Cloud 365+ Terms and Conditions

These terms of service ("Terms") are a legal agreement between you, either an individual or a single legal entity, and the entity identified in Section 1 that operates as Cloud 365+ ("C365+"). These Terms govern your use of any C365+ online services ("Services"), the C365+ website ("Site"), the client software distributed with this Agreement and any other software provided by C365+, including any updates and any accompanying documentation ("Software"). Collectively, the Software, the Site and the Services may be referred to as the "Products."

By clicking the "I AGREE" button, or using any Products, you agree to these Terms and the C365+ Privacy Policy. If you do not agree to these Terms or the Privacy Policy, then do not click the button indicating your acceptance and do not use the Products. If you agree to these Terms on behalf of a legal entity, you represent that you have the authority to bind that legal entity to these Terms.

1. Contracting entity

The data processing performed by the Data Processor on behalf of the Data Controller relates to the Service — a managed, encrypted backup/copy of data selected by the Data Controller. We need certain personal data to enable us to provide our products and services to our clients. In collecting this information, we are acting as a data controller.

Between: Cloud 365+ (C365+) — hereafter "Data Processor"

And: You, the client — hereafter "Data Controller"

The Data Controller and the Data Processor may be referred to individually as a "Party" and collectively as the "Parties".

"data controller" means a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed.

"data processor", in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller.

"processing", in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data. The subject matter, duration, nature and purpose of the Processing, and the types of Personal Data and categories of data subjects shall be as defined in Schedule 1 of this agreement.

Whereas:

• The Data Controller wishes to subcontract certain Services, which imply the processing of personal data, to the Data Processor.
• The Parties seek to implement a data processing agreement that complies with the requirements of the current legal framework in relation to data processing and with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

2. Accounts and fees

2.1 You must register with C365+ to use the Services, and you agree to keep your registration information accurate, complete and up-to-date as long as you continue to use the Services.

2.2 If you sign up for a Trial Account, you agree to pay the fixed subscription fees if you agree to continue with the service after the 30 days trial expires. The service is an automatic renewal unless cancellation has been received (please refer to point 10, Term and Termination). Any accounts not changed to Live from Trial will auto-delete after 90 days.

2.3 If you exceed any quota allocated to your account, you agree that C365+ may restrict your ability to backup further data until you reduce your storage usage or agree to increase your account with a higher quota or no quota at all.

2.4 Partners understand that they have control over their own clients' quotas. If a client exceeds its quota limit the partner is responsible for increasing the client's quota. C365+ will monitor this and will contact the partner directly to inform them if an account is exceeding its quota.

2.5 If you use a credit card for payment, you authorize C365+ to automatically renew your subscription and charge the then-current renewal fees to the credit card associated with your account unless you notify C365+ 30 days before expiration of your current subscription that you do not want to renew.

2.6 Data must be stored for a minimum of 90 days; any data deleted from a Live account within 90 days will still be chargeable at the same buy price rate.

2.7 If paying by direct debit (most countries worldwide), payments will be taken around the 5th monthly. To set up a DD the link is https://pay.gocardless.com/AL0000ZVZJNYKR.

2.8 C365+ reserves the right to and may vary the quoted price of Services, by giving 30 days notice to Customer, to reflect any relevant fluctuation in foreign exchange currency rates which varies the cost price to C365+ by more than two percent (2%).

2.9 C365+ reserves the right to and may vary the quoted price of Services, by giving 30 days notice to Customer, to reflect any relevant supplier cost fluctuations which varies the cost price to C365+ by more than two percent (2%).

2.10 C365+ shall provide all such evidence as the Customer may reasonably request in order to verify increases in any of the costs described in Clause 2.8 and 2.9.

3. Passwords, security & use of Services

3.1 You are responsible for keeping your passwords secure, and you agree not to disclose your passwords to any third party.

3.2 You are solely responsible for any activity that occurs under your user names and accounts, including any sub-accounts. If you lose your passwords or the encryption keys for your accounts, you may not be able to access your data. [Note: Without this Encryption Key, C365+ are unable to restore client's data. C365+ are unable to change or reset the Encryption Key. C365+ do not know or store any passwords].

3.3 You must notify C365+ immediately of any unauthorized use of your accounts or any other security breach related to the Service. If C365+ determines that a security breach has occurred or is likely to occur, C365+ may suspend your accounts and require you to change your user names and passwords.

3.4 C365+ shall notify you, the Data Controller, without undue delay after becoming aware of a Personal Data Breach, and shall notify the relevant supervisory authority (ICO) as applicable.

3.5 Subject to these Terms, C365+ grants you a limited, non-exclusive, non-transferable and revocable licence to access the Site and use the Services and Software.

3.6 You may install and use the Software in executable form on a one client licence per machine basis; additional machines added will be charged and invoiced per machine if applicable. By installing the Software and associated licence, you are agreeing to accept additional costs. Any historical accounts will be reviewed individually and contacted 30 days prior to any changes being implemented.

3.7 You acknowledge that certain third party code may be provided with the Software and that the licence terms accompanying that code will govern its use.

3.8 You specifically agree that you will not, nor will you permit another person to:

• sub-licence, lease, rent, loan, transfer, or distribute any portion of the Products;
• modify, adapt, translate, or create derivative works from the Products;
• decompile, reverse engineer, disassemble, or otherwise attempt to derive source code from the Products; or
• remove, obscure or alter any trademark, copyright or other proprietary rights notices displayed in the Software or on the Site.

3.9 Any Software you have installed will periodically check with C365+ Servers for updates, and you agree that C365+ may automatically download and install such updates on your devices.

3.10 Use of these "Services" will require us to send you, via the email provided, backup reports and server status notices. Agreeing to these "Terms" means specifically agreeing to receiving these emails.

4. Compliance with laws and acceptable use

4.1 You, as Data Controller, are solely responsible for your conduct related to the Service and any data you store or share on the Service. You specifically agree that you will not use the Products to:

• violate any laws or regulations;
• infringe the intellectual property or other rights of third parties;
• transmit any material that is obscene or objectionable or that contains viruses or other harmful computer code or files such as Trojan horses, worms, or time bombs;
• in connection with any nuclear, aviation, mass transit, or medical application or any other inherently dangerous application that could result in death, personal injury, catastrophic damage, or mass destruction; or
• in any other way which results in (or is likely to result in) C365+ having to defend its own interests before a court, government agency, industry regulator, self-regulatory body or similar membership organization, or dispute resolution body and/or which incurs (or is likely to incur) any losses, costs, expenses, damages or other liability in connection with any threatened or actual civil, criminal or administrative proceedings.

5. Data Protection

5.1 As the performance of the Agreement and the delivery of Services implies the processing of personal data, the Data Controller and the Data Processor shall comply with the applicable data protection legislation and regulations.

5.2 The obligations of the Processor are as follows. The Data Processor shall ensure that in relation to personal data disclosed to it by, or otherwise obtained from the Data Controller, it shall act as the Data Controller's data processor in relation to such personal data and shall therefore:

• create and maintain a record of its processing activities in relation to this Agreement; the Data Processor shall make a record available to the Data Controller, any auditor appointed by it and/or the supervisory authority on first request;
• implement appropriate technical and organisational measures for the fulfilment of Data Controller's obligation to respond to requests by Data Subjects to exercise their rights of access, rectification or erasure, to restrict or object to processing of Personal Data, or to data portability;
• not process the personal data for any purpose other than to deliver the Services and to perform its obligations under the Agreement in accordance with the documented instructions of the Data Controller; if it cannot provide such compliance, for whatever reasons, it agrees to promptly inform the Data Controller of its inability to comply;
• inform the Data Controller immediately if it believes that any instruction from the Data Controller infringes applicable data protection legislation and regulations;
• not disclose the personal data to any person other than to its personnel as necessary to perform its obligations under the Agreement and ensure that such personnel is subject to statutory or contractual confidentiality obligations;
• take appropriate technical and organisational measures against any unauthorised or unlawful processing, and evaluate at regular intervals the adequacy of such security measures as described in Schedule 1;
• ensure that access, inspection, processing and provision of the personal data shall take place only in accordance with the need-to-know principle, i.e. information shall be provided only to those persons who require the personal data for their work in relation to the performance of the Services;
• promptly notify the Data Controller about (i) any legally binding request for disclosure of the personal data by a data subject, a judicial or regulatory authority unless otherwise prohibited, such as the obligation under criminal law to preserve the confidentiality of a judicial enquiry, and assist the Data Controller with (ii) any accidental or unauthorised access, and more in general, any unlawful processing;
• deal promptly and properly with all reasonable enquiries from the Data Controller relating to its processing of the personal data or in connection with the Agreement;
• make available to the Data Controller all information necessary to demonstrate compliance with the applicable data protection legislation and regulations;
• at the request and costs of the Data Controller, submit its data processing facilities for audit or control of the processing activities;
• refrain from engaging another data processor without the prior written consent of the Data Controller;
• assist the Data Controller, subject to reasonable additional compensation, with the Data Controller's obligation under applicable data protection laws and regulations;
• respect the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another Processor, namely that the Processor may not engage another Processor (Sub-Processor) without the prior authorisation of the Controller. Those Sub-Processors that are authorised by the Controller at the date of this agreement are listed in Schedule 2. In cases where another Processor is engaged, the Sub-Processor must be subject to the same contractual terms as described in this Agreement.

5.3 The obligations and rights of the controller are as follows. The Controller shall:

• take into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons; the Controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that Processing is performed in accordance with the GDPR. Those measures shall be reviewed and updated where necessary;
• where appropriate in relation to Processing activities, the measures referred to above shall include the implementation of appropriate data protection policies by the Controller;
• implement appropriate technical and organisational measures for ensuring that, by default, only Personal Data which are necessary for each specific purpose of the Processing are processed. That obligation applies to the amount of Personal Data collected, the extent of their Processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default Personal Data are not made accessible without the individual's intervention to an indefinite number of natural persons.

5.4 Personal data processed in the context of this Agreement may not be transferred to a country outside of the European Economic Area without the prior written consent of the Data Controller. If personal data processed under this Agreement is transferred from a country within the European Economic Area to a country outside the European Economic Area, both Data Controller and Data Processor shall ensure that the personal data is adequately protected.

6. Confidentiality

6.1 Each Party acknowledges that during this Agreement, a Party (the "receiving Party") may become privy to Confidential Information which is disclosed by the other Party (the "disclosing Party").

6.2 The receiving Party shall keep all Confidential Information confidential. The receiving Party shall not disclose Confidential Information to any third party, and shall not use Confidential Information for any purposes other than for the purposes of this Agreement. The receiving Party shall safeguard the Confidential Information to the same extent that it safeguards its own confidential and proprietary information and in any event with no less than a reasonable degree of protection.

6.3 Each Party agrees that before any of its subcontractors and/or agents may be given access to Confidential Information, each such subcontractor and/or agent shall agree to be bound by a confidentiality undertaking comparable to the terms of this Agreement. Notwithstanding the return of any Confidential Information, each Party and its subcontractors and/or agents will continue to hold in confidence all Confidential Information, which obligation shall survive any termination of this Agreement.

6.4 In the event the receiving Party is requested or required to disclose, by court order or regulatory decision, any of the disclosing Party's Confidential Information, the receiving Party shall provide, to the extent permitted, the disclosing Party with prompt written notice so that the disclosing Party may seek a protective order or other appropriate remedy and/or waive compliance with the provisions of this Agreement. The receiving Party shall furnish only that portion of the Confidential Information which is legally required.

6.5 Within 30 business days following (i) the termination or expiry of this Agreement or (ii) the disclosing Party's reasonable earlier request at any time, the receiving Party shall destroy or return to the disclosing Party (at its option) any and all of the disclosing Party's Confidential Information, and shall purge all copies and traces of the same from any storage location and/or media.

6.6 The confidentiality undertaking under this section shall not be applicable if the Confidential Information:

• has become publicly known prior to being divulged or thereafter, but without any breach of confidentiality undertaking; or
• has been legitimately obtained from a third party neither tied by an obligation of confidentiality nor professional secrecy; or
• was independently created by the receiving Party without use of any Confidential Information of the disclosing Party; or
• was already known or developed by the receiving Party, as can be demonstrated by documentary evidence.

7. Intellectual property protection

7.1 C365+ is and shall remain the owner of any materials used or made available in the context of the delivery of the Services.

7.2 C365+ respects the intellectual property of others and requires that users of the Service do the same.

7.3 C365+ licenses all such rights to you free of charge on a non-transferable, non-sub-licensable, irrevocable (except for breach), nonexclusive, worldwide basis to such extent as is necessary to enable you to make use of the Services during the term of the Contract. If the Contract is terminated, this license will automatically terminate.

8. User indemnity

8.1 You agree to defend, indemnify and hold C365+, its supplier, partners, and their respective affiliates harmless from and against any claims, liabilities, damages, losses and expenses, including reasonable legal fees and costs, in connection with:

• your use of the Products;
• your breach of these Terms;
• your infringement of any third-party right, including any intellectual property right;
• any claim that use of your data caused damage to a third party;
• any breach by you of the Data Protection clause;
• any breach by you of the Intellectual Property clause.

8.2 This indemnity obligation will survive the termination or expiration of your account and these Terms.

9. Changes to the service and terms

9.1 C365+ reserves the right at any time to modify, suspend, or discontinue providing the Service, in whole or in part.

9.2 In the event C365+ anticipates that any such action will significantly affect your use of the Service in a negative way, C365+ will endeavour to provide you with advance notice by e-mail, an in-client message or by posting relevant information on the Site within 30 days in the event of the following:

• misuse by the user;
• critical maintenance work;
• technological developments making it difficult, infeasible or unprofitable to continue the Services without making changes;
• C365+ can no longer procure equipment, software, services or facilities from suppliers under reasonable terms;
• general market or economic conditions make it difficult or impossible for C365+ to operate its business at a reasonable cost;
• attacks against C365+ by third parties create a serious risk to the integrity, security or availability of customer data;
• laws, regulations or lawsuits require changes to the Services or make it difficult to operate the Services at reasonable costs;
• legal developments like laws, regulations and lawsuits require changes or make them advisable;
• features are added or eliminated from the Services.

9.3 You acknowledge that providing notice of any modification, suspension or discontinuation of the Services or of any modification of the Terms in accordance with clause 10 will not be reasonably practicable for C365+ in the following circumstances:

• misuse by the user;
• unforeseen critical maintenance work;
• breach of data- or cyber-security (or material concerns in relation to the same);
• suspected or alleged infringement of intellectual property rights in respect of the Services;
• unforeseen changes in laws or regulations; or
• widespread network or power failures affecting C365+ facilities.

9.4 Any modification to the Terms will be posted to the Site. Notice of change of such Terms shall be sent to you upon posting. The new Terms shall be effective 30 days after such notice. All material modifications to the Terms will apply prospectively only. Your continued use of any Services following notification by C365+ of any modification to the Terms constitutes your agreement to be bound by the modified Terms. To stay informed of any changes, please review the most current version of these Terms posted on the Site.

9.5 If you do not agree to be bound by the Terms (or any modified version thereof), you must stop using the Services immediately, and request termination of the Agreement (and your account) pursuant to clause 10, Term and Termination.

9.6 C365+ reserves the right to amend these Conditions from time to time and shall notify you of any changes within 30 days, and each such modification will be effective upon posting on the site. All material modifications will apply prospectively only.

9.7 Your continued use of any Products following any such modification constitutes your agreement to be bound by the modified Terms. To stay informed of any changes, please review the most current version of these Terms posted on the Site. If you do not agree to be bound by these Terms, you must contact your Account Manager within 10 working days, permitting 10 working days of negotiation.

10. Term and termination

10.1 These Terms, and any posted revisions, remain in effect as long as you continue to maintain an account or use the Services. You may terminate your account at any time, for any reason, by following the instructions on the Site and discontinuing use of the Products.

10.2 C365+ may suspend your account and these Terms immediately on written notice with 24 hours notice if you fail to pay any fees or invoices when due or otherwise fail to comply with these Terms.

10.3 C365+ may terminate this Agreement (and your account, regardless of whether it is a Paid or Trial Account) immediately on written notice in any of the following circumstances:

• you fail to comply with these Terms and such failure persists for more than 30 days from receipt of a request from C365+ to rectify such non-compliance;
• you commit a Misuse of the Services (as defined in clause 6);
• upon discontinuation of the Services by C365+ in accordance with clause 10.

10.4 On suspension or expiration of your account or these Terms, you will no longer have the right to continue to use the Software and the Services, and you will no longer be able to access and restore your backup data. Also, you specifically agree that C365+ has no obligation to provide you or anyone else with a copy of your backup data and may automatically purge your backup data from C365+ systems.

10.5 The account is invoiced on the agreed contract term of monthly, quarterly or annually in advance for the service. The contract may be terminated at any time by giving 90 days' notice before a new auto month, quarter or year starts. Once any new contract year starts the service can only be terminated on Month 9 of that new year at the earliest. If notice is given before month 9 then the charges must be paid due for the remainder of the minimum period unless the notice has been given because C365+ has materially changed the Conditions of this contract to any detriment.

10.6 To clarify termination, monthly & quarterly contracts are rolling with a 90-day termination period. Yearly contracts as per the above clause.

10.7 All data held on our servers is deleted immediately after the 90 days' notice providing the account is paid to date. C365+ may terminate this contract or the service provided under it at any time on 30 days notice. Any account deleted by the user will result in data being deleted in real time.

11. Entire agreement

11.1 These Terms constitute the entire agreement between you and C365+ and completely replace any prior agreements between you and C365+ in relation to the Products. If any part of these Terms is held invalid or unenforceable, that portion will be construed in a manner consistent with applicable law to reflect, as nearly as possible, the original intentions of the parties, and the remaining portions will remain in full force and effect.

11.2 The Contract shall be governed by and construed in accordance with English law and the Parties agree to submit to the exclusive jurisdiction of the English courts.

12. Limitation of liability

12.1 In no event shall C365+ or its advertisers or suppliers have any obligation or liability to you for the cost of procurement of substitute services or data or for any direct, indirect, incidental, special, exemplary or consequential damages (including, without limitation, any loss of data, revenue or profits or business interruption) or other pecuniary loss arising out of your use or inability to use your account or the service or your loss of data or files stored therein.

12.2 The uptime stated by Microsoft for Microsoft 365 in their SLA is 99.9%, therefore on average per 1000 files there is a possibility of 1 file not being backed up. Even though steps are taken to upload all files, at the time of any backup Microsoft may have downtime issues which will result in partial successful backups. These will be retried on the next backup. C365+ will not be responsible for ANY restore issues if the files that are not backed up, caused by Microsoft's downtime, cannot be restored.

Schedule 1: Data Processing and Security

1. Description of the data processing carried out on behalf of the Data Controller

In addition to the information provided elsewhere in the Agreement, C365+ wish to document the following information in relation to the data processing activities: the data processing performed by the Data Processor on behalf of the Data Controller relates to the Service — a managed, encrypted backup/copy of data selected by the Data Controller. The data processing activity consists of all selected data being compressed and encrypted prior to it leaving the client system. All data is then stored fully encrypted in Wasabi Data Centres unless agreed otherwise with the user. C365+ is unable to read any of the data that is backed up to our servers.

We need certain personal data to enable us to provide our products and services to our clients. In collecting this information, we are acting as a data controller and, by law, we are required to provide you with information about us, about why and how we use your data and about the rights you have over your data. Refer to the Privacy Policy.

The categories of personal data that C365+ hold are:

• Name, address, telephone number and email address of clients if given to C365+
• Username (not password or encryption key)
• Financial data (card details / direct debit) for payment of Services if applicable
• Backup set details

The duration of the data processing activities is in line with the Terms and Conditions and as such will stop upon termination of Services.

2. Description of security measures

The Data Processor has implemented the following security measures:

• Encryption in transit
• Encryption at rest
• Multi-factor authentication
• Regular backups if set up by the user

Schedule 2: Sub-Processors

As of this agreement, the following Sub-Processors have been notified by the Processor to the Controller with respect to the Processing:

• Wasabi
• Digital Ocean
• Go Cardless
• Xero
• Stripe