Data Processing Agreement

1. Scope and Application

This appendix applies only to the extent that VoyraCloud, as a processor on your behalf, processes personal data ("Data") contained in or related to your member content in the course of providing any VoyraCloud services to you, if required by data protection regulations (as defined below).

This appendix constitutes part of the VoyraCloud terms and conditions, or other equivalent agreement between you and VoyraCloud regarding your use of VoyraCloud services ("Agreement").

Capitalized terms not defined here will have the meanings given in the Agreement. If there is a conflict between other terms of this Agreement (including its appendices) or any other agreement you have with VoyraCloud regarding data and this appendix, this appendix shall prevail.

2. Definitions

In this appendix:

"Controller," "Data Subject," "Process," "Processor," and "Supervisory Authority" all have the meanings given to them in the GDPR, or equivalent terms under applicable data protection regulations.

"Data Protection Law" means (as applicable): all laws and regulations applicable to you and/or VoyraCloud processing data and binding upon them, including but not limited to (i) GDPR, (ii) GDPR preserved to UK law by section 3 of the European Union (Withdrawal) Act 2018 ("UK GDPR"), (iii) Singapore Personal Data Protection Act 2012 ("PDPA"), and in each case any relevant national laws, regulations, rules or regulations related to privacy and data protection. For clarity, references to data protection laws include references to data protection laws as amended, modified, extended, re-enacted, consolidated or replaced from time to time.

"GDPR" means Regulation (EU) 2016/679.

"Personal Data" means personal data, personal information, personally identifiable information or other equivalent terms (all as defined in data protection regulations).

"Restricted Transfer" means (i) in the case of applicable GDPR, the transfer of personal data from the European Economic Area to countries, territories or organizations outside the European Economic Area where such transfer is not subject to an adequacy decision by the European Commission; and (ii) in the case of applicable UK GDPR, the transfer of personal data from the UK to any other country, territory or organization where such transfer is not based on adequacy provisions set out in section 17A of the UK Data Protection Act 2018.

"Standard Contractual Clauses" means (i) if data is protected by GDPR, the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council ("EU SCCs"); and (ii) if data is protected by UK GDPR, the "International Data Transfer Addendum to the European Commission's Standard Contractual Clauses" issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018 ("UK Addendum"). Copies of the Standard Contractual Clauses can be obtained at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc, or by contacting us at voyracloud@gmail.com.

3. Processing Description

For this appendix, you (as a controller or processor) designate VoyraCloud as your processor, processing data during the term of this Agreement for the purpose of providing VoyraCloud services and complying with applicable law ("Permitted Purpose").

4. Data Processing

When processing data in accordance with this Agreement, VoyraCloud shall within the scope of its possession or control:

(a) Process data only at your written instruction, unless applicable law requires otherwise;

(b) Ensure that all personnel authorized to process data through VoyraCloud comply with appropriate confidentiality obligations;

(c) Implement and maintain appropriate technical and organizational security measures (including access controls), or make other reasonable security arrangements, aimed at: (i) Protecting VoyraCloud's data from unauthorized or accidental access, processing, deletion, loss or use caused by VoyraCloud's security vulnerabilities; VoyraCloud may change these measures from time to time, but will not lower the level of protection below the mandatory minimum required by data protection regulations (if applicable). If a confirmed security event occurs, within the scope of data protection regulations: (1) VoyraCloud shall promptly notify you and provide you with reasonable information and cooperation so that you can fulfill any data breach reporting obligations under applicable data protection law (and in accordance with its time table); (2) VoyraCloud shall further take any reasonable necessary measures and actions to mitigate the impact of the security event and shall keep you informed of all significant developments related to the security event. Security events shall be considered to include the "personal data breach" as defined under applicable data protection law or any equivalent term;

(d) General authorization is hereby granted to you to engage third-party subcontractors for the purpose of processing data, but subject to VoyraCloud's (i) (on condition that you comply with the provisions of section 5 below) assuming full responsibility for any subcontractor; and (ii) imposing data protection terms on any subcontractor designated to process data on behalf of VoyraCloud, requiring that such subcontractor comply with applicable data protection law or this appendix (in the stronger of the two); You may object to the appointment or replacement of such subcontractors before VoyraCloud appoints or replaces them, provided that such objection is based on reasonable grounds relating to data protection; In such case, VoyraCloud shall not appoint or replace the relevant subcontractors, or, if this is not possible, you may terminate the relevant VoyraCloud services and this appendix (within the scope of the VoyraCloud services) but you shall not be entitled to any refund for any fees or costs incurred in connection with such termination, and such termination shall not affect any other services provided to you or any related fees or costs;

(e) Assist you in responding to requests from data subjects to exercise their rights under applicable data protection law, by providing technical measures, enabling you to directly access, correct, delete, restrict or export data within the scope of VoyraCloud's services and VoyraCloud's role as a processor, consistent with your use of VoyraCloud services (and you agree, considering the nature of processing, that this section reflects VoyraCloud's ability to provide such assistance); If data subjects, supervisory authorities, or any other party directly request data from VoyraCloud, VoyraCloud shall immediately notify you or notify the person they should contact you;

(f) If VoyraCloud believes or is aware that its processing of data may pose a high risk to the data subject's data protection rights and freedoms, it shall immediately notify you and provide reasonable cooperation and/or consultation on any data protection impact assessment and/or prior consultation, at your expense, under applicable data protection law;

(g) In your discretion, upon termination of this Agreement, VoyraCloud shall delete or return all data owned or controlled by VoyraCloud, but VoyraCloud shall not be liable for any costs incurred in connection with such deletion or return; If applicable law requires or permits VoyraCloud to retain part or all of the data, or data archived on backup systems, then this requirement does not apply, in which case VoyraCloud shall isolate and protect such data to prevent further processing, except in the following cases: (i) within the scope of the law's requirements, until such data can be deleted; or (ii) such data no longer contains personal data;

(h) VoyraCloud shall make reasonable security arrangements, at (appropriate periodic intervals), to verify the adequacy of its security measures; and

(i) No policy or action that may be inconsistent with data protection law shall be implemented or taken.

If you are granted audit rights (e.g., standard contractual clauses or applicable data protection law), you agree to exercise your audit rights by instructing VoyraCloud to conduct audits in accordance with this clause. If you wish to change this instruction, you may do so by written request or in accordance with the provisions of standard contractual clauses, and such change shall be made in writing (for clarity, none of the above content requires VoyraCloud to provide any data, materials or information about any other VoyraCloud customer).

For the avoidance of doubt, none of the above content requires VoyraCloud to disclose any rights, privileges or immunities granted under any law or professional conduct rule relating to the disclosure of such information.

5. Your Responsibilities

You agree:

(a) To comply with all obligations under applicable data protection laws with respect to you: (i) using VoyraCloud services to process personal data; (ii) designating us as your processor under this appendix; and (iii) processing personal data contained in VoyraCloud services.

(b) This appendix, the Agreement, any other applicable agreements between you and VoyraCloud, and your configuration and use of VoyraCloud services shall together constitute your complete and final written instructions regarding data processing to VoyraCloud; and

(c) You shall not issue any instructions to VoyraCloud as your processor, nor use VoyraCloud services in any way, such that any applicable data protection law or any other applicable law or regulation may be infringed upon, or VoyraCloud or any of its affiliates may infringe any applicable data protection law or regulation. Subject to the general nature of these terms, you agree and acknowledge that when you disclose personal data to VoyraCloud, you shall: (i) obtain or obtain consent from the relevant data subject under applicable law, so as to process personal data of such data subject and disclose it to VoyraCloud for the purpose of collecting, using and/or disclosing (without affecting any other legal basis for VoyraCloud's processing of such personal data), and such consent has not been withdrawn; or (ii) under the scope of law where no consent is required, you have obtained all necessary legal basis under data protection law to process and disclose personal data to VoyraCloud for the purpose of providing VoyraCloud services under this appendix.

(d) You are responsible for the accuracy of your data and ensure it remains up-to-date, and you shall respond to any requests or complaints from data subjects.

6. International Transfer

6.1 You may decide where to store your data ("designated region"). You agree to store your data in the designated region and transfer your data to the designated region. If processing of your data involves transfer outside the designated region, VoyraCloud shall take the measures necessary as a processor to ensure that such transfer complies with applicable data protection regulations.

6.2 If you transfer data to VoyraCloud constituting a restricted transfer, you agree that the Standard Contractual Clauses shall be deemed to be concluded between you (as a data exporter) and VoyraCloud (as a data importer) by reference to this appendix, as follows:

6.2.1 For data protected by GDPR, the EU SCC shall apply as follows:

(a) If you are the controller of the data module, then the second provision shall apply; if you are the processor of the data module, then the third provision shall apply, in each case, as follows:

(i) In section 7, the optional access clause shall apply (but any new party joining the EU SCC shall be subject to VoyraCloud's prior written consent);

(ii) Option 2 in section 9 shall apply, and the notice period for changes in subcontractors shall be in accordance with the provisions of this appendix section 4(d);

(iii) Option 1 in section 11 shall apply, and the EU SCC shall be subject to Dutch law;

(iv) In section 17, option 1 shall apply, and the EU SCC shall be subject to Dutch law;

(v) The dispute in section 18(b) shall be subject to Dutch court jurisdiction;

(vi) The Annex I of the EU Standard Specifications shall be deemed to contain the complete content of this appendix and/or Annex I of this appendix, and Annex C of the EU Standard Specifications shall be determined by the European Standard Specifications Commission under section 13 of the EU Standard Specifications;

(vii) Annex II of the EU Standard Contractual Clauses shall be deemed to contain the information listed in the Annex C of the linked file in section 4(c);

(b) The following clarifications apply to the EU Standard Clauses:

(i) You may exercise the audit rights under the EU Standard Clauses by applying the provisions of section 4(h) of this appendix and complying with its requirements;

(ii) VoyraCloud may appoint subcontractors under the provisions of section 4(d) of this appendix and you may exercise your right to refuse subcontractors under the provisions of section 4(d) of this appendix;

(iii) Section 4(g) applies to the deletion or return of data transferred after the termination of this Agreement;

(iv) For the avoidance of doubt, considering the nature of VoyraCloud services, you are fully responsible for the accuracy of your data and the legality of your data collection, VoyraCloud has no obligation to check the accuracy of any data transmitted;

(c) You shall pay VoyraCloud the standard professional service fees at the time of the transaction, and shall also reimburse VoyraCloud for any reasonable costs incurred in connection with your use of any data transferred to VoyraCloud under the EU SCC, including but not limited to notification or assistance in processing data subject requests or responses to data subject requests, and cooperation with your deletion or correction of any data transferred;

6.2.2 For data protected by UK GDPR, the UK Addendum shall apply, as follows:

(a) The EU Standard Clauses as filled out in section 6.2.1 shall apply, and shall be modified in accordance with the UK Addendum (filled out under section (b) of this appendix); and

(b) Tables 1 to 3 of the UK Addendum shall be deemed completed, containing information from the EU SCC as described above, and the "exporter" and "importer" options in table 4 shall be deemed selected. The start date of the UK Addendum (as described in table 1) shall be the date of this appendix.

6.2.3. For data outside the scope of GDPR and UK GDPR, if such jurisdictions allow the use of EU SCC (which may be modified to comply with relevant data protection law), then the provisions of the EU SCC shall apply, and necessary modifications shall be made to comply with relevant data protection regulations of the relevant jurisdictions.

6.2.4. For data protected by PDPA, VoyraCloud shall take reasonable necessary measures to ensure that your personal data continues to be protected at least to the standard set out in PDPA. This may include entering into a written agreement with the recipient, including contract terms, company rules with binding effect, and other data protection agreements.

6.3 For further transfer to subcontractors, VoyraCloud shall only participate in such data transfer (including restricted transfer) if it is fully compliant with data protection regulations.

6.4 If any provision of this appendix directly or indirectly conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

6.5 Subject to any express provisions of this appendix, you agree and acknowledge that you are responsible for compliance with data protection regulations in the following respects: (a) you transfer data from one jurisdiction to another; and/or (b) you instruct VoyraCloud (as your processor) to transfer data from one jurisdiction to another. Subject to the general nature of these terms, you agree and acknowledge that you shall not instruct us or cause us to transfer any personal data to any country or region unless required under data protection regulations regarding such transfer, including but not limited to any obligations under applicable data protection law that may be applicable to you in connection with such transfer, to ensure that the level of protection of the transferred data is consistent with that required under data protection regulations.

7. Other

(a) For clarity, the total cumulative liability of VoyraCloud and its affiliates, employees, agents, subsidiaries, representatives or any representative acting on their behalf for any matter arising out of or related to this Agreement and/or this appendix and/or the Standard Contractual Clauses or any such matter shall not exceed the maximum liability of VoyraCloud under the VoyraCloud terms and conditions section 11.6.

(b) VoyraCloud may modify the terms of this appendix, for example to comply with data protection law or to implement any standard contractual clauses adopted by the Information Commissioner's Office, European Commission or any other supervisory authority under data protection law, but such modifications shall not lower the level of protection provided to you below the mandatory minimum required by data protection law (if applicable). If VoyraCloud modifies the terms of this appendix, then the appendix shall be a revised and restated version on the VoyraCloud platform, and VoyraCloud shall provide you with written notice of any significant revision of the appendix (which may be published on the VoyraCloud platform or displayed in your VoyraCloud account) at least 15 days in advance. Continuing to use the relevant product or service after receiving such written notice constitutes your agreement to be bound by the revised and restated appendix.

Appendix 1

A. List of Parties

Data exporter:

Name: Entity identified as "Customer" in VoyraCloud terms and conditions.

Address: Address of the customer associated with the customer's VoyraCloud account, or any other address specified in the data processing appendix or VoyraCloud terms and conditions.

Contact person name, title and contact details: Contact details of the customer account, or any other contact details specified in the data processing appendix or VoyraCloud terms and conditions.

Activity related to data transmitted according to this clause: Specified in sections 3 and 4 of the data processing appendix.

Signature and date: You clicked the "I agree" button when registering your account, which represents your confirmation, signature and acceptance of the terms and conditions and the data processing appendix on the same day.

Role (controller/processor): Controller or processor, as specified in the data processing appendix.

Data importer:

Name: "VoyraCloud" as described in VoyraCloud terms and conditions.

Address: VoyraCloud address specified in VoyraCloud terms and conditions.

Contact person name, title and contact details: Contact details of VoyraCloud specified in the appendix or VoyraCloud terms and conditions.

Activity related to data transmitted according to this clause: Specified in sections 3 and 4 of the data processing appendix.

Signature and date: You clicked the "I agree" button when registering your account, which represents your confirmation, signature and acceptance of the terms and conditions and the data processing appendix on the same day.

Role (controller/processor): Processor

B. Transfer Description

Data subject categories of transferred personal data: Data subjects may include your customers, employees, suppliers and end users.

Categories of transferred personal data: The capitalized terms not defined here shall have the meanings given in VoyraCloud terms and conditions. Personal data may include any information, content, materials and data in electronic format contained in or related to member content.

Transmission of sensitive data (if applicable) and measures taken to limit or secure such data, such as strict purpose limitations, access restrictions (including only accessible to employees trained in a specific manner), maintaining data access records, restricting subsequent transfers or additional security measures: You may upload special categories of personal data to your VoyraCloud services, which may include (depending on your choice) revealing racial or ethnic origin, political views, religious or philosophical beliefs, trade union membership, genetic data, data relating to the unique identification of natural persons, data relating to health or data relating to the natural person's sex life or sexual orientation, and/or data relating to criminal convictions and crimes or related security measures. Before uploading any sensitive data, you are required to assess and confirm that VoyraCloud's technical and organizational measures are sufficient to handle the sensitive data you choose to upload.

Frequency of transmission (e.g., whether data is transmitted on a one-time or continuous basis): Data may be transmitted occasionally or continuously for the purpose of providing VoyraCloud services and any other provisions of this Agreement.

Nature of processing: We shall process and transmit personal data for the purpose of providing VoyraCloud services and any other provisions of this Agreement.

Purpose of data transmission and further processing: We shall process and transmit personal data for the purpose of providing VoyraCloud services and any other provisions of this Agreement.

Retention period of personal data (if not determinable, then standard): Data shall be processed and transmitted during the term of this Agreement.

For transfer to sub-processors, the subject, nature and duration of processing shall also apply to such transfer to sub-processors.

C. Supervisory Authority

Supervisory authority: For EU GDPR, the supervisory authority shall be interpreted in accordance with the EU SCC section 13; for UK GDPR, the supervisory authority shall be the Information Commissioner's Office.