2. Definitions

In addition to terms defined elsewhere in these Terms and Conditions, the following capitalized terms and expressions shall have the following meanings, unless the context requires otherwise:

3. License by yure.ai to the Customer

3.1 License

Subject to the terms and conditions herein and the Customer's timely payment of the Fees, yure.ai grants the Customer a non-exclusive, limited, non-transferable license to permit Permitted Users to access and use the Software Service, starting from the Subscription Start Date and continuing until the end of the Term. This license does not include the right to sublicense, with the exception of the Affiliates. The license is granted as of the Effective Date. yure.ai reserves the right, at its sole discretion, to make both material and non-material changes or updates to the functionality of the Licensed Software, without the need for prior approval from the Customer, provided that such changes do not result in a material reduction of the existing functionalities as of the Effective Date. yure.ai shall notify the Customer of any material changes via email or within the Licensed Software.

3.2 Permitted Users

The Software License Agreement specifies the number of Permitted Users. At any time, the Customer may request an increase in this number. Upon yure.ai's confirmation of the request, the Customer will receive an Annex to the Software License Agreement or an updated written confirmation reflecting the new number of Permitted Users and the corresponding Fees, which shall take effect immediately, unless otherwise agreed. Additionally, the Customer may request a reduction in the number of Permitted Users for the next Renewal Term, provided such request is made before the end of the Initial Term or the current Renewal Term. Following yure.ai's confirmation, the Customer shall receive an Annex to the Software License Agreement or an updated written confirmation with the new number of Permitted Users and corresponding Fees, which shall take effect at the start of the next Renewal Term, unless otherwise agreed. To access and use the Licensed Software, the Customer shall submit a list of Permitted Users to yure.ai and provide accurate, complete, and current information. The Customer shall identify Permitted Users who will be able to create Logins to use the Software Service in accordance with these Terms and Conditions. The Customer is responsible for ensuring the confidentiality and preventing unauthorized use of each Password and Login. If the Customer believes that an unauthorized Third Party has gained access to a Password or Login, they must notify yure.ai immediately in writing. The Customer authorizes yure.ai to rely on any information or instructions provided using the assigned Password or Login, without further investigation, regardless of the actual identity of the individual transmitting the data. The use of the assigned Password or Login, whether authorized or not, is the sole responsibility and risk of the Customer. The Customer agrees to indemnify, defend, and hold harmless yure.ai from any claims, losses, or damages resulting from the use, misuse, or unauthorized use of the Customer's Passwords and Logins.

3.3 Restrictions

Neither the Customer nor any Permitted User is allowed to use the Licensed Software or any of its components in any manner not authorized by yure.ai. To the extent permitted by applicable law, neither the Customer nor any Permitted User may: (i) copy the Licensed Software; (ii) modify, translate, or create derivative works based on the Licensed Software; (iii) disassemble, decompile, or reverse engineer the object code or source code of the Licensed Software; (iv) publish or make available to any Third Party any benchmark testing information or results; (v) export or re-export the Licensed Software in violation of any applicable local or international law or regulation; (vi) intentionally distribute any Virus or other harmful, destructive, or deceptive items, or use the Licensed Software for any unlawful, invasive, infringing, defamatory, or fraudulent purpose; or (vii) remove or circumvent any technical or other protective measures embedded in the Licensed Software.

4. Customer's Authorization to yure.ai

yure.ai acknowledges and agrees that the Customer remains at any time the sole owner of (or where applicable, must ensure it has a valid license to) the Customer Data.

The Customer grants yure.ai a non-exclusive, worldwide, royalty-free authorization to use, copy, store, modify, transmit, and display the Customer Data for the duration of the Term, solely to the extent necessary to provide the Software Service under the Software License Agreement.

The Customer may from time to time provide yure.ai with suggestions, comments, enhancements, or other feedback, excluding Customer Data, regarding the Software Service (the "Feedback"). yure.ai, at its sole discretion, shall decide whether to proceed with the development of any requested enhancements, new features, or functionalities. The Customer hereby grants yure.ai a royalty-free, worldwide, transferable, sublicensable, irrevocable, and perpetual authorization to: (a) copy, distribute, transmit, display, perform, and create derivative works of the Feedback; and (b) use the Feedback and/or any related subject matter, including, but not limited to, the right to develop, manufacture, market, promote, sell, offer for sale, import, rent, provide, or lease products or services that incorporate, practice, or are designed for use with the Feedback and/or any related subject matter.

yure.ai reserves the right, but is not obligated, to review and remove any Customer Data that it deems to be in violation of the provisions of these Terms and Conditions, the Software License Agreement, or the Data Processing Annex, the rights of Third Parties, any applicable laws or regulations, or that is otherwise deemed inappropriate.

5. Intellectual property

The Customer acknowledges and agrees that these Terms and Conditions do not imply a sale of the Licensed Software or any rights therein. yure.ai and its suppliers retain all Intellectual Property Rights to the Licensed Software, including any updates, enhancements, derivative modifications, or improvements made by or on behalf of yure.ai. All rights to the Licensed Software not explicitly granted to the Customer in these Terms and Conditions are reserved by yure.ai. No license is granted to the Customer other than the right to use the Licensed Software as expressly stated herein. yure.ai's name, logo, and the product names associated with the Software Service are trademarks pertaining to yure.ai, and their use is prohibited without yure.ai's prior written consent.

The Customer acknowledges and agrees that the source code of the Licensed Software is and shall remain a confidential and proprietary trade secret of yure.ai.

The Customer further acknowledges that yure.ai has the right to use any techniques, methodologies, tools, ideas, and other know-how acquired during the Term to advance its own business and to enhance any related Intellectual Property Rights.

6. Warranties

6.1 By both Parties

The Customer and yure.ai each represent and warrant that they have the authority to enter into and bind themselves to these Terms and Conditions, the Software License Agreement and the Data Processing Annex. Both parties agree to perform their respective obligations arising from these Terms and Conditions.

6.2 By the Customer

The Customer is solely responsible for the accuracy, quality, integrity, legality, reliability, and copyright of all Customer Data. The Customer warrants that the Customer Data provided will not (i) infringe upon any Intellectual Property Rights of Third Parties; (ii) misappropriate any trade secrets; (iii) be deceptive, defamatory, obscene, pornographic, or unlawful; (iv) contain any Viruses, whether or not intended to harm the Licensed Software; or (v) otherwise violate the rights of any Third Party. Any use of the Licensed Software by the Customer or any Permitted User that breaches these representations and warranties shall constitute unauthorized and improper use of the Software Service.

6.3 By yure.ai

yure.ai owns the Licensed Software. Except as explicitly stated in these Terms and Conditions and to the extent permitted by applicable law, yure.ai expressly disclaims all warranties, whether express or implied, including but not limited to warranties of merchantability, non-infringement, satisfactory quality, and fitness for a particular purpose. Specifically, yure.ai does not guarantee that the Licensed Software will be error-free or that the use of the Software Service will be uninterrupted. As such, yure.ai disclaims any and all liability in this regard. The Licensed Software and Software Service will be provided by yure.ai on an "as-is" and "as available" basis. However, yure.ai commits to making commercially reasonable efforts to address bugs reported by the Customer and to provide the Software Service with minimal Downtime. In the event of Downtime, yure.ai will make efforts to resolve it within three (3) business days. To the best of yure.ai's knowledge, the Licensed Software does not contain any Viruses.

7. Liability

To the fullest extent permitted by applicable law, the maximum liability of the Parties arising from these Terms and Conditions shall not exceed the Fees paid by the Customer to yure.ai for the use of the Licensed Software during the twelve (12) months preceding the event giving rise to the liability. This limitation shall not apply in cases (i) related to the indemnification obligations set forth in Clause 8 of these Terms and Conditions, or (ii) in the event of fraud or willful misconduct.

Under no circumstances will yure.ai, its licensors, or its suppliers be liable to the Customer for any consequential or incidental losses, including, but not limited to, lost profits, loss of business, loss of data, unauthorized access to, alteration, theft, or destruction of the Customer's or its trading partners' computers, systems, data files, programs, or information, costs of obtaining substitute goods or services, or any indirect, special, or consequential damages, regardless of the cause or theory of liability, and whether or not yure.ai was advised of the possibility of such damages.

8. Indemnities

8.1 By yure.ai

yure.ai agrees to defend and indemnify the Customer against any valid and substantiated claims brought by third parties, to the extent that such claims are based on an infringement of the third party's Intellectual Property Rights caused by the Licensed Software. However, this indemnity does not cover claims arising from: (i) any unauthorized use of the Licensed Software; (ii) modifications made to the Licensed Software by the Customer, its employees, or any third party; (iii) the Customer's failure to use updated or modified versions of the Licensed Software provided by yure.ai to prevent claims of infringement or misappropriation; or (iv) the combination of the Licensed Software with other systems, products, processes, or materials if the claim could have been avoided without such combination or use. The indemnity obligation is conditional upon the following: (i) yure.ai receiving prompt written notice of the claim; (ii) yure.ai being granted sole control over the defense and settlement of the claim; (iii) the Customer fully cooperating with yure.ai in the defense and settlement of the claim at yure.ai's expense, upon request; and (iv) the Customer not admitting liability on yure.ai's behalf or agreeing to a settlement without yure.ai's prior written consent. If these conditions are met, yure.ai shall indemnify the Customer for all direct damages and reasonable costs incurred as a result of the claim, as determined by a competent court or as agreed to in a settlement with yure.ai. To clarify, yure.ai shall not be liable for any indirect loss, damage, cost, or expense of any kind, including, but not limited to, loss of profit. If yure.ai reasonably believes that the Licensed Software or any part of it is likely to become the subject of a Third-Party infringement claim, yure.ai has the right, at its sole discretion and expense, to: (i) modify the allegedly infringing part of the Licensed Software to eliminate the infringement while maintaining equivalent functionality; (ii) obtain a license for the Customer to continue using the Licensed Software in accordance with these Terms and Conditions; or (iii) terminate the Software License Agreement and refund a pro rata portion of the Fees for the remaining contractual term.

8.2 By Customer

The Customer agrees to defend and indemnify yure.ai against any valid and well-substantiated claims brought by Third Parties, to the extent that such claims are based on: (i) an infringement of any Third Party's Intellectual Property Rights caused by Customer Data or other Customer's systems, materials, or software; (ii) any breach or violation of these Terms and Conditions by the Customer or its personnel; and/or (iii) fraud, intentional misconduct, or gross negligence committed by the Customer or its personnel. The Customer shall indemnify yure.ai for all direct damages and reasonable costs incurred by yure.ai as a result of the claim, as awarded by a competent court of final instance or as agreed to by the Customer in a settlement agreement.

9. Fees

During the Term and as consideration for the Software Service, the Customer agrees to pay the Fee as set forth in the Software License Agreement.

yure.ai will issue an invoice for the Fees in advance for the Initial Term, unless otherwise specified in the Software License Agreement. All payment obligations are non-cancellable, and any amounts paid are non-refundable. The Customer shall pay the Fees either (i) via Stripe, by completing the online subscription and payment process, or (ii) by bank transfer to yure.ai's transaction account, the details of which shall be specified on the relevant invoice. Invoices for charges under these Terms and Conditions are due within thirty (30) calendar days from the invoice date, unless otherwise stated in the Software License Agreement or invoice. Any amounts not paid by the Customer on the due date specified in the invoice shall accrue default interest in accordance with the Croatian Civil Obligations Act.

10. Confidential information

Under no circumstances shall either Party disclose any pricing or business terms specific to the Software License Agreement, or any related negotiations, including but not limited to competitors, industry analysts, or the press and media.

Neither Party shall use any Confidential Information of the disclosing Party except as expressly permitted under these Terms and Conditions, the Software License Agreement, and the Data Processing Annex, or as explicitly authorized in writing by the disclosing Party. Each Party shall take the same degree of care to protect the disclosing Party's Confidential Information as it uses to protect its own Confidential Information of a similar nature, but in no event less than reasonable care. Neither Party may disclose the other Party's Confidential Information to anyone other than the receiving Party's officers, employees, consultants, and legal advisors who have a legitimate need to know such information, and who are bound by confidentiality obligations similar to those set forth in these Terms and Conditions. Each individual or entity receiving Confidential Information under this clause must have signed a written confidentiality agreement with the sole purpose of supporting the intent of this Clause. The Customer agrees not to disclose any benchmark tests of the Licensed Software to any third party, whether orally or in writing. Each Party further agrees to notify the other Party of any unauthorized use or disclosure of Confidential Information and to provide reasonable assistance in investigating and addressing such unauthorized use or disclosure, including assisting with any legal actions to address the issue.

11. Data Protection

The Customer agrees and acknowledges that personal data (excluding IP addresses, and other unique non-personal identifiers such as Cookie IDs, which are necessary for the provision of Software Services) is processed by yure.ai only to the extent that the Customer voluntarily provides such data when subscribing to or using the Software Service.

To the extent that yure.ai processes any personal data on the Customer's behalf while fulfilling its obligations under these Terms and Conditions, the Parties intend for the Customer to act as the data controller and yure.ai to act as the data processor. Any and all personal data shall be processed in accordance with the provisions outlined in the Data Processing Annex, attached to these Terms and Conditions.

12. Term and termination

12.1 Term

The Software License Agreement shall come into effect on the Effective Date and remain in force until the Subscription End Date (the "Initial Term"). Following the Initial Term, the Software License Agreement shall automatically renew for successive one-month periods (each referred to as "Renewal Term"), unless: (i) the Customer cancels their subscription through the Stripe Customer Portal (for Stripe payments); (ii) the Customer provides written notice of cancellation to yure.ai no later than thirty (30) calendar days before the end of the Initial Term or the current Renewal Term (for bank transfer payments); or (iii) either Party terminates the agreement by written notice in accordance with these Terms and Conditions, in each case before the end of the Initial Term or the current Renewal Term, as applicable.

12.2 Termination

The Software License Agreement may be terminated as follows: (i) by yure.ai, with immediate effect, for any violation committed under these Terms and Conditions, the Data Processing Annex, and the Software License Agreement; (ii) by the Customer upon thirty (30) days written notice if yure.ai is in breach of any material clause of these Terms and Conditions, the Software License Agreement, and the Data Processing Annex, unless such breach is remedied before the end of such remedy period; (iii) by yure.ai, without cause, and upon providing a 30-day notice period; or (iv) automatically if at the end of the Initial Term or the Renewal Term, the Software License Agreement is not renewed as set forth in these Terms and Conditions and the Software License Agreement.

12.3 Insolvency and other Termination Proceedings

Either Party may terminate the Software License Agreement by providing written notice to the other Party, with immediate effect, if the other Party becomes subject to a voluntary or involuntary bankruptcy, insolvency, or similar proceeding, or if it liquidates or ceases to conduct business.

12.4 Effects of Termination

Upon termination of the Software License Agreement, (i) the Customer shall promptly pay yure.ai all Fees and other amounts earned by or due to yure.ai, up to and including the date of termination; (ii) all user rights granted to the Customer pursuant to these Terms and Conditions, the Software License Agreement, and the Data Processing Annex, including the rights to use the Licensed Software, shall immediately cease; (iii) the Customer shall immediately cease using the Licensed Software; and (iv) the following clauses shall survive: Clause 8 (Indemnities), Clause 10 (Confidential Information), and Clause 13.1 (Governing Law and Dispute Resolution).

13. Miscellaneous

13.1 Governing Law and Dispute Resolution

These Terms and Conditions, Software License Agreement, and the Data Processing Annex shall be governed by and interpreted in accordance with the laws of Croatia, without regard to its conflict of law principles. The Parties shall endeavor to resolve any dispute arising from or relating to these Terms and Conditions, the Software License Agreement, and the Data Processing Annex, or its subject matter amicably. Should the Parties fail to reach an amicable resolution, the competent courts of Zagreb shall have exclusive jurisdiction over any such dispute.

13.2 Severability

If any clause of these Terms and Conditions, Software License Agreement, and the Data Processing Annex is determined by a competent court to be invalid or unenforceable, such clause shall be modified to the extent necessary to reflect the original intent of the Parties, while ensuring that the remaining clauses continue in full force and effect.

13.3 No Agency

No joint venture, partnership, employment, or agency relationship shall exist between Customer and yure.ai as a result of these Terms and Conditions, the Data Processing Annex, the Software License Agreement or use of the Licensed Software.

13.4 No Waiver

The failure of a Party to enforce any right or provision of these Terms and Conditions, the Software License Agreement, and Data Processing Annex shall not be deemed a waiver of that right or provision, unless expressly acknowledged and agreed to in writing by that Party.

13.5 Force Majeure

Except for the Customer's obligation to pay the Fee, if the performance of these Terms and Conditions, the Software License Agreement, and the Data Processing Annex by either Party is prevented, hindered, delayed, or made impracticable due to events such as flood, riot, fire, official pandemic, judicial or governmental action, labor disputes, acts of God, power failures, cybercrime, unauthorized access to yure.ai's information technology systems by Third Parties, or any other causes beyond the control of that Party, the respective Party shall be excused from performance to the extent it is affected by such events.

13.6 References

The Customer hereby grants yure.ai permission to publicly refer to the Customer as a client of yure.ai and to use the Customer's name and logo, which remain the Customer's trademarks, on yure.ai's website, social media, and other platforms solely for this purpose. For the avoidance of doubt, yure.ai shall not disclose any Confidential Information in doing so. Any other public references to the Customer shall require the Customer's prior consent.

13.7 Assignment

The Customer may not assign Software License Agreement without obtaining prior written consent from yure.ai. However, yure.ai may assign Software License Agreement to its Affiliate. Any assignment made in violation of this clause shall be considered void. These Terms and Conditions and the Software License Agreement shall be enforceable by and binding upon the permitted successors and assigns.

13.8 Notice

Any notice or communication required under these Terms and Conditions, the Software License Agreement, and the Data Processing Annex shall be delivered in writing to the other Party at the address specified in the License Software Agreement. Notices may be sent by courier, registered mail (with prepaid postage and return receipt), nationally recognized express mail service, or by email with receipt acknowledgement. A notice shall be deemed effective upon receipt or refusal of delivery. Either Party may change its notice address by notifying the other Party of the respective new address.

13.9 Consumer Protection (B2C)

The provisions of this Clause 13.9 apply exclusively where the Customer is a Consumer. For the avoidance of doubt, a Consumer is also a Customer and all references to "Customer" throughout these Terms and Conditions shall include a Consumer, unless the context or nature of a provision indicates that it applies solely in a business-to-business context. To the extent that any provision of these Terms and Conditions conflicts with any applicable mandatory consumer protection laws, including but not limited to the Croatian Consumer Protection Act (Zakon o zaštiti potrošača) and the Croatian Act on Certain Aspects of Contracts for the Supply of Digital Content and Digital Services (Zakon o određenim aspektima ugovora o isporuci digitalnog sadržaja i digitalnih usluga), the latter shall prevail.

Right of Withdrawal. A Consumer has the right to withdraw from the Software License Agreement without stating reasons within fourteen (14) calendar days from the date of conclusion of the agreement ("Withdrawal Period"). However, by completing the subscription and payment process, the Consumer expressly requests that yure.ai commence the provision of the Software Service immediately, before the expiry of the Withdrawal Period, and acknowledges that they will thereby lose their right of withdrawal once the Software Service has been fully performed or has commenced. If the Consumer withdraws from the agreement before the Software Service commences, yure.ai will refund all amounts paid by the Consumer without undue delay and no later than fourteen (14) calendar days after receiving the withdrawal notice, using the same means of payment used by the Consumer. To exercise the right of withdrawal, the Consumer must notify yure.ai by an unambiguous statement (e.g., by email to the address indicated in the Software License Agreement) before expiry of the Withdrawal Period.

Conformity of the Digital Service. yure.ai is responsible for ensuring that the Software Service conforms to the Software License Agreement and these Terms and Conditions throughout the Term. In the event of a lack of conformity, the Consumer is entitled to: (i) request that yure.ai bring the Software Service into conformity, free of charge and within a reasonable time and without significant inconvenience to the Consumer; (ii) receive a proportionate reduction in the Fee for the period during which the Software Service was not in conformity; or (iii) terminate the Software License Agreement and receive a refund of amounts paid in respect of the non-conforming period, where the lack of conformity is not minor. yure.ai bears the burden of proving that any lack of conformity is minor. Any refund due to the Consumer pursuant to this Clause shall be made without undue delay and no later than fourteen (14) calendar days after yure.ai has been notified of the Consumer's decision, using the same means of payment used by the Consumer, without any fees charged to the Consumer.

Modifications to the Software Service. yure.ai may modify the Software Service beyond what is necessary to maintain its conformity only if: (a) the Software License Agreement permits such modification and states a valid reason for it; (b) the modification is made at no additional cost to the Consumer; (c) the Consumer is notified in a clear and comprehensible manner; and (d) where the modification negatively affects the Consumer's access to or use of the Software Service, the Consumer is informed in advance and on a durable medium of the characteristics and timing of the modification and their right to terminate the agreement free of charge within thirty (30) days.

Complaints. Consumers may submit complaints to yure.ai by email to the contact address indicated in the Software License Agreement. yure.ai will acknowledge receipt of each complaint and respond within a reasonable time. The limitation of liability set out in Clause 7 shall not apply to Consumers to the extent prohibited by applicable mandatory consumer protection laws.

13.10 Entire Agreement

These Terms and Conditions, along with the Software License Agreement, and the Data Processing Annex, constitute the complete and exclusive agreement between the Customer and yure.ai, overriding all prior or contemporaneous discussions, negotiations, or agreements, whether written or oral, concerning the subject matter hereof. yure.ai may unilaterally amend these Terms and Conditions at any time by publishing the updated version on its website at https://yure.ai (or such other URL as yure.ai may notify from time to time) and by sending written notice to the Customer via email to the address registered in the Customer's account, no later than eight (8) days before the changes take effect. The updated Terms and Conditions shall automatically apply to all Customers upon the indicated effective date, unless the Customer cancels their subscription before that date in accordance with Clause 12.1 of these Terms and Conditions. The Customer's continued use of the Software Service after the effective date of any update shall constitute acceptance of the updated Terms and Conditions. It is the Customer's responsibility to review the Terms and Conditions on the website periodically.

1. Definitions and interpretation

For the purposes of this Data Processing Annex, the following terms shall be defined as follows:

2. Specification of Data Processing

For the performance of the Services, yure.ai acts as a Data Processor on behalf of the Customer, who is the Data Controller.

A detailed description of the subject matter of the Personal Data Processing, including the categories of Personal Data and Data Subjects involved is provided in Schedule 1 to this DPA.

Any processing of Personal Data related to and for the purpose of the Services shall be carried out in compliance with the relevant Data Protection Legislation.

3. Data Subjects' Rights

Regarding the protection of Data Subjects' rights under the applicable Data Protection Legislation, the Customer shall facilitate the exercise of these rights and ensure that Data Subjects are provided with clear, concise, transparent, intelligible, and easily accessible information about the Processing, using plain and simple language.

If a Data Subject contacts yure.ai directly to exercise their rights (such as requesting access to, correction, or deletion of their Personal Data, or seeking to restrict or object to the Processing), yure.ai shall notify the Customer of the request within five (5) business days. yure.ai shall provide the Customer with full details of the request and, where relevant, a copy of the Personal Data held by yure.ai in relation to the Data Subject. yure.ai shall promptly refer the Data Subject to the Customer. In support of this process, yure.ai may provide the Customer's basic contact information to the Data Subject. The Customer agrees to respond to and handle any such requests in accordance with the applicable Data Protection Legislation.

To the extent possible, yure.ai shall cooperate with and assist the Customer by implementing appropriate technical and organizational measures to help the Customer fulfill its obligation to respond to requests from Data Subjects exercising their rights.

4. Consultation and Correction of Personal Data

yure.ai shall grant the Customer, in its capacity as Data Controller, access to the Personal Data processed for the purpose of providing the Services, enabling the Customer to review and correct such Personal Data.

5. Disclosure

yure.ai shall not disclose Personal Data to any third party, except: (i) as instructed by the Customer; (ii) as specified in any agreement between the Parties related to the provision of the Services; (iii) as necessary for Processing by approved Sub-processors in accordance with Clause 7 herein; or (iv) as required by law or the competent authority's order.

yure.ai represents and warrants that individuals acting on its behalf, who are authorized to process Personal Data or to support and manage systems that process Personal Data, (i) are committed to maintaining the security and confidentiality of Personal Data in accordance with the terms of this Data Processing Annex; (ii) are required to undergo user authentication and login procedures when accessing Personal Data; and (iii) are properly informed about the requirements under the applicable Data Protection Legislation. yure.ai shall ensure that these individuals are aware of the relevant obligations and shall enforce their compliance through contractual or statutory confidentiality requirements.

6. Location of Processing

yure.ai shall store Personal Data at rest within the territory of the European Union.

Any processing of Personal Data by yure.ai personnel or subcontractors outside the European Union may only occur with the prior written approval of the Customer and after the implementation of a legally recognized data transfer mechanism, such as the Standard Contractual Clauses.

7. Use of Sub-processors

The Customer hereby grants yure.ai general written authorisation, within the meaning of Article 28(2) of the GDPR, to engage third-party Sub-processors to assist in providing the Services, subject to the notification and objection procedure set out in Clause 7.4 of this DPA.

Any Sub-processors engaged by yure.ai to process Personal Data shall only be permitted to do so for the purpose of delivering the services yure.ai has assigned to them. They will be prohibited from processing the Personal Data for any other purpose. yure.ai remains fully responsible for ensuring that any such Sub-processor complies with yure.ai's obligations hereunder.

yure.ai shall enter into written agreements with any Sub-processors that contain obligations no less protective than those set out herein.

yure.ai shall maintain an up-to-date list of Sub-processors engaged in providing the Services, including their identities and countries of location, which is made publicly available at https://yure.ai/subprocessors (or such other URL as yure.ai may notify to the Customer from time to time) (the "Sub-processor List"). The Sub-processor List as at the Effective Date is set out in Schedule 2 to this DPA for reference only; the Sub-processor List published on the above URL shall prevail in the event of any inconsistency. yure.ai shall notify the Customer of any intended addition or replacement of Sub-processors by updating the Sub-processor List and sending written notice to the Customer (including by email) at least fourteen (14) calendar days prior to the new Sub-processor commencing the processing of Personal Data. If the Customer has legitimate and documented grounds to object to the use of a new Sub-processor on data protection grounds, the Customer may notify yure.ai in writing within the said notice period. In the absence of such written objection within the notice period, the Customer shall be deemed to have granted general written authorisation for the relevant Sub-processor within the meaning of Article 28(2) GDPR. Where the Customer raises a legitimate objection and the Parties are unable to resolve the matter, either Party may terminate the Software License Agreement on written notice without penalty.

8. Technical and Organizational Measures

yure.ai has implemented and will continue to maintain appropriate technical and organizational measures to protect Personal Data, as well as the systems processing Personal Data, from accidental, unauthorized, or unlawful access, disclosure, alteration, loss, or destruction. These measures shall be aligned with the technical and organizational requirements set forth in the General Data Protection Regulation. The measures shall be designed to reflect the nature, scope, context, and purposes of the Processing, taking into account the risks of potential harm resulting from unauthorized or unlawful Processing or accidental loss, destruction, or damage to Personal Data. These measures shall include, but are not limited to, the following:

• preventing unauthorized individuals from gaining access to systems that process Personal Data (physical access control);
• preventing systems that process Personal Data from being used without proper authorization (logical access control);
• ensuring that individuals authorized to use a system processing Personal Data can only access Personal Data they are permitted to access, in accordance with their access rights, and that Personal Data cannot be read, copied, modified, or deleted without authorization during processing (data access control);
• ensuring that Personal Data cannot be read, copied, modified, or deleted without authorization during electronic transmission, transport, or storage on media, and that the recipients of any Personal Data transfer via data transmission facilities can be identified and verified (data transfer control);
• establishing an audit trail to document who has entered, modified, or removed Personal Data from systems processing it (entry control);
• protecting Personal Data against accidental destruction or loss (availability control); and
• ensuring that Personal Data collected for different purposes is processed separately (separation control).

yure.ai shall regularly update these measures to reflect changes in regulations, technology, and other relevant factors. In all cases, the implemented measures shall ensure a level of security that is appropriate to the risks associated with the Processing and the nature of the Personal Data being protected, while also considering the current state of technology and the cost of their implementation.

Upon the Customer's request, yure.ai must provide the Customer with an updated description of the implemented technical and organizational protection measures within ten (10) calendar days of receiving the request.

9. Personal Data Breaches

In the event of a potential or confirmed Personal Data Breach, regardless of its cause, yure.ai shall notify the Customer without undue delay and no later than forty-eight (48) hours after becoming aware of (or suspecting the occurrence of) such a breach. The notification shall provide the Customer with sufficient information and within a timeframe that enables the Customer to fulfill its obligations to report the Personal Data Breach under the applicable Data Protection Legislation. At a minimum, the notification shall include:

• the nature of the Personal Data Breach;
• the type of Personal Data involved, along with the categories and number of Data Subjects affected;
• the likely consequences of the Personal Data Breach;
• if applicable, the remedial actions taken or planned to mitigate the effects and reduce any damage resulting from the Personal Data Breach;
• the identity and contact details of the Data Protection Officer or another designated Contact Person who can provide further information.

yure.ai shall promptly conduct further investigation into the Personal Data Breach and keep the Customer updated on the progress of the investigation. yure.ai shall also take reasonable steps to minimize the impact of the Personal Data Breach. Both Parties agree to fully cooperate in the investigation and assist each other in meeting any notification requirements and procedures.

The obligation of either Party to report or respond to a Personal Data Breach shall not be interpreted as an admission of fault or liability by that Party regarding the breach.

10. Data Protection Impact Assessment and Prior Consultation

yure.ai shall make commercially reasonable efforts to assist the Customer with any data protection impact assessments required under Article 35 of the GDPR, as well as with any prior consultations with the Customer's supervisory authority, as required under Article 36 of the GDPR, in both cases related to the Processing of Personal Data by yure.ai on behalf of the Customer in connection with the Services.

11. Other Responsibilities

The Customer shall comply with all relevant laws and regulations, including the applicable Data Protection Legislation.

The Customer is responsible for ensuring the lawfulness of the Processing of Personal Data, including, where necessary, obtaining the consent of Data Subjects for the Processing of their Personal Data.

The Customer shall take reasonable steps to keep Personal Data accurate and up to date, ensuring that it is not inaccurate or incomplete in relation to the purposes for which it was collected.

With respect to components that the Customer provides or controls, such as workstations connecting to the Services, data transfer mechanisms, and credentials issued to the Customer's personnel, the Customer shall implement and maintain the necessary technical and organizational measures to protect Personal Data.

12. Notifications

Unless prohibited by law, yure.ai shall notify the Customer as soon as reasonably possible, and no later than two (2) business days after becoming aware of the relevant circumstances, if it or any of its Sub-processors:

• receives an inquiry, subpoena, or request for inspection or audit from a competent public authority related to the Processing;
• intends to disclose Personal Data to any competent public authority outside the scope of the Services. Upon the Customer's request, yure.ai shall provide a copy of any documents delivered to the relevant authority; or
• receives an instruction that violates the Data Protection Legislation or the obligations hereunder.

In such cases, yure.ai shall cooperate with the Customer as requested, to help the Customer comply with any assessment, enquiry, notice, or investigation under the Data Protection Legislation. This includes providing: (i) all data requested by the Customer (which is not otherwise available to the Customer) within the reasonable timeframe specified by the Customer, including full details and copies of the complaint, communication, or request, along with any Personal Data held in relation to the relevant Data Subject(s); and (ii) where applicable, reasonable assistance to enable the Customer to meet statutory deadlines under the Data Protection Legislation.

Any notifications under this DPA, including those related to a Personal Data Breach, shall be sent to one or more of the Customer's Contact Persons via email, possibly supplemented by other methods chosen by yure.ai. Upon the Customer's request, yure.ai shall provide an overview of the registered Contact Persons' contact information. It is the Customer's sole responsibility to promptly report any changes in contact details and ensure that the Customer's Contact Persons maintain accurate contact information.

13. Term and Termination

This Data Processing Annex shall come into effect on the Effective Date of the Software License Agreement and remain in force until yure.ai no longer needs to process Personal Data in connection with the provision of the Services.

The Data Processing Annex cannot be rescinded or terminated independently of the Software License Agreement.