End User License Agreement

Verimatrix App Shield

THE USE OF THE SERVICES IS SUBJECT TO THE TERMS AND CONDITIONS THAT FOLLOW. YOU SHOULD ACCESS AND USE THE SERVICES ONLY IF YOU ACCEPT AND AGREE TO ALL THE TERMS IN THIS EULA.

By accessing and using our Services, YOU agree to be bound by the terms of this EULA. This EULA represents the entire agreement between YOU and Verimatrix, concerning the use of our Services and supersedes any prior agreement, proposal, representation, or understanding between YOU and Verimatrix.

These Terms of Use are effective between YOU and Verimatrix and govern your use of Verimatrix's Services, as of the date you accept this EULA. By clicking on an acceptance button, indicating assent electronically, or otherwise using the Services, you agree to the terms and conditions of this EULA. If YOU do not agree to the terms of this EULA, do not access or use the Services. If YOU have accepted multiple versions of the EULA, the most current version that YOU accepted is the agreement between YOU and Verimatrix and supersedes and replaces all prior versions.

2. OWNERSHIP

The Services are protected by copyright laws and international copyright treaties, as well as other intellectual property laws and treaties. Unless expressly provided otherwise in this EULA, Verimatrix retains all right, title and interest, including any copyright, patent rights, design rights, or other intellectual property rights in and to the Services as well as any improvements or modifications thereto made for YOU, including any improvements or modifications based on, implementing, or otherwise using any feedback YOU or YOUR application has provided to us.

Verimatrix's logo and combinations and Verimatrix App Shield are registered trademarks or trade names of Verimatrix or its subsidiaries. Except as set forth herein, reproduction in whole or in part is prohibited without the prior written consent of Verimatrix.

3. GRANT OF LICENSE

Subject to the terms and conditions of this Agreement, Verimatrix hereby grants to YOU the limited, non-exclusive, non-transferable, non-assignable, non-sublicensable, freely revocable, right and license to use the Services only for the purposes of software protection, security analytics and remote control of YOUR application, in compliance with the terms of this EULA.

The only rights we grant YOU are those rights expressly stated in this Agreement. All rights not expressly granted to YOU under this EULA are reserved by Verimatrix. No license, right, title or interest in any trademark, trade name or service mark of Verimatrix is granted to YOU.

Your use of the Services is limited to devices and operating systems Verimatrix supports and may be affected by the performance and compatibility of your hardware, software and Internet access. Meeting system requirements is your responsibility and YOU are responsible for the cost of your equipment, which may include obtaining updates or upgrades from time to time in order to continue using the Services. System requirements are set forth on the product description page. (For purposes of this Agreement, product description page means the webpage describing the product available at https://appshield.verimatrixcloud.net)

Also, if YOU provide any comments to Verimatrix, information, opinions, or suggestions on the Services, YOU acknowledge and agree that Verimatrix may use them without restriction, for any purpose and without compensation to YOU.

4. LIMITATIONS OF LICENSE

1. Limitation of Use. YOU are the only person/entity allowed to use the services under this EULA.
2. Technical protection measures. YOU may not attempt to circumvent technical protection measures incorporated in or designed to protect the Services.
3. Prohibition on Reverse Engineering, Decompilation, and Disassembly. YOU are prohibited from, without limitation, reverse engineering, decompiling, reverse compiling, adapting, or disassembling, or in any way attempting to reconstruct or discover any algorithms of the Services, whether from the Services' output or otherwise.
4. Vulnerability Rewards Programs (VRP). In order to launch or participate in any initiative that offers rewards for discovering and/or reporting security threats, deficiencies or bugs in YOUR application (Vulnerability Rewards Program), prior written approval from Verimatrix is necessary. If such approval is granted the results must be shared with Verimatrix and can be made public only with the prior written permission from Verimatrix.
5. Security. YOU shall ensure no viruses or malicious code like malware, spyware, key logger, bots (as the expressions are generally understood in the computing industry) interfere with, compromise or adversely affect the provision of the Services. This includes, without limitation, denial of Service, interruption of Service, reduction or compromise in quality and efficiency of Service, or any other aspect that compromises the security or continuity of the Service.
6. Support Services. Verimatrix may elect to provide YOU with support services related to the Services ("Support Services") on a discretionary basis. If Verimatrix elects to provide the same, Support Services shall be considered part of the Services and subject to the terms and conditions of this EULA.
7. Compliance with Applicable Laws. YOU may not use the Service for illegal activities, or as means to violate the law. YOU may not upload content to the Services which YOU do not own or is illegal. YOU must comply with all applicable laws regarding the installation and use of the Services, including, but not limited to, protection of personal data, consumer laws and e-commerce regulations, where applicable. YOU may not engage in any activity that interferes with anyone else's use of the Services.

In case of violation of the above restrictions, Verimatrix retains the right to immediately terminate this EULA pursuant to Section 7 and to obtain full compensation for any damage, costs and expenses it may incur. In addition, YOU will be solely responsible for any fines or other penalties imposed pursuant to applicable laws.

5. NO WARRANTY

THE SERVICES ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. TO THE FULLEST EXTENT PERMITTED BY LAW, VERIMATRIX EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES, WHETHER EXPRESS, STATUTORY OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, QUALITY, FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OR REPRESENTATION THAT THE SERVICE IS ERROR-FREE. VERIMATRIX DOES NOT WARRANT OR ASSUME RESPONSIBILITY FOR THE ACCURACY, TIMELINESS, COMPLETENESS, CURRENTNESS OF ANY INFORMATION, RESULTS, INDICATIONS, ADVICE, PROPOSED ACTIONS, TEXT, GRAPHICS, LINKS OR OTHER ITEMS CONTAINED WITHIN, RELATED TO, OR PROVIDED THROUGH THE SERVICES, INCLUDING THE SERVICES' OUTPUT. VERIMATRIX MAKES NO WARRANTIES IN RELATION TO THE SECURITY OR STABILITY OF THE SERVICES OR THE PROTECTED APPLICATION AND EXPRESSLY DISCLAIMS ALL LIABILITY ARISING OUT OF OR CONNECTED TO THE TRANSMISSION OF A COMPUTER VIRUS, WORM, TIME BOMB, LOGIC BOMB, OR OTHER DESTRUCTIVE ELEMENT.

6. LIMITATION OF LIABILITY

TO THE GREATEST EXTENT PERMITTED BY APPLICABLE LAW, VERIMATRIX SHALL NOT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES OF ANY NATURE WHATSOEVER. FOR THE PURPOSES OF THIS AGREEMENT, LOST PROFITS, BUSINESS INTERRUPTION, DATA BREACH AND LOST INFORMATION ARE DEEMED AS INDIRECT OR CONSEQUENTIAL DAMAGES AND ARE NOT RECOVERABLE HEREUNDER, NOTWITHSTANDING THE THEORY OF LIABILITY AND FORM OF ACTION UNDER WHICH SAID DAMAGES ARE SOUGHT, INCLUDING BUT NOT LIMITED TO CONTRACT, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY, STRICT LIABILITY, STATUTORY LIABILITY OR OTHERWISE, AND WHETHER OR NOT VERIMATRIX HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE ARISING OUT OF OR IN CONNECTION WITH THE USE OF OR INABILITY TO USE THE SERVICES.

IT IS FURTHER EXPRESSLY STATED AND CLARIFIED THAT THE SERVICES ARE NOT DESIGNED, MADE, OR INTENDED FOR USE IN ANY APPLICATION OR DEVICE WHERE FAILURE OR INACCURACY MIGHT CAUSE DEATH OR PERSONAL INJURY, INCLUDING MILITARY GRADE, MEDICAL GRADE OR SPACE GRADE DEVICES, APPLICATIONS AND USES. VERIMATRIX SHALL NOT BE LIABLE IN WHOLE OR IN PART, FOR ANY CLAIMS OR DAMAGES ARISING OUT OF OR IN CONNECTION WITH THE USE AND PERFORMANCE OF THE SERVICE IN SUCH APPLICATIONS.

IN ANY EVENT, VERIMATRIX'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS EULA (WHETHER IN AN ACTION IN CONTRACT, NEGLIGENCE, STRICT LIABILITY, TORT OR ANY OTHER GROUND) SHALL NOT EXCEED THE ANNUAL SUBSCRIPTION FEE PAID OR PAYABLE BY YOU TO VERIMATRIX PURSUANT TO THIS AGREEMENT.

FOR CLARITY, IN CASE VERIMATRIX PROVIDES THE SERVICES HEREUNDER WITHOUT CHARGE, VERIMATRIX HEREBY EXPRESSLY DISCLAIMS ANY AND ALL LIABILITY ARISING OUT OF, OR RELATED TO THIS EULA (WHETHER IN AN ACTION IN CONTRACT, NEGLIGENCE, STRICT LIABILITY, TORT OR ANY OTHER GROUND).

7. TERMINATION

1. We reserve the right to terminate this EULA and your access to the Services, in whole or in part, for any reason or no reason, without penalty or recourse: i) upon the completion of any paid subscription period; ii) at any time, without notice, if there is no paid subscription.
2. In any event, Verimatrix has the right to terminate or suspend this EULA, your account, and your access to the Services if we determine that you have violated this EULA. The Services may contain enforcement technology that allows Verimatrix to suspend your access to the Services if YOU have violated this EULA or if your License has expired or been terminated.
3. Without prejudice to any other rights available under law and/or the present terms of use, in case YOU fail to comply with the terms and conditions of this EULA, Verimatrix reserves the right to terminate at will your use and access to the Services, at any time, without notice or reason.
4. If the EULA is terminated for any reason or expires, YOU are prohibited from making any further use of the Services, and neither YOU nor any personnel employed by YOU will be authorized to use or access the Services, including any online storage or backup services. In such case we may cancel and/or close your account at our sole discretion.
5. After the termination or expiration date, Verimatrix does not have the obligation, but retain the right, to delete, at our sole discretion, any of your online stored or backed-up information, text, files, applications, links, or other materials provided to Verimatrix ("Content"). It is your responsibility to store or backup your Content elsewhere before this EULA expires or is terminated.

8. YOUR CONTENT

The Service allows YOU to upload content (including Software Applications). YOU hereby give Verimatrix the irrevocable right to store, process and modify your content for the purposes of providing and improving the Services. Without prejudice to the above and to Section 7(d), YOU retain ownership of any intellectual property rights that YOU hold in your content.

9. PRIVACY AND DATA PROTECTION

YOU shall only use the Services in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and any other applicable privacy or data protection legislation or regulations.

Verimatrix's Privacy Policy, as may be updated from time to time, which is available at https://www.verimatrix.com/privacy/, sets forth how Verimatrix uses YOUR personal data of the personal data of your users, employees or contractors, and how Verimatrix protects YOUR privacy or the privacy of YOUR employees or contractors when YOU use the Services. Appendix A to this EULA (the "DATA PROCESSING ADDENDUM"), which constitutes an integral part thereof, explains how Verimatrix uses the personal data of your users, employees and/or contractors, and how Verimatrix protects their privacy when YOU use the Services.

By using the Services, YOU agree and confirm that:

• YOU have complied with all requirements under GDPR and all applicable data protection legislation;
• Verimatrix may process and use personal data in accordance with Verimatrix's Privacy Policies, which YOU expressly accept;
• YOU have provided all necessary information to YOUR users, employees and contractors under GDPR and any other applicable data protection legislation and have adequate legal basis for processing of such personal data;
• YOU have the right to allow processing of the personal data of your users, employees or contractors by Verimatrix under GDPR and any other applicable data protection legislation;
• When using the Services, YOU act as the data controller and Verimatrix acts as the data processor, acting on your behalf, in accordance with Art. 28 of GDPR and the DATA PROCESSING ADDENDUM;
• YOU are in compliance with the privacy and data protection rules of any distribution service (e.g. Apple's App Store or Google Play);
• YOU have implemented appropriate security policies so that the personal data YOU access via the Services is only accessible to individuals and organisations that have a right to access and process the same.

10. PAYMENT [applicable if YOU upgrade to "Paid" Services].

a) PAYMENT AUTHORIZATION.

YOU AGREE THAT VERIMATRIX OR OUR AUTHORIZED PARTNER MAY CHARGE THE CREDIT OR DEBIT CARD ACCOUNT OR OTHER PAYMENT DEVICE YOU PROVIDED FOR ALL AMOUNTS YOU OWE RELATED TO YOUR PURCHASE, INCLUDING ANY SUBSCRIPTION RENEWALS. YOU AGREE TO NOTIFY US PROMPTLY OF ANY CHANGE IN YOUR CARD ACCOUNT NUMBER OR EXPIRATION DATE OR OTHER PAYMENT INFORMATION. FOR CREDIT AND DEBIT CARDS, YOU AGREE THAT WE MAY UPDATE SUCH INFORMATION WITH UPDATES RECEIVED DIRECTLY OR INDIRECTLY FROM YOUR CARD ISSUER AND THE RELEVANT CARD NETWORK AND WE MAY USE THE UPDATED CARD INFORMATION TO CHARGE AMOUNTS YOU OWE US. THIS WILL SERVE AS YOUR CONSENT FOR YOUR CARD OR PAYMENT DEVICE TO BE CHARGED OR DEBITED. UPON YOUR REQUEST VERIMATRIX MAY ACCEPT AN ALTERNATIVE PAYMENT METHOD. IN SUCH CASE YOU WILL BE CHARGED ALL TRANSACTION FEES RELATED TO PAYMENT. IF VERIMATRIX CANNOT CHARGE YOUR SELECTED PAYMENT METHOD FOR ANY REASON (SUCH AS EXPIRATION OR INSUFFICIENT FUNDS), YOU REMAIN RESPONSIBLE FOR ANY UNCOLLECTED AMOUNTS, AND VERIMATRIX WILL ATTEMPT TO CHARGE THE PAYMENT METHOD AGAIN AS YOU MAY UPDATE YOUR PAYMENT METHOD INFORMATION.

b) Automatic Renewal.

YOU agree that your paid subscription will be automatically renewed. YOU authorize Verimatrix or Verimatrix's authorized partners to charge your card or payment device on file within 30-days of your subscription expiration date, at the renewal term subscription price in effect at the time the renewal. The subscription price for your auto-renewal is subject to change. Your subscription renewal is ongoing and will continue until YOU cancel. If YOU would like additional information or to cancel your subscription or modify your auto-renewal settings, please contact Customer Service at: appshield@verimatrix.com.

AFTER PURCHASING A SUBSCRIPTION, YOU MAY CHOOSE TO CANCEL AUTOMATIC RENEWAL BY CONTACTING CUSTOMER SERVICE. IF YOU DO NOT WISH TO BE AUTOMATICALLY RENEWED, YOU MUST CANCEL AUTOMATIC RENEWAL MORE THAN 30 DAYS BEFORE YOUR SUBSCRIPTION TERM EXPIRES. IF YOU DO NOT CANCEL AUTOMATIC RENEWAL, YOUR SUBSCRIPTION WILL CONTINUE FOR THE RENEWAL TERM UNDER THE AGREEMENT IN EFFECT AT THE TIME OF EACH RENEWAL UNLESS IT IS TERMINATED BY VERIMATRIX PURSUANT TO THIS AGREEMENT.

Cancellation. Cancelling your subscription or terminating this EULA will not result in a retroactive refund or pro-ration of fees paid based on cancellation date. Cancelling your subscription or terminating this EULA will stop future recurring fees, and YOU will have access to the subscribed Services until the end of the then-current Subscription Term.

Data Charges. YOU are responsible for any charges incurred with your data- or mobile-service provider in connection with your use of the Services, including any overage and penalties assessed for exceeding your data or minute allowance, or use of domestic or international short message service.

11. CHANGES TO THIS EULA

Verimatrix may need to update or change the terms and conditions of this EULA over time. If YOU have a paid subscription, any new terms and conditions will apply when your subscription renews. If YOU do not agree to the new terms and conditions, then YOU must reject the changes by duly notifying Verimatrix, ceasing all use of Services at the end of the then current subscription term. By continuing to use the Services, YOU accept change(s) to this EULA.

12. GOVERNING LAW

THESE TERMS OF USE SHALL BE GOVERNED BY FRENCH LAWS EXCLUDING ANY CONFLICTS OF LAWS RULES. ANY DISPUTE THAT MAY ARISE OUT OF OR IN CONNECTION WITH THE PRESENT TERMS OF USE, INCLUDING WITHOUT LIMITATION, THEIR VALIDITY, FORMATION, INTERPRETATION, PERFORMANCE, CONSTRUCTION, TERMINATION OR EXPIRATION OF THESE TERMS THAT CANNOT BE SETTLED AMICABLY SHALL BE REFERRED TO THE EXCLUSIVE JURISDICTION OF THE COMPETENT COURTS OF PARIS, FRANCE, INCLUDING IN CASE OF PLURALITY OF DEFENDANTS, CONTRIBUTION OR GUARANTEE CLAIMS OR ANY THIRD PARTY PROCEEDINGS AND/OR SUMMARY PROCEEDINGS. THE PARTIES AGREE THAT THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS IS SPECIFICALLY EXCLUDED FROM APPLICATION TO THIS EULA.

13. NO ASSIGNMENT

YOU shall not assign this EULA to any person or entity.

14. NO WAIVER.

Verimatrix does not waive any provision of this Agreement unless it is expressly waived in a written agreement signed by an authorized officer of Verimatrix.

15. SEVERABILITY

If any provision of this EULA is or becomes, at any time or for any reason, unenforceable or invalid, no other provision of this EULA shall be affected thereby, and the remaining provisions of this EULA shall continue with the same force and effect as if such unenforceable or invalid provisions had not been inserted in this EULA.

16. ENTIRE AGREEMENT

This EULA constitutes the entire agreement between YOU and Verimatrix and supersedes all prior agreements, proposal(s) and discussions. No explanation or information (whether written or oral) given to YOU by Verimatrix shall alter the meaning or interpretation of this EULA.

Copyright © 2019 Verimatrix. All rights reserved.

1. Effect. This Data Processing Addendum is supplemental to the End User License Agreement between YOU and Verimatrix and applies to the processing of Personal Data of the users of YOUR application ("Users") carried out on your behalf (in your capacity as a Controller) by Verimatrix (in our capacity as Processor). If there is a conflict or inconsistency between the terms of this Addendum and the provisions of the EULA, the former will prevail.

2. Definitions. Any capitalized terms used in this Addendum which are not otherwise defined herein are as defined in the EULA.

3. Compliance with Data Protection Laws.

In relation to the provision of the Services, as described in the EULA and the Addendum, the parties undertake and agree to comply with the Data Protection Laws (as defined below). The "Data Protection Laws" shall mean the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC ("GDPR" or "General Data Protection Regulation") and any other applicable law, regulation, ordinance, decree, or other legal instrument relating to the protection of personal data, as may be enacted during the life of the EULA. Any capitalized terms used in this Article that are not otherwise defined in this Addendum shall have the meaning ascribed to them in the GDPR.

4. Your Obligations.

YOU retain control over the data which is processed in relation to the Services. YOU undertake not to provide to Verimatrix any Special Categories of personal data (as defined in Art. 9 of the GDPR) and/or Personal Data allowing the direct identification of the data subject (including, without limitation, any of the following: first name, last name, identification number, credit card number, social security number, personal financial information).

In compliance with the GDPR, YOU shall, under your sole responsibility: a) provide data subjects with all required information with respect to the data processing, and in particular, inform the data subjects about (i) the existence of their rights of access, rights to rectification and erasure, right to restriction of processing, right to data portability and right to object; (ii) the nature, the legal basis, and purpose of processing; b) where processing is based on the data subjects' consent, obtain such data subjects' consent for the processing, as described in the EULA and this Addendum; c) where applicable, obtain their consent for the use of cookies. d) maintain a record of processing activities; e) taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk and be able to demonstrate compliance with the GDPR.

YOU warrant that YOU have all the rights and authorizations necessary for Verimatrix to perform the Services.

5. Our Obligations

Verimatrix will only collect data that is available with the existing application's permissions, giving YOU full control on what can be collected.

As a Data Processor, Verimatrix shall only process, on your behalf, the Personal Data of YOUR Users which have been obtained by Verimatrix, pursuant to your instructions and to the extent necessary for the provision of our Services as set forth in the EULA and the present addendum [our contractual agreement(s)] and the exhibit hereto.

Verimatrix will not disclose, sell, trade, or rent your Users' personal data without your prior consent. In order to fulfill the aforementioned purposes, subject to applicable law, Verimatrix may only disclose your Users' personal data to subsidiaries and/or affiliate companies, within the Verimatrix group.

Verimatrix further commits to:

1. process the Personal Data exclusively on your behalf and only on documented instructions from YOU, as set forth in this Agreement, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by the Data Protection Laws to which we are subject; in such a case, we shall inform YOU of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
2. not process the Personal Data or permit it to be processed or accessed, in whole or in part, outside the scope and purpose of our contractual agreement(s);
3. ensure the confidentiality of the Personal Data which is processed under our contractual agreement(s);
4. ensure that persons authorised to process the Personal Data under our contractual agreement(s) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
5. process the Personal Data within the European Economic Area ("EEA"). Any transfer of such Personal Data outside the EEA must be subject to the Data Protection Laws;
6. refrain from engaging a Sub-Processor without your prior specific or general written authorisation, and, as the case may be, to ensure that such third-party processor complies with all obligations of the Data Protection laws;
7. only engage a Sub-Processor with your prior consent and a written contract that imposes substantially similar data protection obligations on the Sub-Processor as those imposed on Verimatrix under this Agreement, provided that if the Sub-Processor fails to fulfill its data protection obligations, Verimatrix shall remain fully liable to YOU for the performance of such Sub-Processor's obligations;
8. assist YOU by appropriate technical and organisational measures, for the fulfilment of your obligations to respond to requests for exercising the data subject's rights, such as the right to access, rectify or erase their Personal Data, or the right to restrict, or object to, the processing of their Personal Data and the right to the portability of their Personal Data; given, however, the nature and limited scope of Personal Data processed under the EULA and this DPA, which does not allow Verimatrix to directly identify data subjects from our records, any data subject's request will need to be facilitated by YOU, in order to be able to provide necessary assistance;
9. take any action required for the fulfilment of your obligations to respond to requests for exercising the data subject's rights without undue delay and in any event within ten (10) business days of receipt of the request from YOU;
10. without prejudice to Verimatrix's right to use fully anonymized data after the end of our contractual agreement(s), so that data subjects are no longer identifiable, delete or return all the personal data to YOU after the end of the provision of services relating to processing, and delete existing copies unless applicable law requires storage of the personal data , in full or in part;
11. assist YOU, upon your request, in ensuring compliance with the obligations deriving from the carrying out of data protection impact assessments and from prior consultation of the supervisory authority, being understood that such services provided by Verimatrix may be subject to additional costs;
12. make available to YOU all information necessary to demonstrate compliance with all the Data Processor's obligations under the GDPR and allow for and contribute to audits, including inspections, conducted by YOU or another auditor mandated by Verimatrix at mutually agreeable times, being understood that such services provided by Verimatrix and audits may be subject to additional costs;
13. notify YOU immediately upon receipt of any request from the competent data protection authority, or a court order, to disclose any of your Personal Data, and, to the extent practicable, will provide all necessary assistance in opposing such disclosure;
14. notify YOU in writing (including via e-mail), to the email address YOU have previously provided, as soon as reasonably practical after becoming aware, of of any actual or suspected accidental, unlawful or unauthorised access, alteration, loss and/or destruction of the Personal Data, and in any event no more than 72 hours after discovering such Personal Data Breach, with such notice to include reasonable details of such Personal Data breach ; and
15. immediately inform YOU if, in Verimatrix's opinion, an instruction infringes the Data Protection Laws.

6. Technical and organisational measures of protection.Taking into account the state of the art and the cost of implementation, and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Verimatrix shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia:

• to ensure the integrity, availability, resilience, and confidentiality of processing systems and services;
• to protect the Personal Data against accidental or unlawful destruction, damage, or accidental loss, alteration, or unauthorised disclosure, access or process. In order to ensure such level of security, we shall implement the appropriate technical security and organisational measures, notably by taking into account, with respect to Verimatrix's tools, products, applications or services, the principles of data protection by design and data protection by default;
• to maintain Certification to ISO/IEC 27001.

7. Data Protection Impact Assessment.

YOU represent and warrant to Verimatrix that (i) YOU have performed, prior to entering into this Agreement, any data protection impact assessment required by the GDPR or any applicable data protection law, completed appropriate due diligence on Verimatrix and, (ii) based on all information provided, there are no additional technical and organisational measures required in respect of the Services and the delivery thereof in relation to protection of Personal Data. Verimatrix shall cooperate with and provide reasonable assistance to YOU in performing any data protection assessment and due diligence, taking into account the nature of Processing and the information available to Verimatrix.

The following are deemed as instructions by Customer to process Personal Data:

Description of Data Processing

1. Extent, Type and Purpose of intended Processing or use of Personal Data
   1. Subject-matter, nature and purpose of the Processing activities: YOU acknowledge that Verimatrix may process the personal data of YOUR Users on YOUR behalf for the purpose of providing, under the EULA, services for software protection, security analytics and remote control of YOUR protected application. Furthermore, Verimatrix may process YOUR Users' Personal Data in order to assist YOU and answer your requests; manage orders; administer payments and/or subscriptions and keep proof of transactions; guarantee the application's security, prevent fraud and diagnose potential threats/problems; comply with legal and/or regulatory obligations.
   2. Duration of the Processing activities The duration of the processing is equal to the duration of the provision of Services by Verimatrix, pursuant to the EULA. Notwithstanding the above, the duration of the Processing may exceed the duration of the provision of Services in case this is required in order to comply with a specific legal or contractual obligation.
   3. Instructions: The following are deemed as instructions by YOU to Process Personal Data: - YOU allow Verimatrix to obtain the personal data necessary for the performance of the Services; - Processing is necessary for the exercise and performance of your contractual and legal rights and obligations, and for the purposes of legitimate interests pursued by YOU; - Personal Data may be processed for another, incompatible purpose only with the prior written consent of the data subject.
2. Categories of Personal Data and Data Subjects
3. Data Subjects: Personal Data concerning the following categories of Data Subjects: YOUR Users
4. Categories of Data:
   • Location data: Geographical data of the device
   • Online identifier: IP address
   • Metadata relating to the data subject's device usage

If you have any questions regarding this statement, please contact Verimatrix's appointed Director of Data Protection at privacy@verimatrix.com.