Terms & Conditions

Subscription Services Agreement 

This Subscription Services Agreement, including all Order Forms, addenda, exhibits and schedules hereto (collectively, this “Agreement”), is between Function Flo Corporation, with offices located at 1807 Crooked Lane, Austin, Texas 78741] (“Function Flo”) and (“Customer”), is effective as of October 31, 2022 (“Effective Date”).

Function Flo and Customer are each referred to individually as a “party,” and collectively as the “parties.”

This Agreement governs Function Flo’s provision of the Services and Customers access to and use of the Services. This Agreement contains general terms and conditions applicable to all such Services. Order Forms contain additional terms specific to the Services provided thereunder. The parties agree as follows:

1. DEFINITIONS.

Data” means the raw data Customer and/or its Clients uploads or submits to Function Flo and the resulting data from the processing of such raw data using the Services.

Feedback” means all suggestions, comments, opinions, code, input, ideas, reports, information, know-how or other feedback provided by Customer (whether in oral, electronic or written form) to Function Flo related to the Services.

Internal Purposes” means internal business use within Customer’s systems, networks, and devices (“Customer Environment”), to manage Customer’s food and/or beverage services business, as well as testing and evaluation of the Services in order to provide Feedback to Function Flo. Such purposes also include use of Services as part of services Customer provides to its third party customers and/or suppliers (“Clients”) to sell or purchase food and/or beverages to or from such Clients, so long as the product is not incorporated into a Customer, Client or other third-party product or software.

Malicious Code” means without limitation code, files, scripts, agents or programs intended to do harm, including without limitation viruses, worms, time bombs and trojan horses.

Order Form” means each mutually agreed upon order on Function Flo’s Order Form template that specifies the Services, including the type or quantity of items, including the number of seats or users (if applicable), the fees for such items and any additional terms applicable to the use of such items.

Payment Method” means Customer’s or its Client’s credit or debit card or other permitted payment method that is charged on behalf of Customer for which Customer or Client is making a purchase through the Services, including without limitation Point of Sale, the mobile applications, or Digital Ordering.

Payment Transaction” means facilitation of payment to Customer by Clients for those purchases with an eligible Payment Method.

Professional Services” means any integration, training, Support or other professional services to be provided by Function Flo as specified in the Order Form or any SOW.

Project Intellectual Property” means either the Intellectual Property Rights created or developed by Function Flo in connection with any SOW and/or Professional Services.

SaaS Platform” means everything at https://www.functionflo.com, and related services located in such domain and subdomains, including software, code, algorithms, hosted services, and web interfaces.

Services” means any and all of the services, software and other offerings, including without limitation digital ordering features that Function Flo offers to Customers, including a Customer’s online ordering page and order & pay at the table features (collectively “Digital Ordering”); and Payment Transactions facilitated on the Function Flo point of sale or via Function Flo’s scan to pay feature (“Point of Sale”), provided by to Function Flo pursuant to this Agreement, including the SaaS Platform, Project Intellectual Property, the offerings provided through https://www.functionflo.com, any mobile applications, APIs, provided by Function Flo, and all such services and software labeled as alpha, beta, pre-release, trial, preview or otherwise. Services may include any enhancements, updates, upgrades, derivatives or bug fixes to such services, software, and offerings, and any documentation, add-ons, templates, sample data sets, and hardware devices as provided by to Function Flo.

SOW” means a statement of work executed in writing by the parties under this Agreement.

Support” means the maintenance and support services for the Services to be provided by Function Flo to Customer as specified in Schedule 1 hereto.

2. LICENSE GRANT.

Customer’s use of the Services is subject to and governed by the terms and conditions in this Agreement, including those in the applicable Order Form. In the event of a conflict between the terms in an Order Form and this Agreement, the terms in the Order Form shall control with respect the Services provided under such Order Form. Subject to and conditioned on Customer’s compliance with the terms and conditions of this Agreement and those in the applicable Order Form, Function Flo grants Customer a non-exclusive, non-sublicensable, non-transferable, revocable, limited license during the Term to use the Services only for the Internal Purposes.

3. LICENSE RESTRICTIONS.

  • Restrictions. Except as expressly authorized in this Agreement or by Function Flo, Customer will not, and will not permit any third party to: (i) access or use the Services for any other purposes (including for any competitive analysis, commercial, professional, or other for-profit purposes); (ii) copy the Services (except as required to run the Services and for reasonable backup purposes); (iii) modify, adapt, or create derivative works of the Services; (iv) rent, lease, loan, resell, transfer, sublicense, display or distribute the Services to any third party; (v) use or offer any functionality of the Services on a service provider, service bureau, hosted, software as a service, or time sharing basis, provide or permit other individuals or entities to create Internet “links” to the Services, or “frame” or “mirror” the Services on any other server, or wireless or Internet-based device; (vi) decompile, disassemble, translate or reverse engineer the Services or otherwise attempt to derive the Services source code, algorithms, methods or techniques used or embodied in the Services; (vii) disclose to any third party the results of any benchmark tests or other evaluation of the Services, or (viii) remove, alter, obscure, cover or change any trademark, copyright or other proprietary notices,labels or markings from or on the Services; (ix) interfere with or disrupt servers or networks connected to any website through which the Services are provided; (x) use the Services to collect or store personal data about any person or entity; (xi) use the Services to build a similar or competitive product or service; (xii) use the Services to transmit Malicious Code or (xiii) use the Services for any illegal, unauthorized or otherwise improper purposes.
  • Other Parties. Any employee, consultant, contractor or agent hired to perform services for Customer may operate the Services on Customer’s behalf solely under these terms and conditions, provided that: (i) Customer is responsible for ensuring that any such party agrees in a legally enforceable manner to abide by and fully comply with the terms and conditions of this Agreement on the same basis as applicable to Customer; (ii) such use is only in connection with Customer’s Internal Purposes; (iii) such use does not represent or constitute an increase in the scope of the licenses provided hereunder; and (iv) Customer remains fully responsible and liable for any and all acts or omissions by such third parties related to this Agreement.
  • Immediate Termination. Any violation of this Section 3 by Customer shall be a material breach of this Agreement and Function Flo may immediately terminate this Agreement without notice.

4. PROFESSIONAL SERVICES.

Function Flo shall provide Customer with the Professional Services set forth in the Order Form or in an SOW. Each SOW will be governed by the terms and conditions of this Agreement and will specify, among other terms the parties deem relevant: (i) a description of the Professional Services that Function Flo will provide; (ii) the schedule for performance; and (iii) the fees that Customer will pay and the schedule for payment. An exemplary format for each SOW is set forth as Exhibit A to this Agreement. In the event of any conflict between the terms and conditions of this Agreement and any SOW, the terms and conditions of this Agreement shall take precedence except as expressly and unambiguously stated otherwise in the applicable SOW.

5. CONFIDENTIALITY.

  • Definition. Confidential Information” means information that either: (i) is designated as confidential by the Discloser at the time of disclosure; or (ii) would reasonably be understood by the Recipient, given the nature of the information or the circumstances surrounding its disclosure, to be confidential, including without limitation, Discloser’s product and/or service designs, product and/or service plans, data, software and technology, financial information, marketing plans, business opportunities, proposed terms, pricing information, discounts, inventions and know-how disclosed by Discloser to Recipient, whether in writing, verbally or otherwise, and whether prior to, on or after the Effective Date. Confidential Information of Function Flo also includes the Services and the existence and terms and conditions of this Agreement.
  • Use of Confidential Information. A party which receives Confidential Information under this Agreement (“Recipient”) may not use the Confidential Information from the party which discloses Confidential Information under this Agreement (“Discloser”) in any way, for its own benefit or the benefit of any third party, except as expressly permitted by, or as required to implement, this Agreement.
  • Disclosure of Confidential Information. Recipient will: (i) hold Confidential Information in strict confidence and take reasonable precautions to protect and secure such Confidential Information (such precautions to include, at a minimum, all precautions Recipient employs with respect to its own Confidential Information); and (ii) not divulge any Confidential Information to any third party (other than to employees or contractors as set forth below). Any employee or contractor given access to any Confidential Information must have a legitimate “need to know” such Confidential Information for use specified in Section 4.b. and Recipient will remain responsible and liable for each such person’s compliance with this Agreement.
  • Confidentiality Period. Irrespective of any termination of this Agreement, Recipient’s obligations with respect to Confidential Information under this Agreement expire 5 years from the date of receipt of the Confidential Information (except with respect to any trade secrets and Data where such obligations will be perpetual).
  • Exclusions. This Agreement imposes no obligations with respect to information which: (i) was in Recipient’s possession before receipt from Discloser; (ii) is or becomes a matter of public knowledge through no fault of Recipient; (iii) was rightfully disclosed to Recipient by a third party, who has no restriction on disclosure; or (d) has been or is developed or acquired by or for Recipient without use of the Confidential Information as can be shown by documentary evidence. Recipient may make disclosures to the extent required by law or court order, provided Recipient makes reasonable efforts to provide Discloser with notice of such disclosure as promptly as possible and uses diligent efforts to limit such disclosure and obtain confidential treatment or a protective order, and has allowed Discloser to participate in the proceeding.
  • Return or Destruction of Confidential Information. Upon termination of this Agreement or written request by Discloser, the Recipient will: (i) cease using the Confidential Information; and (ii) return or destroy the Confidential Information and all copies, notes or extracts thereof to Discloser within seven (7) business days of such request or termination.

6. TERM AND TERMINATION.

  • Term. This Agreement will be effective from the earlier of (i) the date provided above, and (ii) the date on which Customer first used or accessed the Services, and shall continue until terminated, as set forth below (the “Term”).
  • Termination. Notwithstanding anything to the contrary, this Agreement or any SOW may be terminated as follows: (i) by the non-breaching party upon a material breach of this Agreement or applicable SOW by the other party, which breach is not cured within thirty (30) days after receipt of written notice from the non-breaching party, provided that, in the event such breach relates only to a specific SOW, termination may be limited to such SOW; or (ii) by either party in the event the other party becomes insolvent or bankrupt; becomes the subject of any proceedings under bankruptcy, insolvency or debtor’s relief law; has a receiver or manager appointed; makes an assignment for the benefit of creditors; or takes the benefit of any applicable law or statute in force for the winding up or liquidation of such party’s business. In addition to the foregoing, Customer may terminate any Order Form, SOW or Professional Services upon at least forty-five (45) days prior written notice to Function Flo (a “Customer Termination for Convenience”).


  • Effect of Termination. Immediately upon termination, (i) all Order Forms and licenses granted under this Agreement will immediately terminate and Customer will immediately cease all use of the Services; (ii) Customer will destroy the Services in its possession, or upon request by Function Flo, return to Function Flo the Confidential Information that is in its possession or control; and (iii) any and all of Customer’s payment obligations under each Order Form will immediately become due and in the event of a Customer Termination for Convenience, Customer shall pay Function Flo liquidated damages equal to (a) $199 per location times the number of months remaining on the Term for any such Order Form so cancelled. It is agreed by the parties, therefore, that the liquidated damages specified herein are reasonable in light of the anticipated harm to Function Flo that would be caused by a Customer Termination for Convenience, the difficulties of proof of loss, and the inconvenience or non-feasibility of Function Flo otherwise obtaining an adequate remedy, and that such liquidated damages are not to be construed as a penalty.

Upon Function Flo’s request, Customer will certify in writing that Customer has returned or destroyed all copies of Function Flo’s Confidential Information. Sections 1, 3, 5- 13 , and 15 – 17 , will survive termination of this Agreement. Neither party shall be under any obligation to enter into an agreement after termination or expiration of this Agreement.

  • Suspension. Function Flo reserves the right at any time to modify, suspend, or discontinue the Services (or any portion thereof) with or without notice, and Function Flo shall not be liable to Customer or any third party for any such modification, suspension or discontinuance.

7. OWNERSHIP.

The Services are licensed, not sold, and Function Flo, its suppliers or its licensors, retains and reserves all rights not expressly granted in this Agreement. Function Flo, its suppliers or its licensors own all worldwide right, title and interest in and to the Services, including all worldwide patent rights (including patent applications and disclosures); copyright rights (including copyrights, copyright registration and copy rights with respect to computer software, software design, software code, software architecture, firmware, programming tools, graphic user interfaces, reports, dashboard, business rules, use cases, screens, alerts, notifications, drawings, specifications and databases); moral rights; trade secrets and other rights with respect to confidential or proprietary information; know-how; other rights with respect to inventions, discoveries, ideas, improvements, techniques, formulae, algorithms, processes, schematics, testing procedures, technical information and other technology; and any other intellectual and industrial property rights, whether or not subject to registration or protection; and all rights under any license or other arrangement with respect to the foregoing (collectively, “Intellectual Property Rights”). Except as expressly stated in this Agreement, Function Flo does not grant Customer any Intellectual Property Rights in the Services. If Function Flo provides any third party and open source software (“OSS”), it will be aggregated and provided as object code in a separate library, but shall not be considered part of the Services. Use of such open source software is subject to the applicable open source license provided with the OSS. Customer agrees to comply with all open source software licenses. Customer will not distribute the Services or combine it with any other software which would result in an obligation to license the aggregate software in any manner. The OSS attributions and location where the open source version of the OSS is available for download is found at https:www.functionflo.com/thirdparty. Function Flo will provide support for OSS in the binary version provided by Function Flo with the Services as part of support and maintenance. The Services is copyrighted and protected by the laws of the United States and other countries, and international treaty provisions.

8. FEES.

    • Fees and Expenses. Customer shall pay all agreed upon fees for the Services as set forth in the applicable Order Form (“Fees”) and in accordance with terms set forth in such Order Form.
    • Payment Terms. Customer Fees shall be charged to the customer’s payment on file on the first day of each month for the previous month’s payment. Function Flo shall email invoices to Customer on the 1st of each month. Customer shall provide Function Flo with complete and accurate billing contact information including a valid email address. All payments to Function Flo are non-refundable except as otherwise expressly provided in the applicable Order Form. All payments will be made in United States dollars via electric funds transfer, as per the instructions of Function Flo. Function Flo may invoice parts of an Order Form separately or all in one invoice. Any discounts, interests and taxes invoiced to an Order Form shall be allocated equally to each Service and licenses provided under such Order Form.
    • Late Payments. If Customer fails to pay any past due invoice, Function Flo may revoke or suspend the Services until such time as Customer brings its account completely current. Function Flo may charge interest on all past due invoices at a rate of 1.5% per month, or the highest rate allowed by applicable law, whichever is lower. If Customer is delinquent in its payments for two (2) consecutive months, Function Flo may, upon written notice to Customer, modify the payment terms to require full pre-payment of any or all Order Forms

(both currently contracted and in the future), or require other assurances to secure Customer’s payment obligations hereunder.

  • Taxes. All Fees exclude any and all taxes and similar fees now in force, enacted or imposed in the future on the transaction, delivery of the Services, including any sales, use or value added taxes, goods and services tax, consumption tax, customs duties or similar charges, but excluding withholding taxes and taxes solely based on Function Flo’s net income, and Customer shall be responsible for payment of all such taxes, duties and charges, and any related penalties and interest arising from the payment of such amounts. If Customer is legally required to withhold any amounts to be paid to Function Flo, Customer will deduct such taxes from the amount otherwise owed, pay the tax to the appropriate taxing authority, and provide to Function Flo on a timely basis properly executed certificates, receipts or other documentation as evidence of such tax payment to the taxing authority, sufficient to permit Function Flo to establish Function Flo’s right to a credit for such taxes against Function Flo’s income tax liability. Customer shall provide Function Flo with such assistance as Function Flo shall reasonably request in connection with any application by Function Flo to qualify for the benefit of a reduced rate of withholding taxation under the terms of any applicable income tax treaty.

9. FEEDBACK.

Customer agrees to provide Function Flo with Feedback. Function Flo, in its sole discretion, may or may not respond to Customer’s Feedback or promise to address all of Customer’s Feedback in the development of future features or functionalities of the Services or any related or subsequent versions of such Services. Customer assigns, at no charge, all rights, title and interests in Feedback to Function Flo, and agrees that Function Flo is free to use, reproduce, modify, adapt, create derivative works from, publicly perform, publicly display, distribute, make, have made, assign, pledge, transfer or otherwise grant rights in the Feedback in any form and any medium (whether now known or later developed), without credit or compensation to Customer. Customer warrants that the Feedback does not infringe any copyright or trade secret of any third party, and that Customer has no knowledge of any patent of any third party that may be infringed by the Feedback (including any implementation thereof recommended by Customer). Customer further warrants that its Feedback is not subject to any license terms that would purport to require Function Flo to comply with any additional obligations with respect to any Services that incorporates Customer’s Feedback.

10. DATA.

  • Data Processing. Function Flo shall process and use any personal data that Customer provides in accordance with the Function Flo Privacy Policy located at https://www.Function Flo.com/privacy/. To the extent Customer provides to Function Flo personal data from a third party data subject when Customer is acting as their data controller, Function Flo will process such personal data in accordance with its Data Processing Agreement attached hereto as Exhibit B. Function Flo will maintain a security program materially in accordance with industry standards that are designed to protect the security, confidentiality and integrity of the Data. Customer hereby grants Function Flo a perpetual, irrevocable, non-exclusive, royalty-free, paid-up, worldwide, sublicensable license to use, access, transmit, host, store, and display the Data solely for the purpose of providing and improving the Services, including rights to extract, compile, aggregate, synthesize, use, and otherwise analyze all or any portion of the Data. Function Flo may use, publish, share, distribute, or disclose such Data on an aggregate basis or in a de-identified manner that does not allow personal data about Customer to be separated from the aggregate data and identified as originating from Customer.
  • Data Warranty and Obligations. Customer represents, warrants and agrees that Customer has all rights to provide the Data and other materials that Customer provides or makes available to Function Flo. Customer acknowledges and agrees that it is solely responsible for all Data and for its conduct while using the Services. Customer acknowledges and agrees that: (i) it will evaluate and bear all risks associated with its use and distribution of all Data; (ii) it is responsible for protecting and backing up the Data; (iii) it is responsible for protecting the confidentiality of all Data in its possession and control; and (iv) under no circumstances will Function Flo be liable in any way for the content of any Data, including, but not limited to, any errors or omissions in any Data, or any loss or damages or any kind incurred as a result of Customer’s use, deletion, modification, or correction of any Data. Customer has full discretion and control on how to store, protect, remove or delete any Data on the Services and Function Flo shall have no liability for any damages caused by such deletion or removal of or failure to store or protect Data.

11. WARRANTY.

  • Mutual Representations and Warranties. Each party represents and warrants that it has full right, power, and authority to enter into this Agreement and to perform its obligations and duties under this Agreement, and that the performance of such obligations and duties does not conflict with or result in a breach of any other agreement of such party or any judgment, order, or decree by which such party is bound.
  • Function Flo Professional Services Warranty. Function Flo further represents and warrants that it will perform the Professional Services in a competent and workmanlike manner. Customer’s sole and exclusive remedy for breach of the warranty in this Section 11.b. shall be re-performance of the applicable Professional Services.
  • Disclaimer. EXCEPT AS SET FORTH IN SECTIONS 11.a. and 11.b., FUNCTION FLO DISCLAIMS ANY

AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, TITLE, QUIET ENJOYMENT AND WARRANTIES ARISING OUT OF COURSE OF DEALING, USAGE OR TRADE PRACTICE, OR BY STATUTE OR IN LAW. FUNCTION FLO

SPECIFICALLY DOES NOT WARRANT THAT THE SERVICES OR PROFESSIONAL SERVICES WILL MEET CUSTOMER’S REQUIREMENTS, THE OPERATION OR OUTPUT OF THE SERVICES OR PROFESSIONAL SERVICES WILL BE ERROR-FREE, VIRUS-FREE, SECURE, ACCURATE, RELIABLE, COMPLETE OR UNINTERRUPTED. EXCEPT AS OTHERWISE PROVIDED IN THIS AGREEMENT, CUSTOMER PROVIDES THE DATA ON AN “AS IS” BASIS AND PROVIDES NO GUARANTEE OF THE ACCURACY OF THE DATA PROVIDED TO FUNCTION FLO. Function Flo is not obligated to support, update or upgrade the Services.

  • Beta Disclaimer. ALL SERVICES LABELED ALPHA, BETA, PRE-RELEASE, TRIAL, PREVIEW OR SIMILARLY (“Beta Services”) ARE PROVIDED “AS IS”, “AS AVAILABLE”, WITH ALL FAULTS, AND CUSTOMER’S USE OF SUCH BETA SERVICES IS AT ITS SOLE RISK. Function Flo has no obligations in connection with or in the course of providing the Beta Services. Any expectations and estimates regarding Beta Services are based on factors currently known and actual events or results could differ materially. Function Flo does not assume any obligation to update any Beta Services. In addition, any information about Function Flo’s roadmap outlines Function Flo’s general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into this Agreement or any contract or other commitment. Function Flo undertakes no obligation either to develop the features or functionality provided in the Beta Services, or to include any such feature or functionality in a future release of the Services. Customer expressly acknowledges that the Beta Services have not been fully tested, and may contain defects or deficiencies which may not be corrected by Function Flo. The Beta Services may undergo significant changes prior to release of the corresponding generally available final version.

12. INDEMNIFICATION.

  • Claims Against Customer. Function Flo will defend, at its own expense, and hold Customer harmless against any claim, suit or action brought against Customer by a third party to the extent that such claim, suit or action arises from an allegation that the Services, when used as expressly permitted by this Agreement, infringes the intellectual property rights of such third party (“Customer Claim”), and Function Flo will indemnify Customer from liability incurred by Customer to the extent arising from such Customer Claim. If Function Flo receives prompt notice of a Customer Claim that, in Function Flo’s reasonable opinion, is likely to result in an adverse ruling, then Function Flo may (i) obtain a right for Customer to continue using the Services at issue; (ii) modify such Services to make it non-infringing; (iii) replace such Services with a non-infringing version; or (iv) provide a reasonable depreciated or pro rata refund of amounts pre-paid for the allegedly infringing Services.
  • Function Flo Indemnity Limits. Notwithstanding the foregoing, Function Flo will have no obligation under Section 12.a. or otherwise with respect to any infringement claim based upon: (i) any use of the Services not expressly permitted under this Agreement; (ii) any use of the Services in combination with products, equipment, software, or data not made available by Function Flo if such infringement would have been avoided without the combination with such other products, equipment, software or data; or (iii) any modification of the Services by any person other than Function Flo or its authorized agents or subcontractors (collectively, “Excluded Claims”). Function Flo will have no obligation under Section 12.a. or otherwise with respect to any claim based upon the use by Customer of any Data uploaded or accessed through the Services to the extent such claim is not based on the Services itself. Section 12.a. states Function Flo’s sole liability and Customer’s exclusive remedy for all third party claims.
  • Claims Against Function Flo. Customer will defend, at its own expense, and hold Function Flo harmless against any claim, suit or action against Function Flo brought by a third party to the extent that such claim, suit or action arises from (i) Customer’s failure to comply with or violation of any applicable law or regulation, (ii) Customer’s infringement of any third party’s Intellectual Property Right, (iii) Customer’s use of any Data, (iv) Customer’s products or services, or (v) Excluded Claims (each, a Function Flo Claim”), and Customer will indemnify Function Flo harmless from liability incurred by Function Flo that is specifically attributable to such Function Flo Claim or those costs and damages agreed to in a monetary settlement of such Function Flo Claim.
  • Procedure. The foregoing obligations are conditioned on the party seeking indemnification: (i) promptly notifying the other party in writing of such claim; (ii) giving the other party sole control of the defense thereof and any related settlement negotiations; and (iii) cooperating and, at other party’s request and expense, assisting in such defense. Neither party may make any public announcement of any claim, defense or settlement without the other party’s prior written approval. The indemnifying party may not settle, compromise or resolve a claim without the consent of the indemnified party, if such settlement, compromise or resolution causes or requires an admission or finding of guilt against the indemnified party, imposes any monetary damages against the indemnified party, or does not fully release the indemnified party from liability with respect to the claim.

13 . LIMITATION OF LIABILITY.

  • IN NO EVENT WILL FUNCTION FLO BE LIABLE TO CUSTOMER FOR ANY SPECIAL, INDIRECT, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF USE, DATA, GOODWILL OR PROFITS, BUSINESS INTERRUPTION, OR COSTS OF PROCURING SUBSTITUTE SOFTWARE, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, THE PROFESSIONAL SERVICES OR THE USE OR PERFORMANCE OF THE SERVICES. WITHOUT LIMITING THE FOREGOING, FUNCTION FLO WILL HAVE NO LIABILITY OR RESPONSIBILITY FOR ANY BUSINESS INTERRUPTION OR LOSS OF DATA ARISING FROM THE AUTOMATIC TERMINATION OF THE LICENSE RIGHTS GRANTED HEREIN AND ANY ASSOCIATED CESSATION OF THE SERVICES, ITS FUNCTIONS, ANY UNANTICIPATED OR UNSCHEDULED DOWNTIME FOR ANY REASON OR ANY DELETION, CORRUPTION OR DAMAGE OF DATA ON OR THROUGH THE SERVICES. FUNCTION FLO’S TOTAL CUMULATIVE LIABILITY TO CUSTOMER, FROM ALL CAUSES OF ACTION AND ALL THEORIES OF LIABILITY IN CONNECTION WITH THIS AGREEMENT, INCLUDING ALL ORDER FORMS, WILL BE LIMITED TO AND WILL NOT EXCEED THE AMOUNT PAID OR PAYABLE BY CUSTOMER TO FUNCTION FLO UNDER THIS AGREEMENT FOR THE TWELVE MONTH PERIOD PRIOR TO THE EVENT GIVING RISE TO SUCH CLAIM.
  • THE FOREGOING LIMITATIONS, EXCLUSIONS AND DISCLAIMERS SHALL APPLY REGARDLESS OF WHETHER SUCH LIABILITY ARISES FROM ANY CLAIM BASED UPON CONTRACT, WARRANTY, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, AND WHETHER OR NOT THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LOSS OR DAMAGE. INSOFAR AS APPLICABLE LAW PROHIBITS ANY LIMITATION ON LIABILITY HEREIN, THE PARTIES AGREE THAT SUCH LIMITATION WILL BE AUTOMATICALLY MODIFIED, BUT ONLY TO THE EXTENT SO AS TO MAKE THE LIMITATION COMPLIANT WITH APPLICABLE LAW. THE PARTIES AGREE THAT THE LIMITATIONS ON LIABILITIES SET FORTH HEREIN ARE AGREED ALLOCATIONS OF RISK AND SUCH LIMITATIONS WILL APPLY NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY.

14 . COMPLIANCE WITH LAWS.

Customer will comply fully with all applicable laws, including all applicable laws relating to bribery or corruption, and export laws and regulations of the United States and any other country (“Export Laws”) where Customer uses any of the Services. Customer represents and warrants that it is not (a) located in, or a resident or a national of, a restricted country; or (b) on any of the relevant U.S. Government Lists of prohibited persons, including but not limited to the Treasury Department’s List of Specially Designated Nationals and the Commerce Department’s List of Denied Persons or Entity List. Customer further represents and warrants that it shall not export, re-export, ship, or transfer the Services to any restricted countries or restricted end users or use the Services in any restricted countries or for any purposes prohibited by the Export Laws, including, but not limited to, nuclear, chemical, missile or biological weapons related end uses. Customer understands that the requirements and restrictions of the Export Laws may vary depending on the specific Services and may change over time, and that, to determine the precise controls applicable to the Services, it is necessary to refer to the U.S. Export Administration Regulations and the U.S. Department of Treasury, Office of Foreign Assets Control Regulations.

Customer further agrees to comply with all federal, state, provincial, local and foreign laws, rules and regulations applicable to Customer’s business in relation to Customer’s use of the Services, including any applicable privacy and consumer protection laws, tax laws and regulations, the Americans with Disabilities Act of 1990, the then-current version of the Payment Card Industry Data Security Standards as made available at https://www.pcisecuritystandards.org and the by-laws, and any and all other rules, policies and procedures of VISA, MasterCard, Discover and/or other card networks as in effect from time to time.

15. CHOICE OF LAW.

This Agreement shall be governed by and construed in accordance with the laws of the State of Texas, as if performed wholly within the state and without giving effect to the principles of conflict of law rules of any jurisdiction. The parties agree that neither the Uniform Computer Information Transaction Act (UCITA) nor the United Nations Convention on Contracts for the International Sale of Goods shall apply to this Agreement, regardless of the states in which the parties do business or are incorporated.

  • BINDING ARBITRATION AND CLASS ACTION WAIVER.
  • ALL CLAIMS BETWEEN THE PARTIES SHALL BE RESOLVED BY FINAL AND BINDING ARBITRATION RATHER THAN IN COURT, EXCEPT THAT CUSTOMER MAY ASSERT CLAIMS IN SMALL CLAIMS COURT (DEFINED FOR THE PURPOSES OF THIS TOS AS A COURT OF LIMITED JURISDICTION THAT MAY ONLY HEAR CLAIMS NOT EXCEEDING $5,000) IF CUSTOMER’S CLAIMS ARE WITHIN THE COURT’S JURISDICTION. THERE IS NO JUDGE OR JURY IN ARBITRATION, AND COURT REVIEW OF AN ARBITRATION AWARD IS LIMITED.
  • The arbitration shall be conducted by the American Arbitration Association (AAA) under its then-applicable Commercial Arbitration Rules or, as appropriate, its Consumer Arbitration Rules. The AAA’s rules are available at http://www.adr.org/. Payment of all filing, administration and arbitrator fees shall be governed by the AAA’s rules. The arbitration shall be conducted in the English language by a single independent and neutral arbitrator. For any hearing conducted in person as part of the arbitration, Customer agrees that such hearing shall be conducted in Austin, Texas or, if the Consumer Arbitration Rules apply, another location reasonably convenient to both parties with due consideration of their ability to travel and other pertinent circumstances, as determined by the arbitrator. The decision of the arbitrator shall be final and binding. Judgment on the arbitral award may be entered in any court of competent jurisdiction.
  • WE EACH AGREE THAT ALL CLAIMS SHALL BE RESOLVED ONLY ON AN INDIVIDUAL BASIS AND NOT IN A CLASS, CONSOLIDATED OR REPRESENTATIVE ACTION OR OTHER SIMILAR PROCESS (INCLUDING ARBITRATION). IF FOR ANY REASON A CLAIM PROCEEDS IN COURT RATHER THAN IN ARBITRATION, WE EACH WAIVE ANY RIGHT TO A JURY TRIAL AND AGREE THAT SUCH CLAIM SHALL BE BROUGHT ONLY IN A COURT OF COMPETENT JURISDICTION IN AUSTIN, TEXAS. CUSTOMER HEREBY SUBMITS TO THE PERSONAL JURISDICTION AND VENUE OF SUCH COURTS AND WAIVE ANY OBJECTION ON THE GROUNDS OF VENUE, FORUM NON-CONVENIENS OR ANY SIMILAR GROUNDS WITH RESPECT TO ANY SUCH CLAIM. 
  • Notwithstanding anything to the contrary, each party may seek injunctive relief and any other equitable remedies from any court of competent jurisdiction to protect its Confidential Information or Intellectual Property Rights, whether in aid of, pending, or independently of the resolution of any dispute pursuant to the arbitration procedures set forth in this Section 16 .
  • If Function Flo implements any material change to this Section 16 , such change shall not apply to any claim for which Customer provided written notice to Function Flo before the implementation of the change. The prevailing party shall recover its reasonable attorneys’ fees, expert fees, costs including arbitration costs and fees.

17. GENERAL.

Function Flo may include the name, logo of and success stories of Customer in Function Flo’s website, press releases, promotional and sales literature, and lists of customers, in each case in accordance with Customer’s standard trademark usage guidelines. All notices required or permitted under this Agreement hereto will be in writing and delivered in person, by email to the address designated in the applicable Order Form, by confirmed facsimile transmission, by overnight delivery service, or by registered or certified mail, postage prepaid with return receipt requested, and in each instance will be deemed given upon receipt. Customer may not assign, delegate or transfer this Agreement, in whole or in part, by agreement, operation of law or otherwise. Any attempt to assign this Agreement other than as permitted herein shall be null and void. Customer acknowledges that Function Flo may assign, subcontract or delegate any of its rights or obligations under this Agreement. Subject to the foregoing, this Agreement will bind and inure to the benefit of the parties’ permitted successors and assigns. This Agreement along with any additional terms incorporated herein by reference constitute the complete and exclusive understanding and agreement between the parties relating only to the subject matter of the Services, including Confidential Information, and shall supersede any and all prior or contemporaneous agreements, communications and understandings, written or oral, relating to such subject matter. This Agreement is limited to the use of Services, Data and Confidential Information and as such, this Agreement is separate from and shall have no effect on any other agreement Customer may have with Function Flo. Any waiver, modification or amendment of any provision of this Agreement will be effective only if in writing and signed by duly authorized representatives of both parties. All rights and remedies, whether conferred hereunder or by any other instrument or law, will be cumulative and may be exercised singularly or concurrently. The failure by either party to enforce any provisions of this Agreement will not constitute a waiver of any other right hereunder or of any subsequent enforcement of that or any other provisions. The terms and conditions stated herein are declared to be severable. If a court of competent jurisdiction holds any provision of this Agreement invalid or unenforceable, the remaining provisions of the Agreement will remain in full force and effect, and the provision affected will be construed so as to be enforceable to the maximum extent permissible by law. For the purposes of this Agreement, the words “such as,” “include,” “includes” and “including” shall be deemed to be followed by the words “without limitation.” Any prevention of or delay in performance by Function Flo hereunder due to labor disputes, acts of god, failure of the Internet, governmental restrictions, enemy or hostile governmental action, fire or other casualty or other causes beyond its reasonable control shall excuse the performance of its obligations for a period equal to the duration of any such prevention or delay.

Schedule 1

 

GENERAL

 

  • Contact. Function Flo shall designate an administrative representative to communicate with Customer with respect to requests for maintenance and support.
  • Hours. Company provides maintenance and support from 8:00am Central Time to 6:00pm Central Time, Monday through Friday.
  • CLASSIFICATION AND RESPONSE
  • Services Requests. Upon Function Flo’s receipt of a written notice of an error from Customer, Function Flo shall: (i) promptly confirm to Customer that it is in receipt of the notice; and (ii) confer with Customer and use commercially reasonable efforts to reproduce, assess and resolve the error. Function Flo shall classify service requests in accordance with Section 2(b) of this Schedule and respond to service requests in accordance with Section 2(c) of this Schedule.
  • Classification. Requests for maintenance and support shall be classified as follows

 

Severity Level 1

Critical error that renders all essential functions of the Services unusable in any material manner.

Severity Level 2

Significant error that renders an essential function of the Services unusable or negatively impacts the usability or performance of a major function of the Services in a material manner. User-implemented workaround is not available to avoid the error.

Severity Level 3

Minor error that renders a non-essential function of the Services unusable or negatively impacts the usability or performance of a non-essential function but does not significantly affect the overall usability or performance of the Services.

Severity Level 4

Information request or request for clarification on use of a function.

 

  • Response. After receipt of a service request, Function Flo shall commence remedial measures as described below within the timeframes set forth below:

 

Severity Level 1

Six (6) hours.

Function Flo shall promptly initiate the following procedures: (i) assign resources to diagnose and correct the error on an expedited basis using commercially reasonable efforts; (ii) provide ongoing communication on the status of remedial measures; and (iii) advise of a temporary workaround or fix, if available.

Severity Level 2

Twelve (12) hours.

Function Flo shall promptly initiate the following procedures: (i) assign resources to diagnose and correct the error using commercially reasonable efforts; (ii) provide ongoing communication on the status of remedial measures; and (iii) advise of a temporary workaround or fix, if available.

Severity Level 3

One (1) business day.

Function Flo shall advise of a temporary workaround or fix, if available, or Function Flo may implement a fix in the next general release of the Services.

Severity Level 4

Three (3) business days.

Function Flo shall provide the information or clarification requested.

  • SERVICE LEVEL
  • Definitions.
  • Downtime” means any period of time during which any essential function of the Services is inaccessible in any material respect, excluding Permitted Downtime and any period of time during which any essential function of the Services is inaccessible in any material respect due to (i) force majeure, (ii) acts or omissions of Customer or third parties, (iii) outages of third party services, or (iv) outages or issues resulting from Customer configured settings/customizations.
  • Permitted Downtime” means any period of time during which the Services is inaccessible due to scheduled maintenance, which shall be performed only between 12:00 a.m. and 6:00 a.m. CT. Uptime Percentage” means the percentage calculated by subtracting from 100% the percentage of minutes during the month that constitute Downtime.

Assurance. Function Flo shall use commercially reasonable efforts to ensure that the Services maintains a monthly Uptime Percentage of at least 99.9%.

Data Processing Agreement

Insofar as the Function Flo Corporation (“Data Processor”) will be processing personal data on behalf of Customer (“Data Controller”) pursuant to the Subscription Services Agreement or other written or electronic agreement (the “Agreement”) between Data Processor and Data Controller for the purchase of online services from Data Processor, the terms of this Data Processing Agreement (“DPA”) shall apply. Any capitalized terms not otherwise defined in this DPA shall have the meaning given to them in the Agreement. In the event of a conflict between any provisions of the Agreement and this DPA, the provisions of this DPA shall govern and control with regard to the processing of personal data. References to “Data Protection Laws” shall mean any law applicable to Data Processor’s processing or use of personal data, including (to the extent applicable), (a) (i) prior to 25 May 2018, Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“Directive”) and on and after 25 May 2018, Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (“GDPR”); and (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and applicable national implementations of it (as may be amended, superseded or replaced), and (b) The California Consumer Privacy Act of 2018, AB375, Title 1.81.5, § 1798.100 et seq., including any implementing law, as amended (“CCPA”).

  • Processing.
  • Data Processor will only process, store, and use the personal data it receives from the Data Controller as necessary to provide the Data Processor’s services to the Data Controller, the business purposes as set forth in the Agreement, or Data Controller’s prior written instructions. The Data Processor shall never retain, use, disclose, sell, or process the personal data other than as specified in the Data Controller’s documented instructions or as otherwise permitted by law.
  • The Data Controller has all necessary rights to provide the personal data to the Data Processor for the processing to be performed in connection with the Services. To the extent required by Data Protection Laws, the Data Controller is responsible for providing all necessary privacy notices to data subjects, and unless another legal basis set forth in the Data Protection Laws supports the lawfulness of the processing, and for obtaining any necessary consents from data subject to the processing required under the Agreement. Should such a consent be revoked by a data subject, the Data Controller will inform the Data Processor of such revocation, and the Data Processor is responsible for implementing Data Controller’s instruction with respect to the processing of such personal data.
  • Confidentiality.

The Data Processor shall treat all personal data as Confidential Information under the Agreement, and it shall inform all its employees, agents and approved sub-processors engaged in processing the personal data of the confidential nature of the personal data. The Data Processor shall ensure that all such persons or parties have signed confidentiality agreements with obligations no less restrictive in the use and protection of Confidential Information than those in the Agreement.

  • Security Measures.
  • Considering the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Data Processor shall implement appropriate technical and organizational measures to ensure a level of security of the processing of personal data appropriate to the risk. The Data Processor shall maintain and follow written security policies that are fully implemented and applicable to the processing of personal data. At a minimum, such policies will include assignment of internal responsibility for information security management, devoting adequate personnel resources to information security, carrying out verification checks on permanent staff who will have access to the personal data,

conducting appropriate background checks, requiring employees, vendors and others with access to personal data to enter into written confidentiality agreements, and conducting training to make employees and others with access to the personal data aware of information security risks presented by the processing.

  • At the request of the Data Controller, the Data Processor shall demonstrate the measures it has taken pursuant to this Article 3 and shall allow the Data Controller to audit and test such measures, to the extent it does not require providing access to other customers’ data. Subject to such restriction, the Data Processor shall cooperate with such audits carried out by or on behalf of the Data Controller, shall grant the Data Controller´s auditors reasonable access to any premises and devices involved with the processing of the personal data, and shall provide the Data Controller´s auditors with access to any information relating to the processing of the personal data as may be reasonably required by the Data Controller to ascertain the Data Processor´s compliance with this DPA.
  • Data Transfers.

Data Processor may transfer personal data across the border to a country outside of the United States, as necessary to provide the Services. Upon request by the Data Controller, Data Processor will provide details of its transfers of the European Economic Area (the “EEA”) personal data outside of the United States.

Solely to the extent Data Controller transfers any personal data from (a) the EEA, or (b) a jurisdiction where a European Commission positive adequacy decision under Article 25(6) of Directive 95/46/EC is in force and covers such transfer, then the parties agree that such personal data is subject to the model contractual clauses attached hereto as Appendix 1 and annexed to Commission Decision 2004/915/EC (the “Clauses”), which are hereby incorporated into the Agreement. In such cases, Data Controller is the ‘data exporter’ and Data Processor is the ‘data importer’ as defined in the Clauses.

  • Security Breach.

The Data Processor will notify the Data Controller without undue delay upon discovery of any suspected or actual security or confidentiality breach or other compromise of personal data, describing the breach in reasonable detail, the status of any investigation or mitigation taken by the Data Processor, and if applicable, the potential number of data subjects affected. Data Processor will not communicate with any third party regarding any security breach except as specified by other party or by applicable law.

  • Subprocessors.

The Data Processor may subcontract any of its Services-related activities or allow any personal data to be processed by a third party, provided that such subprocessors are bound by data protection obligations compatible with those of the Data Processor under this DPA.

  • Data Subject Rights.

The Data Processor shall assist the Data Controller by appropriate technical and organizational measures, insofar as it is possible, for the fulfillment of the Data Controller’s obligation to respond to requests for exercising the data subject’s rights under the Data Protection Laws.

Appendix 1 – Model Clauses

 

Data Controller and Data Processor have agreed on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1/A.

Clause 1

Definitions

‘the data exporter’ means the controller who transfers the personal data;

‘the data importer’ means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country’s system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;

‘the sub-processor’ means any processor engaged by the data importer or by any other sub-processor of the data importer who agrees to receive from the data importer or from any other sub-processor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;

‘the applicable data protection law’ means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;

‘technical and organizational security measures’ means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the trans-mission of data over a network, and against all other unlawful forms of processing.

Clause 2

Details of the transfer

The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1/A which forms an integral part of the Clauses.

Clause 3

Third-party beneficiary clause

  • The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.
  • The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.
  • The data subject can enforce against the sub-processor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
  • The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.

Clause 4

Obligations of the data exporter The data exporter agrees and warrants:

  • that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
  • that it has instructed and throughout the duration of the personal data-processing services will instruct the data importer to process the personal data transferred only on the data exporter’s behalf and in accordance with the applicable data protection law and the Clauses;
  • that the data importer will provide sufficient guarantees in respect of the technical and organizational security measures specified in Appendix 1/B to this contract;
  • that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or un-lawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
  • that it will ensure compliance with the security measures;
  • that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
  • to forward any notification received from the data importer or any sub-processor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
  • to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 1/B, and a summary description of the security measures, as well as a copy of any contract for sub-processing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
  • that, in the event of sub-processing, the processing activity is carried out in accordance with Clause 11 by a sub processor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
  • that it will ensure compliance with Clause 4(a) to (i).

Clause 5

Obligations of the data importer

The data importer agrees and warrants:

  • to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
  • that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly

notify the change to the data exporter as soon as it is aware, in which case the data

exporter is entitled to suspend the transfer of data and/or terminate the contract;

  • that it has implemented the technical and organizational security measures specified in

Appendix 1/B before processing the personal data transferred;

  • that it will promptly notify the data exporter about:
  • any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;
  • any accidental or unauthorized access; and
  • any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized to do so;
  • to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
  • at the request of the data exporter to submit its data-processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, select-ed by the data exporter, where applicable, in agreement with the supervisory authority;
  • to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 1/B which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;
  • that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent;
  • that the processing services by the sub-processor will be carried out in accordance with Clause 11;• to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

Clause 6

Liability

  • The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or sub-processor is entitled to receive compensation from the data exporter for the damage suffered.
  • If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his sub-processor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become in-solvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.

The data importer may not rely on a breach by a sub-processor of its obligations in order to avoid its own liabilities.

  • If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the sub-processor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the sub-processor agrees that the data subject may issue a claim against the data sub-processor with regard to its own processing operations under the Clauses as if it were the data

exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the sub-processor shall be limited to its own processing operations under the Clauses.

Clause 7

Mediation and jurisdiction

  • The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject; to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority; to refer the dispute to the courts in the Member State in which the data exporter is established.
  • The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8

Cooperation with supervisory authorities

  • The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.
  • The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any sub-processor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.
  • The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any sub-processor preventing the conduct of an audit of the data importer, or any sub-processor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5(b).

Clause 9

Governing law

The Clauses shall be governed by the law of the Member State in which the data exporter is established.

Clause 10

Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

Clause 11

Sub-processing

  • The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub-processor as are imposed on the data importer under the Clauses . Where the sub-processor fails to fulfill its data protection obligations under such written agreement the data importer shall re-main fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement.
  • The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses.
  • The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1

shall be governed by the law of the Member State in which the data exporter is established.

  • The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Clause 12

Obligation after the termination of personal data-processing services

  • The parties agree that on the termination of the provision of data-processing services, the data importer and the sub-processor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.
  • The data importer and the sub-processor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data-processing facilities for an audit of the measures referred to in paragraph 1.

Appendix 1/A

This Appendix forms part of the Clauses and must be completed and signed by the parties.

The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix.

Data exporter

The data exporter is: the non-Function Flo Corporation entity that is a party to the Clauses.

Data importer

The data importer is: Function Flo Corporation 1807 Crooked Lane, Austin, Texas 78741.

Data subjects

The personal data transferred concern the following categories of data subjects: data subjects include individuals about whom data that originated in the EEA is provided to Function Flo Corporation via its services by (or at the direction of) the data exporter.

Categories of data

The personal data transferred concern the following categories of data (please specify):

  • First and last name
  • One or more addresses (street, city, state, zip) to receive deliveries
  • Email address
  • Phone number
  • IP address

Special categories of data (if appropriate)

The personal data transferred concern the following special categories of data (please specify): None Processing operations

The personal data transferred will be subject to the following basic processing activities (please specify): Function Flo Corporation will process the personal data for the purposes of providing its services to the data exporter in accordance with and as described in the Agreement, the DPA, and these Clauses.

Appendix 1/B

This Appendix forms part of the Clauses and must be completed and signed by the parties.

Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):

Function Flo Corporation is committed to implementing appropriate technical and organizational security measures to meet its obligations to the data exporter. Function Flo Corporation has internally documented policies and controls.

These policies refer to all data collected from employees, candidates, users, customers, vendors, or other parties that provide information to Function Flo Corporation.

Function Flo Corporation employees must follow these policies. Contractors, consultants, partners and any other external entities are also covered. Generally, our policy refers to anyone we collaborate with or who acts on our behalf and may need access to Function Flo Corporation data.

To help comply with these policies and controls, Function Flo Corporation will:

  • Classify all data and apply appropriate controls for each level
  • Employ encryption of all customer data in transit and at rest to minimum industry standards

Perform periodic reviews of all our security policies and controls

  • Schedule annual penetration tests of the Function Flo Corporation application and remediate appropriately

Perform annualized security training for all Function Flo Corporation employees