Terms and Conditions

CORRATA LTD. TERMS OF USE

PLEASE READ CAREFULLY: IF YOU ARE ACCEPTING THIS SOFTWARE-AS-A-SERVICE TERMS OF USE (“AGREEMENT”) ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY (“CUSTOMER”), YOU REPRESENT AND WARRANT THAT YOU HAVE FULL AUTHORITY TO BIND THE CUSTOMER TO THIS AGREEMENT. UNLESS THE CUSTOMER HAS ANOTHER VALID AGREEMENT FOR THE PURCHASE AND USE OF CORRATA LTD. (“CORRATA”) PRODUCTS (AS DEFINED BELOW), THIS AGREEMENT GOVERNS YOUR RIGHTS TO THE CORRATA PRODUCTS.

This Agreement is entered into as of the earliest of the date that Customer accepts the terms and conditions herein the date set forth on an Order, or the date on which Customer downloads, installs, activates or uses the Software.

1. Definitions

“Associated Company” means, with respect to a party, any subsidiary or holding company of that party, or any subsidiary or holding company of any such holding company.

“Documentation” means the written and/or electronic release notes, implementation guides, or other published technical documentation about the applicable Product that is provided by Corrata to Customer together with access to the Product.

“Customer Data” means the data inputted or collected by the Customer or by Corrata on the Customer’s behalf for the purpose of using the Product or facilitating the Customer’s use of the Product.

“License Term” means the term of the access rights granted for the Product, as identified in the relevant Order, starting when Corrata delivers to Customer the relevant credentials to access and use the Product.

“Order” means any purchase order, product schedule or ordering document between Customer and authorized reseller or between Customer and Corrata (if purchasing directly) that identifies the products and/or services licensed or sold and any applicable licensing parameters (e.g.,the number of licenses).

“Product” means the mobile security and control services made available by access to and use of software hosted by Corrata to which Customer has purchased a license under the relevant Order. References in this Agreement to the Product shall include the Software.

“Software” means the object code version of Corrata proprietary computer programs made available by Corrata for download by Customer for use in connection with any Product, including any Documentation and Updates.

“Updates” means any correction, update, upgrade, patch, or other modification or addition made by Corrata to specific Software.

• Rights of Access and Use

Access and Use. Subject to the terms and conditions of this Agreement, during the applicable License Term, Corrata hereby grants to Customer (i) a non-exclusive, non-transferable and non-sublicensable license for Customer to install, access and use the Product, solely for Customer’s internal use with Customer’s ordinary business operations and in accordance with the applicable Documentation. Customer may provide access to the Product to its employees, contractors, and Associated Companies (and any employees and contractors of such Associated Companies), provided Customer is responsible for their actions that violate the terms of this Agreement. Customer agrees that its purchase of the Product is neither contingent upon the delivery of any future functionality or features nor dependent upon any oral or written public comments made by Corrata with respect to future functionality or features.

Trial License. This Agreement applies to trial copies of the Product (“Trial Product”), except for the following different or additional terms: (i) the License Term for Trial Product is thirty (30) days, which Corrata may extend upon written consent; (ii) the trial period shall commence on the date that Corrata first provides Customer credentials to access the Trial Product; (iii) Trial Product is provided “AS IS” without warranty of any kind, and Corrata disclaims all warranties, indemnities, and all other liabilities for Trial Product; (iv) Customer is not entitled to any support and maintenance services or any Updates for Trial Product; and (v) either party may terminate the license for Trial Product upon five (5) days’ written notice to the other party.

• Use Restrictions; Customer Obligations

As a condition of the license granted in Section 2, Customer shall not itself and shall not authorize or permit any third party to: (a) reverse engineer, decompile, decode, decrypt, disassemble, or attempt to derive any source code from the Product (except and only to the extent any foregoing restriction is prohibited by applicable law); (b) modify, adapt, or create any derivative works based on the Product; (c) distribute, sell, license, lease, transfer, or otherwise provide any Product to third parties except as expressly provided in this Agreement; (d) provide the Product as a service to unassociated third parties, including but not limited to on a service bureau, SaaS, or time-sharing basis; (e) unbundle any component of any Product; or (f) use the Documentation except for supporting Customer’s authorized use of the Product; or (g) use the Product to store or transmit malicious code or infringing, libelous, unlawful or tortious material; or (h) disrupt the integrity or performance of any Product accessed as a service. Customer shall use commercially reasonable efforts to prevent unauthorized access to or use of any Product and notify Corrata promptly of any such unauthorized access or use.

• Payment; Additional Licenses; Reporting

Customer shall pay the fees for Corrata products and/or services as set forth in the applicable Order. Fees will be invoiced annually in advance.  If Customer is purchasing through a reseller, payment terms will be determined by Customer and the reseller. If Customer is purchasing directly from Corrata, all fees shall be paid in the currency specified in the Order and are due within thirty (30) days of the invoice. Customer shall pay all applicable fees, insurance costs, and taxes, excluding taxes on Corrata’s net income. If the actual number of registered devices or users (as applicable) exceed the number of licenses purchased by Customer in the applicable Order, then Customer shall (a) immediately cease such excess usage or (b) purchase additional licenses to cover the excess usage. Fees for excess usage shall be based on Corrata’s then-current price list or specified in the Order. Customer acknowledges that Corrata’s delivery and support infrastructure may enable Corrata to access the device or user count for the Product. Upon written notice by Corrata, Customer shall certify in writing the number and type of registered devices or users.

• Confidentiality

Definition. “Confidential Information” means non-public information provided by one party (“Discloser”) to the other (“Recipient”) that is designated as confidential or reasonably should be considered as such, excluding information that (i) is or becomes public through no fault of the Recipient, (ii) was known to Recipient before the disclosure, (iii) is disclosed to Recipient by a third party without violation of any confidentiality restrictions, or (iv) is independently developed by the Recipient without access to or use of the Discloser’s information. Corrata Confidential Information includes but is not limited to all Products (and any derivatives, performance data, benchmark results, security assessments, product roadmaps and any other technical information relating to the Products), Documentation and its derivatives, and Corrata’s pricing. The terms and conditions of this Agreement are the Confidential Information of both parties.

Non-disclosure and Non-Use. The Recipient shall (i) only use the Confidential Information of the Discloser to exercise its rights and/or to perform under this Agreement, (ii) use the same degree of care to prevent unauthorized use and disclosure of Discloser’s Confidential Information as it does for its own confidential information, but in no event less than reasonable care, and (iii) with respect to employees, contractors, or agents of Recipient, limit access to the Discloser’s Confidential Information only to those employees, contractors, or agents who have a need to access such Confidential Information and who are subject to confidentiality obligations at least as restrictive as those specified in this Section 5. The Recipient may disclose the Discloser’s Confidential Information to the extent required by any court, governmental body, or law or regulation, provided that, if legally permissible, Recipient shall provide prompt written notice to the Discloser of such disclosure. Upon written request of the Discloser, the Recipient shall return or destroy, at Discloser’s option, the Discloser’s Confidential Information.

• Ownership

Corrata and its suppliers own and retain all right, title, and (except as expressly licensed in this Agreement) interest in and to the Product and its derivative works. Customer Data shall at all times vest in and be the absolute property of the Customer. Customer is not obligated to provide Corrata with any suggestions or feedback about the products or services (“Feedback”). To the extent Customer does provide Feedback to Corrata, Customer assigns ownership of such Feedback to Corrata and Corrata may use and modify such Feedback without any restriction or payment.

• Indemnity

1. Indemnification by Corrata. Corrata shall at its cost and expense (i) defend or settle any claim brought against Customer and its directors, officers and employees (“Customer Indemnitee(s)”) by an unAssociated Company third party alleging that Customer’s use of the Product infringes or violates that third party’s intellectual property right(s), and (ii) pay, indemnify and hold Customer Indemnitees harmless from any settlement of such claim or any damages finally awarded to such third party by a court of competent jurisdiction as a result of such claim.
2. Remedies. If a claim under Section 7 a occurs or in Corrata’s opinion is reasonably likely to occur, Corrata may at its expense and sole discretion: (i) procure the right to allow Customer to continue using the applicable Product, (ii) modify or replace the applicable Product to become non-infringing, or (iii) if neither (i) nor (ii) is commercially practicable, terminate Customer’s license to the affected portion of applicable Product and refund a portion of the pre-paid, unused license fees paid by Customer corresponding to such Product.
3. Exclusions. Corrata shall have no obligations under this Section 7 if the claim is based upon or arises out of: (i) any modification to the applicable Product not made by or at the direction of Corrata, (ii) any combination or use of the applicable Product with any third party equipment, products or systems, to the extent that such claim is based on such combination or use, (iii) Customer’s continued use of the allegedly infringing technology after being notified of the infringement claim, (iv) Customer’s failure to use Updates made available by Corrata, (v) Customer’s failure to use the Product in accordance with the applicable Documentation, and/or (vi) use of the Product outside the scope of the license granted under this Agreement. This Section 7 constitutes Customer’s sole and exclusive remedies, and Corrata’s entire liability, with respect to infringement of third party intellectual property rights.
4. Indemnification by Customer. Customer shall at its cost and expense (i) defend or settle any claim brought against Corrata and its directors, officers and employees (“Corrata Indemnitee(s)”) by an unAssociated Company third party alleging that the Customer Data infringes or violates a third party’s intellectual property or privacy right(s), and (ii) pay, indemnify and hold Corrata Indemnitees harmless from any settlement of such claim or any damages finally awarded to such third party by a court of competent jurisdiction as a result of such claim.
5. Procedures. Each indemnitor’s indemnification obligation is conditioned on the indemnitee: (i) giving the indemnitor prompt written notice of such claim, (ii) permitting the indemnitor to solely control and direct the defense or settlement of such claim, provided the indemnitor shall not settle any claim in a manner that requires the indemnitee to admit liability or pay money without the indemnitee’s prior written consent, and (iii) providing the indemnitor all reasonable assistance in connection with the defense or settlement of such claim, at the indemnitor’s cost and expense.

• Warranties

1. Product. Corrata represents and warrants to Customer that the Product materially conforms to the specifications specified in the relevant Documentation. Customer must notify Corrata of any warranty deficiencies within thirty (30) days from the provision of the deficient Product. Customer’s sole and exclusive remedy and the entire liability of Corrata for Corrata’s breach of this warranty will be for Corrata, at its option, to (i) repair such Product (and/or deliver new applicable Software) or (ii) terminate the applicable License Term and refund any prepaid, unused subscription fees paid to Corrata for the unused period of any such terminated License Term.
2. Exclusions. The express warranties do not apply if the applicable Product (i) has been modified, except by or at the direction of Corrata, (ii) has not been installed, used, or maintained in accordance with this Agreement and Documentation, (iii) has been subjected to abnormal physical or electrical stress, misuse, negligence or accident, and/or (iv) is used with equipment, products or systems not specified in the Documentation. Additionally, these warranties only apply if notice of a warranty claim is provided within the applicable warranty period.
3. Disclaimer. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EXCEPT FOR THE WARRANTIES EXPRESSLY STATED IN THIS SECTION 8, THE PRODUCT AND SERVICES ARE PROVIDED “AS IS,” AND CORRATA PROVIDES NO OTHER REPRESENTATIONS AND WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, AND CORRATA SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.

• Term and Termination

The access rights granted herein with respect to the Product shall remain effective until the License Term for the relevant Product expires or the license for the relevant Product is terminated. This Agreement shall remain effective until the earliest of termination in accordance with this Section 9, or expiration of the applicable License Term. If Corrata agrees to reinstate a lapsed subscription license, then the terms of this Agreement shall apply.

Auto-Renewal. Unless otherwise specified in an applicable Order, the License Term shall automatically renew for successive one (1) year renewal periods (each a “Renewal Term”) unless either party provides written notice of non-renewal or cancellation. Customer must provide such notice at least thirty (30) days prior to the end of the initial License Term for the first renewal, and at least ninety (90) days prior to the end of any subsequent Renewal Term. If Customer does not provide timely notice, the subscription will renew automatically and Customer will be responsible for payment of the applicable renewal fees.

Either party may terminate this Agreement: (a) upon thirty (30) days’ written notice of a material breach by the other party (or three (3) business days in the case of a failure to pay), unless the breach is cured within the notice period, or (b) immediately, if the other party ceases to do business, becomes insolvent, or seeks protection under any bankruptcy or comparable proceedings. In addition, the parties may terminate this Agreement by mutual written consent.

All other licenses terminate upon expiration or termination of this Agreement. In addition, Sections 1, 3-7, and 9-11, and all liabilities that accrue prior to termination shall survive expiration or termination of this Agreement for any reason.

For ninety (90) days after the expiration or termination of this Agreement, upon Customer’s request, Corrata shall permit Customer to access the Product solely to the extent necessary for Customer to retrieve applications uploaded to such Product by Customer. After such 90-day period, Corrata may delete all Customer Data in Corrata’s possession or control.

• Limitation of Liabilities

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EXCEPT FOR ANY BREACHES OF OR FOR LIABILITY ARISING OUT OF SECTION 3 (RESTRICTIONS), 5 (CONFIDENTIALITY) OR A PARTY’S INDEMNIFICATION OBLIGATIONS UNDER THIS AGREEMENT, OR CUSTOMER’S PAYMENT OBLIGATIONS, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY IN CONNECTION WITH THIS AGREEMENT OR THE SUBJECT MATTER HEREOF (UNDER ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STATUTE, TORT OR OTHERWISE) FOR: (a) ANY LOST PROFITS, LOST BUSINESS OPPORTUNITIES, LOST DATA, OR SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR LOSSES OR SUCH DAMAGES OR LOSSES WERE REASONABLY FORESEEABLE, OR (b) AN AMOUNT THAT EXCEEDS THE TOTAL FEES PAYABLE TO CORRATA FOR THE RELEVANT PRODUCT OR SERVICE DURING THE TWELVE-MONTH PERIOD BEFORE THE EVENT GIVING RISE TO SUCH LIABILITY. THESE LIMITATIONS WILL APPLY NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY REMEDY SPECIFIED IN THIS AGREEMENT. MULTIPLE CLAIMS SHALL NOT EXPAND THE LIMITATIONS SPECIFIED IN THIS SECTION 10.

• General

1. Export/Import. The Product and Documentation may be subject to U.S. and foreign import and export control laws and regulations. Customer agrees to comply with all such regulations applicable to Customer, including obtaining applicable import licenses.
2. Governing Law and Jurisdiction. This agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of Ireland. Each party irrevocably agrees that the courts of Ireland shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this agreement or its subject matter or formation (including non-contractual disputes or claims).
3. Assignment. Neither party may assign this Agreement without prior written consent of the other party, provided however either party may do so to a successor-in-interest pursuant to a merger, acquisition, or sale of all or substantially all of its business and/or assets. Any assignment in violation of this Section 12.c shall be void. Subject to the foregoing, all rights and obligations of the parties under this Agreement shall be binding upon and inure to the benefit of and be enforceable by and against the successors and permitted assigns.
4. Data Processing. Corrata shall only collect, access, use, store, safeguard, disclose and transfer (“Process”) Personal Data (i) for the purposes of this Agreement, including without limitation, to implement and deliver the Product and its features and associated services, provide Customer support, and help Customer prevent or address service or technical problems, (ii) as otherwise expressly permitted by Customer in writing, or (iii) as compelled by law. Customer shall make such disclosures, obtain such consents, and provide such access, choices and other applicable rights to individual users with regard to the Processing of Personal Information as are required under applicable law, rules or regulations. “Personal Data” means any information relating to an identified or identifiable natural person that is obtained by or communicated to Corrata by Customer in performance by Corrata of its obligations under this Agreement. Corrata collects, analyzes, and uses aggregated, de-identified technical data and related information (such as product or feature usage, device metrics/metadata and/or mobile application usage) to facilitate market research, product development/improvement and to provide support and maintenance services. Corrata may use, store, or disclose such information or material derived from such information, as long as it is in a form that does not identify or is not attributable to any individual.  Corrata will not disclose Customer Data outside of Corrata or its affiliates except (i) as Customer directs, (ii) as described in the Agreement, or (iii) as required by law.  The Additional European Terms Schedule shall apply to the processing of Personal Data of individuals using the Product in the European Economic Area, United Kingdom or Switzerland by Corrata on behalf of Customer.
5. Publicity; Customer Marks. Corrata may publicly disclose that Customer is a customer of Corrata and a licensee of the Product. Customer grants to Corrata a limited, non-exclusive, non-transferable, royalty-free license to use Customer’s name, trademarks, service marks, and logos (collectively, the “Customer Marks”) solely for the purpose of identifying Customer as a customer of Corrata on Corrata’s website, in sales and marketing materials, investor and board materials, and in case studies, press releases, and similar promotional content (collectively, “Marketing Materials”).
6. Independent Contractor. The parties are independent contractors. This Agreement shall not establish any relationship of partnership, joint venture, employment, franchise or agency between the parties.
7. Customer Associated Companies. An Associated Company may purchase Corrata products and/or services either by executing a participation agreement with Corrata or through Corrata’s acceptance of an Order issued by such Associated Company or Authorized Reseller (as applicable). Upon execution of a participation agreement by Associated Company or, if the Associated Company issues a purchase order referring to this Section 12.j, that is accepted by Corrata, such Associated Company shall be deemed to have purchased such products and/or services hereunder, and such Associated Company shall be bound by and shall comply with the terms and conditions of this Agreement as a “Customer” under the Agreement.
8. Waiver & Severability; Amendments. The failure of either party to enforce any provision of this Agreement shall not constitute a waiver of any other provision or any subsequent breach. If any provision of this Agreement is held to be illegal, invalid or unenforceable, the provision will be enforced to the maximum extent permissible so as to effect the intent of the parties, and the remaining provisions of this Agreement will remain in full force and effect. This Agreement may only be amended, or any term or condition set forth herein waived, by written consent of both parties.
9. Notices. Except as otherwise provided in this Agreement, all legal notices to Customer will be given in writing to any Customer address listed on the applicable Order. All legal notices to Corrata will be given in writing to: Corrata, Ltd., Block 3, Blackrock Business Park, Blackrock, Dublin, Ireland. Such notices will be effective (a) when personally delivered, (b) on the reported delivery date if sent by a recognized international or overnight courier, or (c) five business days after being sent by registered or certified mail (or ten days for international mail). For clarity, purchase orders, invoices, and other documents relating to order processing and payment are not legal notices and may be delivered electronically in accordance with Corrata and Customer’s standard ordering procedures.
10. Entire Agreement. This Agreement consists of these terms and conditions, and the attached schedule(s), which are incorporated by reference. This Agreement constitutes the entire agreement between the parties with respect to its subject matter and supersedes and cancels all prior agreements, representations, communications, and understandings of the parties, written or oral, relating to such subject matter, and is not intended to confer upon any person other than the signatories below any rights or remedies. This Agreement prevails over any conflicting, or additional terms of any ordering document, acknowledgment, confirmation or other document issued by Customer before or after the execution of this Agreement unless such conflicting or additional terms have been introduced via an amendment and accepted in writing by both parties. The headings of sections of this Agreement are for convenience and are not for use in interpreting this Agreement.

SCHEDULE A: ADDITIONAL EUROPEAN TERMS

1. Additional European Terms. These terms apply to the processing of Personal Data of individuals using the Product in the European Economic Area (“EEA”), United Kingdom or Switzerland by Corrata on behalf of Customer. Article 28(1) of the European Union General Data Protection Regulation and Article 28(3) of the UK GDPR (collectively “GDPR”) requires an agreement between a controller and processor, and between a processor and subprocessor, that processing be conducted in accordance with technical and organizational measures that meet the requirements of the GDPR and ensure the protection of the rights of data subjects. The Additional European Terms are intended to satisfy that requirement for the parties. Terms used but not defined in the Additional European Terms, such as “personal data breach”, “processing”, “controller”, “processor”, and “data subject”, will have the meaning given to them in Article 4 of the GDPR.
2. Intent of the Parties. The terms in the Terms of Use, including the Additional European Terms and the other data processing provisions of the Corrata Terms of Use, constitute a data processing agreement. For the Product, Corrata is a data processor (or sub-processor) acting on Customer’s behalf. As data processor (or sub-processor), Corrata will only act upon Customer’s instructions. The Terms of Use, along with Customer’s use and configuration of features in the Product, are Customer’s complete and final instructions to Corrata for the processing of Customer Data. Any additional or alternate instructions must be agreed to in writing.
3. Description of Data Processing
   a. Subject matter and duration. The subject matter of the processing of Personal Data is the performance of the Product including compatible services. The duration of data processing is for the Term.
   b. Nature and purpose. The nature and purpose of the processing shall be to implement and deliver the Product and its features and associated services, provide Customer support, help Customer prevent or address service or technical problems, and provide Customer with support, such as troubleshooting recurring issues and improvements to support or to the Product.
   c. Data exporter. Customer is a controller or processor of Personal Data and the data exporter.
   d. Data importer. Corrata, Inc. is a processor or subprocessor of Personal Data and the data importer.
   e. Data subjects. The categories of Data Subject to whom the Personal Data relates are Customer’s representatives and Customer’s personnel who provide Corrata with their Personal Data by using the Product.
   f. Categories of data. The types of Personal Data processed, which varies by Customer use case, may include: (i) basic contact information of individuals using the Product for administration of local accounts and to enable electronic communications relating to access control or the management of mobile devices; (ii) basic information about mobile devices to facilitate their registration and the deployment, operation and maintenance of Product; (iii) names, email addresses, usernames and other Personal Data contained in authentication tokens and single sign on certificates, authentication requests and responses to those requests, to support secure authentication; and (iv) other data in an electronic form used by Corrata in the context of the Product.
   g. Processing operations. The Personal Data transferred will be subject to the following basic processing activities: collect, store, retrieve, consult, use, erase or destruct, disclose by transmission, disseminate or otherwise make available data exporter’s data as necessary provide the Product in accordance with the data exporter’s instructions, including related internal purposes (such as quality control, troubleshooting, product development, etc.).
   h. Obligations and rights of Customer. The obligations and rights of Customer are set out in the Terms of Use.
4. GDPR Terms
   a. Corrata shall not engage another processor without prior specific or general written authorisation of Customer. In the case of general written authorisation, Corrata shall inform Customer of any intended changes concerning the addition or replacement of other processors, thereby giving Customer the opportunity to object to such changes.
   b. Corrata shall process the Personal Data only on documented instructions from Customer, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by European Union, United Kingdom law or Member State law to which Corrata is subject; in such a case, Corrata shall inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
   c. Corrata shall ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. [28(3)]
   d. Corrata shall take all measures required pursuant to Article 32 of the GDPR.
   e. Corrata shall respect the conditions referred to in Section 4.a and 4.k for engaging another processor.
   f. Corrata shall, taking into account the nature of the processing, assist Customer by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III of the GDPR.
   g. Corrata shall assist Customer in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to Corrata.
   h. Corrata shall, at the choice of Customer, delete or return all the Personal Data to Customer after the end of the provision of services relating to processing, and delete existing copies unless European Union, United Kingdom or Member State law requires storage of the Personal Data. [
   i. Corrata shall make available to Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer.
   j. Corrata shall immediately inform Customer if, in its opinion, an instruction infringes the GDPR or other European Union or Member State data protection provisions.
   k. Where Corrata engages another processor for carrying out specific processing activities on behalf of Customer, the same data protection obligations as set out in GDPR Article 28shall be imposed on that other processor by way of a contract or other legal act under European Union, United Kingdom or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR. Where that other processor fails to fulfil its data protection obligations, Corrata shall remain fully liable to the Customer for the performance of that other processor’s obligations.
   l. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Customer and Corrata shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (i) the pseudonymisation and encryption of Personal Data; (ii) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; (iii) the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and (iv) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
   m. In assessing the appropriate level of security, account shall be taken of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed.
   n. Customer and Corrata shall take steps to ensure that any natural person acting under the authority of Customer or Corrata who has access to Personal Data does not process them except on instructions from Customer, unless he or she is required to do so by European Union, United Kingdom or Member State law.
   o. Corrata shall notify Customer without undue delay after becoming aware of a personal data breach. Such notice will, at a minimum, (i) describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of Personal Data records concerned; (ii) communicate the name and contact details of the data protection officer or other contact where more information can be obtained; (iii) describe the likely consequences of the personal data breach; and (iv) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
   p. Subprocessors. Customer consents to Corrata engaging Subprocessors for the processing of Personal Data in accordance with Section 4.a and 4.k. A list of Corrata’s current Subprocessors is available upon request. At least 14 days before authorizing any new Subprocessor to access Personal Data, Corrata will update the list. Where Corrata is a processor (and not a subprocessor), the following terms apply: (i) If Customer does not approve of a new Subprocessor, then Customer may terminate any subscription for the affected Product without penalty by providing, before the end of the notice period, written notice of termination that includes an explanation of the grounds for non-approval; (ii) if the affected Product are part of a bundle (or similar single purchase of multiple services), then any termination will apply to the entire bundle; and (iii) as Customer’s sole and exclusive remedy, Corrata will refund to Customer any unused prepaid subscription fees.
   q. Data Subject Requests. Corrata will make available to Customer the Personal Data of its data subjects and the ability to fulfill data subject requests to exercise one or more of their rights under the GDPR in a manner consistent with the functionality of the Product and Corrata’s role as a processor. Corrata shall comply with reasonable requests by Customer to assist with Customer’s response to such a data subject request if Customer is unable to respond using the functionality of the Product. If Corrata receives a request from Customer’s data subject to exercise one or more of its rights under the GDPR, Corrata will redirect the data subject to make its request directly to Customer.