Terms and Conditions for the Provision of Software and Services

These Terms and Conditions, in conjunction with the corresponding Proposal(s), are intended to regulate the contractual terms for the provision of Software and the provision of Services, as well as to outline the framework in which the business relations between the company identified in the Proposal (hereinafter Ibernova) and the Customer must be developed.

These Terms and Conditions are binding in relation to an order for a licence to use Software, the provision of Services, Support and/or Maintenance Services, SaaS Services, and/or the acquisition of Third-Party Products upon signing of the corresponding Proposal by Ibernova and the Customer.

In this regard, the parties expressly acknowledge that they have read and unreservedly accept these Terms and Conditions and that they, along with the Proposal(s), comprise the entire agreement between the parties in relation to the purpose of the Proposal(s) and that no other Terms and Conditions or prior commitments by Ibernova or the Customer shall apply, unless otherwise agreed in writing between the parties. In the event of a discrepancy between the content in the Proposal(s) and these Terms and Conditions, the agreements and details of said Proposal(s) shall prevail, and shall be interpreted as such in the event of a conflict due to their specific nature.

Ibernova has the right to modify the present Terms and Conditions or to add new conditions. These changes shall take effect seven days after they have been acknowledged or notified. Such notification may be provided through various measures, including a post made on the Ibernova website, the Customer website, by e-mail or by any other method that allows the Customer to be aware of such changes. The continuity in the commercial relationship between the parties after these changes shall be considered as acceptance by the Customer of said changes.

1. PURPOSE AND TERM

1.1 Purpose

The purpose of this contract is the granting, by Ibernova in favour of the Customer, the right of Software use (licence), as well as the provision of services within the scope described in the Proposal.

1.2 Term

The effective date of these Terms and Conditions coincides with the date of signing the Proposal by Ibernova (after the Customer signs the Proposal) and the Proposal shall remain in force until its expiration or termination.

2. SOFTWARE

2.1 Ownership

The Software and all copies thereof are owned by Ibernova and/or its licensors and all Intellectual and Industrial Property Rights, both moral and economic, over the Software shall remain under the ownership of Ibernova and/or its licensors at all times, which is expressly acknowledged by the Customer.

2.2 Licence

2.2.1. Upon payment of the Licence, Subscription or SaaS Fee, Ibernova grants to the Customer, an individual, non-exclusive, non-transferable licence to use the modules in the quantity and under the Software conditions established in the Proposal(s) (“the Licence”). The Customer shall not be licensed to use the Software until full payment of the Licence Fee. In the case of a Subscription Fee or SaaS Fee, the Customer shall have a licence to use the Software for as long as said Fee is paid.

2.2.2. Notwithstanding that stipulated in the clause above, the Customer is licensed to use the server elements for the Software at the facilities and for the environment and number of users contracted in the Proposal. It should be noted that the Customer is required to have an installation for development and testing on a server other than the one on which the Software will be installed for actual use. The number of licensed users for each module and Software product may not be split between multiple server installations unless specifically agreed upon by the parties in the Proposal(s).

2.2.3. The Software may only be used by:

(a) The Customer,

1. b) The Customer’s parent organisation or affiliates for their own internal business purposes in each case, provided that the parent organisation is 51% or more owned by the Customer; and/or

2.2.4. The Customer, upon usage of the Software by the entities described in clause 2.3, confirms that it has obtained their commitment to comply with the full Terms and Conditions. Notwithstanding the foregoing, the Customer assumes and accepts liability, jointly and severally, towards Ibernova for the actions and/or omissions of its parent organisation or affiliates in connection with any breach of the Licence or its obligations under these Terms and Conditions by them.

2.2.5. The Customer authorises Ibernova to take the appropriate measures in order to verify that the access made by the users corresponds to the number of licences and users contracted by the Customer. In this sense, the Customer authorises Ibernova to audit the use of the Software and to collaborate in the audit in case the former’s involvement is necessary.

2.3. Customer’s Licence Obligations

2.3.1. The Customer and any party authorised to use the Software pursuant to clause 2.3 shall:

2.3.1.1 secure and protect the proprietary rights in the Software and any copies thereof.

2.3.1.2 except for the distribution of the Customer’s Software to authorised users as defined in clause 2.2, ensure that no copies of the Software in any form are delivered to third parties and prevent access to the Software by third parties without the express written consent of Ibernova.

2.3.1.3 provide instructions to those of its employees who have access to the Software not to copy, decompile, disassemble, isolate components or duplicate the Software or provide information or assistance in connection with these activities to third parties.

2.3.1.4 reproduce any copyright notice in any material relating to the Software or any part thereof in which such copyright notice is displayed and not remove any copyright notice, Trademark, trademark information, privacy notice, sign, legend, or other information contained in the Software.

2.3.1.5 not assign, transfer, mortgage, encumber, conduct management of, or otherwise manage any of its rights, duties, or obligations under this Licence without the prior written consent of Ibernova.

3. SOFTWARE SUPPORT AND MAINTENANCE SERVICES

The support and maintenance service to be provided by Ibernova consists of:

3.1 Corrective maintenance for standard Software

This service includes addressing any queries in regard to operation of the Software, the notification and telephone support for errors or anomalies detected by the Customer, as well as the handling of incorrect data as a consequence of malfunctions in the Software.

3.2 Corrective maintenance for adaptations

This applies, as long as it is contracted by the Customer in the Proposal, to the modifications through programming, workflows and reports made by Ibernova and includes:

• Customer support and queries in regard to the functioning of adaptations made by Ibernova.
• Correction of anomalies and failures caused by the Software.

The Customer shall communicate to Ibernova, through the above-mentioned methods, the anomalies detected while using the Software. Whenever such anomalies or errors are included in the services described above, Ibernova will proceed according to the following procedure:

1st.- Telephone support: Ibernova (i) will run the initial diagnosis for errors or anomalies in the Software. For this purpose, it is necessary for the Customer to inform Ibernova about all the data related to the error or anomaly reported and (ii) the latter will issue recommendations to resolve the errors or anomalies reported, as well as for the clarification on specific doubts about the operation of the Software that have arisen with the Customer.

2nd.- Support via remote connection: In the event that the recommendations or actions that Ibernova may take need to be sent to the Customer’s IT systems, Ibernova will inform the Customer so that they can carry out the corresponding transmission remotely. In this regard, it is the Customer’s responsibility to obtain and maintain the necessary infrastructure (understanding as such the cost of communication lines or data traffic between Ibernova’s facilities and the Customer) that are necessary for Ibernova to remotely provide the corrective maintenance service.

3rd.- On-site support: In the event that the presence of an Ibernova consultant is required at Customer facilities to resolve problems arising in connection with the services included in this contract, Ibernova shall have consultants available to support this service, which shall be billed according to the hourly consultation rate in force.

3.3 Software Upgrades

Ibernova undertakes to make available to the Customer new versions of the Software that are developed, in order to improve the quality of the performance, modernise the code if applicable, adapt it to new market circumstances or to new demands in the hardware and software systems, eliminate errors and introduce small functional extensions.

At the time of signing this contract, the Software complies with the general and binding legislative regulations. Subsequent legislative changes of a general and mandatory nature and which generally affect users of the Software will be included in a subsequent update, which will be made available to the Customer at the time said version is commercially released. The legislative modifications that could specifically affect the Customer or the market or sector of activity in which the Customer operates or those general legislative modifications that constitute a substantial change with respect to characteristics and functionalities of the Software, unless expressly indicated by Ibernova, will not be subject to automatic incorporation into the standard version, hence these legislative modifications may be implemented through prior express agreement with the Customer.

3.4 Services not included

The maintenance service does not include the supply by Ibernova of Software that it markets as new and different products or options.

The maintenance service shall only be provided for the application effectively licensed to the Customer, without any obligation from Ibernova to provide maintenance services for versions prior to the current one and the previous one that have been released to the market. The Customer is obligated to install Software updates and improvements released by Ibernova. In the event that the Customer requires intervention by Ibernova to assist the Customer with such updates, this may incur charges payable to Ibernova.

In the same sense, the fact that a Client does not update the licensed Software and maintains it in versions prior to the current and previous versions shall incur an increase in the fees payable to Ibernova since the support for these older versions entails an increase in costs for said software. Likewise, Ibernova shall not be obligated to update or develop versions prior to the current and previous ones that have been released to the market, limiting its obligations with respect to those clients who have not updated their Software to customer assistance and support during a limited period of time.

3.5 Duration of Services

Support and Maintenance Services shall be provided from the date indicated in the Proposal and until ONE YEAR expires after that time. Thereafter, the Support and Maintenance Services shall be provided for successive annual periods of 12 months and shall continue to be provided subject to termination by either party provided that one party provides the other with notice of no less than 60 calendar days prior to the renewal date, or until terminated as established under these Terms and Conditions.

3.6. Error corrections

3.6.1. Ibernova assumes no liability whatsoever arising from the fact that the Software is obligated to provide error correction services related to:

3.6.1.1 defects or errors arising from Customer’s failure to use the appropriate versions of any other software required to run in conjunction with the Software.

3.6.1.2 defects or errors arising from installations, modifications, interventions, or enhancements to the Software provided by anyone other than Ibernova.

3.6.1.3 user errors or misuse of the Software; or defects in hardware or software manufactured by third parties and used in conjunction with the Software.

3.6.1.4 defects or errors caused by using the Software on or with equipment not recommended or approved in writing by Ibernova.

3.6.1.5 using the Software for a purpose for which it is not intended.

3.7. Ibernova Software Upgrades

3.7.1. The Customer will receive new Updates, Service Packs, Releases or Versions provided that the appropriate Annual Maintenance, Subscription Fees, or SaaS Fees are paid to Ibernova in connection with the Ibernova Software. Ibernova reserves the right to charge a reasonable upgrade fee in order for the Customer to obtain a new Release or Version of the Ibernova Software.

3.7.2. It is the Customer’s responsibility to implement new Updates, Service Packs or Releases as soon as they become available. Any effect due to Customer delay in implementing them is the sole responsibility of the Customer and will result in an extra charge applied to the maintenance, subscription, or SaaS fee.

3.7.3. In the event that the Customer needs any Service to help with the implementation of an Update, Service Pack, Release or Version, the costs will be paid by the Customer, according to Ibernova’s Current Rate.

3.8. Maintenance, Support, Subscription and SaaS Rates.

3.8.1. Ibernova may review and increase the price once per calendar year throughout the term of the contract based on the year-on-year increase in the consumer price index (CPI), with a minimum of 2 %, and the Client may terminate the contract, if it does not agree with the increase applied, by means of reliable notification within thirty (30) days after the price update has been communicated. The prices indicated do not include Value Added Tax (VAT) or any other applicable tax or customs duty in force, which will be paid by the Customer and will be paid to Ibernova in addition to the price when it results from the applicable regulations. Any other taxes or customs duties are not applicable to the services regulated in this contract, and therefore shall be the responsibility of each one of the parties, as stipulated under Law.

3.8.2. The Annual Support Fee for the Software and Subscription is calculated on the basis that Customer uses the Software on the operating system and database combination identified by Customer at the time of installation. If the Customer wishes to run the Software using a different operating system or database combinations, Ibernova reserves the right to revise the Annual Support or Subscription Fee (as applicable) upon prior consultation with Customer.

3.8.3. If the Customer purchases additional modules or increases the number of licensed users at any time, this will result in a consequent increase in the Annual Support or Subscription fee. During the support year in which such an event occurs, the Annual Support or Subscription Fee will be prorated to be settled in line with the main Support Services.

3.9. Software provided in Subscription and SaaS mode.

The server where the applications are hosted must have internet access in order to connect to Ibernova’s SaaS service centre.

3.9.1. Duration of the service

(i) The duration of the service is the duration expressly agreed upon in the Proposal, starting from the date indicated in the proposal or, failing that, the date of signing the proposal.

(ii) The establishment of the term has been agreed through mutual consent between the parties by taking the price and other circumstances of the Proposal into consideration, so that said term is agreed as mandatory for both parties, including unilateral termination by the Customer within the aforementioned period and the accrual of compensation to be paid to Ibernova, equivalent to an amount of the instalments that remained to be paid at the time of termination. Said compensation must be paid within fifteen calendar days following notification of termination by the Client.

(iii) At the end of the agreed validity period, provision of the service shall continue, considered as automatically renewed and extended for successive annual periods, unless either of the parties reliably notifies the other in writing of its intention not to renew it, at least ninety calendar days prior to the initial term’s expiration date or the expiration date of any one of its extensions, without prejudice to the provisions of the previous paragraph. The parties expressly state that the aforementioned period is reasonable since Ibernova must sufficiently know in advance about the number and technical characteristics of the Clients to which it must provide the Support and Maintenance Services. For this reason, any communication that does not respect the aforementioned notice shall not be considered valid and, consequently, the service shall be understood to be renewed for a new year.

4. GENERAL CONDITIONS

4.1. Warranties

4.1.1. Ibernova guarantees that the Software, used in accordance with its corresponding documentation and instructions from the provider, shall function at the time of its correct installation and thereafter, as long as the Software is covered by Maintenance, Support, Subscription or SaaS Services.

4.1.2. Under this warranty, the Customer acknowledges that Ibernova Software is commercial software and not a custom programme prepared to meet the individual requirements of the Customer (even if Ibernova is aware of these requirements). It is therefore the Customer’s responsibility to ensure that the features and functions described in the Proposal meet its needs. Ibernova assumes no liability whatsoever for the failure of the Software to provide functions not specified in the corresponding documentation or by Ibernova in the Proposal.

4.1.3. Ibernova guarantees and declares that it has the right to license any part of the Software that it sublicenses to the Customer.

4.1.4. Ibernova does not guarantee that the Software shall operate uninterrupted or error-free. The Customer acknowledges that the Software will not be error-free. Notwithstanding the foregoing, Ibernova works with quality standards specific to its sector to minimise the impact of possible errors in the code.

4.2. Customer Responsibilities

4.2.1. The Customer shall provide Ibernova with all information and documentation that Ibernova may reasonably request for the performance of its obligations.

4.2.2. The Customer shall provide Ibernova, at no cost to the latter, access during normal business hours to facilities, use of telephone and communication lines and computer time such as Ibernova may reasonably deem necessary for the performance of its obligations.

4.2.3. The Customer shall be responsible for connectivity to its network and the Internet, including the agreed-upon mechanism for remote support access.

4.2.4. The Customer shall ensure that users of the Software have received adequate training and that users undertake to perform their role in operating the Software according to Industry Best Practices and in accordance with any Documentation and reasonable advice provided by Ibernova.

4.2.5. The Customer shall designate the key users in its organisation, who must be trained and have proven skill in the use and configuration of the Software. These key users will be the persons who will provide a first level of support to the Customer’s users and will be, in turn, the main point of contact with Ibernova’s technicians.

4.2.6. Without prejudice to those cases in which this is expressly agreed, the Customer is responsible at all times for the security and integrity of its data. This includes, but is not limited to, ensuring that appropriate backups of all data are made on a daily basis and ensuring that the system can be restored to its previous state.

4.2.7. The Customer is responsible for the accuracy of what is entered into and extracted from the Software and for ensuring that the Software parameters are configured correctly in order to perform administrative tasks, data processing, and calculations in accordance with any legal, accounting or tax requirements.

4.2.8. The Customer is responsible for ensuring that it provides the equipment necessary for proper operation of the Software, and that it is ready for the commencement of Services on a date mutually agreed upon in advance between the parties, provided that said equipment is to reside at the Customer’s premises.

4.3. Ibernova Responsibility

4.3.1. Ibernova shall be liable solely and exclusively for the items and within the limits established in this clause.

4.3.2. Ibernova shall accept its liability towards the Customer for personal injury to the Customer’s employees or damage to property owned by the Customer as a result of an unlawful act or omission involving wilful misconduct or gross negligence on the part of Ibernova employees, representatives, subcontractors or partners, up to a maximum amount of €1 500 000.

4.3.3. In the event that Ibernova fails to comply with its obligations of any nature arising from the proposal(s), its liability for non-compliance, loss or damage (whether contractual, tort – including non-compliance, negligence, misrepresentation or any other contractual or extra-contractual claim – restitution or otherwise) shall not exceed, for the set of all claims and causes of action, and with the exception of that stipulated in clause 4.3.2 previously:

(i) In relation to loss or damage caused by the provision of Software or Services, 100% of the Licence or Subscription Fee in total, alongside the total for Service fees actually paid by the Customer to Ibernova during the year prior to the one in which such non-compliance occurs; and

(ii) In connection with loss or damage caused by the provision of Support, Maintenance or SaaS Services, 100% of the Annual Support, Maintenance or SaaS Fee actually paid by Customer to Ibernova during the year prior to the one in which such non-compliance occurs.

4.3.4. In no event shall either party be liable towards the other for any of the following:

(i) Indirect or consequential loss or damage; or

(ii) Loss of business, loss of profit; loss of revenue, loss and/or damage to business reputation, loss or deterioration of data or loss of contracts, revenue, or anticipated savings (whether the foregoing are direct, indirect, or consequential)

(iii) Loss of data use or data value or equipment including software, lost management, operational or other time (whether direct, indirect, or consequential).

4.3.5. It is always a condition for any right to compensation that the Customer reports the damage to Ibernova in writing and through any method that guarantees its receipt as soon as possible after the damage occurs. It is also an essential condition that the Customer is covered by a current Maintenance and Support, Subscription or SaaS contract and that said Customer is up to date with the payment of its obligations. In these cases, Ibernova shall assume those damages that it has caused exclusively by its involvement and in which the necessary and proven causal relationship exists between its conduct and the damage caused.

4.3.6. Under no circumstances shall Ibernova be liable for damages that may be caused by the Customer in breach of the obligations or responsibilities contracted by the latter under this Contract.

4.3.7. Ibernova shall not be liable for claims of damages and losses brought against the Customer by third parties or by companies within the Customer’s group, regardless of the cause of such claims, except in those cases in which Ibernova must be liable by application of a mandatory rule.

4.4. Change control

Ibernova shall only be mandated to provide the Services included in the corresponding Proposal, and with the scope foreseen therein. Likewise, Ibernova shall provide the additional services and shall make the changes to the Services (and to the resulting matters regarding the price or time) that are requested in writing and using any medium that guarantees their receipt by the Customer, provided that Ibernova has accepted the request for the provision of such additional services, and the provisions regarding fees in clause 4.5 thereof shall apply. For these purposes, it shall be understood that Ibernova has accepted the request sent by the Customer if it proceeds to carry out the Services requested by the Customer.

4.5. Rates and Payment

4.5.1. The rates for the provision of Services shall be those agreed upon in each one of the Proposals undersigned by the parties, as the case may be.

4.5.2. Invoicing and payment

4.5.2.1 The Customer shall make payments to Ibernova as consideration for the provision of Services or implementation of Projects in accordance with the terms and conditions established in this clause, unless otherwise specified in the Proposal(s) under which each specific Service or Project has been contracted.

4.5.2.2 Unless otherwise agreed upon by the Parties, all invoices shall be issued in electronic format.

4.5.2.3 The date of invoice issuance for Licence or Subscription Fees for Ibernova Software and/or for Third-Party Products and Custom Software shall be the date of accepting and signing the Proposal(s).

4.5.2.4 The date of invoice payment for Maintenance and Support and SaaS Services shall be in advance, for the periods in respect of the services to be provided for that period. In the event that the customer requires an extension in coverage of services during the period, Ibernova may issue a new additional invoice.

4.5.2.5 The Customer shall pay Ibernova the amounts detailed in the Proposal(s) together with VAT and any other taxes or levies applied by the legal authorities.

4.5.2.6 All invoices shall be payable thirty (30) calendar days from the date of invoice issuance.

4.5.2.7 Expenses shall be additionally charged at the rates established in the Proposal(s).

4.5.2.8 In the event of late payment:

(i) Ibernova reserves the right (supplementary to its other rights) to apply the interest for late payment of commercial transactions to the amount due, as established under current legislation, starting from the due date until Ibernova receives full payment, and to recover from the Customer all expenses incurred in the recovery of the amount due from said Customer; and

(ii) Ibernova shall not be obligated to provide Software or Services, Support Services, Subscription Services and SaaS Services as long as any invoice is outstanding until all amounts due to Ibernova from the Customer have been settled by the latter; and

(iii) In the event the Customer fails to pay a properly issued invoice for a training course by its due date, the training course reservation will be cancelled.

4.5.2.9 Use of the Software may require a temporary access key that prevents the Customer from using the Software after the key expiration date if the Customer fails to pay the Licence Fee in accordance with these Terms and Conditions. Ibernova will provide a permanent access key upon receipt of the full Licence Fee.

4.5.2.10 All Fees are non-refundable.

4.6. Invoice Disputes

4.6.1. The Customer shall submit, in writing, any dispute regarding the content of an invoice issued by Ibernova within fifteen (15) calendar days of the issuance date of the invoice. For the purpose of invoice payment, invoices shall be deemed to have been correctly issued and payment shall be due when the invoices have not been disputed within fifteen (15) calendar days of the issuance date.

4.6.2. If all or part of an invoice is the subject of a valid and reasonable dispute, the Customer shall provide written details of the amount and cause of the dispute, and said Customer shall pay Ibernova any undisputed amounts as such amounts become due. The parties shall, in good faith, attempt to resolve the dispute concerning the unpaid amount. During such time, if Customer has fully complied with the provisions of this clause, Ibernova shall not be entitled to charge interest or deny Services with respect to the disputed amount.

4.7. Assignment and subcontracting

4.7.1. Neither party shall be entitled to sell, assign, sublicense, delegate, transfer or otherwise dispose of, either directly or indirectly, its rights or obligations, except with the prior written permission of the other party, which shall not be unreasonably withheld or delayed.

4.7.2. When either party wishes to assign the rights and obligations deriving from a Proposal to another legal entity within its group or organisation generally for the sole purpose of internal reorganisation, the other party shall not refuse such assignment, provided that each and all of the following conditions are met:

(i) Said legal entity accepts the assignment or delegation and assumes these obligations in writing.

(ii) The Customer or Ibernova, whichever is the assigning party, remains fully responsible for the complete fulfilment of its obligations, and not releasing itself from said obligations; and

(iii) The Customer or Ibernova, whichever is the assigning party, notifies the other party in writing within three business days following the assignment and/or delegation, attaching a copy of the signed assignment or delegation.

4.7.3. Ibernova may provide services through companies in its group or external sub-contractors.

4.7.4. In the event of temporary assignment of specialised IT personnel belonging to Ibernova due to a specific need of the Customer to implement specific activities, Ibernova shall temporarily assign the services of the personnel designated for this purpose to the Customer, communicating the identification data, their position or function and the period of assignment, as well as the work centre for the provision of services.

The employee will continue to be an employee of Ibernova, who will maintain the employment relationship, including remuneration, social security contributions and other legal obligations, although he/she will be functionally integrated into the structure of the Customer, who will assume the direct management and supervision of the tasks entrusted.

The Customer shall pay Ibernova the amount corresponding to the employee’s labour expenses, including salary, social security, and other applicable items, plus the percentage established for management, and such amount shall be invoiced monthly.

4.8. Confidential Information

4.8.1. Both parties undertake to treat all data as confidential, as well as the information contained or represented in any documentation sent to them, and shall not disclose this data or information, in whole or in part, to any third party. The terms of this clause shall not apply to the following information:

(i) Information that was in the public domain at the time of disclosure.

(ii) Information that, although originally Confidential Information, is now in the public domain through no fault of the receiving party of said Confidential Information.

(iii) Information independently conceived, perfected or developed by employees or representatives of either party or that is now or hereafter in the legal possession of either party or its employees or representatives, as demonstrated by written records where the party’s employee or representative can prove that he or she has not had access to confidential information received under an Offer.

(iv) In legally enforceable cases.

4.8.2. The foregoing obligations with respect to confidentiality shall remain in force and effect even if the Proposal(s) or the Contract(s) is/are terminated for any reason.

4.8.3. Nothing in this clause 4.8 may be considered or interpreted as preventing the Customer from disclosing Confidential Information obtained from Ibernova to:

(i) Any Subsidiary (or department or agency in the case of Public Sector Customers) of the Customer, provided that the Customer has required that such information be treated confidentially by said Subsidiary (or department or agency in the case of Public Sector Customers) and its employees.

(ii) Any consultant or sub-contractor under contract with the Customer, provided that the Customer has obtained from the consultant or sub-contractor a non-disclosure agreement signed under substantially the same conditions contained in this clause.

and with respect to Ibernova and the Client, neither party shall be in breach of this clause when information is disclosed pursuant to a legal obligation to divulge information or requirements from a legislative body, but only to the extent necessary.

4.8.4. In the case of contracted SaaS services, confidentiality in communications shall be preserved and shall depend on the system used in their transmission and the network through which they circulate; Ibernova does not assume any other liability for this purpose than those specifically mentioned in this contract.

4.9. Termination

4.9.1. Contract Termination. This Contract shall terminate for the following causes:

(i) At any time, by mutual agreement of the parties.

(ii) Upon termination of the Contract by Ibernova, based on the breach of any of the payment obligations assumed by the Customer under this Contract, without prejudice to Ibernova’s right to opt for continuation of the Contract and to require the Customer to fully comply with its payment obligations, plus any interest for late payment in accordance with the provisions of clause 4.5.2.8.

4.9.2. Termination of a Proposal undersigned within the Contract scope

4.9.2.1. Without prejudice to any other additional causes for termination established in each one of them, any Proposal undersigned within this Contract’s scope shall be terminated for the following causes:

(i) By concluding its term of duration or any of its extensions.

(i) At any time, by mutual agreement of the parties.

4.9.2.2. Ibernova shall have the right to terminate and void a Proposal, including the Software licence, immediately if:

(i) There is any breach of clause 2 (Software); or

(ii) The Customer has not paid within sixty (60) calendar days any fees due under a Proposal; or

(iii) The Customer permanently ceases use of the Software and notifies Ibernova in writing to that effect.

4.9.2.3. In the event that the Customer has not paid the Annual Support and/or Maintenance Fees for sixty (60) calendar days or more, such Services shall be terminated, but the Customer may continue to be entitled to use the Software it has installed under the (financial) conditions indicated by Ibernova.

4.9.2.4. In the case of Subscription or SaaS Service, if the Customer does not pay one of the fees, such service will be terminated, thereby restricting access to the SaaS Service Centre, if applicable.

4.9.2.5. Either party may terminate a Proposal upon written notice to the other party if:

(i) The other party commits a material breach of any term in a Proposal or this Contract that (in the case of a remediable breach) has not been remedied within thirty (30) calendar days of the other party’s written request for a remedy.

(ii) The other party applies for the benefits of an arrangement with creditors or a third-party file against the other party for an arrangement with creditors that prevents it from continuing to perform its obligations normally.

(iii) The other party is unable to pay its debts on a regular basis.

(iv) A trustee, receiver, liquidator, auditor, administrator or similar is appointed in relation to all or part of the business or assets of the other party.

(v) The other party ceases to continue business as a going concern.

(vi) The other party ceases to be in a position to perform the obligations assumed under a Proposal.

4.9.2.6. Furthermore, Ibernova may terminate a Proposal for the sake of convenience by providing 12-month prior written notice to the Customer, and the provisions regarding the effects of termination in clause 4.10 below shall apply.

4.9.2.7. In the event that Ibernova acquires the right to give notice of termination in cases where a receiver, auditor or administrator has been appointed by the Customer (or an equivalent appointment has been made), Ibernova shall not provide said notice of termination unless Ibernova reasonably believes that there may be a breach of these Terms and Conditions or that the Software may be in jeopardy.

4.10. Effects of termination

4.10.1. Effects of Contract termination

(i) Upon termination of this Contract, the Parties shall be bound to respect and observe the clauses that, according to this Contract, persist or are applicable despite its termination.

(ii) Contract termination will automatically terminate the current Proposals, and the Customer will be obligated to pay the amounts that are pending payment for any item in the current Proposals.

(iii) Upon expiration or termination of the Contract and, consequently, of the corresponding current Proposals undersigned within the scope of the Contract, Ibernova shall provide the Customer with the additional assistance (Temporary Extension of Services) as established in this clause, except in the event that Ibernova has terminated the Contract due to non-compliance by the Customer.

(iv) Temporary Extension of Services. In the event that Ibernova terminates the Contract due to Customer non-compliance, Ibernova will only agree to the Temporary Extension of Services if Ibernova so decides and the Customer pays for the Temporary Extension of Services in advance.

The applicable Contract provisions and the corresponding Proposal(s) shall remain in full force and effect during the Temporary Extension of Services.

4.10.2. Effects of Proposal termination

(i) When Ibernova terminates a Proposal, the Customer shall immediately return the Software to Ibernova, or at Ibernova’s request destroy the Software and all copies of the Software or any part thereof, and within seven (7) calendar days certify to Ibernova in writing that it has returned or destroyed the Software, as applicable.

(ii) If the Customer fails to return or destroy the Software, this shall entitle Ibernova, upon reasonable notice, to take such steps as may be necessary to prevent further use of the Software.

4.11. Data Protection

4.11.1. During the term of a Proposal, the parties shall comply with the provisions of current legislation regarding the protection of personal data, either through legislation or regulation, legal requisites or professional codes that govern the use, storage and/or communication of personal data, and shall not allow any act that may result in a breach of the same by either party, all in accordance with the provisions of the contract’s Personal Data Protection Annex that shall be undersigned by the Customer.

4.11.2 In the event that the Customer fails to comply with its payment obligations towards Ibernova, and without prejudice to Ibernova’s right to terminate the Contract in accordance with the provisions of clause 4.9.1, the Customer hereinafter authorises Ibernova to transfer its data to debt management and collection companies in order for them to proceed with the collection of said debts and to include them in credit reference files. Ibernova will provide an advance notification to the Customer indicating the existence of such debt, as well as the entity to which the data is assigned.

4.12. Force Majeure

4.12.1. The parties have no responsibility to comply with any obligation if it is impossible to do so as a result of force majeure. The term force majeure shall be understood to include force majeure on the part of Ibernova’s suppliers, where the suppliers that the Customer has arranged for Ibernova to use cannot adequately comply with their obligations, as well as any defect in Third-Party Products or software that the Customer has arranged for Ibernova to use.

4.12.2 Neither party shall be liable for any delay in performing its obligations if the cause of the delay involves circumstances reasonably beyond its control, and that are unforeseeable or extraordinary, including, but not limited to, any delay caused by interruption of electricity, internet, telecommunications, strikes and unavailability of personnel and any delay caused by any act or omission of the other party.

4.13. Severability

The parties agree that the limitations and exclusions contained in these Terms and Conditions are reasonable under all circumstances of the business relationship between the Client and Ibernova, but that, if in the future, any of the terms are declared unenforceable or invalid under a specific circumstance, neither their application in the remaining circumstances nor the remaining terms shall be affected.

4.14. Waiver

The waiver by either party to demand at any given time compliance with any provision of this Contract or a Proposal shall not imply a general waiver of present or future compliance with that provision or any other provision.

4.15. Notifications

Any notification, request, demand, including those relating to an amendment or modification of these Terms and Conditions, shall be in writing and sent to the address designated by the addressee through a notification sent in accordance with the provisions of this clause. In any case, the parties expressly accept the possibility of sending such notifications by telematic means, including, among others, sending them by e-mail to the person and corporate e-mail account designated by the parties for the purpose of notifications.

Additionally, the notifications made by Ibernova may be sent to the Customer through the interactive online mechanisms that Ibernova has implemented at any time for communication with its customers (for example, intranet, extranet, web space reserved for customers, as well as any other similar environment). Specifically, within this environment, Ibernova may require the Customer to accept the content of the notification or to confirm that it has been received, and it is understood that the acceptance or confirmation issued by the Customer in this environment constitutes a valid and binding manifestation of will for all purposes.

Ibernova reserves the right to notify Customers about any aspect related to new Software features or functionalities, as well as to conduct direct surveys to find out the degree of and satisfaction with its use.

4.16. Dispute procedure and governing law

In the event of a dispute between the parties, before exercising any applicable legal rights, the claimant party must provide written notice of the problem to an official from other party. Then, both parties shall make commercially reasonable efforts to resolve the dispute within the next seven (7) calendar days. If the problem remains unresolved, the claimant party must then provide written notification of the problem to the Managing Director (or equivalent position) of the other party. Then, both parties shall make commercially reasonable efforts to resolve the dispute within the next seven (7) calendar days. If, at the end of this period of fourteen (14) calendar days, a resolution has not yet been reached, then the claimant party has the right to exercise their legal rights.

The interpretation, validity and implementation of this agreement shall be governed by Spanish law and shall be subject to the exclusive jurisdiction of the Courts and Tribunals of Madrid.

THE CUSTOMER or “DATA CONTROLLER.”

1. The DATA CONTROLLER is the legal entity which alone or in conjunction with others determines the means and purposes of data processing subject to this contract in accordance with what is contained in its record of processing activities and in compliance with the provisions of article 4, section 7 of (EU) Regulation 2016/679 – General Data Protection Regulation (hereinafter “GDPR”).
2. The DATA PROCESSOR will process on behalf of THE CUSTOMER the personal data necessary to provide the services that in each proposal corresponds to:
3. a) IT consulting in terms of Software.
4. b) IT maintenance and support for the Olanet/Ibernova MOM/Enntte application, hereinafter “Services”.
5. c) IT maintenance and support for the ERP/MOM (RPS), hereinafter “Services”.
6. d) IT maintenance and support for the ERP/MOM (Ibernova Platform) hereinafter “Services”.
7. The DATA PROCESSOR may access personal data, during the provision of Services to the DATA CONTROLLER and/or its affiliates. Such provision of service may be done by SMARTTECH access to the CUSTOMER IT systems remotely through secure communications networks (VPN, Team Viewer or similar) or by delivery of a backup copy.
8. Both Parties undersign this contract (hereinafter, the “Contract”), in order to formalise the contractual framework of the personal data processor, which they agree on the basis of the following,

CLAUSES:

FIRST. – REGULATION

The processing of personal data shall fully respect (EU) Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter, “GDPR”), Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (hereinafter, “LOPDGDD”), and other applicable regulations.

SECOND. – PURPOSE OF THE PROCESSING ASSIGNMENT

Through these clauses, the DATA PROCESSOR is authorised to process, on behalf of the DATA CONTROLLER, the personal data strictly necessary for the provision of Services identified in the Second Recital of this Contract.

THIRD. – IDENTIFICATION OF THE AFFECTED INFORMATION

For implementation of the services derived from compliance with the purpose of this assignment, the DATA CONTROLLER shall make available to the DATA PROCESSOR,

1. a) IT maintenance and support for the Olanet/Ibernova MOM/Enntte application, the information described below:

• Identifying data: associated with technical projects
• Other data: technical Project data and the data that the Customer attaches to the technical project

1. b) IT maintenance and support for the ERP/MOM (RPS), the information described below:

• Identifying data of customers, suppliers, employees, and users
• Financial data of customers, suppliers, and employees
• Attendance and employee expense control data
• Other data: data that the Customer incorporates into its ERP/MOM (in any case, special protection data)

1. c) IT maintenance and support for the ERP/MOM (Ibernova Platform), the information described below:

• Identifying data of customers, suppliers, employees, and users.
• Economic data of customers, suppliers, and employees
• Time and attendance and employee expense control data.
• Other data: data that the Client incorporates to its ERP / MOM (in no case, data of special protection) .

FOUR. DURATION

This Contract shall take effect from the proposal acceptance date and shall have an indefinite duration, linked to the provision of Service duration identified in the Second Recital of this Contract.

FIFTH. – OBLIGATIONS OF THE DATA PROCESSOR

In accordance with the provisions in article 28 of the GDPR, the DATA PROCESSOR and all of its personnel are committed to the following obligations:

5.1 Data processing

• Use the personal data being processed, or data collected for their inclusion, only for the purpose subject to the provision of Services. Under no circumstances may the data processor use said data for its own purposes or those of third parties.
• Process the data according to the DATA CONTROLLER’s instructions. If the DATA PROCESSOR considers that any of the instructions infringes upon the GDPR or any other provision on data protection within the European Union or the Spanish state, the DATA PROCESSOR shall immediately inform the DATA CONTROLLER.
• The DATA PROCESSOR shall keep, in writing, a record of all categories of processing activities conducted on behalf of the DATA CONTROLLER, which contains, at a minimum, the following:
  • Name and contact details of the data processor(s) and each data controller on whose behalf said data processor is acting and, where appropriate, the data processor’s or data controller’s representative(s) and the data protection officer, if one has been appointed.
  • Description of processing.
  • The categories of processing conducted.
  • The purpose of processing personal data.
  • The justification for the lawfulness of processing personal data.
  • Retention period.
  • The communication of data foreseen in favour of third parties, if applicable (and subject to the express acceptance of the DATA CONTROLLER).
  • Where appropriate, transfers of personal data to a third-party country or international organisation, including the identification of said third-party country or international organisation and, in the case of transfers referenced in article 49, section 1, second paragraph of the GDPR, documentation of appropriate safeguards.
  • An overview of the appropriate technical and organisational security measures in regard to:
    • The pseudonymisation and encryption of personal data.
    • The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
    • The ability to restore the availability and access to personal data quickly in the event of a physical or technical incident.
    • The process of regular verification, evaluation, and assessment of the effectiveness of technical and organisational measures to ensure the security of processing.
• If the DATA PROCESSOR uses the data for another purpose, communicates or uses said data in breach of the stipulations established in this Contract and/or the regulations in force, said Data Processor shall also be considered as the DATA CONTROLLER, having to act in accordance with the regulations in force and being liable, where appropriate, for any infringements it may have personally incurred.
• In the event that, as a consequence of implementing the services, it becomes necessary at any time to modify what is stipulated in this Contract, the DATA PROCESSOR shall reasonably request this and indicate the changes requested. If the DATA CONTROLLER agrees with the request, the Parties shall formalise an addendum to this contract that updates the data in such a way that it always faithfully reflects the details of the processing.

5.2 Communication of data

The DATA PROCESSOR will not disclose data to third parties, unless the data processor has express authorisation to do so from the DATA CONTROLLER, to the extent permitted by law.

The DATA PROCESSOR may communicate data to other data processors from the DATA CONTROLLER, with the prior written consent of the DATA CONTROLLER and in accordance with its instructions. In this case, the DATA CONTROLLER shall identify, in advance and in writing, the entities to which the data is to be communicated, the data to be communicated and the security measures to be applied in order to proceed with said communication.

If the DATA PROCESSOR must transfer personal data, by legal or contractual imperative, to a third-party country or to an international organisation, pursuant to the law of the European Union or of Member States applicable to it, the DATA PROCESSOR shall inform the DATA CONTROLLER of such legal requirement in advance, unless such a law prohibits it for important reasons of public interest.

5.3 Subcontracting of services

When the DATA PROCESSOR proceeds to subcontract activities for the provision of Services and the subcontractor must access personal data under the responsibility of the DATA CONTROLLER, it shall inform the DATA CONTROLLER in advance, identifying the subcontractor, the personal data affected and the processing to be performed, as well as the conditions thereof, in order for the DATA CONTROLLER to potentially oppose said subcontract(s), if it can affect the security of Personal Data.

If the DATA CONTROLLER finally authorises this subcontracting, the subcontractor shall also retain the status of “data processor” and will also be mandated to comply with the obligations established in this document for the DATA PROCESSOR and the instructions issued by the DATA CONTROLLER. It is incumbent upon the DATA PROCESSOR to regulate the new relationship, so that the new processor is subject to the same conditions (instructions, obligations, security measures…) and with the same formal requirements as said DATA PROCESSOR, regarding the proper processing of personal data and the guarantee of rights for the persons affected. In the event of non-compliance by the sub-processor, the initial processor shall remain fully liable to the DATA CONTROLLER in regard to compliance with the obligations.

The DATA PROCESSOR will inform the DATA CONTROLLER of any planned changes in the incorporation or replacement of other subcontractors.

Notwithstanding the foregoing, the DATA CONTROLLER authorises the DATA PROCESSOR to use the following sub-processors in cases where cloud services and/or online management platforms are contracted:

Any change in the provider of cloud-based services will be reported by e-mail.

5.4 Transfer of data to third parties

Unless expressly authorised by the DATA CONTROLLER, or unless there is a legal obligation, the DATA PROCESSOR may not communicate, transfer, or disseminate personal data to third parties, even for storage purposes.

5.5 International data transfers

The data from the DATA CONTROLLER processed by the DATA PROCESSOR may not be processed by the latter outside of the European Economic Area (EEA) unless there is an express authorisation from the DATA CONTROLLER.

The DATA CONTROLLER expressly prohibits the transfer of data outside of the territories indicated in the previous paragraph, either directly or through any subcontractors authorised in accordance with the provisions of this document or other contractual documents, unless it is obligated to do so by virtue of European Union or Member State law applicable to it.

In the event that by the application of national or European Union law the DATA PROCESSOR is required to conduct an international transfer of data, the DATA PROCESSOR shall inform the DATA CONTROLLER of this legal requirement in writing, with sufficient notice prior to carrying out the processing, and shall ensure compliance with any legal requirements applicable to the DATA CONTROLLER, unless the applicable law prohibits it for important reasons of public interest.

5.6 Confidentiality commitment

The DATA PROCESSOR shall:

• Maintain the duty of secrecy in respect of the personal data to which it has had access by virtue of this assignment, even after its purpose has ended.
• Ensure that people authorised to process personal data commit, expressly and in writing, to respect confidentiality and to comply with the corresponding security measures, regarding which they must be informed accordingly.
• Keep documentation proving compliance with the obligation established in the previous section available for the DATA CONTROLLER.
• Ensure the required training on personal data protection is given to people authorised to process personal data.

This obligation extends to any person who could intervene at any stage of the processing on behalf of the DATA PROCESSOR, and it is the duty of the DATA PROCESSOR to instruct the persons reporting to it on this duty of secrecy, and on maintaining this duty even after termination of the provision of Services or of his/her disengagement.

5.7 Attention to rights

When the affected persons exercise their rights of access, rectification, deletion and opposition, limitation of processing, data portability and not to be subject to automated individualised decisions, vis-à-vis the DATA PROCESSOR, the latter must communicate this to the DATA CONTROLLER by e-mail to the address provided by the latter. This communication shall be made promptly and within 3 business days following the request’s reception date, together, where appropriate, with other information that may be relevant to fulfil the request. The DATA PROCESSOR shall assist the DATA CONTROLLER, whenever possible, in order to enable the latter to comply with and respond to the exercise of Rights.

5.8 Right to information

The right to information corresponds to the DATA CONTROLLER. However, in the event that the DATA PROCESSOR should at any time directly collect personal data, at the time of data collection, it must provide information regarding the data processing to be carried out. The text and format in which the information will be provided must be agreed upon with the DATA CONTROLLER prior to the start of data collection, and must, in any case, comply with the contents of the GDPR and the LOPDGDD.

5.9 Notification of data security breaches

In accordance with article 33 of the GDPR, the DATA PROCESSOR shall notify the DATA CONTROLLER, without undue delay, and in any case within a maximum period of twenty-four (24) hours, and using the e-mail provided, of any security breaches involving personal data under its responsibility of which it becomes aware, along with all information relevant to the documentation and communication of the incident. It shall report any incident or failure in its information processing and management system that it has had or may have that jeopardises the security of personal data, their integrity or availability, as well as any possible breach of confidentiality as a result of disclosure of data and information obtained during implementation of the services to third parties. It shall promptly communicate detailed information in this regard, including specifying the persons concerned who suffered a loss of confidentiality and the measures taken for its immediate resolution. If available, at a minimum, the following information must be provided:

• Description of the type of personal data security breach, including, where possible, the categories and estimated number of data subjects affected, and the categories and estimated number of personal data records affected.
• The name and contact details of the data protection officer or other point of contact where further information can be obtained.
• Description of the possible consequences resulting from the personal data security breach.
• Description of the measures adopted or proposed to remedy the personal data security breach, including, where appropriate, the measures adopted to mitigate possible negative impacts.

In case the information cannot be provided simultaneously, and to the extent that it is not, the information shall be gradually provided without undue delay.

It is incumbent on the DATA CONTROLLER to report data security breaches to the Spanish Data Protection Agency. Likewise, it should communicate data security breaches to the interested data subjects as soon as possible, when the breach is likely to pose a high risk to the rights and freedoms of these individual persons.

5.10 Impact assessment

The DATA PROCESSOR must provide support to the DATA CONTROLLER in the creation of impact assessments (hereinafter referred to as “IAs”) relating to data protection, where appropriate. Likewise, it must provide support to the DATA CONTROLLER in conducting prior consultations with the supervisory authority.

5.11 Security measures

The DATA PROCESSOR must process the personal data in accordance with the security criteria and content provided in article 32 of the GDPR, as well as adhere to and adopt the technical and organisational security measures necessary or appropriate to ensure the security of Personal Data to which it has access in any of its dimensions (confidentiality, integrity, availability).

The DATA PROCESSOR is obligated to implement the appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with the provisions of article 32 of the GDPR.

By virtue of the above, the DATA PROCESSOR must implement security measures designed to:

• Guarantee the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
• Restore the availability and access to personal data quickly in the event of a physical or technical incident.
• Verify, evaluate, and assess, on a regular basis, the effectiveness of the technical and organisational measures implemented in order to ensure the security of processing.
• Pseudonymise and encrypt personal data, where appropriate.

The DATA PROCESSOR must conduct a risk analysis of the processing it carries out in order to establish which measures it must apply and how it must do so. The DATA CONTROLLER reserves the right to request from the DATA PROCESSOR the necessary documentation and evidence to prove compliance with the provisions of this section.

5.12 Restitution of personal data

Upon termination of the provision of Services, the DATA PROCESSOR undertakes, as the case may be, to return or destroy:

• The personal data to which it has had access.
• The personal data generated by the DATA PROCESSOR as a result of the processing.
• The media and documents on which any of these data are contained, without keeping any copy; unless their conservation is permitted or required by law or by EU legislation, in which case the destruction shall not take place.

The DATA PROCESSOR may, however, keep the data for as long as liabilities may arise from its relationship with the DATA CONTROLLER. In the latter case, the personal data will be kept blocked and for the minimum time, and will be securely and definitively destroyed at the end of said period, as provided for in article 32 of the LOPDGDD. When the DATA CONTROLLER so requests, the DATA PROCESSOR shall send a certificate attesting to their destruction.

5.13 Collaboration with the DATA CONTROLLER

The DATA PROCESSOR shall collaborate as far as possible with the DATA CONTROLLER in the fulfilment of its obligations regarding:

• Security measures.
• Communication and/or notification of breaches (achieved and attempted) in security measures to the competent authorities or data subjects.
• Support in conducting impact assessments relating to the protection of personal data (IAs) and prior consultations in this regard with the competent authorities; taking into account the nature of the processing and the information available to it.
• Formalisation of those documents or contracts that are necessary for compliance with data protection regulations at all times.

Likewise, it shall make available to the DATA CONTROLLER, at the request of the latter, all the information necessary to demonstrate compliance with the obligations established in this document and other contractual documents and shall collaborate, as far as possible, in the performance of audits and inspections, as the case may be, by the Spanish Data Protection Agency (AEPD).

SIXTH. – OBLIGATIONS OF THE DATA CONTROLLER

The Data Controller expressly declares that all the data supplied to the Data Processor to implement the requested service have been obtained legitimately, and in those cases where it is considered necessary with the free, informed and unequivocal consent of the data subject, and also undertakes to:

1. a) Deliver to the Data Processor or facilitate the latter’s access to the data referenced in clause 2 of this document.
2. b) Inform, in accordance with the regulations, the data subjects whose data are subject to processing and lawfully obtain their express consent or to have legitimate and accreditable reasons for the same.
3. c) Have established the legal basis that legitimises the processing
4. d) Have simple mechanisms for data subjects to exercise their rights.
5. e) Conduct risk assessments, with a record of processing operations and impact assessments if necessary due to the nature of the data processed
6. f) Conduct an impact assessment on the protection of personal data from processing operations to be performed by the Data Processor.
7. g) Have the appropriate security measures in place to safeguard data during their transmission to the data processor
8. h) Conduct the appropriate prior consultations.
9. i) Ensure, in advance and throughout the processing, that the data processor complies with the GDPR.
10. j) Supervise the processing, including the performance of inspections and audits.
11. k) Appoint a data protection officer in those cases where it is mandatory and report his/her identity to the data processor.

SEVENTH. – PERSONS INVOLVED IN DATA PROCESSING

The DATA PROCESSOR must keep a list of persons authorised to process the personal data necessary for the provision of services and guarantee that they undertake, expressly and in writing, to respect confidentiality and to comply with the corresponding security measures, of which they must be duly informed. Likewise, the DATA PROCESSOR must guarantee the necessary training on personal data protection for the persons authorised to process said data.

The DATA PROCESSOR must make the documentation proving compliance with the provisions of this section available for the DATA CONTROLLER.

EIGHTH. – DATA PROTECTION OFFICER

The DATA PROCESSOR must appoint a data protection officer (hereinafter, “DPO”) if necessary according to the GPDR and the LOPDGDDD and communicate this to the DATA CONTROLLER. This communication shall also take place when the appointment is voluntary, and include the identity and contact details of the individual person(s) designated by the DATA PROCESSOR as its representative(s) for the purposes of personal data protection, responsible for compliance with the regulation on the processing of personal data, in the legal/formal and security aspects.

For this purpose, the DATA PROCESSOR has appointed a DPO enrolled in the AEPD Registry and whose contact details are as follows:

NINTH. – AUDIT AND EVIDENCE OF COMPLIANCE

The DATA PROCESSOR must have evidence that proves its compliance with the personal data protection regulations and the duty of active responsibility. Among other evidentiary documentation, it will conduct controls on the degree of compliance with the regulations, which will be made available to the DATA CONTROLLER upon request. Likewise, during the provision of services, it shall make available all information, certifications and audits conducted at any time to the DATA CONTROLLER.

TENTH. – RESPONSIBILITY

THE DATA PROCESSOR is liable for the damages and losses caused by the processing when it has not complied with the obligations described in this contract and with the applicable regulations in regard to these matters or when it has acted outside or against the written instructions established by the DATA CONTROLLER.

When more than one DATA PROCESSOR has participated in the same processing operation and they are responsible for any damage or loss caused by such processing, each data processor shall be held liable for all proven damages and losses.

ELEVENTH. – NOTIFICATIONS

All notifications required for the purposes of this Contract shall be made in writing for the attention and to the address of the person appearing on the heading of this Contract or via the e-mail addresses provided.

TWELFTH. – DUTY TO INFORM

In compliance with the applicable regulations on the protection of personal data ((EU) Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in regard to the processing of personal data and on the free movement of such data; Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights) the legal representatives and/or signatories of this contract are informed that their personal data collected through this contract will be processed by the DATA CONTROLLER, in compliance with and control of the contractual relationship, as well as financial, accounting and tax management and billing management.

The legal basis for processing the personal data provided is the performance of the contract, as well as compliance with legal obligations. The data will not be communicated to third parties unless legally required.

The personal data provided will be kept for the duration of the relationship established through this contract. Once this period has elapsed, the data will be blocked, in order to be able to address potential liabilities derived from the processing of the data, and only for the duration of the statute of limitations for such liabilities. Once these periods have elapsed, this information will be permanently deleted using secure methods.

The legal representatives and/or signatories of the contract are entitled to exercise their rights of access, rectification, deletion, opposition, and limitation of processing, as well as other rights where appropriate, by sending an e-mail to the addresses provided.

When deemed appropriate, recourse can be made to the Supervisory Authority for the protection of personal data: Spanish Data Protection Agency.

THIRTEENTH. – APPLICABLE LAW AND JURISDICTION

The contract shall be governed by Spanish law, with express submission to the Courts and Tribunals of Donosti/San Sebastián, expressly waiving any other jurisdiction that may be eligible, for the resolution of any disputes that may arise in the interpretation, development, performance and/or termination of this contract.