IZT Cloud Voice Data Processing Agreement

1.1 The terms used in this DPA shall be deemed to have the same meaning as in the applicable data-protection regulations and the practice developed at any given time regarding the applicable data-protection regulations. This means that definitions in this DPA may change during the term of the agreement. The above means that this DPA involves the following definitions:

• Processing: the measure or combination of measures concerning Personal Data or sets of Personal Data, e.g. collection, registration, organization, structuring, storage, processing or alteration, creation, reading, use, surrender through transfer, dissemination or other provision, adjustment or consolidation, limitation, deletion or destruction.
• Applicable Data Protection Law: the General Data Protection Regulation (EU) 2016/679 ("GDPR"), and other regulations with the relevant implementation statutes and the regulations in this area applying at any given time. Non-European Data Protection Legislation may also apply to the processing of Customer Personal Data.
• Data Controller: the entity which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.
• Data Processor: the entity which processes Personal Data on behalf of the Controller.
• Personal Data: any information relating to an identified or identifiable natural person.
• Personal Data Breach: security incidents leading to unintentional or unlawful destruction, loss or alteration, or to unauthorized disclosure of or unauthorized access to the Personal Data that has been transferred, stored and otherwise been the subject of Processing.
• Sub-processor: any personal-data processor engaged by the Data Processor or Data Controller that processes Personal Data on behalf of the Data Controller.

2.1 Parties' Roles. Customer, as Data Controller, appoints IZT Cloud, Inc. as a Data Processor to process the Personal Data on Customer's behalf. The processing the Data Processor will perform on behalf of the Data Controller shall be regulated by this DPA.

2.2 Purpose Limitation. Data Processor shall process the Personal Data for the purposes described in Annex A, except where otherwise required by applicable law. Any additional processing required by Data Controller outside of the scope of the DPA will require prior written agreement between the parties, including agreement on any additional fees that Data Controller may be required to pay.

2.3 On the basis of the above, the Parties have entered into the following DPA.

3.1 Security. Data Processor will maintain appropriate security measures to safeguard the security of Personal Data. Data Processor will maintain an information security and risk management program based on commercial best practices to preserve the confidentiality, integrity and accessibility of Personal Data with administrative, technical and physical measures conforming to generally recognized industry standards and practices. Data Processor shall implement appropriate technical and organizational measures to protect Personal Data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

3.2 Confidentiality. Data Processor shall ensure that any personnel whom Data Processor authorizes to process Personal Data on its behalf is subject to confidentiality obligations with respect to that Personal Data. The undertaking to confidentiality shall continue after the termination of the above-entitled activities.

3.3 Personal Data Breaches. Data Processor will notify the Data Controller as soon as practicable after it becomes aware of any Personal Data Breach affecting any Personal Data. At the Data Controller's request, Processor will promptly provide the Data Controller with all reasonable assistance necessary to enable the Data Controller to notify relevant Personal Data Breaches to competent authorities and/or affected Data Subjects, if Data Controller is required to do so under the Data Protection Law.

3.4 Data Subject Requests. Data Processor will provide reasonable assistance, including by appropriate technical and organizational measures and taking into account the nature of the Processing, to enable Data Controller to respond to any request from Data Subjects seeking to exercise their rights under the Data Protection Law with respect to Personal Data (including access, rectification, restriction, deletion or portability of Personal Data, as applicable), to the extent permitted by the law. If such request is made directly to Data Processor, Data Processor will promptly inform Data Controller and will advise Data Subjects to submit their request to the Data Controller. Data Controller shall be solely responsible for responding to any Data Subjects' requests. Data Controller shall reimburse Data Processor for the costs arising from this assistance.

3.5 Sub-processors. Data Processor maintains a list of Sub-processors in Annex A. Data Processor shall notify Data Controller at least thirty (30) days prior to adding or replacing any Sub-processor by email to the primary account contact. Data Controller may object to such changes in writing within fifteen (15) days of notification. If Data Controller objects on reasonable data protection grounds and the parties cannot resolve the objection within fifteen (15) days, Data Controller may terminate the affected Services without penalty. If Data Controller does not object within the fifteen (15) day period, the new Sub-processor shall be deemed accepted. Data Processor shall ensure that its data protection obligations set out in this DPA are imposed on any Sub-processor by written agreement. Data Processor shall remain fully liable to Data Controller for the performance of any Sub-processor.

3.6 Audit Rights. Upon Data Controller's written request (no more than once per twelve-month period), Data Processor shall make available information necessary to demonstrate compliance with this DPA. Data Processor shall permit and contribute to audits conducted by Data Controller or an independent third-party auditor, subject to the following conditions: (a) Data Controller shall provide at least thirty (30) days' prior written notice; (b) audits shall be conducted during normal business hours with minimal disruption to Data Processor's operations; (c) auditors shall execute confidentiality agreements acceptable to Data Processor; (d) Data Controller shall bear all costs associated with such audit unless the audit reveals a material breach by Data Processor.

Within the scope of the DPA and in its use of the services, Data Controller shall be solely responsible for complying with the statutory requirements relating to data protection and privacy, in particular regarding the disclosure and transfer of Personal Data to the Data Processor and the Processing of Personal Data. Customer, as Data Controller, shall be responsible for ensuring that:

4.1 It has complied, and will continue to comply, with all Applicable Data Protection Law, including in any instructions it issued to IZT Cloud, Inc. under this DPA.

4.2 It has, and will continue to have, the right to transfer, or provide access to, the Personal Data to IZT Cloud, Inc. for processing in accordance with this DPA.

5.1 This DPA is valid until the Data Processor's processing of the Personal Data ceases.

5.2 Upon completion of processing, the Data Processor shall return the Personal Data to the Data Controller in a general and legible format, and shall thereafter delete the Personal Data from systems used for processing, unless this is incompatible with other mandatory legislation.

6.1 Indemnification by Customer. Customer shall indemnify, defend, and hold harmless IZT Cloud, Inc., its officers, directors, employees, agents, and representatives from and against any third-party claims, losses, costs (including reasonable legal fees), and liabilities arising from: (a) Customer's breach of this DPA; (b) Customer's breach of Applicable Data Protection Law; (c) Customer's instructions that cause IZT Cloud, Inc. to violate Applicable Data Protection Law; or (d) any claim that Customer Data infringes third-party rights.

6.2 Indemnification by IZT Cloud, Inc. IZT Cloud, Inc. shall indemnify, defend, and hold harmless Customer, its officers, directors, employees, agents, and representatives from and against any third-party claims, losses, costs (including reasonable legal fees), and liabilities arising from: (a) IZT Cloud, Inc.'s breach of this DPA; (b) IZT Cloud, Inc.'s breach of Applicable Data Protection Law in processing Personal Data; or (c) a Personal Data Breach caused by IZT Cloud, Inc.'s failure to implement appropriate security measures as required under Section 3.1.

6.3 Indemnification Procedure. The indemnified party shall: (a) promptly notify the indemnifying party in writing of any claim; (b) grant the indemnifying party sole control of the defense and settlement; and (c) provide reasonable assistance at the indemnifying party's expense.

These instructions form an integral part of the DPA and shall be adhered to by the Data Processor in the processing of Personal Data, unless expressly state otherwise in the DPA. The Data Controller may unilaterally change these instructions at a later date by notifying the Data Processor of the change in writing.

Changes take effect no earlier than 3 calendar days after having been sent by the Data Controller. By accepting the DPA, the Data Controller Processor has confirmed the meaning of these instructions.

Purpose

The purpose of the processing is:

• to deliver communication and collaboration Services
• to support the Services with which the customer is supplied

Type of Personal Data

The following types of Personal Data are processed:

• Name
• Password
• Email
• Phone number
• IP address
• User-generated content, e.g. call information
• User behavior, system log for troubleshooting

The Data Controller and its users can upload Personal Data e.g. profile picture, phone number, address and further contact details. Upon uploading, the Data Controller approves the Data Processor's processing and storage of this information.

The Data Controller and its users can enable/disable certain features, e.g. Call Recording. Upon enabling these features, the Data Controller approves the Data Processor's processing and storage of this information.

The Personal Data processed is determined and controlled by the Data Controller in its sole discretion. As such, IZT Cloud, Inc. has no control over the nature, volume and sensitivity of Personal Data processed through its Services by the Data Controller or its users.

Duration of Processing

Processing lasts for as long as the Data Processor represents the Data Controller. Upon termination of the Services, Personal Data can be deleted by resetting the IZT Cloud Voice PBX to factory default.

Sub-processors

The Sub-processors are used for hosting of servers, and these Sub-processors operate with adequate level of protection for personal data and comply with Applicable Data Protection Law. The list of Sub-processors are as follows:

* Features marked can be disabled or Customer may choose not to use. If disabled or not used, no Personal Data will be transferred to the relevant Sub-processor.

Disclosure of Personal Data

Personal Data may be disclosed to:

• Authorities: On request, and in accordance with the law and official decisions, the Data Processor is obliged to disclose the data resulting from the decision, e.g. to the police.
• Emergency services: In the event of a call to SOS Alarm, for example.
• Other operators or service providers providing the Service: When placing calls to another operator, for example, certain Personal Data is registered with said operator.

Personal Data may also be disclosed to other companies and authorities after the Data Controller has given consent, and/or in order to discharge a specific part of the Service under an agreement.

Changes to this DPA

IZT Cloud, Inc. may change this policy from time to time. If you continue to use IZT Cloud Voice after those changes are in effect, you agree to the revised policy. If the changes are material, we may provide more prominent notice or seek your consent to the new policy.