End User License Agreement

Verimatrix App Shield

THE USE OF THE SERVICES IS SUBJECT TO THE TERMS AND CONDITIONS THAT FOLLOW. YOU SHOULD ACCESS AND USE THE SERVICES ONLY IF YOU ACCEPT AND AGREE TO ALL THE TERMS IN THIS EULA.

By accessing and using our Services, YOU agree to be bound by the terms of this EULA. This EULA represents the entire agreement between YOU and Verimatrix, concerning the use of our Services and supersedes any prior agreement, proposal, representation, or understanding between YOU and Verimatrix.

These terms of use are effective between YOU and Verimatrix and govern your use of Verimatrix's Services, as of the date you accept this EULA. By clicking on an acceptance button, indicating assent electronically, or otherwise using the Services, you agree to the terms and conditions of this EULA. If YOU do not agree to the terms of this EULA, YOU may not access or use the Services. If YOU have accepted multiple versions of the EULA, the most current version that YOU have accepted is the applicable agreement between YOU and Verimatrix and supersedes and replaces all prior versions.

2. OWNERSHIP

The Services are protected by copyright laws and international copyright treaties, as well as other intellectual property laws and treaties. Unless expressly provided otherwise in this EULA, Verimatrix retains all right, title and interest, including any copyright, patent rights, design rights, or other intellectual property rights in and to the Services as well as any improvements or modifications thereto made for YOU, including any improvements or modifications based on, implementing, or otherwise using any feedback YOU or YOUR application has provided to us.

Verimatrix's logo and combinations and Verimatrix App Shield are registered trademarks or trade names of Verimatrix or its subsidiaries. Except as set forth herein, reproduction in whole or in part is prohibited without the prior written consent of Verimatrix.

3. GRANT OF LICENSE

Subject to the terms and conditions of this Agreement, Verimatrix hereby grants to YOU the limited, non-exclusive, non-transferable, non-assignable, non-sublicensable, freely revocable, right and license to use the Services only for the purposes of software protection, security analytics and remote control of YOUR application, in compliance with the terms of this EULA.

The only rights we grant YOU are those rights expressly stated in this Agreement. All rights not expressly granted to YOU under this EULA are reserved by Verimatrix. No license, right, title or interest in any trademark, trade name or service mark of Verimatrix is granted to YOU.

Your use of the Services is limited to devices and operating systems Verimatrix supports and may be affected by the performance and compatibility of your hardware, software and Internet access. Meeting system requirements is your responsibility and YOU are responsible for the cost of your equipment, which may include obtaining updates or upgrades from time to time in order to continue using the Services. System requirements are set forth on the product description page (available at: https://appshield.verimatrixcloud.net/).

Also, if YOU provide any comments to Verimatrix, information, opinions, or suggestions on the Services, YOU acknowledge and agree that Verimatrix may use them without restriction, for any purpose and without compensation to YOU.

4. LIMITATIONS OF LICENSE

1. Limitation of Use: YOU are the only person/entity allowed to use the services under this EULA.
2. Technical protection measures: YOU may not attempt to circumvent technical protection measures incorporated in or designed to protect the Services.
3. Prohibition on Reverse Engineering, Decompilation, and Disassembly: YOU are prohibited from, without limitation, reverse engineering, decompiling, reverse compiling, adapting, or disassembling, or in any way attempting to reconstruct or discover any algorithms of the Services, whether from the Services' output or otherwise.
4. Vulnerability Rewards Programs ("VRP"): In order to launch or participate in any initiative that offers rewards for discovering and/or reporting security threats, deficiencies or bugs in YOUR VRP, prior written approval from Verimatrix is necessary. If such approval is granted the results must be shared with Verimatrix and can be made public only with the prior written permission from Verimatrix.
5. Security: YOU shall ensure no viruses or malicious code like malware, spyware, key logger, bots (as the expressions are generally understood in the computing industry) interfere with, compromise or adversely affect the provision of the Services. This includes, without limitation, denial of Service, interruption of Service, reduction or compromise in quality and efficiency of Service, or any other aspect that compromises the security or continuity of the Service.
6. Support Services: Verimatrix may elect to provide YOU with support services related to the Services ("Support Services") on a discretionary basis. If Verimatrix elects to provide the same, Support Services shall be considered part of the Services and subject to the terms and conditions of this EULA.
7. Compliance with Applicable Laws: YOU may not use the Service for illegal activities, or as means to violate the law. YOU may not upload content to the Services which YOU do not own or is illegal. YOU must comply with all applicable laws regarding the installation and use of the Services, including, but not limited to, protection of personal data, consumer laws and e-commerce regulations, where applicable. YOU may not engage in any activity that interferes with anyone else's use of the Services.

In case of violation of the above restrictions, Verimatrix retains the right to immediately terminate this EULA pursuant to Section 7 and to obtain full compensation for any damage, costs and expenses it may incur. In addition, YOU will be solely responsible for any fines or other penalties imposed pursuant to applicable laws.

5. NO WARRANTY

THE SERVICES ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. TO THE FULLEST EXTENT PERMITTED BY LAW, VERIMATRIX EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES, WHETHER EXPRESS, STATUTORY OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, QUALITY, FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OR REPRESENTATION THAT THE SERVICE IS ERROR-FREE. VERIMATRIX DOES NOT WARRANT OR ASSUME RESPONSIBILITY FOR THE ACCURACY, TIMELINESS, COMPLETENESS, CURRENTNESS OF ANY INFORMATION, RESULTS, INDICATIONS, ADVICE, PROPOSED ACTIONS, TEXT, GRAPHICS, LINKS OR OTHER ITEMS CONTAINED WITHIN, RELATED TO, OR PROVIDED THROUGH THE SERVICES, INCLUDING THE SERVICES' OUTPUT. VERIMATRIX MAKES NO WARRANTIES IN RELATION TO THE SECURITY OR STABILITY OF THE SERVICES OR THE PROTECTED APPLICATION AND EXPRESSLY DISCLAIMS ALL LIABILITY ARISING OUT OF OR CONNECTED TO THE TRANSMISSION OF A COMPUTER VIRUS, WORM, TIME BOMB, LOGIC BOMB, OR OTHER DESTRUCTIVE ELEMENT.

6. LIMITATION OF LIABILITY

TO THE GREATEST EXTENT PERMITTED BY APPLICABLE LAW, VERIMATRIX SHALL NOT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES OF ANY NATURE WHATSOEVER. FOR THE PURPOSES OF THIS AGREEMENT, LOST PROFITS, BUSINESS INTERRUPTION, DATA BREACH AND LOST INFORMATION ARE DEEMED AS INDIRECT OR CONSEQUENTIAL DAMAGES AND ARE NOT RECOVERABLE HEREUNDER, NOTWITHSTANDING THE THEORY OF LIABILITY AND FORM OF ACTION UNDER WHICH SAID DAMAGES ARE SOUGHT, INCLUDING BUT NOT LIMITED TO CONTRACT, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY, STRICT LIABILITY, STATUTORY LIABILITY OR OTHERWISE, AND WHETHER OR NOT VERIMATRIX HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE ARISING OUT OF OR IN CONNECTION WITH THE USE OF OR INABILITY TO USE THE SERVICES.

IT IS FURTHER EXPRESSLY STATED AND CLARIFIED THAT THE SERVICES ARE NOT DESIGNED, MADE, OR INTENDED FOR USE IN ANY APPLICATION OR DEVICE WHERE FAILURE OR INACCURACY MIGHT CAUSE DEATH OR PERSONAL INJURY, INCLUDING MILITARY GRADE, MEDICAL GRADE OR SPACE GRADE DEVICES, APPLICATIONS AND USES. VERIMATRIX SHALL NOT BE LIABLE IN WHOLE OR IN PART, FOR ANY CLAIMS OR DAMAGES ARISING OUT OF OR IN CONNECTION WITH THE USE AND PERFORMANCE OF THE SERVICE IN SUCH APPLICATIONS.

IN ANY EVENT, VERIMATRIX'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS EULA (WHETHER IN AN ACTION IN CONTRACT, NEGLIGENCE, STRICT LIABILITY, TORT OR ANY OTHER GROUND) SHALL NOT EXCEED THE ANNUAL SUBSCRIPTION FEE PAID OR PAYABLE BY YOU TO VERIMATRIX PURSUANT TO THIS AGREEMENT.

FOR CLARITY, IN CASE VERIMATRIX PROVIDES THE SERVICES HEREUNDER WITHOUT CHARGE, VERIMATRIX HEREBY EXPRESSLY DISCLAIMS ANY AND ALL LIABILITY ARISING OUT OF, OR RELATED TO THIS EULA (WHETHER IN AN ACTION IN CONTRACT, NEGLIGENCE, STRICT LIABILITY, TORT OR ANY OTHER GROUND).

7. TERMINATION

1. We reserve the right to terminate this EULA and your access to the Services, in whole or in part, for any reason or no reason, without penalty or recourse: i) upon the completion of any paid subscription period; ii) at any time, without notice, if there is no paid subscription.
2. In any event, Verimatrix has the right to terminate or suspend this EULA, your account, and your access to the Services if we determine that you have violated this EULA. The Services may contain enforcement technology that allows Verimatrix to suspend your access to the Services if YOU have violated this EULA or if your License has expired or been terminated.
3. Without prejudice to any other rights available under law and/or the present terms of use, in case YOU fail to comply with the terms and conditions of this EULA, Verimatrix reserves the right to terminate at will your use and access to the Services, at any time, without notice or reason.
4. If the EULA is terminated for any reason or expires, YOU are prohibited from making any further use of the Services, and neither YOU nor any personnel employed by YOU will be authorized to use or access the Services, including any online storage or backup services. In such case we may cancel and/or close your account at our sole discretion.
5. After the termination or expiration date, Verimatrix does not have the obligation, but retain the right, to delete, at our sole discretion, any of your online stored or backed-up information, text, files, applications, links, or other materials provided to Verimatrix ("Content"). It is your responsibility to store or backup your Content elsewhere before this EULA expires or is terminated.

8. YOUR CONTENT

The Service allows YOU to upload content (including Software Applications). YOU hereby give Verimatrix the irrevocable right to store, process and modify your content for the purposes of providing and improving the Services. Without prejudice to the above and to Section 7(d), YOU retain ownership of any intellectual property rights that YOU hold in your content.

9. PRIVACY AND DATA PROTECTION

YOU shall only use the Services in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and any other applicable privacy or data protection legislation or regulations, ordinance, decree, or other legal instrument relating to the protection of personal data, as may be enacted during the life of the EULA ("Data Protection Laws").

Verimatrix's Privacy Notice (available at: https://www.verimatrix.com/privacy/) explains how Verimatrix uses personal data when YOU visit its website, including when YOU create an account or submit an application to be protected through our Services. Appendix A to this EULA, which constitutes an integral part hereof, sets out the terms under which we process Your Personal Data in providing the Services. Your Personal Data means any personal data YOU supply or otherwise make available to Verimatrix in connection with the Services, including but not limited to the personal data of YOUR users, employees and contractors ("Your Personal Data").

By using the Services, YOU agree and confirm that:

• YOU will at all times while using the Services comply with all applicable Data Protection Laws;
• Verimatrix may process and use Your Personal Data in accordance with this EULA and Verimatrix's Privacy Notice;
• YOU have provided all necessary information to YOUR users, employees and contractors under GDPR and any other applicable data protection legislation and have adequate legal basis for processing of such personal data;
• YOU have the right to allow processing of the personal data of your users, employees or contractors by Verimatrix under applicable Data Protection Laws;
• When using the Services, YOU are the Data Controller and Verimatrix is the Data Processor, acting on your behalf, in accordance with Art. 28 of GDPR and Appendix A to this EULA;
• YOU comply with the privacy and data protection rules of any relevant distribution services (e.g. Apple's App Store or Google Play);
• YOU have implemented appropriate security policies so that the personal data YOU access via the Services is only accessible to individuals and organisations that have a right to access and process the same.

10. PAYMENT (applicable if YOU upgrade to "Paid" Services).

a) PAYMENT AUTHORIZATION.

YOU AGREE THAT VERIMATRIX OR OUR AUTHORIZED PARTNER MAY CHARGE THE CREDIT OR DEBIT CARD ACCOUNT OR OTHER PAYMENT DEVICE YOU PROVIDED FOR ALL AMOUNTS YOU OWE RELATED TO YOUR PURCHASE, INCLUDING ANY SUBSCRIPTION RENEWALS. YOU AGREE TO NOTIFY US PROMPTLY OF ANY CHANGE IN YOUR CARD ACCOUNT NUMBER OR EXPIRATION DATE OR OTHER PAYMENT INFORMATION. FOR CREDIT AND DEBIT CARDS, YOU AGREE THAT WE MAY UPDATE SUCH INFORMATION WITH UPDATES RECEIVED DIRECTLY OR INDIRECTLY FROM YOUR CARD ISSUER AND THE RELEVANT CARD NETWORK AND WE MAY USE THE UPDATED CARD INFORMATION TO CHARGE AMOUNTS YOU OWE US. THIS WILL SERVE AS YOUR CONSENT FOR YOUR CARD OR PAYMENT DEVICE TO BE CHARGED OR DEBITED. UPON YOUR REQUEST VERIMATRIX MAY ACCEPT AN ALTERNATIVE PAYMENT METHOD. IN SUCH CASE YOU WILL BE CHARGED ALL TRANSACTION FEES RELATED TO PAYMENT. IF VERIMATRIX CANNOT CHARGE YOUR SELECTED PAYMENT METHOD FOR ANY REASON (SUCH AS EXPIRATION OR INSUFFICIENT FUNDS), YOU REMAIN RESPONSIBLE FOR ANY UNCOLLECTED AMOUNTS, AND VERIMATRIX WILL ATTEMPT TO CHARGE THE PAYMENT METHOD AGAIN AS YOU MAY UPDATE YOUR PAYMENT METHOD INFORMATION.

b) AUTOMATIC RENEWAL.

YOU agree that your paid subscription will be automatically renewed. YOU authorize Verimatrix or Verimatrix's authorized partners to charge your card or payment device on file within 30-days of your subscription expiration date, at the renewal term subscription price in effect at the time the renewal. The subscription price for your auto-renewal is subject to change. Your subscription renewal is ongoing and will continue until YOU cancel. If YOU would like additional information or to cancel your subscription or modify your auto-renewal settings, please contact Customer Service at: appshield@verimatrix.com.

AFTER PURCHASING A SUBSCRIPTION, YOU MAY CHOOSE TO CANCEL AUTOMATIC RENEWAL BY CONTACTING CUSTOMER SERVICE. IF YOU DO NOT WISH TO BE AUTOMATICALLY RENEWED, YOU MUST CANCEL AUTOMATIC RENEWAL MORE THAN 30 DAYS BEFORE YOUR SUBSCRIPTION TERM EXPIRES. IF YOU DO NOT CANCEL AUTOMATIC RENEWAL, YOUR SUBSCRIPTION WILL CONTINUE FOR THE RENEWAL TERM UNDER THE AGREEMENT IN EFFECT AT THE TIME OF EACH RENEWAL UNLESS IT IS TERMINATED BY VERIMATRIX PURSUANT TO THIS AGREEMENT.

Cancelling your subscription or terminating this EULA will not result in a retroactive refund or pro-ration of fees paid based on cancellation date. Cancelling your subscription or terminating this EULA will stop future recurring fees, and YOU will have access to the subscribed Services until the end of the then-current Subscription Term.

YOU are responsible for any charges incurred with your data- or mobile-service provider in connection with your use of the Services, including any overage and penalties assessed for exceeding your data or minute allowance, or use of domestic or international short message service.

11. CHANGES TO THIS EULA

Verimatrix may need to update or change the terms and conditions of this EULA over time. If YOU have a paid subscription, any new terms and conditions will apply when your subscription renews. If YOU do not agree to the new terms and conditions, then YOU must reject the changes by duly notifying Verimatrix, ceasing all use of Services at the end of the then current subscription term. By continuing to use the Services, YOU accept change(s) to this EULA.

12. GOVERNING LAW

THESE TERMS OF USE SHALL BE GOVERNED BY THE LAWS OF FRANCE EXCLUDING ANY CONFLICTS OF LAWS RULES. ANY DISPUTE THAT MAY ARISE OUT OF OR IN CONNECTION WITH THE PRESENT TERMS OF USE, INCLUDING WITHOUT LIMITATION, THEIR VALIDITY, FORMATION, INTERPRETATION, PERFORMANCE, CONSTRUCTION, TERMINATION OR EXPIRATION OF THESE TERMS THAT CANNOT BE SETTLED AMICABLY SHALL BE REFERRED TO THE EXCLUSIVE JURISDICTION OF THE COMPETENT COURTS OF PARIS, FRANCE, INCLUDING IN CASE OF PLURALITY OF DEFENDANTS, CONTRIBUTION OR GUARANTEE CLAIMS OR ANY THIRD PARTY PROCEEDINGS AND/OR SUMMARY PROCEEDINGS. THE PARTIES AGREE THAT THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS IS SPECIFICALLY EXCLUDED FROM APPLICATION TO THIS EULA.

13. NO ASSIGNMENT

YOU shall not assign this EULA to any person or entity.

14. NO WAIVER.

Verimatrix does not waive any provision of this Agreement unless it is expressly waived in a written agreement signed by an authorized officer of Verimatrix.

15. SEVERABILITY

If any provision of this EULA is or becomes, at any time or for any reason, unenforceable or invalid, no other provision of this EULA shall be affected thereby, and the remaining provisions of this EULA shall continue with the same force and effect as if such unenforceable or invalid provisions had not been inserted in this EULA.

16. ENTIRE AGREEMENT

This EULA constitutes the entire agreement between YOU and Verimatrix and supersedes all prior agreements, proposal(s) and discussions. No explanation or information (whether written or oral) given to YOU by Verimatrix shall alter the meaning or interpretation of this EULA.

Appendix A: DATA PROCESSING ADDENDUM

1. Effect.

This Data Processing Addendum ("Addendum") is supplemental to the End User License Agreement between YOU and Verimatrix and applies to our processing of Your Personal Data (as defined above). If there is a conflict or inconsistency between the terms of this Addendum and the provisions of the EULA, the former will prevail.

2. Definitions.

Any capitalized terms used in this Addendum which are not otherwise defined herein are as defined in the EULA, and any capitalized terms that are not otherwise defined in the EULA shall have the meaning ascribed to them in the GDPR.

3. Your Obligations.

YOU retain control over the data which is processed in relation to the Services. YOU undertake not to provide to Verimatrix any Special Categories of personal data (as defined in Art. 9 of the GDPR) and/or Personal Data allowing the direct identification of the data subject (including, without limitation, any of the following: first name, last name, identification number, credit card number, social security number, personal financial information) unless otherwise agreed in writing between the parties. In compliance with the GDPR, YOU shall, under your sole responsibility: a) provide data subjects with all required information with respect to the data processing, and in particular, inform the data subjects about: (i) the existence of their rights of access, rights to rectification and erasure, right to restriction of processing, right to data portability and right to object; (ii) the nature, the legal basis, and purpose of processing; b) where processing is based on the data subjects' consent, obtain such data subjects' consent for the processing, as described in the EULA and this Addendum; c) where applicable, obtain their consent for the use of cookies. d) maintain a record of processing activities; e) taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk and be able to demonstrate compliance with the GDPR.

YOU warrant that YOU have all the rights and authorizations necessary for Verimatrix to perform the Services.

4. Verimatrix's Obligations

Verimatrix will only collect data that is available to it under Your application's permissions, giving YOU full control of what data is collected by Verimatrix. Verimatrix will not disclose, sell, trade, or rent Your Personal Data without your prior consent. In order to fulfill the aforementioned purposes, subject to applicable law, Verimatrix may only disclose your Users' personal data to subsidiaries and/or affiliate companies, within the Verimatrix group.

As Data Processor, Verimatrix further commits to:

1. process Your Personal Data exclusively on your behalf and only on documented instructions from YOU, as set forth in this EULA and this Addendum, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by the Data Protection Laws to which we are subject; in such a case, we shall inform YOU of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
2. not process Your Personal Data or permit it to be processed or accessed, in whole or in part, outside the scope and purpose of our contractual agreement(s);
3. ensure the confidentiality of Your Personal Data which is processed under our contractual agreement(s);
4. ensure that persons authorised to process Your Personal Data under our contractual agreement(s) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
5. make reasonable efforts to process Your Personal Data within the European Economic Area ("EEA") but, notwithstanding the foregoing, should Verimatrix consider necessary to transfer Personal Data outside the EEA, it may do so provided the transfer is carried out in accordance with applicable Data Protection Law;
6. only engage a Sub-Processor with a written contract that imposes substantially similar data protection obligations on the Sub-Processor as those imposed on Verimatrix under this Addendum, provided that if the Sub-Processor fails to fulfill its data protection obligations, Verimatrix shall remain fully liable to YOU for the performance of such Sub-Processor's obligations;
7. assist YOU by appropriate technical and organisational measures, for the fulfilment of your obligations to respond to requests for exercising the data subject's rights, such as the right to access, rectify or erase their Personal Data, or the right to restrict, or object to, the processing of their Personal Data and the right to the portability of their Personal Data; however, given the nature and limited scope of Personal Data processed under the EULA and this DPA, which does not allow Verimatrix to directly identify data subjects from our records, any data subject's request will need to be facilitated by YOU, in order to be able to provide necessary assistance;
8. take any action required for the fulfilment of your obligations to respond to requests for exercising the data subject's rights without undue delay and in any event within ten (10) business days of receipt of the request from YOU;
9. without prejudice to Verimatrix's right to use fully anonymized data after the end of our contractual agreement(s), so that data subjects are no longer identifiable, delete or return all Your Personal Data to YOU after the end of the provision of services relating to processing, and delete existing copies unless applicable law requires storage of the personal data, in full or in part;
10. assist YOU, upon your request, in ensuring compliance with the obligations deriving from the carrying out of data protection impact assessments and from prior consultation of the supervisory authority, being understood that such services provided by Verimatrix may be subject to additional costs;
11. make available to YOU all information necessary to demonstrate compliance with this Addendum and allow for and contribute to audits, including inspections, conducted by YOU or another auditor mandated by Verimatrix at mutually agreeable times, being understood that such services provided by Verimatrix and audits may be subject to additional costs;
12. notify YOU upon receipt of any request from the competent data protection authority, or a court order, to disclose any of your Personal Data, and, to the extent practicable, will provide all necessary assistance in opposing such disclosure;
13. notify YOU in writing (including via e-mail), to the email address YOU have previously provided, as soon as reasonably practical after becoming aware, of of any actual or suspected accidental, unlawful or unauthorised access, alteration, loss and/or destruction of Your Personal Data, and in any event no more than 72 hours after discovering such Personal Data Breach, with such notice to include reasonable details of such Personal Data breach; and
14. immediately inform YOU if, in Verimatrix's opinion, an instruction infringes the Data Protection Laws.

5. Sub-Processors

YOU consent to Verimatrix engaging third-parties to process Your Personal Data on its behalf ("Sub-Processors"). Verimatrix will ensure that its Sub-Processors comply with all obligations of the Data Protection laws. Verimatrix will maintain an up-to-date list of its sub-processors on its website, and notify YOU of any change thereto with at least 10 days prior written notice (the "Sub-processor Notification Period"). A list of current Sub-Processors can be found at the following bracketed link (https://www.verimatrix.com/sub-processors). YOU may object to a subsequent appointment or replacement of a Sub-Processor within aforementioned Sub-processor Notification Period, provided such objection is based on reasonable grounds relating to data protection. In such event, Verimatrix will either not appoint or replace the Sub-Processor or, if Verimatrix does not consider this possible, YOU may, as Your sole remedy, suspend or terminate Your then current AppShield subscription and shall be refunded of any unused prepaid fees pro rata temporis.

6. Technical and organisational measures of protection.

Taking into account the cost of implementation, and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Verimatrix shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia: i. to ensure the integrity, availability, resilience, and confidentiality of processing systems and services; ii. to protect Your Personal Data against accidental or unlawful destruction, damage, or accidental loss, alteration, or unauthorised disclosure, access or process. In order to ensure such level of security, we shall implement the appropriate technical security and organisational measures, notably by taking into account, with respect to Verimatrix's tools, products, applications or services, the principles of data protection by design and data protection by default; iii. to maintain Certification to ISO/IEC 27001.

7. Data Protection Impact Assessment.

YOU represent and warrant to Verimatrix that (i) YOU have performed, prior to entering into this Addendum, any data protection impact assessment required by Data Protection Laws, completed appropriate due diligence on Verimatrix and, (ii) based on all information provided, there are no additional technical and organizational measures required in respect of the Services and the delivery thereof in relation to protection of Your Personal Data. Verimatrix shall cooperate with and provide reasonable assistance to YOU in performing any data protection assessment and due diligence, taking into account the nature of Processing and the information available to Verimatrix.

Exhibit: Description of Data Processing

Subject-matter, nature and purpose of the Processing activities:

YOU acknowledge that Verimatrix may process Your Personal Data for the purpose of providing, under the EULA, services for software protection, security analytics and remote control of YOUR protected application. Furthermore, Verimatrix may process Your Personal Data in order to assist YOU and answer your requests; manage orders; administer payments and/or subscriptions and keep proof of transactions; guarantee the application's security, prevent fraud and diagnose potential threats/problems; comply with legal and/or regulatory obligations.

Duration of the Processing activities:

The duration of the processing is equal to the duration of the provision of Services by Verimatrix, pursuant to the EULA. Notwithstanding the above, the duration of the Processing may exceed the duration of the provision of Services in case this is required in order to comply with a specific legal or contractual obligation.

Obligations and rights of Verimatrix:

YOU allow Verimatrix to obtain and process Your Personal Data as is necessary for the performance of the Services and as further described in the EULA and this Addendum; Processing is necessary for the exercise and performance of your contractual and legal rights and obligations, and for the purposes of legitimate interests pursued by YOU.

Categories of Data Subjects

The Personal Data of YOUR Users will be processed by Verimatrix in supplying the Services.

Categories of Personal Data:

• Online identifier: IP address.

  The IP address is only identifiable during initial processing during which the bytes which provide identification data are deleted. The remaining bytes which are stored in Verimatrix’s database do not provide information on the identity of the data subject.

Non-personal data:

For clarity, the following data which are processed by Verimatrix do not allow identification of the data subject:

• Location data: General geographical data of the device, including the country or region;
• Device type identifiers (hardware and OS);
• Metadata relating to the data subject's device usage in order to detect threats against the protected application (e.g. tampering, debuggers, rooted phones).

If you have any questions regarding this statement, please contact privacy@verimatrix.com.