Definitions

Extend SAS - Master Service Agreement You must read and accept those terms before creating an account with us.
Upflow SAS provides a standard MSA to accept before creating an account with us.
The latest version of Extend SAS's MSA is available for download below and entered in force as of June 2023.

• Account Administrator: Account created by the Administrator after the registration has beenapproved, allowing for access to the Services.
• Administrator: The individual designated as the contact person authorized by the Merchant to manage the use of Services.
• Agreement: Refers to the Order Form and the Master Service Agreement including its Appendices which together form an inseparable contractual whole
• Merchant Interface: Web interface made available to the Merchant by Extend to enable them to access the Services and to manage their use.
• Data Protection Agreement: The document referred to in Appendix 2: Data Protection Agreement
• Debtor: The Merchant’s customers, to whom the Merchant communicates with, and sends invoices that are covered by the Services.
• Debtors’ data: Personal data concerning the Merchant’s Debtors
• Integration Partner: An Extend partner (accounting or billing software) used to provide and exchange Merchant data that may be required to provide the Services. The list of integration partner is listed on the Website and may change from time to time.
• Order Form: A document specifying any specific commercial conditions agreed between Extend and the Merchant, as the case may be, superseding the Master Service Agreement, as specified in article 22.
• Parties: Extend and the Merchant, herein together referred to as “Parties”.
• Payment Partner: An Extend partner providing payment services, that can be used in conjunction with the Services.
• Pricing Schedule: The pricing schedule described in Appendix 1: Pricing Schedule.
• Services: Services supplied by Extend as described in article 9.
• Subscription: The subscription taken out by the Merchant to access the Services, asdescribed in article 20.
• Suppliers: The Merchant’s suppliers, who send one or multiple of their invoices to the Merchant.
• Suppliers’ Data: Personal data concerning the Merchant’s Suppliers.
• Threshold: The value of the Payment Transactions (incoming payments) used when calculating the Subscription price.
• Extend: The company Data on the Fly LLC, a Colorado Corporation, having its principal place of business at 8509 East Nicholas Ave, Centennial, CO80112, and supplying the Services (referred to in these conditions as“ Extend”).
• User Accounts: Accounts created by the Administrator and made available to any person authorized by them to access the Merchant Interface.
• Users: Natural persons authorized by the Administrator to access the Merchant Interface subject to the rights allocated to them by the Administrator.
• Website: Refers together to (i) Extend’s website, accessible at the address www.tryextend.com and (ii) the Extend’s application.

Purpose

The purpose of the Master Service Agreement, including its Appendices, is to define the conditions under which the Services offered by Extend will be supplied to the Merchant and specify the rights and obligations of both Extend and the Merchant.
These may be accessed and printed at any time by means of a link available on Extend’s website.
When necessary, they may be read in conjunction with the Order Form. Together with its Appendices and the Order Form, they form an inseparable contractual whole
In the event of contradiction, the provisions of the Order Form shall prevail over the Master Service Agreement. In the event of a contradiction between different Order Forms, the most recent document shall prevail over the oldest.
The Agreement shall prevail over any other general or specific terms and conditions not expressly approved by Extend.

Operator of the Website and the Services Contact

The Website and the Services are operated by The Company, Data on the Fly LLC, a Colorado Corporation, having its principal place of business at 8509 East Nicholas Ave, Centennial, CO 80112 and supplying the Services. (referred to in these conditions as “Extend”).
Extend may be contacted using the following contact details, including for any complaints:

• Postal address: 8509 East Nicholas Ave, Centennial, CO 80112, United States
• E-mail address: ben@tryextend.com

Acceptance of the Master Service Agreement

The Master Service Agreement must be accepted by an Administrator who, therefore authorized to represent and enter into commitments on behalf of the Merchant, in accordance with the conditions mentioned in
Article 6.
The acceptance of the Master Service Agreement is formally confirmed by a tick box on the registration application form, or the signature of an Order Form. This acceptance shall only be full and unreserved.
Any acceptance subject to reservations or conditions will be considered as null and void. Any Merchant who does not agree to be bound by the Master Service Agreement must notify Extend and stop accessing the Website or using the Services.

Registration via the Website and the Merchant Interface

To use the Services, the Merchant must register on the Extend Website, in accordance with the conditions stated below.

1. Initially, the Merchant must submit an online registration request via an online form on the The website or the Merchant must fulfil and return a signed Order Form to Extend, supplying the required information concerning their company and the Administrator's contact details.
   Any incomplete registration request will be declined.
   Only a person authorized to enter into commitments on behalf of the Merchant may submit a registration request on the Merchant’s behalf.
   Consequently, the person submitting the registration request certifies that she or he is authorized to represent the Merchant, to enter into commitments on their behalf and to make decisions in their name and on their behalf.
2. Once the registration request has been logged, and if required for the use of the Services, the Administrator shall provide Extend with any information needed in order to approve this registration.
   The Merchant expressly acknowledges and accepts that if the documents required for registration is not approved by Extend, they may not access the Services.
3. The Merchant shall then supply additional information about their company, including information about their Debtors and the invoices. Such information may be provided via an Integration Partner.
   Via their Administrator, the Merchant must also accept the pricing conditions as detailed in the Pricing Schedule which is attached to the Master Service Agreement and/or to the Order Form if so. Only the Administrator is authorized to accept the pricing conditions on the Merchant’s behalf. The Merchant hereby agrees that the pricing conditions set out in the Pricing Schedule are binding for the entire contractual relationship.
4. Extend may request additional documents it considers necessary in order to approve the registration. Extend reserves the right to launch any verification procedures, tests or other checks it considers appropriate in order to approve the registration.
   Extend reserves the right to refuse any registration request from a Merchant without needing to justify its decision. The Merchant will be informed of this refusal by any appropriate written method, including e-mail. The Merchant shall not seek any compensation on these grounds.
   If their registration request is approved, this will result in the opening of an Administrator Account by Extend. This Administrator Account provides access to the Merchant Interface.
5. The Merchant guarantees that all information they submit in the registration form, where applicable, is accurate, up-to-date and correct.
   The Merchant agrees to update this information in the Merchant Interface in the event of any modifications, to ensure that the said information always meets the above-mentioned criteria.
   The Merchant is informed and accepts that the information entered for the creation or updating of the Administrator Account constitutes proof of their identity. The information entered by the Merchant is considered binding upon him from the moment it is approved.

Strictly personal use, User Accounts and Administrator Accounts

Once the registration has been approved and the Administrator Account created, the Administrator has the option to create several User Accounts and/or Administrator Accounts via the Merchant Interface, providing access to the Services. The Administrator Accounts created to possess the same functions and authorizations as those available to the Administrator designated by the Merchant.
The Merchant bears responsibility and liability for the access to the Services issued by the Administrator, and for the Users who are authorized to use these Services.
Only a single User Account or Administrator Account may be created per User and/or per Administrator. Extend reserves the right to delete any additional account created by the same User and/or Administrator.
The User and the Administrator may access their Accounts via the Merchant Interface at any time, after logging in using their username and password.
The User and the Administrator agree to personally use the Services and not to allow any third party to use them in their place or on their behalf, failing which they will assume full liability for this.
Similarly, Users are responsible for keeping their username and password strictly secret, and expressly acknowledge that any use of the Services from their Account will be considered as having been performed by them. The latter must immediately contact Extend using the contact details mentioned in article 3 of these conditions if they discover that their Account has been used without their knowledge. They authorize Extend to take all appropriate measures in such circumstances.
The Merchant is responsible and liable for the use of the Services by the Administrators and the Users. Any use of the Services with the username and password of an Account Administrator and/or User is considered to have been performed by the Merchant.

Description of the Services

As further described on the Website, the Merchant has access to the following Services, with the form, features and technical resources for these services being those considered most appropriate by Extend.

8.1. Invoices management 
         8.1.1. Purpose of the Services
         The Merchant has the possibility to use the following Services provided by Extend

• Creation of collaborative workflows to manage unpaid invoices
• Communication with Debtors and Suppliers to manage unpaid invoices
• Provision of analytics

8.1.2. Implementation of the Services
‍         8.1.2.1. Analytics and Invoice Management
To enable Extend to use of the Services, the Merchant must either:

• Use the interfacing API service (Application Protocol Interface) at the Merchant’s disposal. The documentation of the API is available on the Website.
• Or interconnect Extend with the Merchant’s billing or accounting system using an Extend Integration Partner that Extend may support (the list of available integration being made available on the Website).

8.1.2.2. Payment services        
The Merchant may use one or multiple payment services to facilitate the payment of invoice by its Debtors using a Payment Partner. The Merchant remains responsible for any contractual engagement with the Payment Partner, and any terms imposed by the Payment Partner.

8.2.Other Services
‍Extend reserves the option to propose any other Service it considers appropriate, in the form and involving the features and technical resources it considers most appropriate to provide the said Services. Such other Services may be described on the Website.
Extend will make every commercial effort to inform the Merchant of any updates or changes regarding the Services, ahead of the proposed changes. If the Merchant does not agree with the proposed changes, they have the option to terminate the Services in accordance with the conditions of Article 20.2.

Financial terms & conditions

9.1.Service Prices
         9.1.1. Implementation of the Services
         The provision of the Services may require the performance of installation services and the specific          configuration of the Merchant’s IT systems, which in some cases may result in the invoicing of installation          costs to the Merchant. These costs, if any, are assessed beforehand by Extend and must be approved in          writing by the Merchant via an Order Form or by any appropriate means.

‍         9.1.2. Applicable prices
        In exchange for the Services, the Merchant agrees to pay Extend a given price in the form of a          Subscription in accordance with:‍

• The default Pricing Schedules are described in Appendix 1: Pricing Schedule.
• Any Order Form, as the case may be.
• Any other jointly agreed terms, confirmed by any written means, including by e-mail, or• described on the Website.

Recurring costs such as monthly or yearly subscriptions will generally be invoiced prepaid, i.e. in advance for the following billing period.

Extend reserves the right to propose promotional offers or price reductions at its sole discretion and in accordance with terms or conditions.

Additional costs may be invoiced to the Merchant according to their Subscription (as agreed on pricing schedules or any other related Services not included in the Subscription). The Merchant will be informed in advance of the structure of those cost sand will be invoiced on a recurring basis based on the incurrence of such costs, in accordance with the Pricing Schedules. These costs will be billed post-paid, generally on the next invoice, for the month following their incurrence.

9.2.Price revisions
The above-mentioned prices may be revised by Extend at any time at its sole discretion.
The Merchant will be informed of these modifications by Extend to the Administrator by any appropriate written mean, with a notification period of at least 1 (one) month before the new prices take effect.
Once they have taken effect, the new prices will apply when the Subscription renews.
If the Merchant does not accept the new pricing, the Merchant may terminate their Subscription in accordance with the terms of Article 20. Failing the required termination notification, the Merchant will be deemed to have accepted the new prices.‍‍

9.3.Invoicing and payment
Monthly invoices are issued for the Services, which are due upon receipt and made available to the Customer via email or via the Merchant Interface.
Unless otherwise agreed with Extend, the amounts due for the Services shall be paid to Extend by the Merchant by either‍‍

• SEPA Direct Debit (SDD) or
• charged on a credit or debit card, and pursuant to any additional conditions that will be specified on each invoice.

The prepaid amounts billed will be debited at the beginning of the month for the Subscription for the following month, plus any potential additional post-paid costs incurred from the previous month, plus any additional unpaid amounts owed by the Merchant to Extend.

In the event that debits based on the above-mentioned conditions fail, and if another payment method is used, Extend reserves the right to apply late payment interest to the payment due from the Merchant. This interest will be calculated as per the law and indicated on each invoice on a case-by-case basis depending on the jurisdiction of each Merchant.

Agreement of proof

The Merchant expressly acknowledges and accepts:

1. That the data gathered via Extend’s Website and IT equipment accurately reflects the reality of the operations occurring with regard to this agreement.
2. That this data constitutes the main form of proof accepted between the parties, including for the calculation of the sums owed to Extend.

The Merchant may access this data via their Merchant Interface

Merchant’s obligations

11.1. The Merchant is responsible for obtaining and maintaining any equipment and ancillary services needed to connect to the Internet in order to access or otherwise use the Services, including, without limitation, modems, hardware, servers, software, operating systems, networking, web servers and the like (collectively, “Equipment”), excluding the equipment and technology necessary for Extend to host and make the Services available to the Merchant. The Merchants is responsible for maintaining the security of the Equipment.‍

11.2. In their use of the Services, the Merchant agrees to comply with the applicable laws and regulations and not to infringe the rights of third parties or public policy. When using the services provided by a Payment Partner, the Merchant also agree to fulfil any obligations to which they are subject to in application of the contract with this Payment Partner.
In particular, the Merchant agrees to comply with the applicable regulations and measures against money laundering with respect to payments processed via the Payment Partners, if any. To this end, they agree to cooperate with Extend for any request from a regulator and where applicable with the Payment Partners.
If the Merchant is using the services offered by a Payment Partner, the Merchant accepts that the Payment Partner may suspend payments or ask Extend to suspend the Administrator Accounts and User Accounts for a Merchant in order to perform the necessary verifications concerning a payment, or a specific Debtor. The Merchant acknowledges that Extend is not liable for such a possible suspension.
The Merchant also agrees to comply with the applicable fiscal and social legislation. Accordingly, they will avoid any hidden labor through the dissimulation of paid employment and agree to meet their various obligations regarding the declaration of employees to the social protection bodies, to maintain a personal register and to establish and issue pay slips.‍

11.3. The Merchant acknowledges that they have familiarized themselves with the Website and with the various characteristics and constraints, particularly those of a technical nature, regarding the Services. They bear sole liability for their use of the Services.‍

11.4. The Merchant bears sole liability for dealing with their Debtors.
Among other things, they bear sole liability for the issuing of their invoices and agree that these will comply with their applicable laws regarding the issuance of invoices, in particular regarding the format and languages contained therein. The Merchant is responsible for maintaining their financial data used to provide the Services up to date.‍

11.5. The Merchant agrees that their use of the Services will be strictly personal. They consequently agree that they will not transfer, grant or assign of any of their rights or obligations under the terms of this Agreement to a third party, in any way or form.‍

11.6. The Merchant agrees to provide Extend with all information necessary to the satisfactory performance of the Services. More generally, the Merchant agrees to actively cooperate with Extend to ensure the satisfactory performance of this Agreement and to supply it with any additional documents and information which Extend may request during the performance of the Services.‍

Merchant’s guarantee

The Merchant shall hold Extend harmless against all complaints, claims, legal action and/or proceedings of any kind which Extend may face due to a violation by the Merchant of any of their obligations or guarantees under the terms of the Master Service Agreement. The Merchant agrees to compensate Extend for any loss it may suffer and to pay it all costs, charges and/or awards incurred by it as a result.

Prohibited behavior

13.1. The use of the Services for the following purposes is strictly prohibited:‍

• The performance of illegal or fraudulent activities or those infringing the rights or security of third parties,
• Violations of public policy or of the applicable laws and regulations,
• Intrusions into the IT system of a third party or any activity likely to harm, control, interfere with or intercept any part of a third party’s IT system, or to adversely affect its integrity and security,
• The sending of unsolicited e-mails (spam) and/or prospection or commercial solicitation messages,
• SEO activities intended to improve the ranking of a third-party website,
• Assistance with or incitement to commit one or several of the above-mentioned acts and activities, regardless of the form this assistance or incitement takes,
• More generally any activities misusing the Services for any purpose other than those for which they were designed.

13.2. It is strictly prohibited for the Merchant to copy and/or misuse the concept, the technologies, all or part of the data or any other aspect of the Website for their own use orthose of a third party.‍

13.3. The following are also strictly prohibited:‍

• any behavior likely to interrupt, suspend, slowdown or impede the continuity of the Services
• any intrusions or attempted intrusions in Extend’s systems
• any misuse of the Website’s system resources
• any acts likely to disproportionately overload the latter’s infrastructure
• all attempts to circumvent security and authentication measures
• any acts likely to adversely affect the rights and financial, business or non-pecuniary interests of Extend or of the users of its Website, and finally, more generally
• any non-compliance with the Master Service Agreement

13.4. It is prohibited to seek to obtain payment for, to sell or to assign all or part of the access to the Services or to the Website, and the information posted and/or shared via the said Services and Website.‍

Penalties for non-compliance

In the event of non-compliance with any provisions of the Master Service Agreement or more generally any infringement of the applicable laws and regulations by a Merchant, Extend reserves the right to take all appropriate measures without prejudice to the provisions of Article 21, including:

• Suspending access to the Services for any Merchant who is the cause of such failings or
  infringements or who participated in these
• Taking all appropriate measures and initiating any legal action
• Where applicable, inform the relevant authorities, cooperate with them and supply them with all useful information to assist in the identification and prevention of illegal or illicit activities.

Extend’s liability and guarantee

15.1. Extend shall supply the Services diligently and in compliance with trade practices, with it being hereby specified that it is subject to an obligation of due diligence, with the exclusion of any absolute obligation, which the Merchant expressly acknowledges and accepts.‍

15.2. Extend shall only use the documents, items, data and information supplied to it by the Merchant for the performance of the Services and not to communicate these to any third party unless the Merchant expressly requests this.‍

15.3.Extend shall make every effort to guarantee the security of the Merchant Interface. It guarantees its confidential nature and agrees that it will not supply the content to any third party, pursuant to the provisions of Article 16.‍

Extend shall inform the Merchant of any foreseeable difficulties, including regarding the implementation of the Services or the satisfactory operation of the Merchant Interface. However, Extend may not be considered liable in the event of any malicious intrusion into the Services, unless it has been proven that Extend is guilty of demonstrated gross negligence in this respect‍

In addition, Extend may not be considered liable for any lack of vigilance on the part of the Merchants in maintaining the confidential nature of their usernames and passwords.

15.4.Extend represents that it holds the required insurance policies covering its professional civil liability. It agrees to ensure that this insurance policy remains applicable for the lifetime of the Services.‍

15.5.Extend agrees to regularly perform checks to verify the availability of the Merchant Interface and perform the relevant updates to the Services to maintain such availability. Accordingly, Extend reserves the right to temporarily interrupt access to the Merchant Interface for maintenance reasons. Extend will make the best commercial efforts to anticipate such maintenance windows with prior notification to the Users. Similarly, Extend may not be considered liable if it is temporarily difficult or impossible to access the Merchant Interface, due to circumstances outside of its control, in particular in case of force Extend events or due to disruption of telecommunications networks‍

15.6.Extend represents that it will comply with the laws and regulations applicable to the Services.‍

15.7.Extend does not guarantee to the Merchant ‍

• that the Services are completely free of errors or defects, as they are subject to ongoing efforts to improve them, particularly regarding performance and regular updates
• that the Services will specifically meet their own need sand expectations, as the Services are designed to be standardized and in no way designed solely for a single given Merchant according to their specific constraints and requirements.

15.8.In any circumstances, Extend will not be required to pay the client damages for losses of any form, whether direct, material, commercial, financial or non-pecuniary due to a Merchant’s use of the Services, for any amount exceeding the amounts invoiced by Extend in remuneration for the Services for which it was considered liable, at the time the alleged loss occurred. It may only be considered liable if the said Merchant has issued a complaint by registered letter with acknowledgement of receipt within a period of one month following the occurrence of the said event.‍

15.9.Extend uses third-party service providers, for the implementation of the Services. In the event of unavailability of the Service due to these service providers, Extend will make its best commercial effort to maintain the Services pursuant to this agreement. However, under no circumstances Extend may be considered liable for any failure to perform the Services due to failings due to those service providers.‍

Confidential nature of Merchants’ data

Extend’s intellectual property rights

The systems, software, structures, infrastructure, databases and content of all kinds (text, images, pictures, music, logos, brands, databases, etc.) used by Extend on the Website are protected by all applicable intellectual property rights or database producers’ rights. Any disassembly, decompilation, decryption, extraction, reuse, copies and more generally any act of reproduction, representation,
broadcasting, circulation and use of any of this content, whether wholly or partially, without Extend’s authorization is strictly prohibited and may result in legal action.

Personal data

Business references

Each Party agrees to request the other Party’s prior consent by any appropriate written means including by e-mail for any business and/or public references regarding the business relationship between the Parties. In particular, each Party must obtain the other party’s consent to use reproductions of its brands, trademarks and logos in business references, including during events, in its business documents and on its website, in any form. As a standard, this authorization will be granted for the usage period of the Services and for a period of three (3) years thereafter, unless the disclosed Party is requesting to cease such public reference.
Each Party agrees not to issue negative business and/or public references concerning the other Party.

Duration of the Services, unsubscribing

Termination for non-compliance

In the event that one of the parties fails to comply with its obligations under the terms of this agreement, the agreement will be terminated automatically 15 (fifteen) days after the receipt by the defaulting party of written notice to comply, this remaining unheeded, sent by registered letter with acknowledgement of receipt, mentioning the intention to apply this clause, without prejudice to any damages which may be claimed from the defaulting party.

Effect of termination

The termination of the Services, regardless of the grounds for this, will automatically result in the immediate deactivation of the Merchant’s Administrator Accounts and User Accounts, with the Merchant having no further access to the Services.
Prior to the end of the Services, and upon request to Extend, the Merchant shall recover their data from the Merchant Interface.

Modifications

23.1. Extend reserves the right to modify the Master Service Agreement at any time‍

23.2. The Merchant will be informed of these modifications by any appropriate means at least1 (one) month before they take effect.‍

20.3. The modified Master Service Agreement will apply from the renewal of the next Subscription following their application.‍

Language

In the event that the Master Service Agreement is translated into one or several languages, the The language used for interpretation purposes will be the English language in the event of any contradiction or dispute concerning the meaning of a term or provision.

Applicable law and jurisdiction

In the event of any dispute concerning the validity, interpretation and/or implementation of the Master Service Agreement, the Parties hereby agree that the courts of the State of Delaware will have sole jurisdiction to judge the matter unless procedural rules apply.

In the event of any dispute concerning the validity, interpretation and/or implementation of the Master Service Agreement, the Parties hereby agree that the courts of the State of Delaware will have sole jurisdiction to judge the matter unless procedural rules apply.

Applicability date

The Master Service Agreement is effective on the 22nd of June 2023

The company Data on the Fly LLC, a Colorado Corporation, having its principal place of business at 8509 East Nicholas Ave, Centennial, CO 80112, and supplying the Services(referred to in these conditions as “Extend”).

The purpose of these clauses is to define the conditions in which the Processor undertakes to carryout, on the Controller's behalf, the personal data processing operations defined below.As part of their contractual relations, the parties shall undertake to comply with the applicableregulations on personal data processing and, in particular, Regulation (EU) 2016/679 of the EuropeanParliament and of the Council of 27 April 2016 (hereinafter "the GDPR”).

The Processor is authorized to process, on behalf of the Controller, the necessary personal data forproviding software services allowing the Controller to track unpaid customer invoices.The nature of operations carried out on the data is the storage of data of the Controller for the purposeof Services, including customers’ details, customer contact, invoices and payments.The purposes of the processing are the provision of services relating to business invoices analyticsand management.The personal data processed are the first name, last name, email address, and work address of thecontacts at the customers.To perform the service covered herein, the Controller shall provide the Processor with the followingnecessary information:’

• The list of the Controller’s customers
• The billing contacts at these customers
• A copy of the invoices (paid, outstanding, voided) for each customer, updated as the case may be.
• The list of payments linked to these invoices and/or customers.

This contract enters into force on the signature date of the contract for the period of validity specified in the Terms and Conditions, the Website, or the relevant Order Form

The Processor shall undertake to:

• process the data solely for the purpose(s) subject to the sub-contracting;
• process the data in accordance with the documented instructions from the Controllerincluding with regard to transfers of personal data to a country outside the European Union;
  Where the Processor considers that an instruction infringes the GDPR or of any other legal provision of the Union or of Member States bearing on data protection, it shall immediately inform the Controller thereof. Moreover, where the Processor is obliged to transfer personal data to a third country or an international organization, under Union law or Member State law to which the Processor is subject, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
  The Processor is authorized to transfer any personal data to a third party located outside the EEA, subject to the implementation of appropriate safeguards as defined in Article 46 of GDPR.
  In case of execution of Standard Contractual Clauses, the Controller authorizes the Processor to execute the said clauses in its name and on its behalf. The Supplier shall ensure that its subsequent Sub-Processor(s) (as defined in Article 5) comply with the said clauses and be responsible for any default of compliance with such clauses.
• guarantee the confidentiality of personal data processed hereunder;
• ensure that the persons authorized to process the personal data hereunder:
         • have committed themselves to confidentiality or are under an appropriate statutory obligation of        confidentiality
           • receive the appropriate personal data protection training
• take into consideration, in terms of its tools, products, applications or services, the principles of data protection by design and by default.

The Processor is authorized to engage other processors listed in Schedule 1 (hereinafter the “Sub-Processor") to carry out the processing activities detailed in the abovementioned documents. Should the Processor use other Sub-Processors, it must inform the Controller, in writing beforehand, of any intended changes concerning the addition or replacement of other Sub-Processors. This information must clearly indicate which processing activities are being subcontracted out, the name and contact details of the Sub-Processor and the dates of the subcontract. The Controller has a period of 10 (ten) calendar days from the date of receipt of this information to present its objections. In the absence of any objection from the Controller after this period, the Controller is deemed to have accepted the engagement of the Sub Processors.
The Sub-Processor is obliged to comply with the obligations hereunder on behalf of and in accordance with the Controller’s instructions. It is the Processor’s responsibility to ensure that the Sub-Processor
provides the same sufficient guarantees regarding the implementation of appropriate technical and organizational measures so that the processing meets the requirements of the GDPR. If the Sub Processor fails to fulfil its data protection obligations, the Processor remains fully liable to the Controller for the Sub-Processor’s performance of its obligations.

It is the Controller's responsibility to inform the data subjects concerned by the processing operations atthe time data are being collected.

The Processor shall assist the Controller, insofar as this is possible, for the fulfilment of its obligation to respond to requests for exercising the data subject's rights: right of access, to rectification, erasure and to object, right to restriction of processing, right to data portability, right not to be subject to an automated individual decision (including profiling).

Where the data subjects submit requests to the Processor to exercise their rights, the Processor must forward these requests as soon as they are received by email to the Controller.

The Processor shall notify the Controller of any personal data breach without undue delay after having become aware of it. Said notification shall be sent along with any necessary documentation to enable the Controller, where necessary, to notify this breach to the competent supervisory authority.

The Processor assists the Controller in carrying out data protection impact assessments. The Processor assists the Controller with regard to prior consultation of the supervisory authority

The Processor undertakes to implement the appropriate technical and organizational measures to protect the security, confidentiality and integrity of personal data, including

• the pseudonymization and encryption of personal data;
• the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing
• systems and services;
• the ability to restore the availability and access to personal data in a timely manner in the event• of a physical or technical incident;
• a process for regularly testing, assessing and evaluating the effectiveness of technical and
• organizational measures for ensuring the security of the processing

At the end of the service bearing on the processing of such data, and upon request of the Controller, the Processor undertakes to:

• destroy all personal data, or
• return all personal data to the Controller, or
• return the personal data to the Processor designated by the Controller Together with said return, all existing copies in the Processor's information systems must be destroyed. Once destroyed, the Processor must demonstrate, in writing, that this destruction has taken place.

The Processor states that it maintains a written record of all categories of processing activities carried out on behalf of the Controller.

The Processor provides the Controller with the necessary documentation for demonstrating compliance with all of its obligations and for allowing the Controller or any other auditor it has authorized to conduct audits, including inspections, and for contributing to such audits. During such audits, the Controller or the auditor it has entrusted for this purpose shall not be authorized to access to the Processor’s trade secrets, its strategic information or any information that the Processor has undertaken to keep confidential. The Processor shall have the right to oppose all inspections and/or checks from the Controller or its auditor that may enable them to access to such information, without the Controller being able to make any claim in this regard. In any event, the Controller shall ensure that the auditor and, more generally, its personnel proceeding to said audits are submitted to appropriate confidentiality obligations.

The Controller undertakes to:

• provide the Processor with the data mentioned in II hereof
• return document, in writing, any instruction bearing on the processing of data by the Processor, all personal data to the Controller, or
• ensure, before and throughout the processing, compliance with the obligations set out in the GDPR on the Processor's part.

This agreement shall be subject to the GDPR and to French law. In the event of a dispute between the parties relating to the formation, interpretation or performance of this agreement, exclusive jurisdiction is given to the courts within the jurisdiction of the Court of Paris, France, notwithstanding plurality of defendants, even for emergency proceedings or conservatory proceedings by way of summary proceedings.