Last Updated: 31st July2025
These General Terms and Conditions of Sale and Use (the “Terms”) are entered into between:
Awssome Inc., a Delaware corporation with registered office at 131 Continental Dr, Suite 305, Newark, DE 19713, and principal business address at Maassluisstraat 47, Amsterdam, 1062GANetherlands, doing business as AWSsome (hereinafter referred to as “AWSsome”, “we”, “our”, “us”)
and
"You" which refers to the legal entity accepting these Terms (the “Customer”, also referred to as the “Publisher”), acting through any natural person it authorises to use the Solution (each a “User”) provided by AWSsome by subscribing to it online in the form of licenses.
It is important to read and understand the Terms and Conditions provided by AWSsome before accepting them or accessing the Solution.
High-Level Summary
AWSsome follows GDPR guidelines and has a Data Processing Agreement in place to protect personal data. AWSsome owns all intellectual property rights for the Solution and customers are only allowed to use it.
AWSsome has implemented security measures to prevent data breaches. By default, Customer Data is stored in the cloud region automatically chosen for the nearest performance; regions include the EEA, UK, United States, Canada, Asia-Pacific, Latin America, Middle East and Africa on the Company’s cloud provider geo-availability (Microsoft Azure, Amazon Web Services, or Google Cloud Platform). Customers may request any other public region offered by our cloud provider.
Anomaly: means any malfunction, including purely technical malfunction, of the Solution, regardless of the cause, in relation to the Solution specifications and the Documentation.
Publisher Account: means an account created by AWSsome from the information provided by the Publisher, in order to allow the Publisher to access the Solution.
User Account: means an account created by a User authorized by the Publisher and AWSsome for the purpose of using the Solution.
General Terms and Conditions of Sale and Use or “Terms”: means these general terms and conditions of sale and use and their appendices as well as the Plan and the Data Processing Agreement between the parties.
Date of Availability: means the date of availability of the Solution to the Publisher, manifested by the sending by AWSsome to the Publisher a confirmation email of the Publisher Account.
Offer(s): The Solution provided by AWSsome is available in different formats, called "Offers." The Publisher selects an Offer and at least one Plan (described below).
Plan(s): The conditions for subscribing to the Solution include the type of subscription chosen, the modules selected, and the applicable price. Plans are available on aws.amazon.com/marketplace, and AWS Portal. Each Plan is governed by the terms and conditions outlined in this document.
Private Offer: This is an offer that is created specifically for one Customer of Publisher and which is conducted via the AWS Marketplace. A Private Offer may have its own terms and conditions that replace the General Terms and Conditions of Sale and Use for the Publisher accepting the offer as determined by Publisher in its sole discretion. The fees and charges associated with the Private Offer will follow the terms and conditions specified in the Private Offer.
Customer: means a customer that purchases Publisher’s product via a Private Offer.
Documentation: This refers to the descriptions and instructions for using the Solution, which may be provided in print or on machine-readable media. It includes any documentation provided to the Publisher or posted on the AWSsome website regarding the Solution or any of its components, including any updates or modifications. This does not include commercial, promotional, or training documentation.
Publisher Data: This refers to the data generated by the Publisher and their Users when using the Solution, such as data submitted, stored, sent, or received through the Solution. This may include, but is not limited to, the Publisher's Publisher or its Customer’s personal data.
Right of Use: means the right to use the Solution granted by AWSsome to the Publisher and to the Publisher's Users authorized by the Publisher, as described in article 4.1 of the Terms.
Confidential Information: This refers to any kind of information(commercial, industrial, technical, financial, etc.) that is disclosed by one party (the "Disclosing Party") to the other party (the "Recipient") in connection with these terms and conditions, whether in writing, orally, or during an audit. Confidential Information includes, but is not limited to, personal data, documentation, the Solution, all code for the Solution, all computer programs provided with the Solution, and all algorithms, methods, techniques, and processes disclosed or used in the performance of these terms. Confidential Information does not include information that (a) was independently developed by the Recipient without the use of Confidential Information from the Disclosing Party, (b) is already known to the Recipient,(c) was already in the public domain at the time of disclosure or has entered the public domain not as a result of any act or omission by the Recipient, or(d) was already known to the Recipient at the time of disclosure.
Updates: These are successive partial or complete versions of the Solution that may include corrections for anomalies and/or improvements to the functionality provided by AWSsome as part of the evolution of technology, legal and regulatory frameworks, and functionalities.
GDPR: refers to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
Parties: means AWSsome and the Publisher.
Subscription Period: means the duration of the right to use the Solution granted to the Publisher under these Terms.
Privacy Policy: means the privacy policy of AWSsome whose purpose is to inform the User about the processing of his Personal Data. The Privacy Policy is available at the URL: www.AWSsome.io/privacypolicy. Third Party Online Service: means application functionalities delivered online for which a third party is the author, editor and/or operator but for which AWSsome has rights of use and/or distribution in the framework of the Solution.
Support Services: means the services described in Appendix 2 of the Terms, consisting in answering Users' requests concerning the operation of the Solution, or in giving them the right to use the Online Support Platform.
Related Services: means the services related to the provision of theSolution by AWSsome to the Publisher, namely the support,maintenance, evolution and optimization services of the Solution.
Website: means the AWSsome website whose URL is https://www.AWSsome.io/ or any other website that may replace it.
Solution: means the AWSsome SaaS platform developed and marketed by AWSsome and for which the Publisher and its Users have the Right of Use under these Terms and which enables Publisher to publish and sell Publisher’s products on the AWS Marketplace.
Users: means the users of the Solution who are natural persons authorized by the Publisher and acting under its responsibility, i.e. either employees, service providers, collaborators or corporate representatives of the Publisher or its affiliates acting within the framework of their employment contract, corporate mandate or commitment with the Publisher.
Amazon Web Services Marketplace: means AWS Marketplace.
2.1. Purpose of the Terms .
The purpose of the Terms is to define the terms and conditions under which (i) AWSsome provides a Right of Use of the Solution to Publisher and Users and (ii) Publisher and Users access and use the Solution.
2.2 Publisher's Acceptance of Terms.
The Publisher agrees to make sure that any User complies with the Conditions. The Publisher also confirms that they have performed all necessary due diligence before committing to the Solution and that they have received all necessary information to determine that the Solution meets their needs.
2.3. Intentionally Omitted
3.1 Modification.
AWSsome has the right to change the Terms and Conditions at anytime. They will notify the Publisher and Users of any changes at least thirty(30) calendar days in advance of their effective date. This notification can be provided in writing, such as via email, or through the Solution or the Website.
3.2 Publisher reaction to unilateral changes
If the Publisher does not agree with any changes made to the Terms and Conditions, they have the right to terminate the terms without penalty by giving one month's notice to AWSsome. This is the Publisher's only option in this situation. If AWSsome does not receive a request for termination within two months of notification of the changes, it will be assumed that the Publisher and their Users have accepted the changes. The amended Terms will replace the previous version and will be provided to the Publisher via email in PDF format at the address associated with their Publisher Account. If the changes to the Terms are required by law or regulations, they will automatically go into effect and AWSsome will notify the Publisher of the changes. In this case, the Publisher still has the right to terminate the Terms according to Section 9.2 of the Terms.
3.3. Acceptance or refusal of the modifications by the User.
If the User does not agree to any changes made to the Terms and Conditions, they should stop using the Solution immediately. If the User continues to access the Solution after a two-month period following notification of the changes, it will be assumed that they have accepted the changes and the modified version of the Terms and Conditions will replace the previous version.
4.1. Right to Use the Solution.
Subject to Publisher’s payment of the subscription fee as outlined in the Plan, AWSsome grants the Publisher and its affiliates a limited, non-exclusive, non-transferable, and personal right to use the Solution and its updates by its Users according to these Conditions and the Documentation. This right to use the Solution(called the "Right of Use") is granted to the Publisher and their Users from the date that the Solution becomes available and until the end of the subscription period, which is the duration of the copyright. This right is only valid for as long as the Terms and Conditions are in effect.
4.2. Access to the Solution.
The Software is accessible through the the URL communicated by AWSsome to the Publisher during onboarding. The Publisher also understands that the quality and reliability of transmissions depend on the network infrastructure and may be subject to disruptions or network saturation, which may prevent them from accessing the Solution. It is the Publisher's responsibility to ensure the security of their terminal equipment and Publisher data, software, and any other equipment, including protecting against viruses or attempted intrusions. The Publisher is also responsible for any damage to equipment connected to the website or the Solution, including damage resulting from their connection to the website or the Solution.
4.3. Publisher account.
To access and use the Solution, the Publisher must create a Publisher Account using the information provided. To do so, the Publisher must fill out the required form. The information provided must be complete, accurate, and up to date, and the Publisher is responsible for ensuring this. If any of the information changes, the Publisher must update it to keep the account accurate. The Publisher is solely responsible for the use of the Publisher Account, except in cases of data breach caused by AWSsome. The Publisher agrees to keep their password confidential and to notify AWSsome as soon as possible if it is compromised or disclosed. The email address linked to the Publisher Account must remain valid or a replacement one provided to AWSsome for the Publisher to use the Solution. After the Publisher Account is created, a confirmation message will be sent to the indicated email address. The Publisher must activate the link in the message to validate the account creation. Once the Publisher Account has been created, the Publisher's Users can create their own user accounts and access the Solution.
4.4 User Account.
To use the Solution, a User must create a user account by filling out the required form on the corresponding page, including their first and last name, their company, a valid email address, and a password. Each user account is specific to the provided email address and cannot be shared with other users. The requested data is collected for the purpose of creating a user account and providing the Solution. The information provided must be complete, accurate, and up to date, and both the Publisher is responsible for this. If any of the information changes, the User or Publisher shall update it to keep the account accurate. Publisher is solely responsible for the use of the User Accounts and shall keep their password confidential and notify AWSsome promptly if it is compromised or disclosed. The provided email address must remain valid or a replacement one provided, for the User to access the Solution. After the User Account is created, a confirmation message will be sent to the provided email address. The Publisher must activate the link in the message to validate the account creation.
4.5. Restrictions on the Right of Use.
The Publisher is only authorized to use the Solution within the scope of the Right of Use and within the limits of the choices made upon entering the Terms, as specified in the applicable Offer and selected Plan. The Publisher and its Users must not:
4.6. Suspension of Right of Use.
AWSsome has the right to suspend the Publisher's or any User's right to use the Solution in the following circumstances:
AWSsome will allow the Publisher seven calendar days from notification of the breach to resolve it before suspending the right to use the Solution, unless it is an emergency situation. This period may be extended with the written consent of AWSsome. In this case, the Parties will work together to resolve the issue within a reasonable time, and AWSsome will restore the Publisher's access to the Solution as soon as possible.
5.1. Intellectual property of AWSsome
The Solution is a work of the mind within the meaning of the Code of the Intellectual Property. As such, AWSsome, in its capacity as holder of the copyright on the Solution, is invested with moral and patrimonial rights. AWSsome owns and retains all intellectual property rights and titles to the Solution, including all copyrights, patents, trade secret rights, trademarks and other intellectual property rights therein. The Publisher does not acquire any ownership or title of any kind in the Solution, except for the Right of Use. Because of the above, the Publisher shall refrain from any act or conduct that may directly or indirectly infringe the intellectual property rights on the Solution, as well as on the associated trademarks. Any use not expressly authorized by AWSsome hereunder is unlawful, in accordance with the provisions of Article L.122-6 of the Intellectual Property Code. The Publisher shall not remove, conceal or modify any copyright, trademark or other proprietary notices affixed or attached to the Solution.
5.2 Warranty of eviction: protection of the Publisher in the event of action by third parties
5.2.1. Mutual IP Indemnity
(a)AWSsome will defend Publisher against any third-party claim that the unmodified Solution infringes that party’s EU, UK or US patent, trade-mark or copyright, and will pay resulting damages finally awarded or settled. Liability under this Section counts toward the cap in Article 10.1.4.
(b)Publisher will defend AWSsome against any claim that Publisher Data, or a Marketplace listing created by Publisher, infringes a third party’s IP, and will pay resulting damages finally awarded or settled.
Indemnity is conditional on the indemnified party: (i) giving prompt writtennotice; (ii) granting sole control of defence and settlement; and (iii)providing reasonable co-operation.
AWSsome shall only be responsible for such expenses of proceedings or settlements as AWSsome expressly agrees to in writing.
5.2.2. Exceptions to AWSsome’s indemnity.
AWSsome’s obligations in 5.2.1(a) above shall not apply to damages, costs and expenses resulting from (1) any use of the Solution beyond the scope of the Right of Use granted by these Terms, (2) any modification or derivative work of the Solution made by or for Publisher other than if made by AWSsome, (3) the use of an obsolete infringing version of the Solution (or any component thereof) by Publisher after AWSsome has released a non-infringing version, or (4)any use or combination of the Solution with any technology, software or hardware not provided by AWSsome (including, without limitation, a third party online Service), where the alleged infringement could have been avoided by using the Solution without such technology, software or hardware.
5.2.3. Remedies.
In the event of a claim under 5.2.1without the exceptions set forth in 5.2.2, or if AWSsome believes that a claim is likely, AWSsome may, in its discretion: (1)grant Publisher a Right of Use to continue to use the Solution; or (2) replace or modify the Solution to make it non-infringing, provided that the replacement Solution is substantially similar to the Solution. If AWSsome determines that these remedies cannot reasonably be implemented, AWSsome may elect to terminate these Terms, in which case no refund of prepaid fees is due. If AWSsome chooses one of the options in this section 5.2.3,the solution so chosen shall be the sole and exclusive remedy for Publisher's claim for infringement of intellectual property rights.
5.3 Ownership and use of Publisher Data
5.3.1. Ownership of Publisher Data.
Publisher is responsible for all the data they submit to the Solution, including any copyrighted, trademarked, or proprietary material. They must have permission to use this material and grant AWSsome a limited right to use it for the purposes of these Terms.
5.3.2. Limited Rights to Use Publisher Data by the Solution.
Publisher grants AWSsome anon-exclusive, royalty-free licence to host, reproduce, process and transmit Publisher Data solely to provide and support the Solution and related Services, for the term of the Agreement plus any post-termination retention period required by law.
5.3.3. Use of Sub-processors
To provide the Solution, AWSsome relies on selected third-party service providers (sub-processors), such as Microsoft Azure, Amazon Web Services or Google Cloud Platform for cloud hosting. A current list of sub-processors, including their purpose and hosting location, is maintained by AWSsome and is available to the Publisher upon request.
AWSsome will notify the Publisher in case of any material changes to this list in accordance with the applicable data protection terms. Our current list of authorized sub-processors, including their services and processing locations, is available upon request. To request a copy, please contact: privacy@AWSsome.io.If we intend to add or replace a sub-processor that handles Personal Data, we will notify affected Publishers in advance and provide the opportunity to object in accordance with the Data Processing Agreement (DPA). Where the Publisher reasonably objects, they may terminate the Agreement in line with the terms set out in the DPA.
In the context of the Publisher's use of the AWSsome Solution, in case of complaints related to the security of the Solution, the Publisher may address a complaint to AWSsome atlegal@AWSsome.io.
Publisher may email complaints to legal@AWSsome.io.AWSsome will acknowledge receipt within ten (10) working days and will use commercially reasonable efforts to provide a full response within thirty (30) days. The reply will explain further recourse and the competent mediator.
7.1. Obligations of AWSsome
7.1.1. Availability.
AWSsome sizes its cloud hosting infrastructure, and systems to deliver the Solution in the best conditions of security and accessibility. AWSsome undertakes to make the Solution available to the Publisher under the conditions of availability defined in the Service Level Agreement annexed to these Terms (Appendix 1,SLA), which provides for an Availability of the Solution fixed at 99%. If the availability of the Solution falls below 99%, AWSsome will make available to the Publisher SLA credits (defined in Appendix 1) to compensate the Publisher for the unavailability of the Solution. If the availability of the Solution falls below 90%, Publisher may terminate these Terms immediately and no refund of prepaid fees is due; but AWSsome will proceed with a guided offboarding, providing a free SKU to the Publisher to retain the Marketplace listing live.
AWSsome operates using industry-leading cloud providers (Microsoft Azure, AWS, or GCP). Its availability is subject to its cloud provider SLA.
7.1.2. Updates.
Updates to the Solution will be made available to Publisher at no additional charge. However, the availability of certain enhancements and new features of the Solution may require the payment of additional fees, and AWSsome will determine in its sole discretion whether access to any such enhancement will require additional fees. These Terms shall apply to all Updates, enhancements and new features of the Solution subsequently provided by AWSsome to Publisher. AWSsome shall have no obligation to make any such upgrades requested by Publisher.
7.1.3. Commitment to correct theAnomalies.
AWSsome does not guarantee that the Solution is free of all hazards, defects in design or use, but undertakes to attempt to remedy reproducible Defects with the diligence of an industry professional. The Solution is deemed to be made available to Publishers "as is" without any specific customization measures and cannot meet all specific Publisher needs. AWSsome does not warrant the ability of the Solution to achieve any goals or results that Publisher may have set for itself and/or to perform any tasks that may have motivated Publisher to enter into these Terms.
7.1.4. Security.
AWSsome agrees to:
7.1.5. Hosting.
AWSsome provides hosting on infrastructure operated by Microsoft Azure, AWS or GCP in the public cloud region automatically selected for proximity and performance. Current regions include but are not limited to the EEA, UK, United States, Canada, Singapore, Australia, Japan, India, Brazil, United Arab Emirates and South Africa. A Publisher may request any other available public region, and, subject to feasibility, AWSsome will confirm the change in writing (which will supersede this Section 7.1.5).
AWSsome will also implement necessary security measures and technical and organizational measures to ensure the security of Personal Data processed by the Solution and will report any security breaches or updates needed to ensure the security of the storage system for Users' identifiers. AWSsome will also assist the Publisher in processing Users' requests concerning their data and manage the exercise of the rights of the individuals involved in accordance with the GDPR.
7.1.6 Warranty.
AWSsome represents and warrants that AWSsome has been granted all necessary authorizations and approvals by AWS Marketplace to offer and provide the Solution and the Right to Use the Solution to Publisher and that AWSsome is, and will be during the Subscription Period, compliant with all Amazon Web Services requirements to be able to provide the Solution and the Right to Use the Solution to Publisher.
7.2. Publisher's Obligations
7.2.1. Publisher & User
Publisher and User agree to use the Solution in accordance with applicable law, the Documentation, and these Terms.
7.2.2. The Publisher and, where applicable, the User;
The Publisher agrees to use the Solution for their professional activity only and in accordance with its documentation. They are solely responsible for their Publisher Data and accept full responsibility for its nature, content, accuracy, integrity, and legality. The Publisher agrees not to attempt to gain unauthorized access to the Solution, and not to send or store non-professional or illegal data through the Solution. They will provide AWSsome with necessary technical data and information about their computer facilities, files, documentation, and other resources in a timely manner at their own expense. The Publisher will provide AWSsome with information needed to create a plan and User accounts, and ensure that only authorized Users have access to the Solution. They will also ensure that all Users accepting the terms and conditions and respect their obligations. The Publisher agrees to take all necessary precautions to maintain the confidentiality of Confidential Information. For confidentiality obligations, see Article 14.
8.1.1. Termination of the Terms for convenience.
The Terms may be terminated by the Publisher at any time by notice to AWSsome as provided below. Any started Plan is due. Thus, amounts already paid to AWSsome under the Right of Use for any month started will not be refunded.
8.1.2. Termination of the Terms incase of breach by a Party of any of its obligations.
Each Party may terminate the Terms by email, via letter delivered by an internationally recognized delivery service or registered letter with acknowledgement of receipt, in the event of non-performance or non-compliance by the other Party of any of its obligations under the Terms, provided that the non-defaulting Party has notified the defaulting Party inwriting of this breach and that the defaulting Party has not remedied the breach within fifteen (15) calendar days of this notification. In the event of termination of the Terms by AWSsome under 8.1.2, the Right of Use shall cease immediately, and Publisher shall not be entitled to any refund. In the event of termination of the Terms by Publisher under
8.1.2, Publisher shall have a Right of Use for the duration of the calendar month in which the termination occurs. Publisher’s sole remedy for AWSsome’s uncured material breach shall be the right to terminate the Terms. Pre‑paid fees are non‑refundable.
8.1.3. Effect of Termination of Terms., Termination of the Terms shall result in termination of Publisher's subscription and the date of termination of Publisher's subscription is the effective date of termination of the Terms. The rights and obligations of the Parties which, by their nature, survive the termination or completion of these Terms shall remain in full force and effect after the termination of these Terms.
8.2. Reversibility and export of data. Within thirty(30) days of the effective date of termination of these Terms for any reason,(1) AWSsome will remove all synchronization between the Solution and the Third-Party software used by Publisher (if any), and (2)Publisher shall export its Data accessible via the Solution, or request from AWSsome the return of a copy of the last backup of its Data Except specific request of the Publisher, the Data of the Publisher will be, in the event of request of its share, restored to him in a standard format. In order to facilitate the transfer of the Publisher Data to the Publisher, the Publisher may request in writing the opening of a reversibility phase, which will begin fifteen (15) calendar days after receipt of the Publisher's request. The reversibility phase will have a maximum duration of one month, unless the Parties agree otherwise. AWSsome will provide commercially reasonable and good faith cooperation to Publisher to facilitate the export of its Data. Beyond this cooperation, reversibility will be at the Publisher's expense regardless of the cause of termination of the Terms.
9.1. Price.
In consideration of the Right to Use the Solution and the Support Services, Publisher agrees to pay AWSsome the price as set forth in the applicable Plan(s).
9.2 Payment.
All sales are conducted through the AWS Marketplace storefronts by default. However, AWSsome may, at its discretion, agree with the Publisher on an alternative method of payment. In such cases, AWSsome will issue an invoice reflecting the mutually agreed-upon terms documented in a written format, such as email correspondence.
The Publisher is required to settle the payment on or before the due date specified in the invoice. Any delays in payment will incur a penalty fee.
Payment is overdue only if (i) undisputed, and (ii)remains unpaid fifteen (15) days after a written reminder. A “good-faith dispute” is a written notice that details the amount contested and the reasons.
Late-payment charge. Any amount that remains unpaid more than sixty (60) days after the original due date shall, without further notice, accrue late-payment interest at the lesser of (i) eight percent (8 %) per annum above the European Central Bank reference rate, or (ii) the maximum rate permitted by applicable law, calculated from the original due date until paid in full. Publisher shall also reimburse AWSsome for all reasonable costs of collection (including legal fees) incurred in recovering overdue sums.
AWSsome may suspend access for overdue sums outside a good-faith dispute after the grace period.
9.3Supplier Payment Terms.
9.3.1Payment period.
AWSsome shall remit undisputed supplier invoices within forty‑five (45) days of receipt or the due date shown on the invoice, whichever is later.
Payment dates shall be extended by any period during which banking systems are unavailable or force‑majeure events prevent timely remittance.
9.3.2Invoice requirements.
Invoices must be issued in PDF format and sent to finance@AWSsome.io, quoting the relevant Purchase Order and complying with all applicable tax regulations.
9.3.3Late payment.
If payment is late, AWSsome shall pay the outstanding principal plus any statutory late-payment interest the supplier is entitled to charge.
9.3.4Scope & precedence.
These Payment Terms apply to all Purchase Orders issued on or after 15 July 2025and override any prior or conflicting payment terms.
10.1. Responsibility of AWSsome
AWSsome maintains an Information Security Management System certified to ISO/IEC 27001 and conducts regular audits to ensure ongoing compliance.
10.1.1. Obligation of means.
Under these terms, AWSsome is committed to doing its best to provide high quality and reliable services, including security, scalability, and compliance with industry standards. AWSsome is also responsible for ensuring reliable access to internet-dependent services, including third-party servers, and their performance.
10.1.2. Limitation of liability.
AWSsome is only responsible for providing the Solution to integrate with Cloud Marketplace(s).The Publisher is responsible for their own decisions and actions based on the Solution. AWSsome will not be held responsible for any interruptions or damages resulting from:
These exclusions shall not apply in the event of gross negligence or willful misconduct of a Party or its personnel.
10.1.3. Nature of the damage.
AWSsome and Publisher shall each be liable only for direct, foreseeable losses proven to have been caused by that Party’s fault. Neither Party shall be liable for any indirect or unforeseeable loss suffered by the other Party or by any third party, including but not limited to loss of profit, loss of business, loss of revenue, loss of customers, or loss of opportunities.
10.1.4. Aggregate Limit.
Except for liability that cannot be limited by law or that results from a Party’s willful misconduct or gross negligence, the total cumulative liability of either Party under these Terms(including the DPA) shall in no case exceed the Subscription Fees actually paid by Publisher for a single twelve- (12-) month Subscription Term immediately preceding the event giving rise to liability.
Indirect or consequential losses remain excluded as set out in Article 10.1.3, and all monetary claims—including indemnities, data-protection breaches and confidentiality breaches—count toward this ceiling.
Liability for data-protection matters shall be determined in accordance with Article 82 GDPR, provided that the aggregate cap and exclusions above shall continue to apply except to the extent Article 82 expressly forbids such limitation.
In accordance with the provisions of article 1218 of the Civil Code, each of the Parties will be released from any responsibility if the non-execution of its obligations results from a case of force majeure, in the sense of the jurisprudence of the Court of Cassation. The Party invoking such circumstances shall notify the other Party of their existence as soon as possible, shall do its best to limit the consequences and shall resume performance of these Terms immediately after these circumstances have disappeared. If such circumstances continue for more than one (1) month, the Parties agree to enter into discussions with a view to amending these Terms to take account of them. If they fail to reach agreement, the Terms may be terminated without compensation by either Party by simple written notice to the other Party, which shall take effect upon receipt.
AWSsome provides Support Services to Users in accordance with Appendix 2, Support Terms and Conditions.
13.1 Planned Maintenance.
AWSsome periodically schedules and performs maintenance work, including as part of Updates to the Solution, in order to make available new features of the Solution or to correct Defects. In most cases, maintenance will have little or no negative impact on the availability and functionality of the Solution.
13.2. Unscheduled Maintenance.
AWSsome may perform unscheduled maintenance at any time, including to correct certain Anomalies on an emergency basis. The Publisher acknowledges and accepts that legislative or technological developments may, at any time, render all or part of the Solution illegal or unsuitable. AWSsome will then have the right to update the Solution in order to bring it into conformity with the legal or regulatory provisions in force or, if necessary, with the technological situation.
13.3. Notification.
Where possible, AWSsome will notify Publisher of the date and time of scheduled maintenance with five business days notice. If AWSsome expects a maintenance event, scheduled or unscheduled, to adversely affect the availability or functionality of the Solution, AWSsome will use commercially reasonable efforts to notify Publisher in writing of such maintenance event. If a maintenance operation requires the interruption of the Solution, AWSsome will perform such interruption, to the extent possible, at a time that has the least possible impact on Publisher's use of the Solution.
14.1 Obligations of Recipient.
Recipient shall treat as confidential all Confidential Information provided to it by the Disclosing Party and shall use such Confidential Information only for the purpose of performing its contractual obligations under these Terms. Recipient shall not disclose the Confidential Information to any third party without the prior written consent of the Disclosing Party, except for those of its employees and contractors who:(i) have entered into a written agreement with Recipient imposing limitations on use and confidentiality at least as protective as those contained in these Terms, and (ii) require access to such Confidential Information solely for the purpose of fulfilling Recipient's obligations or exercising Recipient's rights hereunder. To protect Confidential Information, Recipient shall use measures similar to those it takes to protect its own highly confidential information, but in no event less than reasonable measures, to prevent unauthorized disclosure and use of Confidential Information.
14.2 Exceptions.
Confidential Information may be disclosed pursuant to an order of a court, public body or other governmental authority, in which case Recipient shall notify the Disclosing Party as soon as possible and shall use reasonable efforts to limit the scope of such order or to prevent public disclosure of such information.
15.1. Data controller.
The Parties shall in all circumstances comply with the regulations applicable to them in terms of the protection of Personal Data, in particular to the GDPR. The Parties undertake, as independent data controllers for the processing operations of Personal Data that they respectively carry out for their own needs within the framework of these Terms ,to respect all their obligations arising from the GDPR and in particular to provide the persons concerned whose Personal Data are likely to be processed, with the relevant information relating to the protection of their personal data as described in their respective Privacy Policies and in the Data Processing Agreement (the “DPA”). AWSsome's Privacy Policy is available at the following link: www.AWSsome.io/privacypolicy. The Publisher and the User declare that they have read it and accept all the terms.
15.2. Sub‑contractor
Where AWSsome processes Personal Data on behalf of Publisher, the Parties agree that the DPA governs such processing and prevails over any conflicting term in these T&Cs.
15.3. Further Processing.
The Parties also agree that AWSsome may process the Personal Data collected in the course of the operation of the Solution as a data controller for the purposes of fraud and malware prevention and detection, security incident management, improvement of the Solution (e.g. improvement of the user experience or user journey, development of new features or improvement of existing features...), or creation of statistics (the "Further Processing"). The Publisher expressly acknowledges that this Further Processing is determined and compatible with the Initial Processing given (among other things) the link between these two processes (use and improvement of the Solution), the nature of the Personal Data involved (absence of Sensitive Data), the limited consequences of the Further Processing for the Data Subjects, and the existence of appropriate safeguards that we implement in the context of this processing. The Publisher therefore authorizes this Further Processing.
15.4 Data Subject Rights.
Users have the right to access, rectify, erase, restrict or object to the processing of their Personal Data, and the right to data portability. They may also lodge a complaint with the competent supervisory authority.
The Publisher expressly agrees that AWSsome may, without any prior authorization or information, subcontract all or part of its obligations hereunder. In case of subcontracting, AWSsome will remain solely responsible for the good respect of the obligations subscribed under the Terms and will be responsible towards the Publisher for any breach due to its subcontractor.
Publisher authorises AWSsome to reference Publisher’s name and to display its logo and trademarks on the AWSsome website, in marketing collateral and press releases solely for the purpose of identifying Publisher as a customer of the Solution. Publisher may withdraw this consent at any time by written notice, in which case AWSsome will cease new public use within thirty (30) days.
AWSsome has the right to transfer its rights and obligations under these Terms to a third party through any legal means, whether or not there is payment involved. If AWSsome chooses to do this, it will no longer be responsible for fulfilling its obligations under these Terms after letting the Publisher know about the transfer. Any assignment by Publisher requires AWSsome’s prior written consent (not to be unreasonably withheld).
Aware of the risks and possible consequences linked to the execution of these Terms, the Parties accept, assume, and consequently renounce to renegotiate the terms, whatever the circumstances which could occur. The Parties therefore expressly decide by mutual agreement that the application of Article 1195 of the Civil Code shall be waived.
20.1. These Terms are governed by French law, without application of the rules of conflicts of law.
20.2.The Parties shall endeavor to resolve any disputes that may arise between them amicably.
20.3. Furthermore, in the event of a persistent complaint, the Publisher may write to the Mediator in accordance with article L. 316-1 of the Monetary and Financial Code at the following address Afepame Mediator, Association Afepame, 36 rue Taitbout, 75009 Paris.
20.4. In the absence of an amicable arrangement, any dispute relating to these Terms , in particular its formation, validity, execution, interpretation, expiry or termination, will be submitted to the appreciation of the Commercial Court of Paris to which jurisdiction is expressly granted, notwithstanding third-party appeals or multiple defendants.
No failure or delay by either Party in exercising any right under these Terms will constitute a waiver of that right. If any provision (or part of a provision) of these Terms is or becomes illegal, invalid or unenforceable, the legality validity and enforceability of any other provision of these Terms will not be affected and the provision (or relevant part) will apply with such deletions or modifications as may be necessary to make the provision legal, valid and enforceable. The English language version of these Term shall be the governing version used when interpreting or construing these Terms.
Any amendments to these terms must bein writing and signed by both parties.
These Terms may be executed in counterparts, which taken together will form one agreement
24.1 Form. All notices required or permitted under these Terms must be given by electronic mail (e-mail). No hard-copy or courier delivery is required unless expressly stated elsewhere in these Terms.
24.2 To AWSsome. Notices to AWSsome Inc (“AWSsome”) shall be sent to legal@AWSsome.io.
24.3 To Publisher. Notices to the Publisher shall be sent to the e-mail address of the individual who completed the initial Marketplace purchase decision of the Solution, unless and until the Publisher designates another contact e-mail by written notice to AWSsome under this Article.
24.4 Receipt. A notice is deemed received on the earlier of (i) the date the sending server receives a successful transmission confirmation, or (ii) the first business day following the day itis sent, provided no delivery-failure message is returned.
24.5 Change of Address. Either Party may update its notice address by e-mail notice in accordance with this Article; the change is effective upon receipt.
These Terms supersede in their entirely any “marketplace purchase”, “click-through,” “shrink-wrap,” “browse-wrap” or similar terms that have not been specifically negotiated by the parties, including but not limited to any terms that may be surfaced when establishing a Publisher or User Account, whether before, on, or after the date of this agreement, will be effective to add to or modify these Terms, regardless of any party’s “acceptance” of those terms by electronic means.
1. Service Availability Level
AWSsome agrees to make the Solution available at least 99% of the time (‘Solution Availability’). The Solution Availability will be calculated monthly by applying the following formula: Solution Availability = [(Actual Availability divided by Total Scheduled Availability) multiplied by 100%]. with the following definitions: "Actual Availability" means Total Scheduled Availability (in minutes) less Interruptions (in minutes)."interruption" refers to the time when the solution is unavailable, meaning that users cannot access it. Any partial or temporary malfunction of the solution that does not change its basic functions, as well as any unavailability due to the following events or factors("Exclusions"), will not be considered an interruption: force majeure; the Publisher or any user using the solution in a way that goes against the terms or documentation; maintenance of the solution as defined in the terms; suspensions of access to the solution that are permitted by the terms; any unavailability caused by an event beyond AWSsome's control, such as the failure of a third party technology or the Publisher's or a third party's environment (e.g. Publisher's internet network) to function properly; any unavailability caused by the Publisher's data. "Solution Maintenance" means the time (in minutes) that the Solution is not available to Publisher due to maintenance of the Solution, including maintenance and upgrade operations of the Solution and third party solutions used by AWSsome to provide the Solution. Maintenance of the Solution includes scheduled maintenance and unscheduled emergency maintenance. To the extent possible, AWSsome will provide Publisher with reasonable written notice of any scheduled or emergency maintenance.
"Total Scheduled Availability" means 7 days a week, 24 hours a day in minutes.
2. SLA Credits
If the availability of the Solution ina given month is less than 99%, AWSsome will grant Publisher an SLA credit as defined in the table below:
SLA Credits are a percentage of themonthly price paid by the Publisher. AWSsome will apply the SLAcredits as a reduction to the Subscription Fees on the next invoice issued toPublisher. The SLA credits are Publisher's sole and exclusive remedy and AWSsome'ssole and exclusive liability for breach of the SLA.
These Support Terms and Conditions for technical support services (the "Support Terms") apply to support services offered by AWSsome in connection with the provision of the Solution under the AWSsome Terms of Sale and Use. Capitalized terms have the meaning given to them in the Terms.
The User may submit support requests by e-mail to support@AWSsome.io. To make a request for support, the user must provide diagnostic information necessary to process the request, such as a description of the problem, the Publisher's configuration and network, and any relevant Publisher data. The user may be asked to communicate (through chat or video) with AWSsome's support team to answer questions and assist with the request as needed. If necessary, AWSsome's support team and/or any authorized person may access Publisher data and/or impersonate the User to access the User's environment, but this access will be limited in time and used solely for the purpose of processing the request.
If AWSsome thinks a support request is actually a request for a new feature, it may redirect the request internally or ask the user to log the request with the product team for consideration to be added in a future update to the solution. AWSsome will provide support services while the terms are in effect and will not be required to provide support services after the terms expire or are terminated.
The Provider’s employees’ access to the Solution is protected by AWS IAM Identity Center SSO mechanism within the Provider’s AWS Organization, whereby AWS acts as a trusted third party regarding security alerts for potential login attempts to any of the Provider’s employee accounts. On the Publisher’s side, Users can access the platform through AWS IAM Identity Center Single-Sign On if they have an AWS account or federated identity. If preferred, AWSsome can issue an identifier and passwords through Amazon Cognito User Pools. When a User is inactive on the Solution fora certain period of time (two weeks), they are automatically logged out and must log back in using their username and password to access the Solution again. Passwords are stored encrypted with a 256-bit AES encryption algorithm managed by AWS KMS. Encryption keys are deployed in accordance with good IT security practices to prevent fraud or malicious attacks.
API Key Encryption Measurements and Encryption Key Management.
The Solution’s API keys are encrypted using AWS KMS. The corresponding encryption keys are generated and managed by AWS Key Management Service within the AWS environment. In accordance with good cryptographic practice, AWSsome prohibits extensive reuse of encryption keys and implements automatic key rotation through AWS KMS to generate new cryptographic material. In addition, access to encryption keys is strictly limited to developers who need access to the application in production. Access is limited (“need to know basis”) by implementing AWS IAM policies with mandatory justification request forms that individuals are asked to complete to prove that access is legitimate and secure, tracked through AWS CloudTrail for audit purposes.
Security at Subcontractors.
Prior to engaging Third-Party Contractors, AWSsome audits their security and privacy practices to ensure that they provide a level of security and privacy appropriate to their access to data and the scope of services they are asked to provide. Once AWSsome has assessed the risks presented by the Subcontractor, the Subcontractor is then, subject always to the requirements set forth in Section 18 of this TSA, required to commit to appropriate contractual terms and conditions for security, confidentiality and privacy.
This Data Processing Agreement (“DPA”) supplements AWSsome Terms & Conditions (the “Agreement”) entered into by and between the customer signing this DPA (“Customer” or “Publisher”) and AWSsome Inc. (“Company”). By executing the DPA in accordance with Section 11herein, Customer enters into this DPA on behalf of itself and, to the extent required under applicable Data Protection Laws (defined below), in the name and on behalf of its Affiliates (defined below), if any. This DPA incorporates the terms of the Agreement, and any terms not defined in this DPA shall have the meaning set forth in the Agreement.
1. Definitions
1.1. “Affiliate” means (i) an entity of which a party directly or indirectly owns fifty percent (50%) or more of the stock or other equity interest, (ii) an entity that owns at least fifty percent(50%) or more of the stock or other equity interest of a party, or (iii) an entity which is under common control with a party by having at least fifty percent (50%) or more of the stock or other equity interest of such entity and a party owned by the same person, but such entity shall only be deemed to be an Affiliate so long as such ownership exists.
1.2. “Authorized Sub-Processor” means a third-party who has a need to know or otherwise access Customer’s Personal Data to enable Company to perform its obligations under this DPA or the Agreement, and who is either (1) listed in Exhibit B or (2) subsequently authorized under Section 4.2 of this DPA.
1.3. “Company Account Data” means personal data that relates to Company’s relationship with Customer, including the names or contact information of individuals authorized by Customer to access Customer’s account and billing information of individuals that Customer has associated with its account. Company Account Data also includes any data Company may need to collect for the purpose of managing its relationship with Customer, identity verification, or as otherwise required by applicable laws and regulations.
1.4. “Company Usage Data” means Service usage data collected and processed by Company in connection with the provision of the Services, including without limitation data used to identify the source and destination of a communication, activity logs, and data used to optimize and maintain performance of the Services, and to investigate and prevent system abuse.
1.5. “Data Exporter” means Customer.
1.6. “Data Importer” means Company.
1.7. “Data Protection Laws” means any applicable laws and regulations in any relevant jurisdiction relating to the use or processing of Personal Data including: (i) the California Consumer Privacy Act (“CCPA”), (ii) the General Data Protection Regulation (Regulation(EU) 2016/679) (“EU GDPR”) and the EU GDPR as it forms part of the law of England and Wales by virtue of section 3 of the European Union (Withdrawal) Act2018 (the “UK GDPR”) (together, collectively, the “GDPR”), (iii) the Swiss Federal Act on Data Protection, ; (iv) the UK Data Protection Act 2018; and (v)the Privacy and Electronic Communications (EC Directive) Regulations 2003; in each case, as updated, amended or replaced from time to time. The terms “Data Subject”, “Personal Data”, “Personal Data Breach”, “processing”, “process or,” “controller,” and “supervisory authority” shall have the meanings set forth in the GDPR.
1.8. “EU SCCs” means the standard contractual clauses approved by the European Commission in Commission Decision2021/914 dated 4 June 2021, for transfers of personal data to countries not otherwise recognized as offering an adequate level of protection for personal data by the European Commission (as amended and updated from time to time), as modified by Section 6.2 of this DPA.
1.9. “ex-EEA Transfer” means the transfer of Personal Data, which is processed in accordance with the GDPR, from the Data Exporter to the Data Importer (or its premises) outside the European Economic
Area (the “EEA”), and such transfer is not governed by an adequacy decision made by the European Commission in accordance with the relevant provisions of the GDPR.
1.10. “ex-UK Transfer” means the transfer of Personal Data covered by Chapter V of the UK GDPR, which is processed in accordance with the UK GDPR and the Data Protection Act 2018, from the Data Exporter to the Data Importer (or its premises) outside United Kingdom (the “UK”), and such transfer is not governed by an adequacy decision made by the Secretary of State in accordance with the relevant provisions of the UK GDPR and the Data Protection Act 2018.
1.11. “Services” shall have the meaning set forth in the Agreement.
1.12. “Standard Contractual Clauses” means the EU SCCs and the UK SCCs.
1.13. “UK SCCs” means the EU SCCs, as amended by the UK Addendum.
2. Relationship of the Parties; Processing of Data
2.1. The parties acknowledge and agree that with regard to the processing of Personal Data, Customer may act either as a controller or processor and, except as expressly set forth in this DPA or the Agreement, Company is a processor. Customers shall, in its use of the Services, at all times process Personal Data, and provide instructions for the processing of Personal Data, in compliance with Data Protection Laws. Customer shall ensure that the processing of Personal Data in accordance with Customer’s instructions will not cause Company to be in breach of the Data Protection Laws. Customer is solely responsible for the accuracy, quality, and legality of (i) the Personal Data provided to Company by or on behalf of Customer, (ii) the means by which Customer acquired any such Personal Data, and (iii) the instructions it provides to Company regarding the processing of such Personal Data. Customer shall not provide or make available to Company any Personal Data in violation of the Agreement or otherwise inappropriate for the nature of the Services, and shall indemnify Company from all claims and losses in connection therewith.
2.2. Company shall not process Personal Data (i) for purposes other than those set forth in the Agreement and/or Exhibit A, (ii) in a manner inconsistent with the terms and conditions set forth in this DPA or any other documented instructions provided by Customer, including with regard to transfers of personal data to a third country or an international organization, unless required to do so by Supervisory Authority to which the Company is subject; in such a case, the Company shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest, or (iii) in violation of Data Protection Laws. Customer hereby instructs Company to process Personal Data in accordance with the foregoing and as part of any processing initiated by Customer in its use of the Services.
2.3. The subject matter, nature, purpose, and duration of this processing, as well as the types of Personal Data collected and categories of Data Subjects, are described in Exhibit A to this DPA.
2.4. Following completion of the Services, at Customer’s choice, Company shall return or delete Customer’s Personal Data, unless further storage of such Personal Data is required or authorized by applicable law. If return or destruction is impracticable or prohibited by law, rule or regulation, Company shall take measures to block such Personal Data from any further processing (except to the extent necessary for its continued hosting or processing required by law, rule or regulation) and shall continue to appropriately protect the Personal Data remaining in its possession, custody, or control. If Customer and Company have entered into Standard Contractual Clauses as described in Section 6 (Transfers of Personal Data), the parties agree that the certification of deletion of Personal Data that is described in Clause 8.1(d) and Clause8.5 of the EU SCCs (as applicable) shall be provided by Company to Customer only upon Customer’s request.
2.5. CCPA. Except with respect to Company Account Data and Company Usage Data, the parties acknowledge and agree that Company is a service provider for the purposes of the CCPA (to the extent it applies) and is receiving personal information from Customer in order to provide the Services pursuant to the Agreement, which constitutes a business purpose. Company shall not sell any such personal information. Company shall not retain, use or disclose any personal information provided by Customer pursuant to the Agreement except as necessary for the specific purpose of performing the Services for Customer pursuant to the Agreement, or otherwise as set forth in the Agreement or as permitted by the CCPA. The terms “personal information,” “service provider,” “sale,” and “sell” are as defined in Section 1798.140 of the CCPA. Company certifies that it understands the restrictions of this Section 2.5.
3. Confidentiality
3.1. Company shall ensure that any person it authorizes to process Personal Data has agreed to protect Personal Data in accordance with Company’s confidentiality obligations in the Agreement. Customer agrees that Company may disclose Personal Data to its advisers, auditors or other third parties as reasonably required in connection with the performance of its obligations under this DPA, the Agreement, or the provision of Services to Customer.
4. Authorized Sub-Processors
4.1. Customer acknowledges and agrees that Company may (1) engage its Affiliates as well as the Authorized Sub-Processors on the List (defined below) to access and process Personal Data in connection with the Services and (2) from time to time engage additional third parties for the purpose of providing the Services, including without limitation the processing of Personal Data. By way of this DPA, Customer provides general written authorization to the Company to engage sub-processors as necessary to perform the Services.
5. Company Sub processors. A list of Company’s current Authorized Sub-Processors (the “List”) is available to Customers per request.
Such List may be updated by Company from time to time. Company will provide a mechanism to subscribe to notifications (which may include but are not limited to email notifications) of new Authorized Sub-Processors and Customer, if it wishes, will subscribe to such notifications where available. If Customer does not subscribe to such notifications, Customer waives any right it may have to receive prior notice of changes to Authorized Sub-Processors. At least ten (10) days before enabling any third party other than existing Authorized Sub-Processors to access or participate in the processing of Personal Data, Company will add such third party to the List and notify subscribers, including Customer, via the aforementioned notifications. Customer may object to such an engagement by informing Company in writing within ten (10) days of receipt of the aforementioned notice by Customer, provided such objection is in writing and based on reasonable grounds relating to data protection. Customer acknowledges that certain sub-processors are essential to providing the Services and that objecting to the use of a sub-processor may prevent Company from offering the Services to Customer.
5.1. If Customer reasonably objects to an engagement in accordance with Section 4.2, and Company cannot provide a commercially reasonable alternative within a reasonable period of time, Customer may discontinue the use of the affected Service by providing written notice to Company. Discontinuation shall not relieve Customer of any fees owed to Company under the Agreement.
5.2. If Customer does not object to the engagement of a third party in accordance with Section 4.2 within ten (10) days of notice by Company, that third party will be deemed an Authorized Sub-Processor for the purposes of this DPA.
5.3. Company will enter into a written agreement with the Authorized Sub-Processor imposing on the Authorized Sub-Processor data protection obligations comparable to those imposed on Company under this DPA with respect to the protection of Personal Data. In case an Authorized Sub-Processor fails to fulfill its data protection obligations under such written agreement with Company, Company will remain liable to Customer for the performance of the Authorized Sub-Processor’s obligations under such agreement.
5.4. If Customer and Company have entered into Standard Contractual Clauses as described in Section 6 (Transfers of Personal Data), (i) the above authorizations will constitute Customer’s prior written consent to the subcontracting by Company of the processing of Personal Data if such consent is required under the Standard Contractual Clauses, and(ii) the parties agree that the copies of the agreements with Authorized Sub-Processors that must be provided by Company to Customer pursuant to Clause9(c) of the EU SCCs may have commercial information, or information unrelated to the Standard Contractual Clauses or their equivalent, removed by the Company beforehand, and that such copies will be provided by the Company only upon request by Customer.
6. Security of Personal Data.
6.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Company shall maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing Personal Data. Exhibit C sets forth additional information about Company’s technical and organizational security measures.
7. Transfers of Personal Data
7.1. The parties agree that the Company may transfer Personal Data processed under this DPA outside the EEA, the UK, or Switzerland as necessary to provide the Services. Customer acknowledges that Company’s processing operations take place in the geographic region automatically selected by the Company’s cloud provider (Microsoft Azure, Amazon Web Services, or Google Cloud Platform) based on data-subject proximity or as otherwise chosen by Customer. The selected region may be located in the EEA, United Kingdom, United States, Canada, Asia-Pacific (e.g., Singapore, Australia, Japan, India, South Korea), Latin America (e.g., Brazil), or the Middle East & Africa (e.g., United Arab Emirates, South Africa). Transfers to regions outside the EEA/UK/Switzerland shall occur only in accordance with this Section 6. If Company transfers Personal Data protected under this DPA toa jurisdiction for which the European Commission has not issued an adequacy decision, Company will ensure that appropriate safeguards have been implemented for the transfer of Personal Data in accordance with Data Protection Laws.
7.2. Ex-EEA Transfers. The parties agree that ex-EEA Transfers are made pursuant to the EU SCCs, which are deemed entered into (and incorporated into this DPA by this reference) and completed as follows:
7.2.1. Module One (Controller to Controller) of the EU SCCs apply when Company is processing Personal Data as a controller pursuant to Section 9 of this DPA.
7.2.2. Module Two (Controller to Processor)of the EU SCCs apply when Customer is a controller and Company is processing Personal Data for Customer as a processor pursuant to Section 2 of this DPA.
7.2.3. Module Three (Processor to Sub-Processor) of the EU SCCs apply when Customer is a processor and Company is processing Personal Data on behalf of Customer as a sub-processor.
7.3. For each module, where applicable the following applies:
7.3.1. The optional docking clause in Clause7 does not apply.
7.3.2. In Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of sub-processor changes shall be as set forth in Section 4.2 of this DPA;
7.3.3. In Clause 11, the optional language does not apply;
7.3.4. All square brackets in Clause 13 are hereby removed;
7.3.5. In Clause 17 (Option 1), the EU SCCs will be governed by French law.
7.3.6. In Clause 18(b), disputes will be resolved before the courts of France;
7.3.7. Exhibit B to this DPA contains the information required in Annex I and Annex III of the EU SCCs;
7.3.8. Exhibit C to this DPA contains the information required in Annex II of the EU SCCs; and
7.3.9. By entering into this DPA, the parties are deemed to have signed the EU SCCs incorporated herein, including their Annexes.
7.4. Ex-UK Transfers. The parties agree that ex-UK Transfers are made pursuant to the UK SCCs, which are deemed entered into and incorporated into this DPA by reference, and amended and completed in accordance with the UK Addendum, which is incorporated herein as Exhibit D of this DPA.
7.5. Transfers from Switzerland. The parties agree that transfers from Switzerland are made pursuant to the EU SCCs with the following modifications:
7.5.1. The terms “General Data Protection Regulation” or “Regulation (EU) 2016/679” as utilized in the EU SCCs shall be interpreted to include the Federal Act on Data Protection of 19 June 1992 (the “FADP,” and as revised as of 25 September 2020, the “Revised FADP”) with respect to data transfers subject to the FADP.
7.5.2. The terms of the EU SCCs shall be interpreted to protect the data of legal entities until the effective date of the Revised FADP.
7.5.3. Clause 13 of the EU SCCs is modified to provide that the Federal Data Protection and Information Commissioner(“FDPIC”) of Switzerland shall have authority over data transfers governed by the FADP and the appropriate EU supervisory authority shall have authority over data transfers governed by the GDPR. Subject to the foregoing, all other requirements of Section 13 shall be observed.
7.5.4. The term “EU Member State” as utilized in the EU SCCs shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs.
7.6. Supplementary Measures. In respect of any ex-EEA Transfer or ex-UK Transfer, the following supplementary measures shall apply:
7.6.1. As of the date of this DPA, the Data Importer has not received any formal legal requests from any government intelligence or security service/agencies in the country to which the Personal Data is being exported, for access to (or for copies of) Customer’s Personal Data (“Government Agency Requests”);
7.6.2. If, after the date of this DPA, the Data Importer receives any Government Agency Requests, the Company shall attempt to redirect the law enforcement or government agency to request that data directly from the Customer. As part of this effort, Company may provide Customer’s basic contact information to the government agency. If compelled to disclose Customer’s Personal Data to a law enforcement or government agency, Company shall give Customer reasonable notice of the demand and cooperate to allow Customer to seek a protective order or other appropriate remedy unless Company is legally prohibited from doing so. Company shall not voluntarily disclose Personal Data to any law enforcement or government agency. Data Exporter and Data Importer shall (as soon as reasonably practicable) discuss and determine whether all or any transfers of Personal Data pursuant to this DPA should be suspended in the light of the such Government Agency Requests; and
7.6.3. The Data Exporter and Data Importer will meet as needed to consider whether:
7.6.3.1. the protection afforded by the laws of the country of the Data Importer to data subjects whose Personal Data is being transferred is sufficient to provide broadly equivalent protection to that afforded in the EEA or the UK, whichever the case may be;
7.6.3.2. additional measures are reasonably necessary to enable the transfer to be compliant with the Data Protection Laws; and
7.6.3.3. it is still appropriate for Personal Data to be transferred to the relevant Data Importer, taking into account all relevant information available to the parties, together with guidance provided by the supervisory authorities.
7.6.4. If Data Protection Laws require the Data Exporter to execute the Standard Contractual Clauses applicable to a particular transfer of Personal Data to a Data Importer as a separate agreement, the Data Importer shall, on request of the Data Exporter, promptly execute such Standard Contractual Clauses incorporating such amendments as may reasonably be required by the Data Exporter to reflect the applicable appendices and annexes, the details of the transfer and the requirements of the relevant Data Protection Laws.
7.6.5. If either (i) any of the means of legitimizing transfers of Personal Data outside of the EEA or UK set forth in this DPA cease to be valid or (ii) any supervisory authority requires transfers of Personal Data pursuant to those means to be suspended, then Data Importer may by notice to the Data Exporter, with effect from the date set out in such notice, amend or put in place alternative arrangements in respect of such transfers, as required by Data Protection Laws.
8. Rights of Data Subjects
8.1. Company shall, to the extent permitted by law, notify Customer upon receipt of a request by a Data Subject to exercise the Data Subject’s right of: access, rectification, erasure, data portability, restriction or cessation of processing, withdrawal of consent to processing, and/or objection to being subject to processing that constitutes automated decision-making (such requests individually and collectively “Data Subject Request(s)”). If Company receives a Data Subject Request in relation to Customer’s data, Company will advise the Data Subject to submit their request to Customer and Customer will be responsible for responding to such request, including, where necessary, by using the functionality of the Services. Customer is solely responsible for ensuring that Data Subject Requests for erasure, restriction or cessation of processing, or withdrawal of consent to processing of any Personal Data are communicated to Company, and, if applicable, for ensuring that a record of consent to processing is maintained with respect to each Data Subject.
8.2. Company shall, at the request of the Customer, and taking into account the nature of the processing applicable to any Data Subject Request, apply appropriate technical and organizational measures to assist Customer in complying with Customer’s obligation to respond to such Data Subject Request and/or in demonstrating such compliance, where possible, provided that (i) Customer is itself unable to respond without Company’s assistance and (ii) Company is able to do so in accordance with all applicable laws, rules, and regulations. Customers shall be responsible to the extent legally permitted for any costs and expenses arising from any such assistance by Company.
9. Actions and Access Requests; Audits
9.1. Company shall, taking into account the nature of the processing and the information available to Company, provide Customer with reasonable cooperation and assistance where necessary for Customer to comply with its obligations under the GDPR to conduct a data protection impact assessment and/or to demonstrate such compliance, provided that Customer does not otherwise have access to the relevant information. Customers shall be responsible to the extent legally permitted for any costs and expenses arising from any such assistance by the Company.
9.2. Company shall, taking into account the nature of the processing and the information available to Company, provide Customer with reasonable cooperation and assistance with respect to Customer’s cooperation and/or prior consultation with any Supervisory Authority, where necessary and where required by the GDPR. Customers shall be responsible to the extent legally permitted for any costs and expenses arising from any such assistance by Company.
9.3. Company shall maintain records sufficient to demonstrate its compliance with its obligations under this DPA, and retain such records for a period of three (3) years after the termination of the Agreement. Customer shall, with reasonable notice to Company, have the right to review, audit and copy such records at Company’s offices during regular business hours.
9.4. Upon Customer’s written request at reasonable intervals, and subject to reasonable confidentiality controls, Company shall, either (i) make available for Customer’s review copies of certifications or reports demonstrating Company’s compliance with prevailing data security standards applicable to the processing of Customer’s Personal Data, or (ii) if the provision of reports or certifications pursuant to (i) is not reasonably sufficient under Data Protection Laws, allow Customer’s independent third party representative to conduct an audit or inspection of Company’s data security infrastructure and procedures that is sufficient to demonstrate Company’s compliance with its obligations under Data Protection Laws, provided that (a) Customer provides reasonable prior written notice of any such request for an audit and such inspection shall not be unreasonably disruptive to Company’s business; (b) such audit shall only be performed during business hours and occur no more than once per calendar year; and (c) such audit shall be restricted to data relevant to Customer. Customer shall be responsible for the costs of any such audits or inspections, including without limitation a reimbursement to Company for any time expended for on-site audits. If Customer and Company have entered into Standard Contractual Clauses as described in Section 6 (Transfers of Personal Data), the parties agree that the audits described in Clause 8.9 of the EU SCCs shall be carried out in accordance with this Section 8.4.
9.5. Company shall immediately notify Customer if an instruction, in the Company’s opinion, infringes the Data Protection Laws or Supervisory Authority.
9.6. In the event of a Personal Data Breach, Company shall inform Customer without undue delay and, in any event, within seventy-two (72) hours after becoming aware of the breach. Company will take all steps it deems necessary and reasonable to remedy or mitigate the breach, to the extent remediation is within Company’s reasonable control.
9.7. In the event of a Personal Data Breach, Company shall, taking into account the nature of the processing and the information available to Company, provide Customer with reasonable cooperation and assistance necessary for Customer to comply with its obligations under the GDPR with respect to notifying (i) the relevant Supervisory Authority and (ii)Data Subjects affected by such Personal Data Breach without undue delay.
9.8. The obligations described in Sections8.6 and 8.7 shall not apply in the event that a Personal Data Breach results from the actions or omissions of Customer. Company’s obligation to report correspond to a Personal Data Breach under Sections 8.6 and 8.7 will not be construed as an acknowledgement by Company of any fault or liability with respect to the Personal Data Breach.
10. Company’s Role as a Controller. The parties acknowledge and agree that with respect to Company Account Data and Company Usage Data, Company is an independent controller, not a joint controller with Customer. Company will process Company Account Data and Company Usage Data as a controller (i) to manage the relationship with Customer; (ii) to carry out Company’s core business operations, such as accounting, audits, tax preparation and filing and compliance purposes; (iii) to monitor, investigate, prevent and detect fraud, security incidents and other misuse of the Services, and to prevent harm to Customer; (iv) for identity verification purposes; (v) to comply with legal or regulatory obligations applicable to the processing and retention of Personal Data to which Company is subject; and (vi) as otherwise permitted under Data Protection Laws and in accordance with this DPA and the Agreement. Company may also process Company Usage Data as a controller to provide, optimize, and maintain the Services, to the extent permitted by Data Protection Laws. Any processing by the Company as a controller shall be in accordance with the Company’s privacy policy set forth at www.AWSsome.io/privacypolicy.
11. Conflict. In the event of any conflict or inconsistency among the following documents, the order of precedence will be:(1) the applicable terms in the Standard Contractual Clauses; (2) the terms of this DPA; (3) the Agreement; and (4) the Company’s privacy policy. Any claims brought in connection with this DPA will be subject to the terms and conditions, including, but not limited to, the exclusions and limitations set forth in the Agreement.
12. Execution of this DPA. Company has pre-signed this DPA, in the signature block below and in each of the main body, and Exhibit B (as the “data importer”). To complete this DPA, Customer must: (i) complete the information requested in the signature block below and sign there, (ii) complete the information requested of the “data exporter” on Exhibits B, and (iii) send the completed and signed Agreement to Company by email to legal@AWSsome.io Upon receipt of the validly completed Agreement by Company at this email address, this DPA will become legally binding.
Details of Processing
Nature and Purpose of Processing
AWSsome (AWSsome Inc) processes Customer Personal Data only to operate the AWSsome marketplace and fulfil Marketplace orders, strictly as instructed by Customer/Publisher. Processing activities include:
Processing activities include, without limitation:
Duration of Processing
For the life of the Agreement plus any retention required by law or documented by Customer. AWSsome’s retention periods for Account Data and Usage Data appear in its Privacy Policy.
Categories of Data Subjects
Categories of Personal Data
Publisher account data (very low-sensitivity)
– Company name
– Work email address of each authorised User
End-customer order data (minimal)
– Email address (mandatory, provided via AWS IAM Identity Center)
– Name and surname (optional, if Publisher collects it)
– Role / job title (optional)
– Phone number (optional)
Sensitive or Special-Category Data
Customer is prohibited from submitting special-category data (GDPR Art. 9) or sensitive personal data (including criminal-history data) to AWSsome.
EU Standard Contractual Clauses & UK Addendum Information
1. The Parties
Data exporter(s) (Controller)
Name: Customer or Publisher legal name as shown on the Marketplace Order or Purchase.
Trading name(if different): Customer trading name, if any
Address: Customer address from the Order Form, or Marketplace Billing Profile.
Official registration number (if any): [Customer company/VAT number, if any]
Contact person: [Name, position and email from the Order Form]
Activities relevant to the transfer: see Section 2 of the DPA.
Role: Controller
Execution: Accepted electronically when Customer clicks “I agree” to the Terms.
Data importer(s) (Processor)
Name: AWSsome Inc
Trading name: AWSsome
Address in EU (EU, UK and rest of the world): Maassluisstraat 47, Amsterdam, 1062GA Netherlands.
Address in US (US customers): 131 Continental Dr, Suite 305, Newark, DE 19713, United States.
Contact email: legal@AWSsome.io
Official registration number: 32-0791600 (USEIN)
Activities relevant to the transfer: see Section 2 of the DPA.
Role: Processor (or Sub-processor where Customer itself is a Processor)
Execution: AWSsome accepts these Clauses by publishing the Terms and this DPA.
Electronic execution. The parties agree that acceptance of the Agreement through a click-wrap mechanism or marketplace purchase constitutes a valid signature for the purposes of the EU Standard Contractual Clauses and the UK Addendum.
2. Description of the Transfer
3. Competent Supervisory Authority
For the EUSCCs: the supervisory authority of the Customer (data exporter) in accordance with Clause 13.
For the UK Addendum: the UK Information Commissioner’s Office (ICO).
This policy
This privacy policy applies to the AWSsome website, the AWSsome SaaS application and any related products or services(“Solution”).
Hosting
AWSsome runs on leading cloud services.
The application is deployed on Microsoft Azure, Amazon Web Services or Google Cloud Platform when needed. Data is stored in the public cloud region that is automatically chosen for lowest latency; regions can be in the EEA, United Kingdom, United States, Canada, Asia-Pacific, Latin America, the Middle East or Africa.
All providers offer high availability, built-in disaster recovery and ISO/IEC 27001-certified data-centres.
Encryption
Every byte is encrypted in transit and at rest with service-managed keys.
Back-ups are held in a separate availability zone in the same geography.
Authentication
Sign-in uses AWS IAM Identity Center Single Sign-On when the customer has an AWS Organization with federatedidentity configured.
Where SSO is not available, AWSsome issues its own credentials. Passwords are stored using industry‑standard salted hashing algorithms.
Protection of personal data
AWSsome is controller for account, billing and security data, and processor for any “Publisher Data” you upload.
The rules for processor work are setout in the Data Processing Agreement.
Data (what we handle is low-sensitivity):
Publisher account data: company name, authorised-user work email, authorized-user name and surname.
Marketplace order data: end-customer email (mandatory), name (optional), role (optional), phone (optional). Defined by the Publisher.
Publishers must not upload special-category or criminal-history data.
Sub-processors
All sub-processors are vetted, bound by GDPR-level contracts.
International transfers
When data leaves the EEA or UK, AWSsome relies on:
EU Standard Contractual Clauses and the UK Addendum; and the EU-US Data Privacy Framework, where the recipient is self-certified.
Retention
Active accounts – data kept while the contract is active.
Customer-closed – data deleted 30 days after closure.
Suspended – data deleted 120 days from suspension.
Back-ups – 30-day rolling window.
Billing/tax – contract term + 6 years.
Security logs – 12 months.
Support tickets – contract term + 24months.
After these periods data is deleted or fully anonymised.
Security & certifications
AWSsome maintains an ISO/IEC27001-certified ISMS.
Since 31 August 2025 we also hold a SOC 2 Type 2 attestation covering Security, Confidentiality and Availability.
Key controls include SSO, least-privilege access, encryption, network segmentation, 24 × 7 monitoring and tested incident-response plans.
Our most recent SOC 2 Type 2report and ISO 27001 certificate are available to customers under NDA.
Your rights
You may, under applicable law, ask to access, correct, delete, restrict or port your Personal Data, or object to our processing.
Send requests to legal@AWSsome.io. We may verify identity before action.
Incident notification
If a breach affects Publisher Data while we act as processor, we will inform the Publisher without undue delay as required by the DPA.
If we act as controller, we will notify the CNIL and, where required, affected persons.
Children
The Solution targets business users only. We do not knowingly collect data from minors.
Changes
Material changes will be announced in-app or by email 30 days before they take effect. Continued use after that date means acceptance.
Contact
Email: legal@AWSsome.io
Post: AWSsome, Maassluisstraat 47,Amsterdam, 1062GA Netherlands.