Event Management Software Terms

Correct as at: 29 July 2026

This Master Services Agreement (“MSA”) outlines the terms and conditions applicable to “You” meaning the entity you represent in accepting these terms or, if that does not apply, to you individually. If you are accepting on behalf of your employer or another entity, you represent and warrant that: (i) you have full legal authority to bind your employer or such entity to these terms; (ii) you have read and understand these terms; and (iii) you agree to these terms on behalf of the party that you represent.

These terms are effective as of the date you first sign a proposal or contract with iVvy, or use or access an iVvy software product, whichever is the earlier. iVvy reserves the right to adjust these terms by posting the revised version of this MSA on the iVvy website. Upon review by You, if the new terms are unacceptable, You agree to negotiate acceptable terms with iVvy in good faith or remain on your existing terms until the end date of your current agreement.

Terms of agreement

1. Definitions and interpretation

1.1 Definitions

All Groups Australian Consumer Price Index the Consumer Price Index (All Groups – Weighted average of eight capital cities) published by the Australian Bureau of Statistics, or any equivalent replacement index published from time to time.

APAC means the nations contained within the Asia Pacific business region consisting of the whole of Asia as well as the countries of the Pacific Rim.

Australian Consumer Law means the Australian Consumer Law as contained in Schedule 2 of the Competition and Consumer Act 2010 (Cth).

Business Day means a day that is not a Saturday, Sunday or public holiday in:

(a) the City of the Gold Coast (Queensland, Australia) if you are in APAC;

(b) the City of London (United Kingdom) if you are in the United Kingdom, or EMEA; and

(c) the City of Madison, Wisconsin (United States of America) if you are in the Americas.

Cardholder Data means data and information relating to the cardholder which is uploaded to the Gateway or otherwise communicated to iVvy for the purpose of making a payment under this MSA or any Contract.

Client has the meaning given to it in clause 10 of this MSA.

Client's Data means any data of or in respect of the Client received by or disclosed to iVvy during iVvy's performance of a Contract.

Customer means the party defined as such in the opening recitals of this MSA.

Customer Data means any data of or in respect of the Customer or its Related Bodies received by or disclosed to iVvy during iVvy's performance of a Contract.

Confidential Information means:

(a) the terms of this MSA and any Contract(s), all code, designs, drawings, specifications, techniques, models, data, diagrams, project plans, flow charts, processes, procedures, inventions, know-how and business, technical and financial information disclosed by a party in any form, and in the case of iVvy includes the Software source code, object code, file layouts and interfaces and the Documentation, software in various stages of development (including any new releases and or new versions) and the customers, suppliers and contractors of iVvy, and also includes any information that a party designates as being confidential at the time of disclosure or should be reasonably known by the receiving party to be confidential or proprietary due to that nature of the information disclosed and the circumstances surrounding the disclosure.

Confidential Information does not include information that:

(a) is already known to the Recipient prior to its disclosure by the Disclosing Party;

(b) is or becomes generally known through no wrongful act of the Recipient;

(c) is independently developed by the Recipient without use of or reference to the Disclosing Party’s Confidential Information; or

(d) is received from a third party without restriction and without a breach of an obligation of confidentiality.

Contract means a contract for the provision of Services and/or Deliverables from iVvy to the Customer, formed in accordance with clause 2.1.

Deliverables means any materials, deliverables, modifications or developments we provide in connection with our Services.

Developed IP means any improvements, alterations or similar to the Existing IP arising out of the Customer's access to and/or use of the Software and/or any other Deliverables.

Disclosing Party means the party disclosing Confidential information.

Documentation means any documentation (including digital copies) for and in relation to the Software provided to the Customer by iVvy.

Effective Date means the date on which the last party to this MSA signs.

EMEA means the business region consisting of the nations of Europe, the Middle East and Africa.

Existing IP means the Intellectual Property Rights in existence prior to the parties entering this MSA.

Fee means the fees specified in the Contract.

Force Majeure Event means an event beyond the reasonable control of a party (Affected Party), including without limitation strike, lock-out or labour dispute (except when that solely relates to the Affected Party’s workforce), act of God, war, riot, civil commotion, epidemic, pandemic, compliance with a law or government order, rule, regulation or direction (other than as a result of an act or omission of the Affected Party), accident, breakdown or unavailability of utilities, plant, machinery or telecommunication services, fire, flood, storm which in every case is not reasonably foreseeable and is beyond the reasonable control and without the fault or negligence of the Affected Party.

Further Terms has the meaning given to it in clause 3.1(b).

Gateway means the payment processing services that is used to take payments from Customers.

GST means goods and services tax.

Initial Term has the meaning given to it in clause 3.1(a).

Insolvency Event means the occurrence of any one or more of the following events regarding a party:

(a) where the party is an individual, the party is bankrupted;

(b) a meeting has been convened, resolution proposed, petition presented, or order made for the winding up of that party;

(c) a receiver, receiver and manager, provisional liquidator, liquidator, or other officer of the Court, or other person of similar function has been appointed regarding all or any material asset of the party;

(d) a security holder, mortgagee or chargee has exercised, attempted to exercise or indicated an intention to exercise its rights under any security of which the party is the security provider, mortgagor or chargor; or

(e) an event has taken place with respect to the party which would make, or deem it to be, insolvent under any law applicable to it.

Intellectual Property Rights means any intellectual property rights in existence now or coming into existence in the future anywhere in the world and includes (but is not limited to) rights in respect of copyright, future copyright, trademarks (whether registered or unregistered), inventions, patents, designs (whether registered or unregistered), data and databases, confidential information and know how.

iVvy means iVvy Pty Ltd ACN 138 782 822 if the Customer is in APAC; iVvy Inc if the Customer is in the Americas; and iVvy UK Limited Company Number 11206473 if the Customer is in EMEA.

iVvy Terms of Service means the terms contained in this document, the Master Services Agreement published at www.ivvy.com/venues-terms/

Moral Rights has the meaning provided under the Copyright Act 1968 (Cth) and includes any equivalent rights applicable in any jurisdiction outside of Australia.

Recipient means the party receiving Confidential Information.

Related Bodies Corporate has the meaning given to that term in the Corporations Act 2001 (Cth).

Services means a service iVvy provides the Customer as described in a Contract.

Software means the licensed software specified in the Contract.

Statement of Work means a document containing substantially the same information as the template Contract in Schedule 1 to this MSA outlining the Services and Deliverables proposed to be provided by iVvy to the Customer, which is made expressly in accordance with this MSA and by its execution by each party forms a constituent document of a Contract.

Taxes means all taxes other than income tax including without limitation GST, VAT and other applicable consumption taxes, duties, charges and fees.

The Americas means the business region consisting of the nations of North America (including Canada, the United States, and Mexico), Central America, and South America.

United Kingdom Consumer Price Index means the UK Office of National Statistics (Consumer Price Inflation, CPI 12-month rate) published by the UK Office of National Statistics, or any equivalent replacement index published from time to time.

United States Consumer Price Index means the US Bureau of Labor Statistics Consumer Price Index (All Urban Consumers, CPI-U, unadjusted for the prior 12 months) published by the US Bureau of Labor Statistics, or any equivalent replacement index published from time to time.

VAT means value added tax.

1.2 Interpretation

In this MSA, unless the context otherwise requires:

(a) A reference to an agreement includes any schedules thereto, variation or replacement of the agreement.

(b) If the due date for any obligation is not a Business Day, the due date will be the next Business Day.

(c) Headings are provided for convenience and do not affect the interpretation of the documents making up this MSA.

(d) The words “include”, “includes” and “including” must be read as if followed by the words “without limitation”.

(e) The singular includes the plural, and the plural includes the singular.

(f) If a word or phrase is defined its other grammatical forms have corresponding meanings.

(g) Agreements, representations and warranties made by two or more people will bind them jointly and severally.

(h) A reference to any legislation includes any consolidation, amendment, re-enactment or replacement of legislation.

(i) A person includes the person’s executors, administrators and permitted novatees and assignees.

(j) No rule of construction will apply to the provision of a document to the disadvantage of a party merely because that party drafted the provision or would otherwise benefit from it.

2. Contracts

2.1 From time to time, the parties may agree to enter Contracts specifying the Deliverables and/or Services to be supplied by iVvy. A Contract will comprise of:

(a) a Contract (in substantially the same form as Schedule 1 – Contract Template); and

(b) this MSA,

and, in the event of any inconsistency between any of the above documents, the document higher in the list shall prevail to the extent of the inconsistency.

2.2 Each Contract is a separate enforceable agreement in respect of its subject matter and, unless expressly specified otherwise in the relevant Contract(s) or this MSA, does not affect the rights or obligations of the parties in respect of any other Contract or this MSA.

2.3 For the absence of doubt, nothing in this MSA compels any party to enter any Statement(s) of Work or Contract(s) for any Service(s) or Deliverable(s) at any time.

3. Term and termination

3.1 MSA term

Unless terminated in accordance with this clause 3 or on the termination of all contracts linked to this MSA:

(a) the term of this MSA shall commence on the Effective Date of the initial Contract and continue for the term of the initial Contract from the Effective Date ("Initial Term"); and

(b) at the completion of the Initial Term, this MSA shall automatically renew for successive twelve (12) month periods ("Further Terms") unless terminated by either party giving notice to the other at least ninety (90) days prior to the expiry of the then current term.

3.2 Contract term

(a) The term of a Contract will be specified within the relevant Contract.

3.3 Termination for cause

This MSA or any Contract may be terminated on written notice to the other party:

(a) by iVvy:

(i) if the Customer fails to make payment of any Fees when due hereunder and such failure continues for 7 days after the Customer receives written notice of the overdue payment;

(b) by either party:

(i) if the other party breaches any material term of this MSA and either:

(A) the breach cannot be remedied; or

(B) if the breach can be remedied, it is not remedied by the breaching party within 30 days after receiving written notice of such breach.

(ii) if the other party is subject to an Insolvency Event;

(iii) if a Force Majeure Event affecting the other party continues for more than 30 days.

3.4 Consequence of termination

(a) Upon the expiration or earlier termination of any Contract:

(i) the Customer's right to access and use the Software and the Documentation the subject of the Contract will immediately cease, and any Customer Data may be deleted;

(ii) iVvy will render invoices to the Customer up to the latter of; the date of termination, or the end of the contracted term under the Contract; and

(iii) the Customer must pay all undisputed amounts due and owing to iVvy.

(b) Upon the termination of this MSA or any Contract:

(i) each party must continue to perform its respective obligations during any termination notice period (including payment of any Fees accruing, due, or payable, during the termination notice period); and

(ii) neither party is entitled to compensation because of the other party's termination.

(c) For the avoidance of doubt:

(i) the termination or expiry of a Contract does not affect the continued operation of this MSA or any other Contract. This MSA continues for the term specified unless also terminated in accordance with this MSA. Each other Contract continues for the term specified in the Contract unless also terminated in accordance with that Contract;

(ii) in the case of termination prior to the end of the original term or any subsequent agreed or automatically extended term, the value of the invoice to be rendered per clause 3. (a) (ii), and payable by the Customer will be the pro-rated value calculated to the end of that term. i.e. for a three-year (36 month) contract terminated after 15 months, the final invoice value will equal 21 months (36- month term minus 15 months); and

(iii) nothing in this clause 3 affects any other rights and remedies available to the parties at law or in equity.

4. Fees and payment

4.1 Fees payable

(a) Any Fees payable by the Customer under a particular Contract will be specified and detailed in the applicable Contract.

(b) Unless otherwise stated in the applicable Contract the Fees are exclusive of any Taxes, and any Taxes payable with respect to the Fees must be paid by the Customer to iVvy at the same time as payment is due for the relevant Fees.

4.2 Fee adjustment mechanism

(a) Subject to any other fee adjustment mechanism agreed under a Contract, upon each anniversary of the Contract, the Fees will be increased by the relevant consumer price index; the All Groups Australian Consumer Price Index for APAC, the United Kingdom Consumer Price Index for EMEA, or the United States Consumer Price Index for the Americas, over each year (or part thereof) of the preceding Contract Term.

(b) You acknowledge that the pricing for the SaaS services is based on the current market conditions and the prevailing costs at the time of contract execution. In the event of significant changes in the market conditions or costs that substantially impact iVvy’s ability to provide the SaaS services at the agreed-upon price, iVvy reserves the right to adjust the price of the SaaS services. In this case, the process will be as follows:

(i) iVvy shall provide written notice to the Customer at least 90 days prior to implementing any price adjustment. The notice shall include the effective date of the price adjustment and the reasons for such adjustment.

(ii) Upon receiving the notice, the Customer shall have the right to terminate this agreement within 30 days of the receipt of the notice, without incurring any early termination fees or penalties.

(iii) If the Customer chooses not to terminate the agreement, the adjusted pricing shall take effect on the specified effective date mentioned in iVvy’s notice. iVvy shall make commercially reasonable efforts to minimize any price adjustments and shall act in good faith when determining the necessity of such adjustments.

(iv) Any price adjustments made in accordance with this clause shall not affect the fees paid by the Customer prior to the effective date of the adjustment.

(v) The Parties shall periodically review the pricing structure and market conditions to assess the need for any future price adjustments. iVvy shall engage in good-faith discussions with the Customer to reach a mutually acceptable agreement on any proposed adjustments.

(c) This Fee Adjustment Clause shall survive the termination or expiration of this agreement.

4.3 Payment

(a) iVvy will invoice the Customer for the Fees incurred and the Customer must pay each undisputed invoice in accordance with each Contract. If no process for invoicing is specified in a Contract, iVvy may issue invoices annually in advance and each invoice is payable no later than thirty (30) days after the date of invoice. For the absence of doubt, a breach of this clause 4.3(a) is a material breach of the applicable Contract.

(b) If any Fee or other amount payable under a Contract by the Customer remains unpaid for more than 7 days past the due date, iVvy may:

(i) suspend the Customer's access to the Software and performance of all or any of iVvy's obligations under the Contract;

(ii) charge an administration fee;

(iii) charge the Customer interest on the outstanding amount at the rate set by Westpac Banking Corporation (Australia) for overdraft facilities for amounts more than $100,000 calculated from the date that payment is due until the date that payment is made; and/or

(iv) refer the debt to a third-party debt collector.

(c) If the Customer disputes an invoice, the dispute must be referred for resolution under clause 17. The Customer may withhold payment of any amount that it disputes in good faith until the dispute has been resolved and must pay all amounts which are reasonably not in dispute (including where an amount is partly disputed and partly not disputed, the part reasonably not in dispute).

5. Record-keeping and audit rights

5.1 During the Term and for twelve (12) months thereafter the Customer agrees to maintain full, true and up to date books of account, records and documentation relating to each Contract (including appropriate audit trails for transactions performed, and tax imposed).

5.2 iVvy may (acting reasonably) conduct an audit of the Customer's records for the purpose of:

(a) assessing the Customer's performance and compliance with its obligations under this MSA and/or the applicable Contract; and/or

(b) complying with any direction or request of a regulator,

and the Customer must:

(c) cooperate in the audit process; and

(d) supply iVvy with access to any documents or information reasonably required (which may be subject to conditions including confidentiality).

5.3 iVvy will:

(a) provide not less than five (5) Business Days' notice of any request for any information under clause 5.2;

(b) use its best endeavours to schedule and carry out audits to minimise impact on the Customer's operations; and

(c) in carrying out an audit, comply with the Customer's reasonable and lawful policies and directions.

5.4 Nothing in this clause 5 grants or implies any general right of a party to audit the other party's records of other customers, financial and accounting books and records, or any other aspect of its business operations, beyond the rights and for the purposes described in this clause 5.

6. Confidentiality

6.1 Each of the parties hereto agree that it will hold in confidence, and not disclose to any third parties, any Confidential Information received from the other party for any purpose other than performing its obligations and fulfilling its rights under this MSA and any Contract.

6.2 Notwithstanding clause 6.1, the Recipient may disclose the other party's Confidential Information:

(a) to the Recipient's Related Bodies Corporate, officers, employees’ agents and contractors (Representatives) having a legitimate need to know, if they are bound to confidentiality obligations no less protective than the confidentiality obligations imposed under this clause 6, and the Recipient remains liable for compliance by its Representatives of the confidentiality obligations in this clause. The Recipient must ensure that any third party to whom it has disclosed Confidential Information pursuant to this subclause 6.2(a) complies with the terms of this clause as if it were named as the party; and

(b) if required by law, court order or the rules of any stock exchange (but only to the minimum extent required to comply and subject to provision of advance notice to the other party if practicable).

6.3 If either party becomes aware of, or suspects, any breach of confidence it shall promptly notify the other party and give the other party all reasonable assistance to prevent any further breach, including assistance in connection with any proceedings which the aggrieved party may institute against any such persons.

6.4 The Recipient shall protect the confidentiality of the Disclosing Party’s Confidential Information in the same manner that it protects the confidentiality of its own Confidential Information but using not less than a reasonable degree of care.

6.5 Each party acknowledges and agrees that its disclosure of the other party's Confidential Information would cause substantial harm for which damages alone would not be an adequate remedy, and that upon any such disclosure the disclosing party will be entitled to injunctive relief in addition to what other remedies it might have at law. This clause survives the expiry or termination of any Contract or this MSA.

7. Intellectual property

7.1 Ownership of intellectual property

(a) All Existing IP vests and remains vested in the owner of those Intellectual Property Rights. Subject to clause 7.1(b), all right, title, and interest in any adaptation, translation, modification, or derivative, of a party's Existing IP, by the other party, is assigned to the party that owns the underlying Existing IP.

(b) Any Developed IP is assigned to and vests in iVvy or the third-party nominated by iVvy.

7.2 Intellectual property licenses

(a) To the extent that any Existing IP or Developed IP constitutes a Deliverable under a Contract, iVvy grants the Customer a limited, royalty-free, non-exclusive, license to use and deal with its Existing IP to exercise its rights under and as set out in the relevant Contract and the Modules referred to therein.

(b) To the extent that the Customer provides any of its Existing IP to iVvy in the course of a Contract, the Customer grants a non-exclusive, royalty free, irrevocable, worldwide, perpetual license (with a right to sub-license) to use, commercialise, reproduce, modify, adapt, publish, communicate and broadcast the Intellectual Property Rights in the Existing IP solely to the extent that iVvy is required to use such rights in order to perform (or support the performance of) its obligations in respect of the Contract.

7.3 Use of intellectual property

(a) The Customer agrees that it will not:

(i) infringe iVvy’s Intellectual Property Rights and that it will use its best endeavours to ensure that its employees, contractors, officers and agents do not infringe iVvy's Intellectual Property Rights;

(ii) reverse engineer iVvy's Existing IP or any of the Developed IP or solicit, facilitate, or enable (including by omission) a third party to do so; and

(iii) use any of iVvy's trademarks, or describe any of iVvy's products or services, whether in printed or digital material or on the internet, without iVvy's prior written consent.

(b) The Customer agrees to sign all documents and do all other things reasonably required by iVvy to perfect, confirm or register the assignments of the Developed IP referred to in clause 7.1(b). If requested by iVvy, the Customer will promptly deliver to iVvy, in the form reasonably required by iVvy:

(i) consents to the infringement of any Moral Rights of any individuals who have authored any Developed IP; and

(ii) deeds of assignment of any Intellectual Property Rights referred to in clause 7.1(b) that were created by any of the Customer's employees or contractors.

(c) The Customer must immediately notify iVvy of and provide any assistance requested by iVvy with respect to, any:

(i) infringement or potential infringement of our Intellectual Property Rights of which the Customer becomes aware; and

(ii) third party claim that use of the Software, or any other Deliverable, infringes any third party's Intellectual Property Rights.

8. Customer obligations

8.1 During the Term of this MSA and any Contract, the Customer must:

(a) provide reasonable assistance as iVvy may require to perform the Services; and

(b) take all necessary steps to assure itself that the scope of any Contract is adequate to address the Customer’s needs.

8.2 Without limiting the foregoing, iVvy’s performance under this MSA or any Contract may be contingent upon the performance of obligations by Customer, and to the extent that iVvy is delayed or unable to perform its obligations under this MSA or any Contract as a result of the Customer’s failure to perform in a timely manner, such delay or failure to perform by iVvy will not be deemed a breach by iVvy.

8.3 The Customer agrees that it will not integrate, or allow any third party to integrate, third-party software, with any iVvy product unless the Customer has first received iVvy's written approval. Where approval is granted by iVvy to integrate third party software, the Customer and third-party software provider will execute an Application Programming Interface (API) Agreement.

8.4 Where the Customer processes, stores, or transmits credit card data, the Customer agrees that it will comply with its obligations under the Payment Card Industry Data Security Standard Version 4.0 (PCI-DSS v4.0) and the iVvy PCI-DSS v4 Responsibility Matrix.

9. Insurance

9.1 The Customer shall maintain during the term of this MSA (and if any policy is on a claims-made and reported form, for three years thereafter) with a reputable insurer, comprehensive public liability insurance with minimum limits of liability of $10,000,000.

9.2 iVvy shall be given at least 30 days’ notice of cancellation or expiration of such insurance.

10. Customers’ agreements

10.1 iVvy acknowledges that, from time to time, the Customer may enter into agreements with its own customers or members ("Clients") which may result in the upload of those Client's Data to the Software. The Customer agrees to embed a link to iVvy’s Privacy Policy (https://www.ivvy.com/privacy/) within the Client agreements, or to implement within those agreements, terms that expressly:

(a) obtain permission for iVvy to extract and use the Client's Data in the ordinary course of iVvy's business;

(b) state that such Client(s):

(i) agree that iVvy shall not be liable (including, but not limited to, for any direct, indirect, special, punitive, incidental or consequential damages or losses) to such Client(s) for any reason with respect to the use of Client's Data;

(ii) acknowledge that iVvy expressly disclaims any warranties to such Client(s) with respect to the Client's Data; and

(iii) shall not make any claims against iVvy.

(c) state that such Client(s) acknowledge and agree that the limitations, disclaimers, exclusions and agreements in favor of iVvy set forth in this clause 10 will be held in trust by Customer for, and enure to the benefit of, iVvy and will be binding on such Client(s).

11. Work product

With respect to any deliverables (‘Work Product’) created by iVvy, subject to full payment by Customer, iVvy grants Client a nonexclusive, paid-up and royalty-free right (but without the right to sub-license), to use the Work Product for Client’s internal use and otherwise for any permitted use of the Services during the term of this Agreement.

12. Equitable relief

12.1 In addition to any other rights which iVvy may have under this MSA, at law or otherwise, iVvy may suspend (in whole or in part) access to and use of the Software by the Customer immediately on notice to Customer in the event of any breach or threatened breach of the provisions of this MSA, or if the Customer is the subject of an Insolvency Event.

12.2 The Customer acknowledges that any breach or threatened breach of the provisions of this MSA could result in serious and irreparable injury to iVvy for which iVvy cannot be adequately compensated by money damages alone. The Customer agrees that in the event of such a breach or threatened breach by it, in addition to any other remedy iVvy may have, iVvy is entitled to specific performance of such provisions and to seek both temporary and permanent injunctive relief (to the extent permitted by law) without having to prove actual damages.

13. Warranties

13.1 The Customer represents, warrants, and covenants that:

(a) it has all necessary rights, permissions and authority required to authorise iVvy and its Related Bodies Corporate to extract, access and use the Customer's Data and the Client's Data;

(b) it will not infringe iVvy's Intellectual Property Rights and nor will iVvy's use of the Customer Data or Client's Data infringe any third-party's Intellectual Property Rights or other rights; and

(c) any third party to whom it has disclosed iVvy's Confidential Information or Intellectual Property Rights complies with the terms of this MSA as if that third-party was a named party and the Customer will be responsible to iVvy for any act, omission or negligence by such third-party that would constitute a breach of this MSA.

13.2 iVvy represents, warrants and covenants to the Customer that the Services shall be performed in a workmanlike and professional manner consistent with prevailing industry standards.

13.3 Each Party represents, warrants and covenants to the other that:

(a) the terms of this MSA do not violate any existing agreements or other obligations to which it is bound;

(b) it has all requisite legal authority to enter into this MSA and any Contract; and

(c) that it shall comply with all laws applicable to its performance hereunder.

13.4 Except as set out in this clause 13, neither party makes any representations or warranties of any kind, whether express or implied, including any warranties of merchantability, fitness for a particular purpose or non-infringement.

14. Indemnification

14.1 The Customer agrees to release and indemnify, defend, hold harmless and keep iVvy and its Related Bodies Corporate, affiliates, directors, officers, employees, licensees, contractors and agents of iVvy, from and against any claim, notice, demand, action, proceeding, litigation, investigation, judgement, damage, loss, cost, charge, liability, or expense (including legal costs and expenses on an indemnity basis) however arising, whether present, unascertained, immediate, future or contingent, and whether based in contract, tort, statute, or otherwise, arising out of or in connection with:

(a) any breach by you of this MSA or any Contract arising out of this MSA;

(b) the Customer's use of the Software, Services or any other Deliverables the subject of a Contract;

(c) any Customer Data or Client's Data uploaded, posted, provided or made available by the Customer;

(d) any wilful or negligent act or omission by the Customer or any of its employees, contractors or agents;

(e) any claim that through the Customer's use of the Software, Services or other Deliverables, damage was caused to any third party;

(f) the Customer's infringement of the Intellectual Property Rights or other rights of a third party; or

(g) the Customer's breach or infringement of any law or regulation.

15. Limitation on liability

15.1 To the extent that any mandatory guarantee or warranty under the Australian Consumer Law or any other statute, or at common law or otherwise, is read into the terms of this MSA or any Contract, iVvy's liability for failure to comply with any such guarantee or warranty is limited, at iVvy's sole discretion, to one or more of:

(a) supplying any goods or services again; or

(b) paying the cost of having the goods or services supplied again.

15.2 The Customer acknowledges and agrees that:

(a) It will not hold iVvy or any of its Related Bodies Corporate responsible or liable for any loss or damage, whether in contract, tort (including negligence), statute, or otherwise in connection with the Software, Services, or any other Deliverable to the extent that the Customer or any other person contributed to the loss or damage;

(b) it must take reasonable steps to mitigate any actual or anticipated loss or damage; and

(c) it will not hold iVvy or any of its Related Bodies Corporate responsible or liable for any loss, damage or expenses to the extent that the Customer could have avoided or reduced the amount of the loss, damage or expense, by taking reasonable steps to mitigate its loss.

15.3 iVvy and its Related Bodies Corporate are not liable to the Customer for any loss of profit, loss of revenue, loss of contract value, loss of opportunity, loss of data, damage to reputation, loss of goodwill, service disruption or any indirect, special, exemplary or consequential loss, or any other loss not arising as a natural consequence of a breach or other event giving rise to liability of a party, suffered or incurred by the Customer whether in contract, tort (including negligence), statute, or otherwise, in connection with the Software, Services, or any other Deliverable, even if iVvy had been advised of the possibility of such loss.

15.4 To the extent permitted by law, iVvy and its Related Bodies Corporate's maximum aggregate liability to the Customer with respect to the Software, Services or any other Deliverable is capped at the value of the Fees which the Customer has paid to iVvy in the 12 months before the date on which the Customer's cause of action arose.

15.5 Nothing in this MSA excludes any of iVvy's liability under the Australian Consumer Law or any other applicable law that cannot legally be excluded. To the extent liability under the Australian Consumer Law or any other applicable law can be limited, iVvy's liability is so limited.

16. Notices

16.1 All notices, consents, approvals or any other communications given or made under this MSA shall be in writing and signed by the sender or its duly authorised representative, and shall be deemed effectively given upon:

(a) if personally delivered, on delivery;

(b) if sent by pre-paid mail, on the fifth clear Business Day after the date of posting (or the seventh Business Day after the date of posting if sent to or from an address outside Australia); and

(c) if sent by email, at the time of transmission by the sender, unless the sender receives an automated notice generated by the sender’s or the recipient’s email server that the email was not delivered.

except that, if the delivery, receipt or transmission is after 5.00pm in the place of receipt or on a day which is not a Business Day, it is taken to have been received at 9.00am on the next Business Day.

16.2 All communications shall be sent to the respective parties at the addresses set out below or any other such address as provided by the parties from time to time.

Contact Details iVvy Customer Attention Chief Operating Officer As per Contract Address PO Box 594, Mudgeeraba, QLD 4213

Email support@ivvy.com As per Contract

17. Dispute resolution

17.1 Negotiation

(a) If a party to this MSA believes that there is a dispute in connection with this MSA or a Contract, the disputing party must provide the other party with notice of the dispute; and

(b) within 7 days of a party receiving notice of a dispute, the responsible officers of each party must meet and use all reasonable endeavors, acting in good faith, to attempt to resolve the dispute.

17.2 Mediation

(a) If the dispute is not resolved within 7 days of the meeting referred to in clause 17.1(b), then the parties must first refer the dispute to a mediator agreed to by the parties, or if no

mediator is agreed, a mediator nominated by the President of the Queensland Law Society or the President's nominee.

(b) Unless otherwise agreed between the parties:

(i) mediation will take place in Brisbane, Australia, or, if it is impracticable for either party to travel to Brisbane, by video conference or such other means as directed by the mediator; and

(ii) the parties will be entitled to legal representation.

(c) Each party will use all reasonable endeavours to resolve the dispute through mediation as soon as practical including, but not limited to, providing the mediator with all information relevant to the dispute.

(d) Each party must bear its own costs of complying with this clause 17 and bear equally the mediator's costs.

(e) If the dispute remains unresolved thirty (30) days after the appointment of the mediator, a party that has complied with this clause 17 may terminate the dispute resolution process by giving notice to the other party in writing.

(f) If a party breaches this clause 17 the other party need not comply with this clause.

18. Force majeure

18.1 Neither party will incur any liability to the other party on account of any loss or damage resulting from any delay or failure to perform all or any part of this MSA or a Contract if such delay or failure is caused, in whole or in part, by Force Majeure Event and the party affected has complied with this clause 18.

18.2 The Affected Party’s obligations under this agreement are suspended while the Force Majeure Event continues and to the extent that it is prevented, hindered or delayed and the Affected Party will not be liable for a delay in delivery or performance resulting directly or indirectly from the Force Majeure Event.

18.3 As soon as reasonably practicable after the start of the Force Majeure Event the Affected Party must notify the other Party in writing of the Force Majeure Event, the date on which the Force Majeure Event started and the effects of the Force Majeure Event on its ability to perform its obligations under this agreement.

18.4 The Affected Party must make all reasonable efforts to mitigate the effects of the Force Majeure Event on the performance of its obligations under this agreement, provided that this clause does not require the Affected Party to settle any industrial dispute in a manner that it does not wish to.

18.5 As soon as possible after the end of the Force Majeure Event the Affected Party must notify the other party in writing that the Force Majeure Event has ended and resume the performance of its obligations under this agreement.

19. Miscellaneous

19.1 This Agreement shall be governed by and construed in accordance with the laws of:

(a) for APAC customers, the laws of the State of Queensland, Australia. The parties submit to the exclusive jurisdiction of the courts of Queensland, Australia and any courts entitled to hear appeals from those courts.

(b) for EMEA customers, the laws of the country of England and Wales, United Kingdom and any courts entitled to hear appeals from those courts.

(c) for the Americas customers, the laws in the State of California, United States and you agree to unconditionally submit to the non-exclusive jurisdiction of courts in the State of California, United States.

19.2 The Customer may not assign, novate, transfer, sub-contract or delegate any of its rights or obligations under this MSA or a Contract without our prior written consent from iVvy.

19.3 The Customer acknowledges that iVvy may provide similar services to third parties as those being provided to Customer and nothing in this MSA creates an exclusive relationship between iVvy and the Customer.

19.4 The relationship of the parties is that of an independent contractor, and nothing in this Agreement is intended to, or shall be construed to, create a partnership, agency, joint venture, employment or similar relationship. Neither Party will be entitled to any of the benefits that the other Party may make available to its employees, including but not limited to, group health or life insurance, workers compensation, payroll tax deductions, profit-sharing or retirement benefits, or any other benefit.

19.5 The failure of either party to insist upon strict performance by the other party of any provision of this MSA, or to exercise any right or remedy consequent upon a breach thereof, shall not constitute a waiver of such breach or of such provision or any other provision of this MSA. The failure of either party to exercise its rights to enforce any provision of this MSA shall not prevent such party from fully exercising its rights or enforcing any provision at another time. If any law, rule, or regulation is enacted or modified or there is any substantial change in the judicial, administrative, or regulatory agency interpretation of an existing law, rule, or regulation, in a manner that materially and adversely affects a Party’s ability to perform under this Agreement, or to realise the intended benefits of this Agreement, or if any governmental entity determines that this Agreement is illegal or in violation of any law, rule, or regulation, then either Party may terminate this Agreement immediately by written notice to the other Party.

19.6 This MSA may be executed in any number of counterparts, each of which shall be deemed original and all of which shall constitute a single instrument. Signatures submitted via electronic signature shall have the same force and effect as originals.

19.7 Each provision, paragraph and subparagraph of this MSA constitutes a distinct and separate covenant, and if any provision, paragraph, or subparagraph is adjudged by any court of law or

arbitrator to be void or unenforceable in whole or part, such adjudication shall not be deemed to affect the validity of the remainder of this MSA, or of any other provision, paragraph, or subparagraph of this MSA.

19.8 The following clauses survive the termination of this MSA: 2, 3.5, 4, 5, 6, 7, 12, 13, 14, 15, 16 and 17.

19.9 This MSA and any Contract constitute the whole of the agreement between the parties relating to the subject matter therein, and replaces all earlier representations, statements, agreements and understandings except as stated otherwise in this MSA or a Contract. The Customer acknowledges and agrees that it has not relied on any statement, representation, assurance or warranty made by any person (including a third party) in accepting the terms of this MSA or any Contract.

19.10 Nothing in this MSA shall be construed or considered to grant to either party any rights under any patents, trademarks or other intellectual property of the other party except as specifically delineated herein. License rights stated herein are contingent. Removal of contingencies can be done only by writings signed by both parties. Notwithstanding this section, iVvy is hereby expressly allowed to use the Customer’s name on its website and in other marketing materials as a demonstration of having provided services for Customer.

19.11 No modification of, amendment or addition to, this MSA is valid or binding unless set forth in writing and executed by authorised representatives of iVvy and Customer.

19.12 Except to the extent provided for in any Contract, iVvy objects to and rejects any additional or different terms proposed by the Customer, including those contained in any Customer purchase order, acceptance, vendor portal or website. Neither iVvy’s acceptance of the Customer's purchase order nor its failure to object elsewhere to any provisions of any subsequent document, website, communication, or act of the Customer shall be deemed acceptance thereof or a waiver of any of the terms hereof.

19.13 In the event the General Data Protection Regulation (“GDPR”) or any other data privacy law applies to Customer Data, Appendix 1 shall apply. Appendix 1 to this Agreement sets out certain information regarding data processing addendum as required by article 28(3) of the GDPR and equivalent requirements of other data protection laws. The parties acknowledge and agree regarding the Processing of Customer Data, and as more fully described in Appendix 1 to this MSA. The Customer acts as a data controller, iVvy and/or the Customer act as a data processor.

19.14 Where iVvy processes, stores or transmits Cardholder Data via its own Gateway, iVvy will at all times comply with the Payment Card Industry Data Security Standard (“PCI DSS") requirements for Cardholder Data that are prescribed in the PCI DSS security audit procedures or are otherwise issued by the Payment Card Industry Security Standards Council, as they may be amended from time to time, including without limitation the encryption of such Cardholder Data.

19.15 The United Nations Convention on Contracts for the International Sale of Goods will not apply in any way to this MSA or any Contract.

Attachments

Schedule 1: Template - Contract

Schedule 2: Template - Data Processing Addendum (for use if required)

Schedule 3: Service Levels, which sets out iVvy’s response and resolution targets for High, Medium and Low Priority Faults.

Schedule 1

Template – contract

Contract Customer - Solution

Customer Name Reference: YYYYMMDD-XXXXXX Customer Address City, Country Postcode Created: DD Month YYYY Expiry: DD Month YYYY Customer First-name Surname First-name.surname@customer.com

Billing email First-name.surname@customer.com

Customer Phone Number: +xx xxxx xxxx

Created by iVvy Sales First-Name Surname

Comments Thank you for your continued support of iVvy. Please find below an agreement for xxxx

Products & Services Product Quantity Unit Price Total

Product X 1 $0.00 / year $0.00 / year Product description for x years

Product X

Product Description

Annual subtotal $0.00

Total $0.00 Contract Terms

Declaration By signing, you confirm your request for iVvy Group (iVvy Inc, iVvy Pty Ltd, iVvy UK Ltd & iVvy NZ Pty Ltd) to provide you with the product/s for the term of this agreement. You acknowledge that you read and understood the Terms & Conditions at https://www.ivvy.com/venues-terms. You acknowledge the terms governing the direct debit arrangement as set out in this agreement if agreed as a payment method. By signing, you confirm your request for iVvy to provide you with the product/s for the term of this agreement.

Termination Either party is entitled to terminate the Agreement for convenience at the end of the relevant term (be that the end of the fixed term, or the anniversary of the fixed term) on not less than 90 days' prior written notice.

Fee Increases The annual subscription fee may be subject to an increase, in accordance with the Terms & Conditions, and on each anniversary of the commencement date at the relevant Consumer Price Index (CPI).

Term At the end of any Fixed Term, the Term will automatically renew for successive one-year periods and will continue to do so until the Service is terminated in accordance with the Agreement.

Payment Methods Annual payments can be paid via invoice, Direct Debit, or Credit Card and if monthly payments are agreed they must be paid via Direct Debit or Credit Card (Credit Card transactions may incur standard processing surcharges).

Payment Fees are payable upon signing.

Licensing Start Date: DD Month YYYY

Signature Before you sign this contract, an email must be sent to you to verify your identity. Find your profile below to request a verification email.

Questions? Contact me First-name Surname Sales Representative Firstname.surname@ivvy.com

iVvy Global Headquarters: 54 Siganto Drive Helensvale, Queensland 4212 Australia

Schedule 2

Template – data processing addendum

This Data Processing Addendum (“DPA”) forms part of the terms of the Privacy Policy and Master Services Agreement made between “Customer”, and iVvy a private limited company, on behalf of itself and as agent for its affiliates (“iVvy”), collectively “the Parties”.

1. Introduction

Under a standard iVvy master services agreement (the “MSA”) iVvy has agreed to supply certain software and professional services to "Customer" with respect to its business. iVvy may outsource certain processing activities to the Customer under this agreement.

The parties would like to document their obligations considering the General Data Protection Regulation.

2. Definitions

All capitalized terms not defined in this DPA will have the same meaning set forth in any underlying master distribution Agreement between the Parties.

Data Protection Legislation means the UK Data Protection Legislation and (for so long as and to the extent that the law of the European Union has legal effect in the UK) the General Data Protection Regulation ((EU) 2016/679) and any other directly applicable European Union regulation relating to privacy.

Ivvy Data Privacy Policy means the policy at https://www.ivvy.com.au/privacy/. The Privacy Policy sets out the scope, nature and purpose of processing by iVvy, the duration of the processing and the types of personal data (as defined in the Data Protection Legislation, Personal Data) and categories of Data Subject

UK Data Protection Legislation means any data protection legislation from time to time in force in the UK including the Data Protection Act 1998 or 2018 or any successor legislation.

Affiliate means an entity that directly or indirectly controls, is controlled by or is under common control with an entity.

Agreement means any underlying master agreement between the Parties.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Customer means iVvy and / or Customer Customer(s) which owns the personal data for processing under this agreement and is known as the Data Controller.

Customer Account Data means personal data that relates to Customer’s relationship with iVvy and or Customer, including the names or contact information of individuals authorized by Customer to access Customer’s account, and billing information of individuals that Customer has associated with its account. Customer Account Data also includes any data iVvy may need to collect for the purpose of identity verification, or as part of its legal obligation to retain records.

Customer Content means;

(a) personal data exchanged because of using the Services including but not limited to, such as text message bodies, voice and video media, images, email bodies, email recipients, sound, and, where applicable, details Customer submits to the Services from its designated software applications and services and

(b) data stored on Customer’s behalf such as communication logs within the Services or marketing campaign data that Customer has uploaded to the Services

Customer Data has the meaning given in the Agreement. Customer Data includes Customer Account Data, Customer Usage Data, Customer Content, Personal Information and Sensitive Data, each as defined in this Addendum.

Customer Usage Data means data processed by iVvy for the purposes of transmitting or exchanging Customer Content by way of communication networks.

Customer Usage Data includes data used to identify the source and destination of a communication, such as

(a) individual data subjects’ telephone numbers, data generated in the context of providing the Services, and the date, time, duration and the type of communication

(b) activity logs used to identify the source of Service requests, optimize and maintain performance of the Services, and investigate and prevent system abuse.

Personal Information means any information that identifies, describes, is capable of being associated with, or could reasonably be linked directly or indirectly with a particular consumer, including any information considered as identifiable under any relevant applicable law.

Processor means the entity which processes personal data on behalf of the controller.

Processing (and process) means any operation or set of operations performed on personal data or on sets of personal data, whether by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Security Incident means any unauthorized breach of any security measure that leads to destruction, loss, alteration, disclosure, or access to any Customer Data without authorization.

Services means distribution services provided by the Customer to its Customers and / or iVvy pursuant to the Agreement.

Sub-processor means;

(a) iVvy, when iVvy is processing Customer Content and where Customer is a processor of such Customer Content or

(b) any third-party processor engaged by iVvy to process Customer Content to provide the Services to Customer.

Third Party Request means any request, correspondence, inquiry, or complaint from a data subject, regulatory authority, or third party.

3. Data protection

Both parties will comply with all applicable requirements of the Data Protection Legislation. This clause is in addition to, and does not relieve, remove or replace, a party's obligations under the Data Protection Legislation. In this clause, Applicable Laws means (for so long as and to the extent that they apply to Customer, iVvy and Customer the law of the European Union, the law of any member state of the European Union and/or the UK Data Protection Legislation and any other law that applies in the UK.

The parties acknowledge that for the purposes of the Data Protection Legislation,” Customer” is the data controller, iVvy and Customer can be both the data processor and/or Customer is the sub-processor (where Data Controller and Data Processor have the meanings as defined in the Data Protection Legislation and Sub-processor is another Data Processor).

Without prejudice, iVvy will procure reassurances from Customer that it has all necessary appropriate consents and notices in place to enable lawful transfer of the Personal Data to iVvy and for iVvy to transfer it to Customer and/or Customer for the duration and purposes of this agreement.

Without prejudice Customer shall, in relation to any Personal Data processed in connection with the performance by Customer of its obligations under this agreement:

• Process that Personal Data only in accordance with the Privacy Policy or otherwise on the written instructions of Customer or iVvy unless Customer is required by Applicable Laws to otherwise process that Personal Data. Where Customer is relying on laws of a member of the European Union or European Union law as the basis for processing Personal Data, Customer shall promptly notify iVvy of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit Customer from notifying iVvy;

• Ensure that it has in place appropriate technical and organisational measures, reviewed and approved by Customer or iVvy, to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures are set out in the Privacy Policy);

• ensure that all personnel who have access to and/or process Personal Data are obliged to keep the Personal Data confidential; and

• transfer any Personal Data outside of the European Economic Area only in accordance with the Privacy Policy;

• assist Customer and iVvy in responding to any request from a Data Subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

• notify iVvy without undue delay on becoming aware of a Personal Data breach;

• at the written direction of Customer and/or iVvy delete or return Personal Data and copies thereof to Customer and/or iVvy on termination of the agreement unless required by Applicable Law to store the Personal Data; and

• maintain complete and accurate records and information to demonstrate its compliance with this agreement and allow for audits by Customer, iVvy, or Customer’s or iVvy’s designated auditor.

• The customer shall not appoint further third parties to process Personal Data under this agreement unless it obtains the prior written consent of iVvy.

• Customer shall be fully liable for all its actions or omissions in relation to compliance with this agreement.

• iVvy may, at any time on not less than 30 days’ notice, revise this agreement by replacing it with any applicable processor to sub-processor standard clauses or similar terms forming part of an applicable certification scheme (which shall apply when replaced by attachment to this agreement).

• Both parties acknowledge that all data controllers, data processors and sub- processors remain responsible for compliance, and will take responsibility for any breach that was their fault under this legislation.

4. Addendum to agreement

Replacement of Prior Agreement.

• The Parties agree that the DPA shall supersede and replace any existing data processing addendum between the Parties that the Parties may have previously entered into in connection with the services under the Agreement.

• Agreement in Full Force and Effect. Except for any changes made in this DPA, the Agreement remains in full force and effect.

5. Governing Law

This DPA shall be governed and construed in accordance with the governing law and jurisdiction set forth in the provisions of the Agreement, unless required otherwise by applicable law.

6. Relationship of the parties

As between the Parties, Processor shall process Customer data only as a service provider and Processor acting on behalf of iVvy and its Customers, pursuant to the scope of providing services under the Agreement.

(i) iVvy as a Processor The parties acknowledge and agree that regarding the processing of Customer Content, Customer may act either as a controller or processor and iVvy and Customer as a processor. iVvy and Customer will process Customer Content in accordance with Customer’s instructions, and the terms and conditions of those individual business contracts.

(ii) iVvy as a Controller of Customer Account Data The parties acknowledge that, regarding the processing of Customer Account Data, the Customer is a controller and iVvy is an independent controller, not a joint controller with the Customer. iVvy will process Customer Account Data as a controller to

(a) manage the relationship with Customer;

(b) carry out iVvy’s core business operations, such as accounting and filing taxes;

(c) detect, prevent, or investigate security incidents, fraud, and other abuse or misuse of the Services;

(d) perform identity verification;

(e) comply with iVvy’s legal or regulatory obligation to retain Subscriber Records; and

(f) as otherwise permitted under Applicable Data Protection Law and in accordance with this Addendum, the Agreement, and the iVvy Privacy Notice.

(iii) iVvy as a Controller of Customer Usage Data. The parties acknowledge that, regarding the processing of Customer Usage Data, Customer may act either as a controller or processor and iVvy is an independent controller, not a joint controller with Customer. iVvy will process Customer Usage Data as a controller to carry out the necessary functions as a communications service provider, such as:

(a) iVvy’s accounting, tax, billing, audit, and compliance purposes;

(b) to provide, optimize, and maintain the Services, platform and security;

(c) to investigate fraud, spam, wrongful or unlawful use of the Services;

(d) as required by applicable law or regulation; or

(e) as otherwise permitted under Applicable Data Protection Law and in accordance with this Addendum, the Agreement, and the iVvy Privacy Notice.

7. Duties of processor

Processor agrees that;

(i) it shall comply with its obligations as a Processor under applicable law in respect of its Processing of Personal Information and any Processing instructions;

(ii) It has provided notice and obtained (or shall obtain) all consents and rights necessary under applicable laws to Process Personal Information and provide services to Customer and iVvy pursuant to this DPA and the Agreement;

(iii) it shall only process data for the purposes described in this DPA

8. Processor is prohibited from;

(i) selling Customer and/or iVvy data;

(ii) retaining, using or disclosing Customer and / or iVvy data for any purpose other than for the specific purpose of performing the services specified in the Agreement, including retaining, using, or disclosing Customer and / or iVvy data for a commercial purpose other than providing the services specified in the Agreement;

(iii) retaining, using or disclosing Customer and / or iVvy data outside of the direct business relationship between iVvy and Processor.

9. Sub-processors

A current list of iVvy’s sub-processors is available in the Sub-processors document.

iVvy agrees to impose contractual data protection obligations, including appropriate technical and organizational measures to protect personal data, on any sub-processor it appoints that require such sub-processor to protect Customer Content to the standard required by Applicable Data Protection Law, including the requirements set forth in this Addendum.

Processor may only engage Sub processors;

(i) after written notice to iVvy;

(ii) pursuant to a written agreement with Sub processor imposing data protection terms that require Sub processor to protect Customer and / or iVvy data to the standard required by applicable laws and

(iii) where Sub processor agrees to maintain appropriate technical safeguards to protect Customer and / or iVvy data from Security Incidents; and

(iv) Processor shall remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of Sub processor that would cause Processor to breach any of its obligations under this DPA.

10. Third party access

Processor will not permit any third party (other than Processor’s contracted third-party providers or Sub-processors subject to a contract and data protection addendum which matches the data protection requirements of this DPA) to access iVvy data or use iVvy data to modify or add to Personal Information it collected from a source that is not iVvy.

11. Notification requirement

Processor will promptly notify iVvy if following iVvy instructions would result in violation of any applicable law where Processor must disclose iVvy data in response to a legal proceeding or investigation by regulatory authorities.

12. Access and controls

Customers may request Processor to retrieve, correct, delete, or restrict access to their data, and Processor agrees to comply in connection with its obligations under applicable law, including its obligations relating to responding to requests from individuals or applicable data protection authorities. To the extent the Customer is unable to independently access the relevant data, Processor shall provide reasonable cooperation to assist Customer and / or iVvy to respond to any requests from individuals or applicable data protection authorities relating to the Processing of data under the Agreement. If Processor receives any requests from individuals to exercise their rights, Processor shall promptly notify iVvy.

13. Governmental authority requests

Where required in connection with requests from a government authority, each Party will immediately inform the other Party and Processor will reasonably cooperate to provide records related to its Processing activities in connection with the Agreement, including information on the categories of data Processed and the purposes of the Processing, the use of Sub processors with respect to such Processing, any data disclosures or transfers to third parties, and a general description of technical and organizational measures used to protect the security of such data. Processors provide reasonably requested information to enable iVvy to carry out data protection impact assessments or prior consultations with data protection authorities as required by law.

14. Data security

Processors shall implement and maintain appropriate technical and organizational security measures to protect Customer and / or iVvy data from security Incidents and to preserve the security and confidentiality of the Personal Information. Processor is responsible for its secure use of its systems, including securing its account authentication credentials, protecting the security of Customer and / or iVvy data when in transit to and taking any appropriate steps to securely encrypt or backup any data uploaded.

15. Data processing

Processor shall ensure that any person authorized to Process Customer and/or iVvy data (including Processor’s and any Sub processor’s staff, agents, and subcontractors) shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).

16. Security incident response

Upon becoming aware of a Security Incident, Processor shall notify iVvy without undue delay and provide timely information relating to the Security Incident as it becomes known, but in no event, less than forty-eight (48) hours from the time Processor became aware of the Security Incident.

17. Compliance

Processor will verify its compliance with this DPA, upon reasonable request by iVvy.

18. Location of processing

Processor will only Process Customer and/or iVvy data within the region such data originated. Processors shall provide an adequate level of protection for data collected, transferred, Processed, or retained in accordance with the requirements of applicable laws.

19. Deletion of data

Upon termination or expiration of the Agreement, Processor shall delete, after providing iVvy the ability to download all iVvy data (including copies) in its possession or control, save that this requirement shall not apply to the extent Processor is required by applicable law to retain some or all of the iVvy data (including copies) in its possession or control, save that this requirement shall not apply to the extent Processor is required by applicable law to retain some or all iVvy data, which Processor shall securely isolate and protect from any further Processing, except to the extent required by applicable law.

20. Change in applicable Law

The Parties agree and acknowledge that this DPA may be updated to comply with applicable law, and in such case the Parties agree to update this DPA.

By signing this DPA, both parties certify that it understands and will comply with the obligations set forth herein.

By signing this DPA, both parties certify that it understands and will comply with the obligations set forth herein.

Executed for and on behalf of;

iVvy	Company Name
Printed Name	Printed Name
Signature	Signature
Title	Title
Date	Date

Schedule 3

Service levels

Service Level targets are as per the following table (also available as a PDF: Schedule 3 – Service Levels):