General Terms and Conditions
In Parallel Oy — Effective 11 November 2025
These general terms and conditions ("General Terms") apply to the delivery of Services by In Parallel Oy ("Supplier"), Business ID 3394334-7, to Customer under the valid Agreement that refers to these General Terms. Such sections of these General Terms, which refer to services that are not included in the scope of the Agreement between Supplier and Customer, shall not be applied.
1. Definitions
"Affiliate" means a company being Controlled by, under common Control with or Controlling a Party; and "Control" shall mean the power to direct the management and operations of the relevant company through ownership of the majority of the voting rights therein.
"Agreement" means the individual agreement for the delivery of Services by Supplier to Customer, consisting typically of a main agreement document, scope and prices documents, and these General Terms, as well as possible amendments thereto.
"Customer" means a company or other entity that has entered into an Agreement with Supplier.
"Customer Data" means all Customer specific data, information or material uploaded to, transferred through, posted, processed, or entered into the Software Service or otherwise delivered to Supplier by or on behalf of Customer.
"Intellectual Property Rights" or "IPRs" mean all copyrights (including the right to modify and assign such copyright), patents, utility models, designs, trademarks, logos, domain names, inventions, improvements, trade secrets, know-how and all other intellectual property rights (including any applications or rights to the foregoing).
"Party" and "Parties" mean Supplier and Customer, individually or together.
"Professional Service(s)" mean services for implementation, development, customization, training and/or any other agreed professional services to be performed by Supplier.
"Service(s)" means the In Parallel Oy's solution related services that the Parties have agreed in the Agreement to be delivered by Supplier to Customer, in the form of Software Services, Professional Services and/or any other agreed services.
"Software Service(s)" means the software service or solution specified in the Agreement that Supplier makes available to Customer via a data network to an access point defined by Supplier, including to the extent determined by Supplier updates, upgrades, and Customer support.
2. General Obligations of Parties
Supplier shall perform all agreed Services in a professional and workmanlike manner and in accordance with the Agreement. The standard working methods of Supplier shall be followed. Unless otherwise agreed, the Services are applied remotely and utilizing online tools and communication systems.
Supplier's delivery of Services is dependent on Customer's fulfilment of its obligations under the Agreement and Customer's delivery of requested, required and relevant information in an up-to-date form.
Customer shall be responsible for acquiring, installing, and maintaining, at its own cost, all necessary hardware, software, connections, data-communication links, and all other material and services required for the use of the Services in accordance with the recommendations provided by Supplier.
Customer shall access the Software Service and use the Services only for lawful purposes, in compliance with any and all applicable laws and regulations, under relevant consents (including those related to personal data), as well as in accordance with all policies and instructions notified by Supplier to Customer. Customer shall ensure that the agreed use of the Services does not violate any export control restrictions or international trade sanctions.
The Parties shall continuously and in good faith cooperate and as necessary consult each other. The Parties shall provide their contact details to each other and keep such information up to date.
3. Professional Services
The Parties shall agree in writing on each project or assignment concerning Professional Services, including the schedule for the performance thereof and the estimated price. The standard services to be delivered are defined in the Agreement. Any additional work and price thereof will be agreed between the Parties in a separate statement of work ("SOW").
Supplier shall perform Professional Services as agreed, in a professional manner and using suitable and skilled resources. Each Party shall invest sufficient resources, time, and competence to the assignment. Supplier shall not be liable for any delay caused by Customer, and Supplier shall be entitled to charge additional costs incurred due to delays or deficiencies of Customer. To the extent activities cannot be performed according to the agreed schedule because of Customer's delay or decision to reschedule, Supplier shall be entitled to charge for resources allocated to such activities to the extent they cannot reasonably be re-allocated to other activities.
If a Party discovers that a planned time schedule cannot be met, or that delays are expected, such Party shall immediately inform the other Party, and the Parties shall agree on any required changes to the time schedule and/or required actions to avoid or minimize the delay.
Any agreed Customer specific development is performed as an ad hoc assignment. Any updates, upgrades, changes or support of Customer tailored functionality or integrations, or agreed test environments, shall be subject to separate case specific agreement and will be invoiced on a time and materials basis.
4. Software Service
For the Subscription Period set out in the Agreement Customer is given access to the agreed Software Service, subject to due payment of all applicable fees. Customer shall have a limited, non-exclusive, non-transferable, and non-sublicensable right to use the Software Service for Customer's own internal business purposes.
Customer is not allowed to sell, distribute, or otherwise make the Software Services available to any third party other than Customer's users and Customer's designated Affiliates. Affiliates of Customer that are within the scope of this Agreement shall be set out in the Agreement, and the Parties may from time to time agree in writing to add or remove such Affiliates of Customer. Customer is fully liable for the acts and omissions of its users and Affiliates.
Customer, its users and Affiliates are not allowed to: (a) copy, translate, disassemble, decompile, reverse-engineer or otherwise modify any parts of the Software Service; (b) transmit any content, data or information that is unlawful, abusive, malicious, harassing, defamatory, or invasive of another person's privacy rights; (c) infringe the IPRs of any entity or person; (d) interfere with or disrupt any software or systems used to host and provide the Software Service, or any other equipment or networks connected to the Software Service; (e) use the Software Service in the operation of any service bureau, outsourcing or time-sharing service; (f) circumvent or disclose the user authentication or security of the Software Service or any host, network or account related thereto; (g) access the Software Service for the purpose of building a competing product or service or copying its features or user interface; or (h) make any use of the Software Service that violates any applicable law or regulation.
If Customer without the approval and involvement of Supplier connects the Software Service to any third-party service, Supplier shall not have any liability for possible defects or failures caused by such third-party service to the Software Service and vice versa. Supplier may deny access to the Software Service for any third-party service provider in case of reasonable security concerns.
5. Changes to Software Service
The Software Services are standard services of Supplier, and Supplier reserves all rights to develop, improve and/or to modify the Software Services. Furthermore, Supplier may decide to offer certain features of the Software Services to Customer as additional features against a separate fee.
Supplier may (but is not obliged to) make such changes to Software Service that (i) are reasonable and customary under the circumstances and do not materially affect the Software Service, (ii) are necessary to prevent severe data security risks, or (iii) results from law or regulation by authorities. Supplier endeavours to inform Customer of all such changes in advance and in any case without undue delay after such change.
Supplier is entitled to make updates and changes to the Software Services other than specified in the preceding paragraph by informing Customer in advance. If the change has a material adverse effect on the contents of the Software Service, Supplier must inform Customer about the change in writing at least thirty (30) days before the effective date of the change and Customer shall have the right to terminate the Agreement as of the effective date of the change by giving fourteen (14) days prior written notice to Supplier.
Possible change-related training sessions required by Customer, or any changes to Customer tailored functionality or integrations, are subject to separate invoicing and to separate case specific agreement.
6. Suspension of Software Service
Supplier shall have the right to suspend delivery of the Software Service for a period reasonably required for installation, modification or service work. Supplier is also entitled to prevent Customer's access to the Software Service if Customer uses the Service contrary to the Agreement or as necessary due to an identified severe data security risk. Supplier strives to inform Customer in advance of such interruptions. If this is not reasonably possible, Supplier shall inform Customer without delay after Supplier has learned of such matter.
7. Support and Availability of Services
Supplier offers customer service in matters relating to the use of the Services as defined in the Agreement.
Supplier will provide the Software Service in accordance with the Agreement.
Supplier will use commercially reasonable efforts to make the Services available at least 99.8% of the time, measured during each calendar month, excluding Scheduled Downtime (defined below) and unavailability caused by the failure of any third party vendor, the Internet, a force majeure event, or another reason beyond Supplier's reasonable control. Supplier's Software Services will be considered unavailable when there is no external connectivity for a five-minute period.
A minimum of three days' advance notice will normally be provided for all scheduled downtime to perform system maintenance, backup and upgrade functions for the In Parallel Services (the "Scheduled Downtime") if the In Parallel Services will be unavailable due to the performance of such work.
"Unscheduled Downtime" means the time outside of the Scheduled Downtime when the Services are not available, excluding any unavailability caused by the failure of any third party, the Internet, any force majeure event, or any other reason beyond Supplier's control.
8. Disclaimer of Warranty
Except as expressly set out in the Agreement or its annexes, Supplier provides the Services on "as-is" and "as available" basis and Supplier expressly disclaims any and all representations, warranties or conditions, relating to any Services provided under this Agreement, whether express, implied, or statutory, including any warranties of title, non-infringement, merchantability or fitness for any particular purpose. Supplier makes no representation or warranty that Services are uninterrupted or error-free or that data is accurate, complete or reliable.
9. Intellectual Property Rights
The IPRs to the Services, materials, working papers, documentation, software, and databases included in the production of the Services, results of the Services, and to any amendments or additions thereto, shall belong to Supplier or its licensors. The product names associated with the Services are service marks and trademarks of Supplier or third parties, and no right or license is granted to use them. This Agreement does not grant Customer any rights of ownership in or related to the Services or the IPRs owned by Supplier and its licensors.
Customer's right to use the Software Service is set out under Section 4 above.
The IPRs and the title to Customer Data shall belong to Customer.
Customer may from time to time provide suggestions, comments, or feedback ("Feedback") with respect to the Services or confidential information provided originally by Supplier. Supplier will be free to use possible Feedback, and to reproduce, disclose and distribute such Feedback without restrictions. Furthermore, Supplier has the right to use the ideas, notions, concepts, expressions, ways of use, techniques, solution models, planning documents, knowledge bases and knowhow that the Supplier has owned prior to the Agreement or that has been used or developed in connection with producing the Services.
The Agreement has no effect on the IPRs that each Party had prior the effective date of the Agreement. Except as specifically provided under the Agreement, the Agreement shall not give either Party any direct, indirect, or implied right or license to use or otherwise exploit IPRs belonging to the other Party.
10. Customer Data
Customer shall be responsible for the accuracy, completeness, reliability, integrity, quality and non-infringement of any Customer Data as well as for the compliance thereof with the laws, regulations, and orders of authorities. If any Customer Data is in violation of any laws, statutes, regulations, good practices, or rights of third parties, Supplier may prevent access to such Customer Data or delete it from the Service.
Customer grants Supplier and its subcontractors (subject to applicable data protection laws) a non-exclusive, worldwide, royalty-free, fully paid-up, and sub-licensable license to use, copy, transfer, store, and modify Customer Data during the term of this Agreement for the purposes of providing Supplier Services and managing Customer relationship between Supplier and Customer as well as analyzing the use of Supplier Services.
11. Backup Copies, Data Security
Supplier shall be responsible for making backup copies of Customer Data and for maintaining the backup copies in a suitable manner in conformity with reasonable industry standards. Supplier's liability for loss of data and restoration thereof is limited to reconstructing data caused by its default back to the last available backup. Restoring data from backup copies requires a written request of Customer's contact person. Supplier has the right to charge a fee for restoring of data in accordance with its price list in force at the time of request, unless the loss of data was due to an act or omission of Supplier.
Customer and Supplier shall each be responsible for taking care of the data security with respect to their respective information systems. Neither Party shall be responsible for the data security or interruptions of any general data communication network, nor for any other factors outside of their control nor for any damage caused by such factors.
Customer manages passwords connected to its users and shall ensure the use of sufficiently strong passwords. Customer shall keep and cause its users to keep all user IDs, passwords, and any details regarding access to the Software Service secret at all times and not disclose them to any third party except to the extent allowed under the Agreement. Customer shall at all times be and remain fully responsible for the access to the Software Service by its users. Customer shall inform Supplier immediately, if any user ID or password have been revealed to any unauthorized third party or if Customer has a reason to suspect misuse of any such user ID or password. Customer shall change and shall cause its users to change the password required for the access to the Software Service upon written request of Supplier, if deemed necessary by Supplier due to a data security risk concerning the Software Service or otherwise.
Each Party shall notify the other Party without delay of any significant data security issues affecting the Services, after which each Party is for its own part responsible for taking immediate actions to remove the same.
12. Third-Party Solutions
In the production of Services, Supplier may utilize standard software products that are licensed by Supplier from a third party, and which may be made available to Customer through the Services as set out in the Agreement and its annexes. The ownership and IPRs of such third-party products shall always remain the sole property of the relevant third party and they may be provided on special terms and conditions and/or with deviations from the Services in general.
In addition, Supplier may always utilize open-source software and other third-party software components for the purpose of producing and providing the Software Service. Supplier shall ensure that it has the right to use such third-party software components and to provide Customer with the Software Service on the terms and conditions set out in this Agreement.
13. Prices and Terms of Payment
The applicable fees and payment terms are detailed in the Agreement and/or its annexes. If a price for a Service has not been agreed, the price in the Seller's price list effective on the date of order shall apply.
As regards Software Services, Customer shall pay for each Subscription Period in full against an invoice issued by Supplier upon Customer gaining access to the Software Service in question.
The Parties may agree that Consulting Services are provided by Supplier to Customer on a time-and-material basis or against a lump sum payment. Unless otherwise agreed, Supplier invoices all one-time fees at the time of signing, and time-and-material based Services monthly in arrears.
All invoices shall be in euros. Notices relating to invoices or payments hereunder shall be given in writing within fourteen (14) days from the date of receipt of the relevant invoice.
The payment term is thirty (30) days net from the date of invoice. Late payments shall bear penalty interest from the invoice date in accordance with the Finnish Interest Act. Customer shall be responsible for the reasonable costs incurred by Supplier for collecting overdue fees.
If any payment by Customer is delayed by more than thirty (30) days from the due date despite a written reminder, Supplier shall be entitled to suspend its performance without any liability until Customer has fulfilled its payment obligations under the Agreement.
Customer agrees to settle the invoices in full without any deductions or set-off.
All prices are exclusive of VAT and any other applicable taxes or fees/payment charges imposed by public authorities or financial institutions from time to time. Such taxes and fees shall be added to the prices and be borne by Customer.
Unless otherwise agreed in an Agreement, any customary and reasonable travel, accommodation, and daily allowance expenses are charged separately on a monthly basis against receipts.
All invoiced fees and all payments made in accordance with this Agreement are non-refundable. For clarity, in the event of early termination during a Subscription Period, Customer shall not be entitled to a refund of any prepaid fees.
Supplier shall be entitled to adjust the recurring charge of a Service by notifying the Customer of the change in writing at least sixty (60) days before the effective date of the change. With respect to Software Services, the adjusted prices shall apply from the beginning of the next Subscription Period. With respect to recurring charges related to such Consulting Services that are provided to Customer under an Agreement in force until further notice, the adjusted prices shall apply after the notice period (not less than sixty (60) days). Where a price change occurs, Customer shall be entitled to terminate the Agreement for the Service in question on the effective date of the price change by notifying Supplier thereof in writing at least thirty (30) days before the effective date of the change. In such case Customer shall also be entitled to terminate the Agreement simultaneously with respect to other Services which, due to the above-mentioned termination, can no longer be essentially used for the benefit of Customer. For clarity, the aforesaid shall not limit Supplier's right to adjust its fees and prices at any time to reflect possible changes in the volume or scope of the Services provided to Customer.
14. Confidentiality
Each Party shall keep in confidence and not disclose to any third party all material and information received from the other Party if the information is marked as confidential or if the information should reasonably be understood to be of confidential nature ("Confidential Information"). The Confidential Information of the other Party may be used only for the purposes of the Agreement. Each Party may only share such Confidential Information to its directors, employees and legal advisors that need to know it for the purpose of the Agreement and that are bound by the confidentiality obligations set out herein. The receiving Party shall handle all Confidential Information with no less a degree of care than is used for its own Confidential Information and at least with reasonable care.
The confidentiality obligations shall not apply to material or information, which (i) is generally available or otherwise made public; (ii) the receiving Party has received from a third party without any obligation of confidentiality; (iii) was in the possession of the receiving Party prior to receipt of the Confidential Information; (iv) the receiving Party has independently developed without using the Confidential Information of the other Party; or (v) which the receiving Party is required to provide due to mandatory law or regulation or a judicial order.
Each Party is entitled to use the general professional skills and experience acquired in connection with the Agreement, observing the confidentiality obligations herein.
The undertakings of this Section 14 shall survive the expiration or termination of the Agreement for any reason and shall bind the Parties for a period of five (5) years after the expiration or termination of the Agreement.
15. Data Protection and Processing of Personal Data
Unless otherwise set out in the Agreement or its annexes, the Software Service is delivered and maintained, and Customer Data is stored within the European Union or the European Economic Area.
Unless otherwise agreed in writing, the terms and conditions for processing of personal data (Appendix 1 to these General Terms) shall apply to such processing of personal data that Supplier may carry out on behalf of Customer.
As a company based in Finland and in the European Union, Supplier shall comply with applicable European Data Protection Legislation, as defined in Appendix 1.
The Customer shall comply with any data protection legislation applicable to it in its home country, in addition to which it shall ensure for its own part that the processing of personal data covered by the Agreement is lawful under the Data Protection Regulation, as defined in Appendix 1.
16. Term and Termination
The Agreement shall become effective and binding when each of the Parties have signed the Agreement.
With respect to Software Services, the Agreement shall remain in force for the fixed Subscription Period specified in the Agreement or in its appendices, whereafter the Agreement shall automatically renew for an additional equally long Subscription Period at the list price in effect at the time of renewal, unless either Party has given notice of termination sixty (60) days prior to the expiry of the ongoing Subscription Period.
With respect to Consulting Services, the Agreement shall remain in force until completion of such Consulting Services, or as set out in the Agreement or its annexes.
Each Party will be entitled to terminate this Agreement in writing with immediate effect if the other Party; (a) is in material breach of its obligations under the Agreement and has not remedied such breach within sixty (60) days after written notice thereof; or (b) is insolvent, declared bankrupt, is put into liquidation or there are other grounds to assume that the other Party cannot fulfil its financial obligations under the Agreement.
On the effective date of termination or expiry of the Agreement or of the right to use a certain Service, Customer's access to such Service will be terminated and Customer shall discontinue using the Service.
Customer is responsible for downloading/saving prior to the expiry or termination of the Agreement any Customer Data that it may wish to keep. Supplier's responsibility to retain Customer Data terminates thirty (30) days from termination or expiration of the Agreement, after which Supplier shall destroy Customer Data unless Customer has requested Supplier assistance in the delivery of Customer Data. Supplier shall, if requested by Customer, provide assistance to Customer for the transfer of Customer Data in its possession to Customer or to a third party designated by Customer, and also provide such Consulting Services as may be required for the termination of the Service for Customer. Unless otherwise agreed, such assistance and services will be provided in accordance with Supplier's standard price list applicable at that time.
Notwithstanding the aforesaid, Supplier shall be entitled to retain a copy of Customer Data to the extent required by mandatory laws or regulations.
If the fulfilment of this Agreement has been delayed for more than three (3) months due to a force majeure event, each Party shall have the right to terminate the Agreement with immediate effect by notifying the other Party thereof in writing. In such event neither Party has the right to claim damages for such termination.
17. Limitation of Liability
The total aggregate liability of a Party towards the other Party resulting from a breach of the Agreement is limited to the payment of direct damages and further to a maximum of fifty (50) % of the price payable for the agreed Services directly related to the cause of action asserted under the Agreement. In case of continuous services, the aforementioned fifty (50) % limit is calculated from the monthly service price multiplied by twelve (12).
Neither Party is liable for any indirect, incidental, consequential or punitive damages or the consequences thereof such as loss of profits, revenues, business opportunities, data, or goodwill, or interruption of production or operations, or damages caused to third parties or by the purchase of replacement products or services, even in case the Party in question has been advised of the possibility of such damages. No claim shall be made by Customer to Supplier later than twelve (12) months from the date of the service delivery.
The limitations of liability shall not apply to damages caused by wilful misconduct or gross negligence.
Notwithstanding anything stated in these General Terms, evaluation licenses are delivered on "as is" basis and Supplier shall under no circumstances be liable for any damages whatsoever resulting from the use of such licenses.
18. Applicable Law; Dispute Resolution
The Agreement is governed by the laws of Finland, excluding its choice of law provisions and the United Nations Convention on Contracts for the International Sale of Goods (CISG).
Any dispute, controversy or claim arising out of or relating to the Agreement, or the breach, termination or validity thereof, shall be finally settled by arbitration in accordance with the Arbitration Rules of the Finland Chamber of Commerce. The number of arbitrators is one (1) and the arbitration takes place in Helsinki, Finland. The language used in the arbitration is Finnish if Customer has an office in Finland, and English if Customer has no office in Finland.
Each Party may however bring a claim before a general court as first instance to apply for an injunctive relief or collect any undisputed receivables.
19. Miscellaneous
Force Majeure
Neither Party shall be liable for delays or damages caused by an impediment beyond its reasonable control, the consequences of which the Party could not reasonably have avoided or overcome. Such force majeure events shall include, if not proven otherwise, inter alia, war or insurrection, mobilization, earthquake, flood or other similar natural catastrophe, pandemics, interruptions in general traffic, data communication or supply of electricity, general network interruptions, denial-of-service attacks, import or export embargo, strike, lockout, boycott or other similar industrial action, or unforeseen delays by a subcontractor. A Party shall inform the other Party in writing and without delay of an occurrence and of discontinuance of a force majeure event.
Reference Right
Customer agrees to allow Supplier to (a) use Customer's name and logo to identify Customer as a customer of Supplier and Supplier's Services in Supplier's promotional and marketing materials, including its website; (b) issue press releases indicating that Customer has ordered Services, the contents of which press release will be pre-approved by Customer and which shall not be unreasonably withheld; and (c) publish a case study that describes how the Services were used to solve Customer's business needs, subject to Customer's prior review and approval.
Assignment, Subcontractors
Neither Party may assign the Agreement. However, Supplier is entitled to assign its receivables to a third party, and the Parties are entitled to assign the Agreement to their Affiliate or in connection with a merger or acquisition procedure. Each Party may use subcontractors, remaining liable for the performance of its subcontractors as for its own acts or omissions.
Survival, No Waiver
Any terms and conditions that by their nature or their explicit wording should survive a cancellation or termination of the Agreement shall so survive. No waiver of any provision or breach of the Agreement constitutes a waiver of any other provision or subsequent breach.
Severability
If any provision of the Agreement is held to be invalid or unenforceable, it shall be deemed to be severed from the Agreement and shall be of no effect and shall not affect the validity and enforcement of the remaining provisions of the Agreement.
Amendments of Agreement
All changes and amendments to the Agreement and its annexes shall be agreed in writing and signed by both Parties in order to be valid. Supplier reserves the right to update and amend any service descriptions and security descriptions to reflect changes in the Services, processes, or technical environment. Furthermore, Supplier may change these General Terms from time to time. Supplier shall notify Customer of the change at least sixty (60) days before the change takes effect. If Customer does not accept the amendment to the General Terms, Customer has the right to terminate the Agreement from the effective date of the amendment by giving thirty (30) days' notice in writing.
Appendix 1 — Terms and Conditions for Processing of Personal Data (DPA)
1. Scope of Application
These terms and conditions for processing of personal data (DPA) shall apply when Supplier processes personal data on behalf of Customer under the Agreement.
2. Specification of Data Processing
For the purposes of provision of the Services under the Agreement, Customer is the data controller, and Supplier is the data processor. The personal data processed may include the following categories of personal data of the Customer's employees, directors and other stakeholders: (i) employee information, including name, position, team, location, goals or objectives that the employee is responsible for, progress reports (audio and text), contact details, represented company, tasks, other identification data and other data made available from Customer's HR systems or otherwise; (ii) communications data, such as answers to audio or text based surveys, audio or video recordings, text input and other content or other correspondence with data subjects.
Customer shall not send or use the Services to process any sensitive personal data and shall instruct its employees and other relevant stakeholders not to provide any sensitive personal data to the Services.
3. Definitions
The definitions used in the Agreement document are applied. In addition, the following terms shall have the meanings set forth below (unless and to the extent the context otherwise requires): (i) "Data Protection Legislation" shall mean the data protection or privacy laws and regulations in force from time to time, including applicable national and EU legislation in force from time to time. Data Protection Legislation may refer to, inter alia, the Finnish Data Protection Act (1050/2018) and/or the Data Protection Regulation (as defined below); and (ii) "personal data", "processing", "controller", "processor" and "data subject" each shall have the same meaning as in the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("Data Protection Regulation").
4. General Rights and Responsibilities
As the controller, Customer is liable for ensuring that it has an adequate legal basis and has all the required rights and permissions to process personal data and that the processing of personal data is and will continue to be carried out in accordance with the applicable laws and Data Protection Legislation. Customer is responsible for compiling data protection notices and making them available, and also for providing information for the data subjects and making notifications to the authorities as required.
Customer shall have a right to give instructions to Supplier on the processing of personal data. Such instructions shall be in accordance with applicable laws, regulations and Data Protection Legislation and will become binding towards Supplier upon their written acceptance by Supplier. Should Supplier's performance of instructions require any measures exceeding the obligations set out in the Agreement, the fulfilment of such instructions may be subject to separate fees by Supplier.
When processing personal data on behalf of Customer for the purpose of providing the Services, Supplier shall: (i) process personal data solely in accordance with the documented instructions of Customer; unless otherwise required by laws applicable to the data processor, in which case Supplier, to the extent provided by applicable laws, will prior to such processing inform Customer of such requirement; (ii) insofar as this is possible and taking into account the nature of the processing and the information available to Supplier, assist Customer with appropriate technical and organizational measures in responding to requests for exercising the data subjects' rights and in fulfilling Customer's mandatory obligations under the Data Protection Regulation regarding data security, data breach notifications and data protection impact assessments (however, Supplier is obliged to assist Customer only to the extent Customer is unable to fulfil the respective obligations without Supplier's assistance); and (iii) ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. To the extent it is necessary to demonstrate Supplier's compliance with its obligations laid down in these terms and conditions for processing of personal data, Supplier shall (iv) upon request make available to Customer documentation on Supplier's data processing activities, and (v) upon separate agreement allow for audits by Customer or an independent third-party auditor mandated by Customer. Any audit or inspection shall be carried out upon reasonable notice, at Customer's expense, in an efficient manner without unnecessary disturbance to Supplier's daily operations, and in a way that respects Supplier's confidentiality obligations towards other customers and/or third parties. Supplier may also provide Customer with an audit report by a third-party auditor and where available audit reports concerning its audits of subcontractor(s).
Supplier shall have the right to invoice the work resulting from the assistance required by Customer under Sections (ii), and (iv) and (v) above in accordance with its prevailing prices.
5. Data Security
Supplier shall implement and maintain appropriate organizational and technical measures to protect personal data against accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure or access. The present technical and organizational measures are described in a security description, which can be provided to Customer upon request.
If Supplier becomes aware of a personal data breach affecting the personal data processed on behalf of Customer, Supplier shall notify Customer of the personal data breach without undue delay.
6. Use of Third Parties in Data Processing
Where Supplier subcontracts its tasks related to personal data processing, Supplier shall enter into a written agreement with each sub-processor. Such written agreement shall impose similar obligations on the sub-processor as are imposed on Supplier under these terms and conditions for processing of personal data.
Supplier shall inform Customer of the present sub-processors used by Supplier in the provision of the Services and of changes concerning its sub-processors, including the identity and location of new or replaced sub-processors. In case Customer objects to the use of a specific sub-processor, Customer shall notify Supplier in writing (including e-mail) within fourteen (14) calendar days after receipt of Supplier's notice. Supplier will then use reasonable efforts to change the affected Services or to recommend a commercially reasonable change to Customer's use of the affected Services to avoid the processing of personal data by the relevant sub-processor. If Supplier is unable to make available or propose such change within sixty (60) calendar days, either Party may as sole and final remedy terminate those Services which cannot be provided by Supplier without the use of the relevant sub-processor with immediate effect or upon reasonable notice defined by the terminating Party.
7. International Transfers of Personal Data
To the extent Supplier for the purpose of the Services needs to transfer personal data outside the European Union or the European Economic Area, Supplier shall ensure that the transfer is only made to (a) countries that ensure an adequate level of protection as deemed by the EU Commission, or (b) entities that have provided appropriate safeguards (for example by use of the standard data protection clauses adopted by the EU Commission) as set out in Chapter V of the Data Protection Regulation.
8. Liability for Damage and Limitation of Liability
Section 17 (Limitation of Liability) of the General Terms shall otherwise apply in connection to these terms and conditions for processing of personal data, but each Party's maximum liability shall be limited to the Service fees received by Supplier under the relevant Subscription Agreement during twelve (12) calendar months prior to the issue giving rise to the claim.
9. Deleting Personal Data
Upon termination of the Agreement, Supplier shall delete or anonymize all personal data on its systems (except any backups made for recovery purposes which are retained for no longer than six (6) months) at the latest sixty (60) calendar days after the last effective day of the Agreement, unless otherwise required by applicable laws or agreed upon in writing between the Parties.