StriveCloud Reseller Terms

These general reseller terms (“Terms”), including the documents incorporated by reference herein (i.e. the Specific Terms and the Quotations), govern your use of the StriveCloud Software (as defined below) and form a legal contract between StriveCloud BV, a Belgian private limited liability company with registered seat located at Coupure Rechts 620/10, 9000 Gent, registered with the Crossroads Bank for Enterprises under company number 0647.559.033 (“StriveCloud”), and you or the entity that you represent (the “Software Reseller”). Hereinafter StriveCloud and the Software Reseller are also jointly referred to as the “Parties” and each individually as a “Party”. These Terms are filed and accessible via StriveCloud’s website.

Article 1. Definitions

Capitalized terms used in these Terms shall have the following meaning, or shall have the meaning as defined elsewhere in these Terms.

“Confidential Information” means the content of these Terms, and all information communicated, disclosed or otherwise exchanged between the Parties in the context of these Terms, either directly or indirectly, such as but not limited to (technical) data, personal data, reports, materials, documents, correspondence, Software, designs and business information. Will not be considered as Confidential Information, information which: (i) was or becomes generally available to the public or industry without breach of these Terms; (ii) was in the possession of the receiving Party at the time of disclosure to it without obligation of confidentiality; (iii) was obtained legitimately and lawfully by the receiving Party, e.g. from a third party who had a lawful right to disclose such information to it without any obligation to restrict its further use or disclosure; or (iv) was independently developed by the receiving Party without reference to Confidential Information of the other Party.

“Data Protection Legislation” means all applicable legislation regulating the processing of personal data, including the EU General Data Protection Regulation no. 2016/679 of April 27th 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) and the Belgian law of July 30th 2018 on the protection of natural persons with regard to the processing of personal data, as well as future modifications.

“Effective Date” means the date of the entry into force of these Terms, as specified in the Specific Terms.

“End Customers” means the Software Reseller’s own customers who shall be legal entities that will in turn make the StriveCloud Software available to their end users (i.e. natural persons such as its employees, customers, etc.) according to a B2B2C model.

“Feature Page” means licensor’s webpages specifying the details of the StriveCloud Software and pricing information, such as https://strivecloud.io/conditions/.

“Intellectual Property Rights” means any design rights, trade marks, domain names and trade or business names (whether registered or unregistered), patents, copyright and related rights, database rights, trade secrets, other intellectual property rights and similar or equivalent rights anywhere in the world which currently exist or are recognised in the future; and applications, extensions and renewals in relation to any such rights.

“Licensing Terms” means the terms between StriveCloud and the licensee for the provision of Services, consultable at https://strivecloud.io/terms-of-use/.

“Quotation” means any commercial document agreed between the Parties in writing, specifying the provided Services, the fees and the Effective Date (i.e. a form of quotation, purchase order or other similar document) with respect to a particular End-Customer.

“Services” means the relevant StriveCloud Software, made available in the form of software-as-a-service, and other services that will be provided by StriveCloud in the context of these Terms.

“Software” means computer programs and related data that provide instructions to the computer systems, whether in an executable form (object code) or a human-readable form (source code), including documentation and preparatory design material.

“Specific Terms” means the commercial document agreed between the Parties in writing specifying the specific terms applicable to the scope of the rights granted to the Software Reseller.

“StriveCloud Software” means the customizable scalable gamification Software developed by StriveCloud, including enhancements, improvements and modifications.

“Sub-Processing Agreement” means the sub-processing agreement attached hereto as Annex 3.

Article 2. Scope and Structure of these Terms

2.1. These Terms stipulate how and to what extent the Software Reseller can make the StriveCloud Software available to its End-Customers. These Terms shall not be construed as constituting a joint venture or agency (“handelsagentuur”) between the Parties, who remain independent contracting parties.

2.2. The Software Reseller shall enter into a license agreement with the End-Customers that shall include as a minimum the Licensing Terms (the “License Agreement”). For the avoidance of doubt, these Licensing Terms should be considered to be a template agreement and any reference to StriveCloud as contractual party should be updated towards the Software Reseller.

2.3. In case of conflicts between the provisions of the main body of these Terms and the Specific Terms, the Specific Terms shall prevail (unless explicitly indicated otherwise). In case of conflicts between the provisions of the main body of these Terms and the Quotation, the Quotation shall prevail (unless explicitly indicated otherwise). In case of conflicts between the Quotation and the Feature Page, the Quotation will prevail.

2.4. These Terms are deemed accepted by the Software Reseller, even when they are conflicting with the Software Reseller’s general or special terms and conditions. The fact that StriveCloud did not explicitly reject the terms and conditions of the Software Reseller referred to in any contract, Specific Terms or Quotation (as defined hereafter) cannot be interpreted by the Software Reseller as an acceptance by StriveCloud of such terms and conditions.

Article 3. Rights and obligations of the Software Reseller

3.1 The Software Reseller shall:

a) use its best efforts to market and promote the Services;

b) guarantee that the End-Customers shall not constitute resellers, distributors or other types of intermediaries;

c) only make the StriveCloud Software available to its End-Customers who have entered into a License Agreement and who will use the StriveCloud Software for their own professional purposes and within the agreed parameter(s);

d) be liable towards its End-Customers (including for any first line support in respect of the StriveCloud Software) and the Software Reseller undertakes to sign appropriate legal undertakings with the End-Customers in order to ensure that StriveCloud shall not bear any liability towards the End-Customers;

e) be responsible for invoicing the End-Customers and collecting payment from the End-Customers, without any responsibility of or implication for StriveCloud;

f) keep and maintain full, true and accurate records relating to the creation or granting of accounts to its End-Customers. These records shall contain all data reasonably required for verification of amounts to be paid, and the quantity of accounts granted or created to potential end-users by the End-Customers;

g) at all times fully cooperate in order to meet the rights of StriveCloud as described in these Terms;

h) immediately notify StriveCloud in writing if any third party gains unauthorized access to or use of StriveCloud Software, other proprietary materials or Confidential Information. The Software Reseller shall take all reasonable steps to stop and further prevent such unauthorized access or use;

i) include the reference to StriveCloud “Powered by StriveCloud” that will be displayed on each webpage or application related to or including the StriveCloud Software;

j) acknowledge and ensure that StriveCloud has the right to contact the End-Customers at all times, including but not limited to for purposes of improving the StriveCloud Software and for marketing purposes. Upon StriveCloud’s request, the Software Reseller shall provide the contact details of the End-Customers and the Software Reseller shall ensure to have appropriate contractual arrangements in place to allow StriveCloud to receive these contact details (as per Article 9 of these Terms); and

k) defend and indemnify StriveCloud against any claims brought by third parties to the extent such claim is based on any breach or violation by the Software Reseller or its personnel of any provisions of these Terms, applicable laws or regulations, and/or fraud, intentional misconduct, or gross negligence committed by, or any misrepresentations made by, the Software Reseller or its personnel.

Article 4. Rights and obligations of StriveCloud

4.1 StriveCloud shall:

a) make the StriveCloud Software available to the End-Customer after the Parties have signed a Quotation in respect of such End-Customer, as of which moment StriveCloud shall be allowed to invoice in accordance with Article 5;

b) provide support and maintenance to the Software Reseller as set forth in Annex 2; and

c) have the right to audit and inspect the Software Reseller’s and its End-Customers’ use of the StriveCloud Software and their obligations in this respect during normal business hours on giving reasonable notice (except if such notice would defeat the purpose of the inspection), for the purpose of verifying the Software Reseller’s compliance with the Agreement. Each Party shall bear its own costs related to such inspection, provided that, in the event such audit determines that the Software Reseller has acted in breach of the Agreement, in addition to any other rights and remedies available to StriveCloud in respect of such a breach, the Software Reseller shall bear the full cost of such inspection. In case of any detected use that affects or threatens to affect or otherwise poses a risk to the security or integrity of the StriveCloud Software or to StriveCloud’s reputation, StriveCloud is entitled to intervene and to limit the use of the StriveCloud Software. In the Quotation a maximum usage is mentioned (in the form of a maximum number of active users or any other usage metric referred to in the Quotation). StriveCloud will monitor the End User’s usage on a monthly basis. The Parties acknowledge and agree that all findings and log files of StriveCloud in respect of this Article are conclusive and have probative value. In the event the End User’s usage exceeds the maximum usage included in the Quotation, StriveCloud will take note of the difference of that month and send an invoice containing the price of that difference, using the applicable prices for usage set forth in the Quotation. In deviation from Article 5.4, invoices for usage excess will be payable within fifteen (15) calendar days after the date of invoice.

4.2 The Software Reseller acknowledges and shall ensure that StriveCloud has the right to contact the End-Customers at all times, including but not limited to for purposes of improving the StriveCloud Software and for marketing purposes. Upon StriveCloud’s request, the Software Reseller shall provide the contact details of the End-Customers and the Software Reseller shall ensure to have appropriate contractual arrangements in place to allow StriveCloud to receive these contact details (as per Article 9 of the Agreement).

Article 5. Pricing and Invoicing

5.1 Under the conditions as set forth in these Terms, the Software Reseller is entitled to purchase the Services at the pricing arrangements set forth on the Feature Pages and the commercial conditions described in Annex 1, minus the discounts specified in the Specific Terms. StriveCloud reserves the right to (i) modify the prices set out therein at any time and shall duly inform the Software Reseller before such modifications take effect (which shall be at the start of the next Renewal Term, unless a later date is communicated by StriveCloud) and (ii) make new versions, enhancements, modifications or updates of the StriveCloud Software only available to the Software Reseller upon additional payment or increased prices, as the case may be. The Software Reseller shall duly inform the End-Customers about and implement (i) these price modifications and (ii) new versions, enhancements, modifications or updates of the StriveCloud Software. The Software Reseller will reflect this information obligation in its agreement with the End-Customers.

5.2 The discount will not apply to End-Customers who were direct customers of StriveCloud during the six (6) months prior to the date the Software Reseller has concluded a License Agreement with said End-Customer.

5.3 StriveCloud shall invoice the Software Reseller: (i) license fees on a yearly or monthly basis, as applicable; (ii) one-time Services, such as the installation and set-up or workshops, after such occurrence has been completed; and (iii) any Services on a monthly basis. Any fees payable under these Terms shall be considered nonrefundable.

5.4 The Software Reseller shall pay each invoice within thirty (30) calendar days after the date of invoice, unless otherwise agreed in the Specific Terms or Quotation. Payments shall be done by wire transfer to the account indicated on the invoice.

5.5 All amounts not paid by the Software Reseller on the relevant due date shall bear an interest for late payment in accordance with the law of 8 August 2002 on combating late payments in commercial transactions, without prior notice of default. All costs arising from collecting any outstanding claims, including but not limited to legal fees or administrative costs, and with as minimum a fixed amount equal to the higher of fifteen percent (15%) of the unpaid amount or two hundred and fifty euros (EUR 250), are for the account of the Software Reseller and may be recovered by StriveCloud. In addition, in case of non-payment of the license fees for the use of the StriveCloud Software, StriveCloud has the right to suspend access to the StriveCloud Software until all invoices in relation to such license fees are correctly paid.

Article 6. Term and Termination

6.1 These Terms enter into force on the Effective Start Date for the initial period agreed upon in the Specific Terms (“Initial Term”). After the Initial Term, these Terms shall be automatically and tacitly renewed for successive periods of one (1) year (“Renewal Term”), unless either Party gives prior notice by registered letter at the latest one (1) month before expiration of the then running Initial Term or Renewal Term.

6.2 Either Party has the right to terminate these Terms with immediate effect and without prior judicial intervention, in the following cases:

(i) in case of a material breach by the other Party, which in case it is capable of being remedied is not remedied within fifteen (15) days after receiving notice thereto by the other Party; or

(ii) in case the other Party enters into liquidation, receivership, bankruptcy or other insolvency-related proceedings, whether compulsorily or voluntarily, or the Party is unable to pay its debts within the meaning of the applicable laws of the jurisdiction other than for the purposes of reconstruction or amalgamation.

6.3 Upon expiration or termination of these Terms (for any reason whatsoever), the Parties agree to put in place a wind-down plan and to reasonably continue their cooperation in order to effect an orderly termination of their relationship. All License Agreements which have been properly granted pursuant to these Terms prior to its termination or expiration and/or which are in effect upon termination or expiration, shall survive any termination or expiration of these Terms, and the termination or expiration of these Terms shall not affect the existing rights or obligations of properly licensed End-Customers. For avoidance of doubt, End-Customers will be serviced until the end of their contract term in case these Terms are terminated before the end of their contract term. If desired so by the End-Customer the License Agreement will be assigned to StriveCloud. In case the termination is due to a breach of the Software Reseller or in case the Software Reseller terminates these Terms for convenience, all then current License Agreements will in any event be assigned to StriveCloud immediately and at no cost, to which end the Software Reseller shall fully cooperate and ensure the assignment in the contractual relationship with the End-Customers.

6.4 Upon any termination or expiration of these Terms:

(i) The Software Reseller shall immediately pay to StriveCloud all amounts due and owing (and the Software Reseller shall not be entitled to a refund of any payments made under these Terms prior to termination or expiration);

(ii) The rights and licenses granted to the Software Reseller under these Terms shall terminate unless expressly stipulated otherwise in these Terms;

(iii) The Software Reseller shall not enter into any new License Agreement;

(iv) The Software Reseller shall immediately cease all marketing and distribution of the Services, and holding itself out as StriveCloud’s representative or reseller;

(v) The Software Reseller shall immediately return to StriveCloud any marketing or promotional materials and/or documentation supplied by StriveCloud which are in the Software Reseller’s possession or under its control;

(vi) The Software Reseller shall immediately cease all display, advertising and use of the Marks and, thereafter, shall not use, advertise or display any trademark, trade name, logo or designation, or any part thereof, which is similar to or likely to cause confusion with the Marks;

(vii) The Software Reseller shall notify its End-Customers, with whom it concluded a License Agreement, of the termination or expiration of this Agreement and cooperate in good faith with StriveCloud in accordance with Article 6.3 above; and

(viii) The Software Reseller shall certify in writing to the other Party its compliance with the foregoing.

Article 7. Confidentiality

7.1 Each Party acknowledges and agrees to maintain the confidentiality of Confidential Information provided by the other Party under or relating to these Terms, including after termination or expiry of these Terms. The Parties may not disclose the other Party’s Confidential Information without the prior written permission of the other Party.

7.2 Notwithstanding the foregoing, each Party may disclose the other Party’s Confidential Information to: (i) its employees, agents, contractors or subcontractors in so far as strictly required for the performance of these Terms; and (ii) its advisors (such as lawyers, accountants and auditors) or if required to do so by law, in which case it shall inform the other Party thereof in advance (in so far as allowed by law) and shall limit the disclosure of Confidential Information to what is necessary.

7.3 If any Confidential Information is disclosed other than as permitted under these Terms, the relevant Party shall, as soon as becoming aware of it, notify the other Party thereof and shall take all steps necessary to limit the consequences of such non-permitted disclosure and to prevent further unauthorised disclosure.

7.4 Upon termination or expiration of these Terms, each Party shall return and/or destroy, at the other Party’s request, all Confidential Information received by the other Party.

Article 8. Intellectual Property Rights

8.1 StriveCloud hereby grants the Software Reseller, who accepts, a non-exclusive, worldwide, non-transferable right to use, execute, store, copy, distribute, modify, and support the StriveCloud Software, including the right to sub-license to its End-Customers (and their authorized end users), strictly in accordance with these Terms, for the duration of these Terms.

8.2 Further, StriveCloud hereby grants the Software Reseller, who accepts, a non-exclusive, worldwide, non-transferable right to use StriveCloud’s trademarks, service marks, logos, and trade names (the “Marks”), for the purpose of marketing, promoting and commercializing the Services under these Terms and in the manner set forth in the (style) guidelines provided by StriveCloud from time to time and subject to and consistent with the terms and conditions of these Terms. The Marks remain the exclusive property of StriveCloud. The Software Reseller will take no action that may jeopardize StriveCloud’s proprietary rights in the Marks, nor shall the Software Reseller apply for or obtain registration for any Marks, or other marks that are similar or likely to cause confusion with the Marks. The Software Reseller acknowledges StriveCloud’s ownership of and title to all rights in its Marks and the goodwill attached to the Marks. The Software Reseller shall follow StriveCloud’s instructions relating to the Marks in unaltered form.

8.3 StriveCloud may perform Software integrations, modifications, developments or enhancements specifically for or at the request of the Software Reseller or the End-Customer, or based on any ideas, suggestions or recommendations made by the Software Reseller or the End-Customer (“Specific Developments”). Any Intellectual Property Rights in such Specific Developments shall vest exclusively in StriveCloud and shall become part of the StriveCloud Software licensed in accordance with Article 8.1 above. To the extent StriveCloud integrates third party software for or at the request of the Software Reseller, the Software Reseller shall be fully responsible for the use of this third party software and warrants to StriveCloud that it has obtained all required rights in this respect.

8.4 StriveCloud may use the Software Reseller’s and its End-Customers’ names and trademarks on its website, in client reference lists and in other marketing materials. The Software Reseller shall enter into appropriate contractual arrangements with the End-Customers in order to ensure this usage right.

Article 9. Data Protection and Security

9.1 Each Party shall comply with their respective obligations under Data Protection Legislation in accordance with the Sub-Processing Agreement. Amongst others, both Parties shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks for data subjects. The security measures adopted by StriveCloud are described in Annex 6 to these Terms.

9.2 The Software Reseller shall enter into appropriate contractual arrangements (including but not limited to a data processing agreement and privacy policy) with the End-Customers and their users in order to ensure the transfer of personal data towards (and access of their personal data by) StriveCloud, acting as a sub-processor of the Software Reseller.

Article 10. Liability

10.1. StriveCloud’s liability under these Terms at any time shall be limited to the fees paid to StriveCloud under these Terms during the twelve (12) months preceding the event giving rise to damage, it being understood that during the first twelve (12) months of the Initial Term, the liability cap shall be calculated by using the average monthly fees multiplied by twelve (12).

10.2. StriveCloud cannot be held liable for: (i) damages resulting from the inadequate use of the StriveCloud Software by the End-Customer; (ii) damages resulting from inaccurate or incomplete information and data provided by the Software Reseller or the End-Customer; and (iii) indirect, special, consequential, punitive or incidental damages such as loss of profit, loss of business, reputational damage, financial losses and loss of data.

10.3. Except as expressly provided in these Terms and to the extent permitted under applicable law, StriveCloud expressly disclaims all warranties, express or implied, including but not limited to any warranties of merchantability, non-infringement, satisfactory quality and fitness of the StriveCloud Software for a particular purpose. In particular, StriveCloud does not warrant that the StriveCloud Software is error-free or that the use of the StriveCloud Software shall be secure or uninterrupted, that StriveCloud will detect any or every defect in the Software Reseller’s or any End-Customer’s systems, or that any or all problems with respect to the StriveCloud Software can be solved, and hereby disclaims any and all liability on account thereof. The StriveCloud Software will be provided by StriveCloud under these Terms on an “as-is” and “as available” basis.

Article 11. General Provisions

11.1. These Terms constitute the entire agreement between the Parties relating to the subject matter of these Terms and replace all previous arrangements between the Parties, whether oral or written, relating to the same subject matter. All deviating or additional conditions to these Terms must be agreed upon in writing and signed by duly authorized representatives.

11.2. The Agreement may not be assigned to third parties unless with prior explicit consent of the other Party, it being understood that StriveCloud may assign the Agreement to (i) a parent company or subsidiary, (ii) an acquirer of all or substantially all of StriveCloud’s assets involved in the operations relevant to the Agreement, or (iii) a successor by merger, (partial) split or other combination. Any purported assignment in violation of this Article will be void. This Agreement may be enforced by and is binding on permitted successors and assigns.

11.3. If one or more of its provisions are declared invalid, the validity of the remaining provisions will not be affected. To replace the invalid provision, the Parties will negotiate a new provision that matches as closely as possible the original intention of the Parties.

11.4. Notices under these Terms shall be sent to:

a. For the Software Reseller: the contact details specified in the Specific Terms;

b. For StriveCloud: Joris De Koninck, legal@strivecloud.io.

11.5. These Terms are exclusively governed by Belgian law. The courts of Ghent, Belgium are exclusively competent for any disputes arising out of or in connection with these Terms.

11.6. A Party shall not be considered in breach of or in default under these Terms on account of, and shall not be liable to the other Party for, any delay or failure to perform its obligations hereunder (other than a failure to pay any amounts due under these Terms) by reason of fire, earthquake, flood, explosion, strike, riot, war, terrorism, or similar event beyond that Party’s reasonable control (each a “Force Majeure Event”); provided, however, if a Force Majeure Event occurs, the affected Party shall, as soon as practicable, (a) notify the other Party of the Force Majeure Event and its impact on performance under these Terms, and (b) use reasonable efforts to resolve any issues resulting from the Force Majeure Event and perform its obligations hereunder. In case the duration of the Force Majeure Event exceeds two (2) months, the other Party shall have the right to terminate these Terms.

Article 12. Amendments

12.1. StriveCloud may update or modify these Terms from time to time, including incorporated agreements (such as the Specific Terms and any Quotation), for the following reasons: (i) applicable law, including but not limited to a change of such law, advice or order based on applicable law; (ii) minor changes to the Service; (iii) technical reasons; (iv) operational requirements; or (v) changes that are advantageous to the Software Reseller.

12.2. If a revision meaningfully reduces any End-Customer’s rights, StriveCloud will use reasonable efforts to notify the Software Reseller (by, for example, sending an email to the Software Reseller, posting on StriveCloud’s website or Feature Pages, or in the Service itself). The Software Reseller must notify StriveCloud within ten (10) calendar days of StriveCloud’s notice of the modifications that the Software Reseller does not agree with such changes with respect to one or more End-Customers, and StriveCloud (at StriveCloud’s option and as the Software Reseller’s exclusive remedy) may either: (i) permit any relevant End-Customer(s) to continue under the prior version of these Terms until the start of such End-Customer’s next renewal term (after which the modified Terms will apply); or (ii) allow the Software Reseller to terminate the Quotation of any relevant End-Customer(s) and receive a pro-rated refund based on the unused portion of such End-Customer’s term under such Quotation.

12.3. In any event, any continued use of the Services by End-Customers after the moment the modifications take effect, constitutes the Software Reseller’s acceptance of the modifications in their respect.

List of Annexes

• Annex 1: Commercial Conditions
• Annex 2: Support & Maintenance
• Annex 3: Sub-Processing Agreement
• Annex 4: Details with regard to the Processing of Personal Data
• Annex 5: List of current Sub-processors
• Annex 6: Security Measures

Annex 1: Commercial Conditions

Licenses and License Fees

All functionalities of the different licenses can be consulted on the following website: https://strivecloud.io/conditions/.

StriveCloud has the right to modify the website should the need arise. With each modification, you will receive an email notifying you that a change has taken place. The mail address where the changes will be sent is the mail address mentioned in Article 11.4 of these Terms.

Recommended Selling Prices

StriveCloud recommends the following selling prices for the StriveCloud Software, which can be found on the website https://strivecloud.io/conditions/, which the Software Reseller is not obliged to follow as it may set the prices at its discretion. StriveCloud shall provide updates of these prices on a yearly basis.

Set-up and Onboarding

For the End-Customer of the Software Reseller, StriveCloud shall perform a one-time set-up and deployment; the set-up fee can be consulted on the following website: https://strivecloud.io/conditions/. The setup fee is subject to the above discount system.

Optional Workshops

The options regarding offering Workshops can be found on the following link: https://strivecloud.io/conditions/. The workshop fee is subject to the above discount system.

Optional Additional Services

Additional Services provided by StriveCloud can be found on the following link: https://strivecloud.io/conditions/. The additional services are subject to the above discount system.

Annex 2: Support and Maintenance

StriveCloud provides the following support and maintenance services with respect to the StriveCloud Software towards the Software Reseller.

Helpdesk

StriveCloud provides a helpdesk function which is only available for questions concerning the use of the StriveCloud Software. StriveCloud’s helpdesk is available on workdays between 8 a.m. and 5 p.m. CET, excluding national holidays. The helpdesk can be contacted via the following contact details: support@strivecloud.io.

Availability

StriveCloud maintains the availability of the StriveCloud Software to the best of its ability. The Software Reseller accepts that the maintenance of the StriveCloud Software can give rise to a temporary unavailability of the StriveCloud Software, which cannot last more than four (4) hours between 9 a.m. CET and 8 p.m. CET, unless the Parties derogate by indicating a longer period.

No urgent interventions shall take place from Monday to Friday outside the timeslot indicated above. If this seems to be impossible for StriveCloud, it shall notify the Software Reseller at least twenty-four (24) hours in advance and, if possible, of the estimated duration of the intervention.

Incident Management

StriveCloud will manage incidents within its field of responsibility according to the following levels. The level of incident will be determined by StriveCloud. Response times and resolution times start running as of the moment StriveCloud receives notice of an incident from the Software Reseller. StriveCloud has the right to refuse its incident management if: (i) the incident is due to the wrongful use of the StriveCloud Software; (ii) the incident is due to a non-authorized modification of the StriveCloud Software; (iii) the Software Reseller prevents StriveCloud from performing maintenance and/or updates; (iv) the incident is caused by an application that is not supported.

Critical (the functionality concerned is not available and hinders the use of the StriveCloud Software). Response time: 4 hours. Resolution time: 8 hours.

High (the functionality concerned is limited available and hinders the proper use of StriveCloud Software). Response time: 4 hours. Resolution time: 2 working days.

Low (the functionality concerned is available but certain problems arise). Response time: 4 hours. Resolution time: 3 weeks.

Annex 3: Sub-Processing Agreement

This Sub-Processing Agreement governs the processing of Personal Data by the Sub-processor and describes specific terms in respect of the processing of Personal Data by StriveCloud in connection with the provision of Services as may be provided to the Reseller and/or the End-Customers by StriveCloud in connection with the Agreement, the terms of which are incorporated herein by reference.

Capitalized terms not otherwise defined herein shall have the meaning specified in the Agreement.

1. Definitions and Interpretation

1.1 For the purpose of this Sub-Processing Agreement, the following terms shall have the following meaning. In case of any doubt or differences with the terms defined in the Data Protection Legislation, the definitions stipulated in the relevant Data Protection Legislation shall prevail.

“Contact Person” means the individual(s) assigned by a Party and communicated to the other Party as point of contact and representing the Party for (a part of) the Services.

“Data Controller” means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the Processing of Personal Data.

“Data Processor” means a natural or legal person, public authority, agency or any other body which processes Personal Data on behalf of the Data Controller.

“Data Protection Legislation” means the EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), together with the codes of practice, codes of conduct, regulatory guidance and standard clauses and other related legislation resulting from such Directive or Regulation, as updated from time to time.

“Data Subject” means an identified or identifiable natural person to whom the Personal Data relates. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. The relevant categories of Data Subjects are identified in Annex 4.

“Personal Data” means any information relating to a Data Subject. The relevant categories of Personal Data that are provided to StriveCloud by, or on behalf of, the End-Customer are identified in Annex 4.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed in connection with the provisioning of the Services.

“Processing”, “Process(es)” or “Processed” means any operation or set of operations which is performed upon Personal Data or on sets of Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Services” means all services, functions, responsibilities and outputs of StriveCloud as described in the Agreement.

“Standard Contractual Clauses” means the standard contractual clauses of which the European Commission on the basis of Article 26(4) of Directive 95/46/EC decided that these offer sufficient safeguards for the transfers of personal data to a third country, or the data protection clauses adopted by the European Commission or by a supervisory authority and approved by the European Commission in accordance with the examination procedure referred to in Article 93(2) of EU Regulation 2016/679. In the event of any such data protection clauses adopted in accordance with EU Regulation 2016/679, including the European Commission’s update on the 4th of June 2021, such clauses shall prevail over any standard contractual clauses adopted on the basis of Directive 95/46/EC to the extent that they intend to cover the same kind of data transfer relationship.

“Sub-processor” means any subcontractor engaged by the Data Processor to perform a part of the Services and who agrees to receive Personal Data intended for Processing.

1.2 This Sub-Processing Agreement forms an integral part of the Agreement. The provisions of the Agreement therefore apply to this Sub-Processing Agreement. All capitalized terms not defined in this Sub-Processing Agreement will have the meaning set forth in the Agreement.

1.3 In case of conflict between any provision in this Sub-Processing Agreement and any provision of another part of the Agreement, this Sub-Processing Agreement shall prevail.

2. Scope and Purpose

2.1 The Sub-processor shall be entitled to Process Personal Data in connection with and for the purpose of the performance of the Services. The Reseller is the Data Processor of the End-Customer and StriveCloud is the Sub-processor of the Data Processor as regards the Processing of Personal Data under this Sub-Processing Agreement.

3. Specification of the Data Processing

3.1 Any Processing of Personal Data under the Agreement shall be performed in accordance with the applicable Data Protection Legislation.

3.2 For the performance of the Services, StriveCloud is a Sub-processor Processing Personal Data for the Reseller who is acting on behalf of the End-Customer. As a Sub-Processor, StriveCloud shall follow the written and documented instructions of the Reseller for the Processing of Personal Data. The Reseller is responsible for ensuring that the End-Customer’s complete instructions are set out in this Sub-Processing Agreement and that the End-Customer’s complete instructions are provided to StriveCloud during the term of the Agreement. Any additional or alternate instructions must be jointly agreed by the Parties in writing. The following is deemed an instruction by StriveCloud to Process Personal Data: (1) Processing in accordance with the Agreement; and (2) Processing initiated by the End-Customer’s users in their use of the Services.

3.3 A more detailed description of the subject matter of the Processing of Personal Data in terms of the concerned categories of Personal Data and of Data Subjects (envisaged Processing of Personal Data) is contained in Annex 4.

4. Data Subjects’ Rights

4.1 With regard to the protection of Data Subjects’ rights pursuant to the applicable Data Protection Legislation, the Reseller shall ensure that the End-Customer facilitates the exercise of Data Subject rights and shall ensure that adequate information is provided to Data Subjects about the Processing hereunder in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

4.2 Should a Data Subject directly contact StriveCloud wanting to exercise his individual rights (such as requesting a copy, correction or deletion of his data, or wanting to restrict or object to the Processing activities), StriveCloud shall inform the Reseller of such request without undue delay and provide the Reseller with full details thereof, together with a copy of the Personal Data held by it in relation to the Data Subject where relevant. StriveCloud shall promptly direct such Data Subject to the Reseller. In support of the above, StriveCloud may provide the Reseller’s basic contact information to the requestor. StriveCloud shall be entitled to reasonable compensation from the Reseller for any requested cooperation that refers specifically to the Processing of Personal Data processed under this Sub-Processing Agreement that is not a consequence of StriveCloud being in breach of its obligations under the Sub-Processing Agreement regarding the Processing of Personal Data.

4.3 Insofar as this is possible, StriveCloud shall cooperate with and assist the Reseller and the End-Customer by appropriate technical and organizational measures for the fulfilment of the Reseller’s and/or the End-Customer’s obligation to respond to requests from Data Subjects exercising their rights.

5. Consultation and Correction of Personal Data

5.1 StriveCloud will provide the End-Customer, in its role of Data Controller, with access to Personal Data Processed under the Agreement if and when so requested by the End-Customer or the Reseller, in order to allow the End-Customer to consult and correct such Personal Data.

6. Disclosure

6.1 StriveCloud will not disclose or otherwise reveal any Personal Data covered by the Sub-Processing Agreement to a Data Subject or third party, unless otherwise stated in the Agreement or required by law or a court or official authority’s decision. In the event that StriveCloud must disclose such Personal Data due to law or a court or official authority’s decision, StriveCloud shall notify the Reseller and the End-Customer, unless this is prohibited by applicable law or a court or official authority’s decision.

6.2 StriveCloud represents and warrants that persons acting on behalf of StriveCloud and who are authorized to Process Personal Data, or to support and manage the systems that Process Personal Data, (i) have committed themselves to maintain the security and confidentiality of Personal Data in accordance with the provisions of this Sub-Processing Agreement, (ii) are subject to user authentication and log-on processes when accessing the Personal Data, and (iii) have undertaken appropriate training in relation to Data Protection Legislation. StriveCloud shall inform the persons acting on its behalf about the applicable requirements and ensure their compliance with such requirements through contractual or statutory confidentiality obligations.

7. Deletion and Return of Personal Data

7.1 Upon the termination of the agreement between the Reseller and the End-Customer, StriveCloud shall, at the Reseller’s request that shall be made no later than sixty (60) calendar days after the termination of the agreement between the Reseller and the End-Customer, delete or promptly return all Personal Data to the Reseller or to the party nominated by the Reseller. The Personal Data available electronically shall also, if the Reseller so requests, be submitted in electronic form in accordance with the Reseller’s instructions, provided this is reasonable. The Reseller bears the responsibility that the Reseller’s requests to StriveCloud under this clause are made in accordance with the End-Customer’s instructions. If an End-Customer should provide instructions under this clause directly to StriveCloud regarding the Processing of its Personal Data, StriveCloud shall comply with such instructions. StriveCloud may delete existing copies of the Personal Data following expiry of the above-mentioned period, unless applicable Data Protection Legislation requires otherwise.

8. Location of Processing

8.1 StriveCloud will store Personal Data at rest within the territory of the European Union.

8.2 The Reseller shall ensure that StriveCloud is entitled to enter into the European Commission’s Standard Contractual Clauses for transfer of Personal Data to a third country or any provisions succeeding these, on the End-Customer’s behalf.

9. Use of Sub-Processors

9.1 The Reseller acknowledges and expressly agrees that StriveCloud may use third party sub-processors for the provision of the Services as described in the Agreement.

9.2 Any such sub-processors that provide services for StriveCloud and thereto Process Personal Data will be permitted to Process Personal Data only to deliver the services StriveCloud has entrusted them with and will be prohibited from Processing such Personal Data for any other purpose. StriveCloud remains fully responsible for any such sub-processor’s compliance with StriveCloud’s obligations under the Agreement, including this Sub-Processing Agreement.

9.3 StriveCloud will enter into written agreements with any such sub-processor which contain obligations no less protective than those contained in this Sub-Processing Agreement, including the obligations imposed by the Standard Contractual Clauses, as applicable.

9.4 StriveCloud shall make available to the Reseller the current list of sub-processors for the Services identified in Annex 5. Such sub-processors list shall include the identities of those sub-processors and their country of location. StriveCloud shall provide the Reseller with a notification of a new sub-processor before authorizing any new sub-processor(s) to Process Personal Data in connection with the provision of the Services under this Sub-Processing Agreement.

9.5 StriveCloud shall notify the Reseller if StriveCloud intends to replace or engage a new sub-processor. StriveCloud shall then state the sub-processor’s name and details of the location of the processing and, at the Reseller’s written request, information about the processing activity to be undertaken by the sub-processor on behalf of StriveCloud. The Reseller shall be entitled to object to such changes in writing within thirty (30) calendar days of StriveCloud’s notice.

10. Technical and Organizational Measures

10.1 StriveCloud has implemented and will maintain appropriate technical and organizational measures intended to protect Personal Data, or the systems that Process Personal Data, against accidental, unauthorized or unlawful access, disclosure, alteration, loss or destruction. These measures shall take into account, and be appropriate to, the state of the art, nature, scope, context and purposes of Processing and risk of harm which might result from unauthorized or unlawful Processing or accidental loss, destruction or damage to Personal Data.

10.2 The present technical and organizational measures are described in Annex 6. StriveCloud shall adapt these measures systematically to the development of regulations, technology and other aspects, and supplement them with the applicable technical and organizational measures of Sub-processors, as the case may be. In any event, the implemented technical and organizational measures shall ensure a level of security appropriate to the risks represented by the Processing and the nature of the Personal Data to be protected, taking also into account the state of technology and the cost of their implementation.

10.3 Upon the Reseller’s request, StriveCloud must provide the Reseller within fourteen (14) calendar days of receipt by StriveCloud of the Reseller’s request with an updated description of the implemented technical and organizational protection measures.

11. Personal Data Breaches

11.1 In the event of a (likely or known) Personal Data Breach and irrespective of its cause, StriveCloud shall notify the Reseller without undue delay after having become aware of (the likelihood or occurrence of) such Personal Data Breach, providing the Reseller with sufficient information and in a timescale which allows the Reseller to meet any obligations to report a Personal Data Breach under the Data Protection Legislation. Such notification shall as a minimum specify:

• the nature of the Personal Data Breach;
• the nature or type of Personal Data implicated in the Personal Data Breach, as well as the categories and numbers of Data Subjects concerned;
• the likely consequences of the Personal Data Breach;
• as the case may be, the remedial actions taken or proposed to be taken to mitigate the effects and minimize any damage resulting from the Personal Data Breach;
• the identity and contact details of the Data Protection Officer or another Contact Person from whom more information can be obtained.

11.2 The Reseller shall be responsible for immediately notifying the End-Customer of a (likely or known) Personal Data Breach in accordance with the Data Protection Legislation.

11.3 StriveCloud shall without undue delay further investigate the Personal Data Breach and shall keep the Reseller informed of the progress of the investigation and take reasonable steps to further minimize the impact. Both Parties agree to fully cooperate with such investigation and to assist each other in complying with any notification requirements and procedures.

11.4 A Party’s obligation to report or respond to a Personal Data Breach is not and will not be construed as an acknowledgement by that Party of any fault or liability with respect to the Personal Data Breach.

12. Data Processor Responsibilities

12.1 The Reseller shall comply with all applicable laws and regulations, including the Data Protection Legislation.

12.2 The Reseller shall use its best efforts to ensure that the End-Customer takes reasonable steps to keep Personal Data up to date to ensure the data are not inaccurate or incomplete with regard to the purposes for which they are collected.

12.3 The Reseller shall implement and maintain the required technical and organizational measures for protection of Personal Data.

12.4 StriveCloud shall make available to the Reseller all information necessary to demonstrate compliance with the Data Protection Legislation’s requirements on processors and allow for and contribute to audits, including inspections, conducted by the End-Customer or another auditor mandated by the End-Customer. In the event that an End-Customer wishes to conduct an inspection, such End-Customer shall provide StriveCloud with reasonable prior notice and shall at the same time specify the content and scope of the inspection. StriveCloud may charge the Reseller for any reasonable costs incurred in conjunction with the audit.

12.5 StriveCloud shall immediately inform the End-Customer if StriveCloud considers that information, including inspections, is not required or infringes Data Protection Legislation. An inspection may only be conducted if an audit cannot be met by StriveCloud providing information.

12.6 A precondition for an audit is that the End-Customer or an auditor mandated by the End-Customer has entered into necessary confidentiality undertakings and complies with StriveCloud’s security regulations at the location where the inspection is to be performed, including that the inspection will be performed without any risk of it hindering StriveCloud’s business or the protection of other customers’ information. Information collected as part of the inspection shall be erased after the audit has been completed or when it is no longer needed for the purpose of the audit. End-Customer shall limit its initiatives to conduct an audit to no more than once per two years.

13. Notifications

13.1 Unless legally prohibited from doing so, StriveCloud shall notify the Reseller as soon as reasonably possible, and at the latest within five (5) business days of becoming aware of the relevant circumstances, if it or any of its Sub-processors:

(i) receives an inquiry, a subpoena or a request for inspection or audit from a competent public authority relating to the Processing;

(ii) intends to disclose Personal Data to any competent public authority outside the scope of the Services;

(iii) receives an instruction that infringes the Data Protection Legislation or the obligations of this Sub-Processing Agreement.

13.2 In this respect, StriveCloud shall co-operate as requested by the Reseller to enable the Reseller to comply with any assessment, enquiry, notice or investigation under the Data Protection Legislation, which shall include the provision of:

(i) all data requested by the Reseller (which is not otherwise available to the Reseller) within the reasonable timescale specified by the Reseller in each case, including full details and copies of the complaint, communication or request and any Personal Data it holds in relation to the relevant Data Subject(s); and

(ii) where applicable, providing such assistance as is reasonably requested by the Reseller to enable the Reseller to comply with the relevant request within the Data Protection Legislation statutory timescales.

13.3 Any notification under this Sub-Processing Agreement, including a Personal Data Breach notification, will be delivered to one or more of the Reseller’s Contact Persons via email, possibly supplemented by any other means StriveCloud selects. Upon request of the Reseller, StriveCloud shall provide the Reseller with an overview of the contact information of the registered Reseller’s Contact Persons. It is the Reseller’s sole responsibility to timely report any changes in contact information and to ensure the Reseller’s Contact Persons maintain accurate contact information.

14. Term and Termination

14.1 This Sub-Processing Agreement enters into force on the date of the conclusion of the Agreement by all Parties and remains in force until Processing of Personal Data by StriveCloud is no longer required in the framework of or pursuant to the Agreement.

Annex 4: Details with regard to the Processing of Personal Data

This Annex determines the subject matter, duration, nature and purpose of the processing, the types of personal data and categories of data subjects, and the retention period of the personal data.

Types of personal data

• First and last name
• Birthdate
• Gender
• Address details
• E-mail address
• Data relating to data subject’s activity on StriveCloud’s digital services
• IP-addresses
• Web browser and device type
• Usertag

Nature of the processing

Personal data processing in the context of the functioning of the StriveCloud Software and the proper (technical) operation and security thereof.

Purpose of the processing by StriveCloud

• Functioning of the StriveCloud Software
• Providing the functionalities of the StriveCloud Software
• Account registration
• Communication with accounts

Duration of the processing and retention period of personal data

• The personal data are processed by StriveCloud during the term of these Terms.
• The Software Reseller requests StriveCloud to store the personal data for a period of twelve months after termination of these Terms.
• In any case, personal data of a user will be deleted by StriveCloud after 1 year of inactivity on the user’s account.

Annex 5: List of Current Sub-Processors

Always active:

• Google: Google Cloud Platform and Google Analytics (hosting and location is always closest to customer location or on customer request)
• Pusher
• Sendgrid

Only active if the customer enables the functionality:

• Payment systems: Stripe, CCV
• Segment
• Discord
• Playable
• Twitch
• Slack

Annex 6: Security Measures

This Annex contains an overview of the technical and organisational security measures that StriveCloud will implement.

Roles and responsibilities. All StriveCloud employees have elevated permissions, yet all data access is logged permanently. All StriveCloud employees are aware of the consequences of accessing data and applicable legislation. Security regulations are provided to all StriveCloud employees and included into their employment contract.

Pre-employment screening. All StriveCloud employees have gone through a background check before employment.

Password settings. All passwords require at least 8 characters and can use the full range of ASCII characters. Passwords never leave the Reseller’s systems without being hashed. All stored passwords will be dynamically salted to prevent decoding. Passwords are only resettable if the user has access to the email address configured in the account. For admin accounts, other guidelines are used. Authentication requires a 100-character personalized password which is managed in LastPass. If any key would get lost (which has never happened and is impossible using a key management solution), a new key would be generated and shared with that single person using LastPass.

Distribution of account name and password. Passwords are never sent by StriveCloud to a user. Administrators or users with more access rights will only receive their keys using LastPass.

Password reset. Password resets are managed by the password reset page; only the sent email can prove your identity. Password resets for administrators or users with more access rights have never happened before; if for any reason they would happen, a new secure 100-character randomized string will be saved to the LastPass account of that employee/administrator.

Remote user access. All access is remote, although without 2FA.

Remote site access. All third parties we provide access to use a traced key of which all logs can be followed to source IP addresses, so no missed traffic is possible.

Vulnerability scanning and patching. All services are using containerized environments which use weekly updates to ensure the latest security updates are being used.

Hardening. Only proxy servers are able to connect to our cloud network. All other traffic is blocked from the start. None of the services use default passwords; instead they use Production environment passwords only known and accessible by a single person. We do not use a CIS benchmark yet do have all required firewalls and use ACLs.

Malware protection. No anti-virus is installed on our Linux servers. All latest security patches are being used and monitored to ensure latest updates are being used.

Logging and monitoring. All logs are gathered and accessible up to 2 years in the past. Log data is analyzed frequently. Strange or unexpected behaviour is directly noted to the development team as a notification.

Cryptography. As per request, all domains will be protected with a separate PKI certificate instead of a wildcard certificate. Usually for a platform we deploy this will consist of 6 different keys which are stored securely in our cloud.

(Web and Mobile) Application Security. All applications are reviewed before being published.

Identity and Access Management. All authentication is done by user and password. Each user has individual access to the necessary parts of the application. All access rights are being checked monthly to ensure no unwanted left-behind keys or users.

Asset registration. All our assets are tracked in the cloud to ensure direct contact to the owner, access to their physical location and network location.

Change registration. All deploys are done behind the screens in a test environment before being published live. Larger and more time-consuming changes are done overnight after being approved.

Media cleaning. All media is deleted by the Google Cloud (our server host) policy. More info can be found here: https://cloud.google.com/security/deletion/.

Correct date and time. Our platforms allow different time zones and time settings. All times are always checked, read and written on our servers.

Network segmentation and security zoning. None of our cloud networks are interconnected except for certain clusters using a single port and transport communication protocol to other zones of our infrastructure.

Applications sharing a platform. None of our applications share data except if requested by a client.

Software versions. Only software versions that are supported by the supplier must be used for the system.

System data backup. Backups are made daily and stored for at least one month over a variety of locations. Restores are tested weekly to ensure functionality.

Business Continuity Management. All processes enforced by StriveCloud are written down and easily transferable to ensure continuity.

Business Continuity Plans. All our environments are fully tested before deploys to ensure functionality. Any updates which may have an impact on the experience are performed outside of regular visitor hours and will not be noticed. If any services are performed during daytime and a downtime is expected, a timely notice will be given.

Traffic data. All traffic data is stored anonymously; this includes logs, billings, market analysis. It is not possible to link back traffic to a user.

Separating environments. We do use containerized clusters for our hosting, yet all Resellers are entirely separated from each other to ensure separation of data and networking.

Net Neutrality. We never obstruct or delay services on purpose.

Cookies. Resellers are being informed after signup about the installed cookies; further explanation is also provided in the policy.

Security Patches. We will resolve all security vulnerabilities as soon as possible. A security update is performed within 3 days (at the latest) after we have been made aware.

Database protection. Databases are protected by validating inputs; access is only given to other servers for production environments and functions with large impact are only able to be executed after an approval.

‍

‍