’s reasonable control;

(ii) Downtime resulting from acts or omissions of the Customer or a third party, including hacker or cyberattacks; or

(iii) Downtime resulting from the Customer’s equipment and/or third-party equipment not under Edora’s direct control.

Exclusive Remedy

This Appendix constitutes the Customer’s sole and exclusive remedy for Edora’s failure to provide the Service. Edora’s failure to meet the service levels in this Appendix will not constitute a breach of the Agreement.

Appendix E – User Data and Usage Data Policy

Ownership of User Data and Usage Data

As between the parties, the Customer owns and is the Controller of the Customer’s data, including the data of the Customer’s Users.

Sharing of User Data

Each party must share with the other party the User Data necessary to provide the Service. Edora is the Processor of shared User Data.

Use of User Data and Usage Data

Consents

Subject to applicable law, each party must obtain all necessary consents and take all steps required by applicable law to lawfully collect, use, process and/or transfer User Data and Usage Data as required under the Agreement. This includes implementing appropriate privacy policies and terms of use.

Appendix F – Security Obligations

The Customer’s Administration of the Service

The Customer must appoint one or more qualified employees with rights to administer the Service (each an “Administrator”). The Customer must immediately notify Edora of any unauthorised use of or access to the Service or Administrator rights. Edora reserves the right to suspend administrative access to the Service in response to the Customer’s breach of the terms of this Appendix.

Security of the Customer’s Network

The Customer must use commercially reasonable measures to maintain the security of its networks as described below. The Customer must immediately inform Edora of security breaches, fraudulent activities, hacker or cyberattacks and other security-related issues concerning the Service—in all cases before publicly disclosing those incidents—and must provide Edora with all reasonable assistance in investigating and resolving those issues.

The Customer must use commercially reasonable efforts to keep its servers physically and logically secure so that unauthorised parties cannot use administration tools to modify or damage files. The Customer’s internal network must be protected using measures such as secure firewalls and network routers that prevent unauthorised access and are administered and monitored by trained network administrators.

The Customer’s data must be protected against unauthorised access using secure data-access rules administered and monitored by trained data-system administrators. Data may be accessed only by applications approved by the Customer. Data must be managed on robust, industry-standard physical devices with scheduled and secure backup management. All User Data or Usage Data that the Customer is permitted to store or access under the Agreement must be maintained, accessed and transferred in a secure environment and stored on a server that is not visible from the internet.

If the Customer becomes aware of a material security deficiency, the Customer must notify Edora immediately. Failure to comply with the security obligations under the Agreement and/or Edora’s stated security policies and procedures, or failure to remedy a material security deficiency, constitutes a material breach of the Agreement, and Edora is entitled to suspend the Service immediately. The Customer must immediately inform Edora of any material changes that the Customer wishes to make to the Service and/or its security procedures during the term of the Agreement. Edora may terminate the Agreement if those changes do not meet the minimum security standards set out in this Appendix.

Appendix G – Termination Period

During the Termination Period, Edora continues to provide the Services that existed at the beginning of the Termination Period.

At the end of the Termination Period, Edora will no longer allow the Customer or the Customer’s Users to log in to the Service. Edora may retain relevant User Data after the Termination Period in accordance with Edora’s retention and archiving policies and as described in Appendix E. After termination of the Agreement, Edora has no obligation to maintain or make data available for transfer to the Customer, the Customer’s Users or any third party.