Stora Terms of Use

These Terms of Use apply to your use of all software services provided by Stora Ltd of 11 Newry Road, Banbridge, Northern Ireland, BT32 3HR (“Stora”). By using the Platform, you (referred to in this Agreement as the “Customer”) agree to be bound by them in relation to all use of the Platform.

1. Definitions

The following definitions apply in this document:

The Platform means the self-storage facility management software service made available to the Customer and its Users on and subject to the terms of this Agreement and as specified in any invoice or order form sent to you by Stora.

Business Day means a day (other than a Saturday, Sunday or public holiday) on which banks are open for business in the United Kingdom.

Confidential Information means all information (whether or not it is described as confidential) in any form or medium concerning any past, present or future business, operations or affairs of either party, including, without limitation customer data, all technical or non-technical data, formulae, patterns, programs, devices, methods, techniques, plans, drawings, models and processes, source and object code, software and computer records; all business and marketing plans and projections, details of agreements and arrangements with third parties, and User and supplier information and lists; all financial information, pricing schedules and structures, product margins, remuneration details and investment outlays; all information concerning any employee, customer, contractor, supplier or agent of the relevant party; the party’s policies and procedures, but excludes information that the other party can establish is known by or is in the other party’s possession or control other than through a breach of this document and is not subject to any obligation of confidence; or is in the public domain other than by a breach of this document or any obligations of confidence.; or is independently developed by or on behalf of the receiving party without reference to or use of the disclosing party’s Confidential Information.

Customer Data means any information that the Customer or any of its Users uploads to the Platform, including Customer Personal Data.

Customer Personal Data means any Personal Data that the Customer or any of its Users uploads to the Platform.

Data Processing Addendum means the additional terms forming part of this Agreement at Schedule 1.

Data Protection Legislation means the UK Data Protection Act 2018, Regulation (EU) 2016/679 of the European Parliament and of the Council, (the General Data Protection Regulation); any other existing or future law, directive or regulation (anywhere in the world) relating to the Processing of Personal Data or privacy, to which Stora or the Customer is subject.

Data Controller, Data Processor, Data Subject, Processing and Personal Data have the meanings given to those expressions or any equivalent or corresponding expressions in the Data Protection Legislation.

Force Majeure means an event or cause beyond the reasonable control of the party claiming force majeure. It includes each of the following, to the extent it is beyond the reasonable control of that party: act of God, lightning, storm, flood, fire, earthquake or explosion cyclone, tidal wave, landslide, adverse weather conditions; act of public enemy, war (declared or undeclared), terrorism, sabotage, blockade, revolution, riot, insurrection, civil commotion, epidemic or pandemic; the effect of any change in applicable laws, orders, rules or regulations of any government or other competent authority; and embargo, inability to obtain necessary materials, equipment or facilities, or power or water shortage.

Intellectual Property means all copyright, patents, inventions, trade secrets, know-how, product formulations, designs, circuit layouts, databases, registered or unregistered trade marks, brand names, business names, domain names and other forms of intellectual property;

Intellectual Property Rights means, for the duration of the rights in any part of the world, industrial or intellectual property rights, whether registrable or not, including in respect of Intellectual Property, applications for the registration of any Intellectual Property and any improvements, enhancements or modifications to any Intellectual Property registrations.

User means any end user authorised by the Customer to access the Customer’s self-storage management system instance on the Platform to purchase self-storage services and accompanying related goods and services.

2. The Platform

2.1. The Platform provides the Customer with a web-based platform to operate and manage a self-storage facility or facilities. Subject to payment of the applicable fees notified on Stora’s website, or otherwise on any invoice or order form, Stora shall make the Platform available to the Customer and its Users.

2.2. The Customer acknowledges that Stora accepts no liability for the operation or otherwise of the Platform as a result of interaction with integration with any third party software or service.

2.3. The Customer agrees and accepts that the Platform is an online service hosted by Stora and its infrastructure providers, and shall only be maintained by Stora, and is not available locally from the Customer’s systems. The Customer acknowledges that it is responsible for maintaining an internet connection to access the Platform. The Customer also acknowledges that the Platform is managed and supported exclusively by Stora and that no ‘back-end’ access to the Platform is available to the Customer or its Users.

2.4. Stora reserves the right to upgrade, maintain, tune, backup, amend, add or remove features, redesign, improve or otherwise alter the Platform at its sole discretion. Stora shall not amend the Platform in a manner that would intentionally cause the Customer to lose access to Customer Data or fundamentally decrease the utility of the Platform to the Customer, other than in accordance with the terms of this Agreement.

3. Payment of fees

3.1. The Customer shall pay the fees notified to it by Stora for use of the Platform. The fees for the use of the Platform are payable monthly (or as otherwise agreed in writing) in full and are based on the applicable tier of Customer’s usage of the Platform. No refunds are payable for any fees under any circumstances.

3.2. All invoices for the use of the Platform must be paid within 14 days of receipt. If full payment is not received by such date, Stora may suspend or withhold access for the Customer and all Users until such payment is received. Stora reserves the right to charge interest for any late payments at 4% above the prevailing Bank of England base rate.

3.3. All prices are exclusive of applicable local, state, federal and international sales, value added, withholding and other taxes and duties of any kind unless otherwise stated.

3.4. The Customer shall pay all invoices for the use of the Platform in full and shall have no right of set off for any liability it may claim to be owed to it by Stora at any time.

3.5. Stora may make the Platform (or any part of it) available to you for a limited evaluation period at no charge at its discretion. All the terms and conditions of this Agreement apply to your use of the Platform during any such period. the Platform. The terms and conditions of this Agreement will apply to your use of the Platform regardless of whether you pay for it or not.

4. Licence to use the Platform

4.1. Subject to compliance with the terms and conditions of this Agreement, the Customer and its Users are granted a limited, non-exclusive and revocable license to access and use the Platform for the duration of this Agreement.

4.2. The Customer is solely responsible for the security of user names and passwords issued to it for access to the Platform.

4.3. Stora may revoke or suspend access to the Platform at any time if the Customer or any User is in breach of this Agreement and has failed to comply with Stora’s reasonable request to remedy such breach within a reasonable time period.

4.4. The Customer shall ensure that each of its Users is aware of and complies with the terms of this Agreement, and the Customer shall remain liable to Stora for any breach of this Agreement by its Users, and any losses or damages that Stora may suffer as a result of any such breach.

4.5. The Customer agrees that it shall only use the Platform for its own internal business purposes and shall not use it to engage in any conduct that is unlawful, immoral, threatening, abusive or in a way that is deemed unreasonable by Stora in its sole discretion. The Customer shall not provide access to the Platform to any third party except to its Users purchasing access to the Customer’s self-storage facility. This includes misuse of APIs, integrations, or technical access methods as described in clause 12.

4.6. Stora shall endeavour to respond to all support requests within 3 Business Days or sooner. Stora reserves the right to require the payment of reasonable fees for non-standard support requests prior to the provision of such support.

5. Customer Data

5.1. The Customer shall provide Stora with access to such Customer Data as Stora may reasonably request in order to provide the Platform.

5.2. Stora obtains no right, title or interest in Customer Data including any Intellectual Property found within it. The Customer grants Stora a licence to use the Customer Data solely for the purposes of providing the Platform in accordance with this Agreement.

5.3. Stora accepts no liability for the content of Customer Data.

5.4. The Customer and its Users are responsible for the accuracy, quality and legality of Customer Data. The Customer shall ensure that it is has an appropriate legal basis (including consents where required by law) for making any Customer Data available to Stora for use on the Platform. The Customer hereby indemnifies Stora in relation to any claims, losses, damages and costs that Stora or its related parties may suffer as a result of any claim that Stora’s possession or use of the Customer Data to provide the Platform in accordance with this Agreement infringes any applicable Data Protection Legislation or the Intellectual Property Rights or any other rights of any third party, or that the Customer has acted in breach of the Data Processing Addendum.

5.5. Stora shall be entitled to delete Customer Data where any outstanding payments due to Stora by Customer remain unpaid in accordance with the terms of this Agreement and following reasonable attempts by Stora to seek payment.

5.6. Stora shall not access, use, modify or otherwise deal with Customer Data except to provide the Platform, where required by compulsion of law, or upon the Customer or any User’s authority (such as to provide technical support for the Platform), or as part of internal testing and troubleshooting. Notwithstanding the foregoing, Stora shall be permitted to use aggregated and/or anonymised sets of Customer Data and data otherwise generated through the use of the Platform by the Customer and its Users which do not contain Personal Data at its discretion without limitation, including after termination or expiry of this Agreement.

5.7. Stora may automatically scan files uploaded to the Platform for malware and other security threats. Where Stora reasonably considers that Customer Data may threaten the security of the Platform, its infrastructure or its users, Stora may restrict access to, quarantine or remove that Customer Data as reasonably necessary to investigate or address the threat.

6. Compliance with data privacy laws

6.1. Stora and the Customer will comply with all applicable requirements of the Data Protection Legislation.

6.2. To the extent that Stora acts as a Data Processor of Customer Personal Data in the course of making the Platform available to the Customer, both parties shall comply with the terms of the Data Processing Addendum.

6.3. Stora hereby indemnifies the Customer in relation to any claims, losses, damages and costs that the Customer may suffer as a result of any claim that Stora has acted in breach of the Data Processing Addendum. This indemnity shall not apply to any claim which arises from use of the Platform by the Customer or any User otherwise than in accordance with Stora’s reasonable instructions or the terms of this Agreement or in breach of the Data Processing Addendum.

7. Security

7.1. Stora takes the security of the Platform and the privacy of its Customers and Users very seriously. Stora shall use industry-standard systems and processes to protect the security of Customer Data.

7.2. The Customer agrees that its Users shall not do anything to prejudice the security or privacy of Stora’s systems (and the systems of Stora’s infrastructure providers) or the information on them. Standard support does not include custom integrations, API troubleshooting, or recovery from Customer-caused technical issues unless expressly agreed as paid services.

8. Intellectual Property

8.1. The Customer shall not copy, alter, or use the Platform except as provided by this Agreement without the prior written consent of Stora.

8.2. The Platform may incorporate software and other proprietary systems and Intellectual Property owned by Stora or which Stora has appropriate authority to use, and the Customer agrees that such is protected by copyright, trademarks, patents, proprietary rights and other laws, both domestically and internationally.

8.3. The Customer warrants that it shall not infringe on any third-party rights through the use of the Platform.

8.4. The Customer agrees and accepts that the Platform is the Intellectual Property of Stora and the Customer further warrants that by using the Platform the Customer and its Users will not:

8.4.1. copy the Platform or the services that it provides for their own commercial purposes; and

8.4.2. directly or indirectly copy, recreate, decompile, reverse engineer or otherwise obtain, modify or use any source or object code, architecture, algorithms contained in the Platform or any documentation associated with it.

8.5. All content (with the exception of Customer Data) remains the Intellectual Property of Stora, including (without limitation) any source code, ideas, enhancements, feature requests, suggestions or other information provided by the Customer or any other party with respect to the Platform.

8.6. Stora hereby indemnifies the Customer in relation to any claims, losses, damages and costs that the Customer may suffer as a result of any claim that the Customer’s use of the Platform in accordance with this Agreement and any instructions provided by Stora to the Customer infringes the Intellectual Property Rights of any third party. This indemnity shall not apply to any use of the Platform by the Customer or any User otherwise than in accordance with Stora’s reasonable instructions or the terms of this Agreement.

9. Confidentiality

9.1. Stora agrees to keep all Customer Data in confidence, and to the extent Customer Data is accessed and/or received by the Platform it shall be deemed as Confidential Information for the purposes of this Agreement.

9.2. Each party acknowledges and agrees that:

9.2.1. the Confidential Information is secret, confidential and valuable to the disclosing party (Discloser);

9.2.2. it owes an obligation of confidence to the Discloser concerning the Confidential Information;

9.2.3. it must not disclose the Confidential Information to a third party except as permitted in this Agreement;

9.2.4. all Intellectual Property rights remain vested in the Discloser but disclosure of Confidential Information does not in any way transfer or assign any rights or interests in the Intellectual Property to the receiving party; and

9.2.5. any breach or threatened breach by the receiving party of an obligation under this Agreement may cause the Discloser immediate and irreparable harm for which damages alone may not be an adequate remedy. Consequently the Discloser has the right, in addition to other remedies available at law or in equity, to seek injunctive relief against the receiving party (and its agents, assigns, employees, officers and directors, personally) or to compel specific performance of this clause.

9.3. A party must notify the Discloser in writing, giving full details known to it immediately, when it becomes aware of:

9.3.1. any actual, suspected, likely or threatened breach by it of any obligations it has in relation to the Confidential Information.

9.3.2. any actual, suspected, likely or threatened breach by any person of any obligation in relation to the Confidential Information; or

9.3.3. any actual, suspected, likely or threatened theft, loss, damage, or unauthorized access, use or disclosure of or to any Confidential Information.

9.4. The receiving party must promptly take all steps that the Discloser may reasonably require and must co-operate with any investigation, litigation or other action of the Discloser or of a related body corporate if there is:

9.4.1. any actual, suspected, likely or threatened breach of a term of this Agreement; or

9.4.2. any theft, loss, damage or unauthorized access, use or disclosure of or to any Confidential Information that is or was in its possession or control.

10. Warranties

10.1. Stora warrants that the Platform will conform to all representations and descriptions of functionality and service made available to the Customer and that it will use all reasonable commercial efforts to maintain the online availability of the Platform, excluding downtime for scheduled and emergency maintenance, which shall be notified in advance to Customer wherever possible, and scheduled to minimize disruption to Customer’s operations.

10.2. Stora warrants that it will use industry standard measures to maintain the security of the Platform as described in this Agreement, and that it will fix defects in the software in a prompt manner.

10.3. Except as otherwise provided in this Agreement, the Customer acknowledges and agrees that the Platform (including all content, function, and services) is provided “as is,” without additional warranty of any kind, either express or implied, including any additional warranty for information, data, data processing services or uninterrupted access, any warranties concerning the availability, accuracy, completeness, usefulness, or content of information, and any warranties of title, non-infringement, merchantability or fitness for a particular purpose.

10.4. Stora does not warrant that the Platform (or the function, content or services made available within it) will be timely, secure, uninterrupted or error free. Stora makes no warranty that the Platform will meet the Customer’s expectations or requirements. No advice, results or information, or data whether oral or written, obtained through the Platform shall create any warranty not expressly made herein. If a Customer is dissatisfied with the Platform, the sole remedy is to discontinue using the Platform.

10.5. The Customer acknowledges that the Platform is hosted on third party infrastructure, and Stora shall not be liable to Customer for any costs, losses, damages, downtime, or other liability arising from the use of or reliance upon such third party infrastructure.

10.6. Each party acknowledges that it has not relied on any representation, warranty or statement made by any other party, other than as set out in this Agreement.

11. Liability & Indemnity

11.1. THE CUSTOMER AGREES THAT IT USES THE PLATFORM AT ITS OWN RISK.

11.2. THE CUSTOMER ACKNOWLEDGES THAT STORA IS NOT RESPONSIBLE FOR THE CONDUCT OR ACTIVITIES OF ANY USER AND THAT STORA IS NOT LIABLE FOR SUCH UNDER ANY CIRCUMSTANCES.

11.3. THE CUSTOMER ACKNOWLEDGES AND AGREES THAT STORA SHALL NOT BE LIABLE FOR ANY USE OF TEMPLATE TERMS AND CONDITIONS OR SIMILAR DOCUMENTATION MADE AVAILABLE BY STORA FOR USE BY THE CUSTOMER WHEN SELLING SERVICES TO ITS USERS. SUCH TEMPLATES ARE PROVIDED BY STORA FOR INFORMATION ONLY AND ARE USED BY THE CUSTOMER AT THEIR OWN RISK. THE CUSTOMER AGREES THAT IT IS RESPONSIBLE FOR SEEKING ITS OWN LEGAL ADVICE ON THE SUITABILITY OF SUCH TEMPLATES FOR THE CUSTOMER’S BUSINESS.

11.4. THE CUSTOMER AGREES TO INDEMNIFY STORA FOR ANY LOSS, DAMAGE, COST OR EXPENSE THAT STORA MAY SUFFER OR INCUR AS A RESULT OF OR IN CONNECTION WITH THE USE BY CUSTOMER OR ITS USERS OF THE PLATFORM OR CONDUCT IN CONNECTION WITH THE PLATFORM, INCLUDING ANY BREACH BY THE CUSTOMER OR ANY OF ITS USERS OF THIS AGREEMENT. STORA SHALL HAVE NO LIABILITY FOR ISSUES ARISING FROM UNSUPPORTED INTEGRATIONS OR CUSTOMER-IMPLEMENTED TECHNICAL SOLUTIONS.

11.5. EXCEPT AS REQUIRED BY LAW, STORA’S MAXIMUM LIABILITY TO THE CUSTOMER OR ANY USER IN RELATION TO THIS AGREEMENT (INCLUDING UNDER ANY INDEMNITY) SHALL NOT EXCEED THE FEES PAID IN THE TWELVE MONTHS PRECEDING THE DATE OF THE LIABILITY ARISING.

11.6. IN NO CIRCUMSTANCES WILL STORA BE LIABLE FOR ANY INCIDENTAL, CONSEQUENTIAL OR INDIRECT DAMAGES, LOSS OR CORRUPTION OF DATA, LOSS OF PROFITS, GOODWILL, BARGAIN OR OPPORTUNITY, LOSS OF ANTICIPATED SAVINGS OR ANY OTHER SIMILAR OR ANALOGOUS LOSS RESULTING FROM THE CUSTOMER OR ANY USER’S ACCESS TO, OR USE OF, OR INABILITY TO USE THE PLATFORM, WHETHER BASED ON WARRANTY, CONTRACT, TORT, NEGLIGENCE, IN EQUITY OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT STORA KNEW OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGE, TO BUSINESS INTERRUPTION OF ANY TYPE, WHETHER IN TORT, CONTRACT OR OTHERWISE.

12. API, Integrations and Technical Fair Use

12.1 Public API access

Stora may make application programming interfaces (“APIs”) and related technical documentation available to Customers to enable integrations with third-party systems or custom applications.

Use of the API is optional and is provided primarily for technically competent Customers or their appointed developers.

12.2 Prohibited technical behaviour

Customers must not, and must not permit any third party to:

a) Circumvent, interfere with, or attempt to bypass Stora’s intended user interfaces, access controls, security mechanisms, rate limits or safeguards, including (without limitation) through:

• injected or modified client-side code

• browser extensions or automation tools

• reverse proxies or traffic interception

• scraping, crawling or emulating private endpoints

b) Use the API or any other technical means in a manner that:

• creates an unreasonable load on Stora’s systems

• risks system stability, performance, or availability

• compromises data integrity or security

• negatively impacts other Customers

c) Use undocumented, private, deprecated, or unsupported endpoints or functionality.

12.3 Fair usage and stability

Stora reserves the right to apply rate limits, throttling, temporary suspension, or permanent revocation of API access where usage is excessive, abusive, or poses a risk to the platform, whether or not such usage is intentional.

Stora does not guarantee uninterrupted availability of the API and may modify, deprecate, or withdraw API functionality with reasonable notice where practicable.

12.4 Unsupported integrations and customer responsibility

Customers acknowledge that:

a) Any custom integration, automation, script, or third-party system built using the API or other technical means is implemented at the Customer’s own risk.

b) Stora does not provide free support, troubleshooting, or recovery for issues caused by:

• unsupported integrations

• custom code

• misconfigured systems

• third-party tools or services

• actions taken outside documented and supported functionality

c) Stora is not responsible for data loss, billing errors, access issues, or service disruption arising from Customer-built or third-party integrations.

12.5 Chargeable technical support

Where investigation, remediation, or recovery work is required as a result of non-standard usage, unsupported integrations, or Customer-caused technical issues, Stora reserves the right to:

• treat such work as paid professional services or chargeable support

• charge reasonable fees at Stora’s then-current support or consultancy rates

• require payment in advance before commencing such work

This includes (without limitation) restoring data, correcting billing issues, reversing automation effects, diagnosing performance issues, or repairing system state.

12.6 Suspension or termination

Repeated or serious breaches of this section may result in suspension or termination of API access, or suspension of the Customer’s account, in accordance with these Terms.

13. Termination

13.1. This Agreement shall remain in force unless it terminates or expires in accordance with this clause 13.

13.2. Unless otherwise stated in any invoice or order form, this Agreement shall remain in force for one calendar month – whether the Customer is paying monthly or annually - and shall automatically renew for subsequent calendar months unless either party provides written notice to the other party of its intention to terminate no later than 7 days before the end of the then-current month.

13.3. Where a party is in material breach of this Agreement, and has failed to remedy such breach within 28 days of notification by the other party, the other party may terminate this Agreement by giving written notice of termination, which shall become effective 5 Business Days after the date of the notice.

13.4. Either party may terminate this Agreement immediately by notice, if either party:

13.4.1. stops or suspends or threatens to stop or suspend payment of all or a class of its debts;

13.4.2. is insolvent under company law;

13.4.3. has an administrator appointed in respect of it;

13.4.4. has an order made or a resolution passed for its winding up or dissolution or it enters into an arrangement, compromise or composition with or assignment for the benefit of its creditors or a class of them;

13.4.5. has any security enforced over, or a distress, execution or other similar process levied or served against, the whole or a substantial part of its assets or undertaking; or

13.4.6. is subject to any event which, under the law of any relevant jurisdiction, has an analogous or equivalent effect to any of the events listed above.

13.5. Expiry or termination of this Agreement is without prejudice to and does not affect the accrued rights or remedies of any of the parties arising in any way out of this Agreement up to the date of expiry or termination.

13.6. Rights and obligations under this Agreement shall survive termination of this Agreement where reasonably required to give commercial effect to such rights and obligations.

13.7. Stora may terminate this agreement and the Customer account with Stora with 28 days notice without cause. In the event that the Customer has already paid for time beyond this, Stora may at it’s sole discretion refund pro-rata any pre-paid subscription fees after deducting any costs incurred for onboarding or any other support services provided. At the end of the 28 days notice, the Customer’s account with Stora will be closed.

14. Force Majeure

14.1. If a party is prevented in whole or in part from carrying out its obligations under this Agreement as a result of Force Majeure, it will promptly notify the other party accordingly. The notice must:

14.1.1. specify the obligations and the extent to which it cannot perform those obligations;

14.1.2. fully describe the event of Force Majeure;

14.1.3. estimate the time during which the Force Majeure will continue; and

14.1.4. specify the measures proposed to be adopted to remedy or abate the Force Majeure.

14.2. Following a notice of Force Majeure in accordance with section 14.1 and while the Force Majeure continues, the obligations which cannot be performed because of the Force Majeure will be suspended, other than obligations to pay money that is due and payable.

14.3. The party that is prevented from carrying out its obligations under this Agreement as a result of Force Majeure must remedy the Force Majeure to the extent reasonably practicable and resume performance of its obligations as soon as reasonably possible.

14.4. The party that is prevented from carrying out its obligations under this Agreement as a result of Force Majeure must take all action reasonably practicable to mitigate any loss suffered by the other party as a result of the party’s failure to carry out its obligations under this Agreement.

14.5. The term of this Agreement will not be extended by the period of Force Majeure.

15. Other provisions

15.1. The Customer may not assign or otherwise license or transfer any of its rights and obligations under this Agreement.

15.2. Each party acknowledges that it has not relied on any representation, warranty or statement made by any other party, other than as set out in this Agreement.

15.3. The relationship of the parties to this Agreement does not form a joint venture or partnership.

15.4. The Customer agrees that Stora may reference the Customer’s use of the Platform in its promotional materials.

15.5. No clause of this Agreement will be deemed waived and no breach excused unless such waiver or consent is provided in writing.

15.6. Any clause of this Agreement, which is invalid or unenforceable is ineffective to the extent of the invalidity or unenforceability without affecting the remaining clauses of this Agreement.

15.7. Any part of this Agreement may be amended by Stora at any time, and any aspect of the Platform may be updated or discontinued at any time, provided that the core functionality of the Platform will not be varied in a way that materially affects the Customer’s use of the Platform. Any changes to this Agreement or to the Platform which will significantly affect the rights and obligations of the Customer will be notified to the Customer in advance of such changes taking effect.

15.8. This Agreement shall be governed by and construed and enforced in accordance with the laws of England and Wales.

15.9. Each Party expressly agrees that exclusive jurisdiction for resolving any claim or dispute between the Customer and Stora relating in any way to use of the Platform shall be with the courts of England and Wales.

Schedule 1 — Data Processing Addendum

This Data Processing Addendum (“DPA”) forms a part of the Stora Terms of Use between Stora Ltd and Customer (“Agreement”) which apply to the Customer’s use of the Platform. All capitalized terms not defined herein shall have the meaning set forth in the Agreement.

This DPA is an addendum to and forms a part of the Agreement and shall be legally binding with effect from the commencement of the Agreement. If any terms of this DPA are inconsistent with the terms of the Agreement, including the exhibits thereto, then the terms of this DPA shall prevail.

1. Background

1.1. This DPA applies to Customer Personal Data provided by Customer as a Data Controller in connection with their use of the Platform. It states the technical and organizational measures Stora uses to protect Customer Personal Data in the course of acting as a Data Processor when providing the Platform.

1.2. If processing of Customer Personal Data involves an International Transfer, the EU Standard Contractual Clauses and/or the UK Standard Contractual Clauses, as the case may be, apply, and as stated in Section 5 and are incorporated by reference.

2. Appendices

Customer as a Data Controller determines the purposes of collecting and processing Customer Personal Data in the Platform. Appendix 1 states the details of the processing Stora will provide via the Platform under the Agreement. Appendix 2 states the technical and organizational measures Stora applies to the Platform, unless the Agreement states otherwise. Appendix 3 defines the applicable modules and options for the EU Standard Contractual Clauses and the UK Standard Contractual Clauses.

3. Stora Obligations

3.1. Stora will follow instructions received from Customer with respect to Customer Personal Data, unless they are (i) legally prohibited or (ii) require material changes to the Platform. In the event and to the extent the functionality of the Platform does not allow Customer or authorized users to do so, Stora may correct, block or remove any Customer Personal Data in accordance with Customer’s instruction. If Stora cannot comply with an instruction, it will notify Customer (email permitted) without undue delay.

3.2. Stora will use the appropriate technical and organizational measures to protect all Customer Personal Data.

3.3. Stora shall notify Customer without undue delay but in no event later than seventy-two (72) hours of its discovery of a Security Breach.

3.4. At Customer’s request, Stora will reasonably support Customer in dealing with requests from Data Subjects or regulatory authorities regarding Stora’s processing of Customer Personal Data.

3.5. Upon termination of the Agreement for whatever reason, and upon Customer’s written request made within thirty (30) days after such termination, Stora will (as applicable) return to Customer or destroy all Customer Personal Data. After such 30-day period, Stora will destroy such Personal Data.

4. Subprocessors

4.1. Customer authorizes Stora to subcontract the processing of Customer Personal Data to Subprocessors. Stora is responsible for any breaches of the Agreement caused by its Subprocessors.

4.2. Subprocessors will have the same obligations in relation to Stora as Stora does as a Data Processor (or Subprocessor) with regard to their processing of Customer Personal Data.

4.3. Stora will evaluate the security, privacy and confidentiality practices of a Subprocessor prior to selection. Subprocessors may have security certifications that evidence their use of appropriate security measures. If not, Stora will regularly evaluate each Subprocessor’s security practices as they relate to data handling.

4.4. Stora’s use of Subprocessors is at its discretion, provided that:

4.4.1. Stora will notify Customer in advance (by email or such other means which Stora makes available to its customers) of any changes to the list of Subprocessors in place as of the commencement of provision of the Platform (except for Emergency Replacements or deletions of Subprocessors without replacement).

4.4.2. If Customer has a legitimate reason that relates to the Subprocessors’ processing of Customer Personal Data, Customer may object to Stora’s use of a Subprocessor, by notifying Stora in writing within thirty days after receipt of Stora’s notice. If Customer objects to the use of the Subprocessor, the parties will come together in good faith to discuss a resolution. Stora may choose to: (i) not use the Subprocessor or (ii) take the corrective steps requested by Customer in its objection and use the Subprocessor. If none of these options are reasonably possible and Customer continues to object for a legitimate reason, either party may terminate the Agreement on thirty days’ written notice. If Customer does not object within thirty days of receipt of the notice, Customer is deemed to have accepted the new Subprocessor.

4.4.3. If Customer’s objection remains unresolved sixty days after it was raised, and Stora has not received any notice of termination, Customer is deemed to accept the Subprocessor.

4.4.4. The list of Subprocessors current as of the commencement of provision of the Platform is set out in Appendix 1.

4.5. Stora may change a Subprocessor where the reason for the change is outside of Stora’s reasonable control. In this case, Stora will inform Customer of the replacement Subprocessor as soon as possible. Customer retains its right to object to a replacement Subprocessor under Section 4.4.2.

5. International Transfers

5.1. Personal Data from EEA, UK, or Swiss Data Controller(s) may only be exported to or accessed by Stora or its Subprocessors outside the EEA, the UK, or Switzerland, as applicable (“International Transfer”):

5.1.1. if the recipient, or the country or territory in which it processes or accesses Personal Data, ensures an adequate level of protection for the rights and freedoms of Data Subjects in relation to the processing of Customer Personal Data as determined by the European Commission or another regulatory body of competent jurisdiction; or

5.1.2. in accordance with Section 5.2.

5.2. The UK or EU Standard Contractual Clauses (as applicable) apply where:

5.2.1. there is an International Transfer to a country that does not ensure an adequate level of protection for the rights and freedoms of Data Subjects in relation to the processing of Customer Personal Data as determined by the European Commission or another regulatory body of competent jurisdiction, and/or

5.2.2. there is an International Transfer to a recipient that is not covered by an appropriate safeguard, including, but not limited to, binding corporate rules, an approved industry code of conduct, and individual adequacy decision by a regulatory body of competent jurisdictions, or an individual transfer authorisation granted by a regulatory body of competent jurisdiction.

5.3. For Third Country Subprocessors, Stora shall ensure that such Subprocessor has entered into the unchanged version of the UK or EU Standard Contractual Clauses prior to the Subprocessor’s processing of Personal Data.

5.4. Nothing in this DPA will be construed to prevail over any conflicting clause of the UK or EU Standard Contractual Clauses.

6. Definitions

“Customer Personal Data” means any Personal Data that the Customer or any of its Users uploads to the Platform.

“Data Protection Legislation” means the Data Protection Act 2018, Regulation (EU) 2016/679 of the European Parliament and of the Council, (the General Data Protection Regulation); any other existing or future law, directive or regulation (anywhere in the world) relating to the Processing of Personal Data or privacy, to which Stora is subject.

“Data Controller”, “Data Processor”, “Data Subject”, “Processing” and “Personal Data” have the meanings given to those expressions or any equivalent or corresponding expressions in the Data Protection Legislation.

“EEA” means the European Economic Area, namely the European Union Member States along with Iceland, Lichtenstein and Norway.

“EU Standard Contractual Clauses” shall mean the standard contractual clauses promulgated by the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (C/2021/3972) on standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR.

“Security Breach” means a confirmed accidental or unlawful destruction, loss, alteration, or disclosure that results in the compromise of the integrity and/or confidentiality of Personal Data. They include Appendices 1 and 2 attached to this DPA.

“Subprocessor” means Stora affiliates and third parties engaged by Stora or Stora’s affiliates to process Personal Data.

“Third Country Subprocessor” means any Subprocessor incorporated outside the EEA and outside any country for which the European Commission has published an adequacy decision as published at http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm.

“UK Standard Contractual Clauses” means the UK Data Transfer Addendum, being the applicable EU Standard Contractual Clauses as amended by a data transfer addendum in a form adopted by the UK ICO, as amended, superseded or replaced from time to time.

Appendix 1

Details of Data Processing

1. Parties and roles

1.1 Customer to Stora transfer

Data Exporter:
Name: The Customer identified in the Agreement.
Address: As stated in the Agreement.
Role: Controller

Data Importer:
Name: Stora Ltd
Address: As stated in the Agreement.
Role: Processor

1.2 Stora to Subprocessor transfer

Where Stora transfers Customer Personal Data to a Subprocessor in a third country in connection with providing the Platform:

Data Exporter:
Name: Stora Ltd
Address: As stated in the Agreement.
Role: Processor

Data Importer:
Name: The relevant Subprocessor appointed by Stora under the Agreement and notified in accordance with the DPA.
Address: As stated in the applicable Subprocessor terms or notice.
Role: Subprocessor / Processor

2. Purpose(s) of the processing and any transfer

Stora processes Customer Personal Data for the purpose of providing the Platform and related services under the Agreement, including:

• hosting the Platform
• storing Customer Personal Data
• monitoring, maintaining and securing the Platform
• scanning uploaded files for malware and other security threats
• troubleshooting and support
• releasing fixes, updates and upgrades
• administering the underlying infrastructure used to provide the Platform

Where necessary, Stora may transfer Customer Personal Data to its authorised Subprocessors for the same purposes.

3. Description of processing

Categories of Data Subjects:
Unless otherwise provided by the Customer, Customer Personal Data may relate to the following categories of data subjects:

• the Customer’s users and personnel
• the Customer’s end customers and prospective end customers
• any other individuals whose personal data is submitted to the Platform by or on behalf of the Customer

Categories of personal data:
The Customer determines, in its sole discretion, the categories of Customer Personal Data submitted to the Platform, subject to the functionality of the Platform. The data may include:

• name
• email address
• telephone number
• postal address
• other contact details
• account, booking, tenancy and transaction information
• communications and support records
• files, images and documents uploaded to the Platform, including identification documents where submitted by or on behalf of the Customer
• any other personal data submitted by or on behalf of the Customer through the Platform

Sensitive data:
None, unless submitted by the Customer. The Customer is responsible for ensuring it has an appropriate lawful basis for any personal data, including any special category data, submitted to the Platform.

Processing operations:
Customer Personal Data may be subject to the following processing activities:

• collection
• storage
• organisation
• access
• use
• hosting
• transmission
• support and troubleshooting
• security monitoring
• automated malware and security scanning of uploaded files
• restricting access to, quarantining or removing files reasonably suspected of presenting a security threat
• backup
• deletion or destruction in accordance with the Agreement

Frequency of processing / transfer:
Continuous, as required to provide the Platform.

Retention period:
As set out in the Agreement and any applicable retention or deletion provisions.

Competent supervisory authority:
As specified in Appendix 3 and determined by the applicable transfer scenario.

4. Authorised Subprocessors as of the Effective Date

• Salesforce, Inc. (Heroku): Application hosting and managed database and cache services; EU.
• C2 Industries (Bucketeer, using Amazon Web Services S3): File and image storage; EU (Ireland).
• Amazon Web Services (AWS): File and image storage and automated malware scanning using Amazon S3 and Amazon GuardDuty; EU (Ireland).
• Mailgun Technologies, Inc. (Sinch): Transactional email delivery; EU or US, depending on the Customer’s region.
• Better Stack: Application logging, monitoring and error tracking; EU.
• Intercom: Customer support communications and operator account support; EU and US.
• PostHog, Inc.: Product analytics; EU (Germany).
• PandaDoc, Inc.: Contract and electronic signature services, where enabled; EU and US.
• Cloudflare, Inc.: Secure connectivity for supported Paxton smart-entry integrations, where enabled; global.

For clarity, third-party services selected or contracted directly by the Customer and connected to the Platform, including payment providers and smart-entry systems, are not Stora Subprocessors where they process personal data under the Customer’s own agreement with that provider. The Customer is responsible for assessing and authorising those providers.

Any additional Subprocessors used by Stora shall be notified and authorised in accordance with the DPA.

Appendix 2

Technical and Organizational Measures

The following sets out Stora’s current technical and organizational security measures. Stora may change these at any time without notice so long as it maintains a comparable or better level of security. This may mean that individual measures are replaced by new measures that serve the same purpose without diminishing the security level.

1. Storage limitation

1.1 The Data Processor is required to limit the storage of personal data processed for the Data Controller by deleting personal data concerning users of services or customer service representatives upon request from the Data Controller.

2. Information security policy

2.1 The Data Processor shall have a documented information security policy, which is defined and approved by the management, published and communicated to its staff and other relevant parties.

3. Information security organisation

3.1 The Data Processor shall have staff with appointed responsibilities for ensuring an appropriate information security.

4. Staff security

4.1 The Data Processor shall in the recruitment process conduct adequate controls for applicants according to applicable legislation, which shall be in proportion to the business operations, the categories of personal data given access to and risk levels.

4.2 The Data Processor shall ensure that all personnel with access to personal data processed for the Data Controller have a confidentiality obligation towards the Data Processor and receive continued information security training.

4.3 The Data Processor shall have an employee offboarding process which includes removal of access rights and return of IT equipment.

5. Personal data handling

5.1 The Data Processor shall handle personal data processed for the Data Controller as confidential information.

6. Access Control

6.1 Users shall only have access to personal data, personal data processing resources, networks and network services that are needed to perform their duties and for which they have received explicit permission to access.

6.2 The Data Processor shall prevent unauthorised access to personal data processed for the Data Controller by (at least) implementing activity logs which register user activities and can give information about what personal data has been exposed to unauthorised access, modification, erasure or destruction.

7. Physical security

7.1 Physical access to the Data Processor’s systems and processing environment shall be restricted to authorised personnel.

7.2 Physical access to personal data processed for the Data Controller shall be restricted and require identifiable and personal authentication scheme.

7.3 Equipment shall be placed and protected to minimise risks for environment related threats and dangers and unauthorised access.

8. Communication security

8.1 Personal data processing resources containing personal data or which are part of the system of the processing shall be protected by firewalls.

8.2 The Data Processor shall apply up-to-date security measures for electronic messages to actively protect against viruses, malware, ransomware and other harmful software.

8.3 Development, test and production environments shall be separated to minimise the risk for unauthorised access or changes in the production and other environments.

8.4 Data from the Data Controller cannot be used in test or development environments without removing or anonymising personal data.

8.5 Where enabled, files newly uploaded to the Platform may be automatically scanned for malware and other security threats. Scan results may be used to restrict access to, quarantine or remove files reasonably suspected of presenting a security threat.

Appendix 3

Standard Contractual Clauses

EU Standard Contractual Clauses

UK Standard Contractual Clauses