DATA PROCESSING AGREEMENT

This data processing agreement (“DPA”) applies where it is expressly incorporated into or referenced by: (a) an Agreement; or (b) a Partner Agreement.

AGREED TERMS

1   Definitions, Interpretation, and Application

1.1   The definitions and rules of interpretation in this Clause 1 apply in this DPA (unless the context requires otherwise).

1.2   For the purposes of this DPA:

“Adequacy Decision” means a formal decision made by the European Commission, the United Kingdom (“UK”) government, or applicable government authority, which recognises that another country, territory, sector or international organisation provides an equivalent level of protection for personal data;

“Affiliate” means any entity that directly or indirectly, through one or more intermediaries, controls, or is controlled by, or is under common control by the Parties or their respective successors. Affiliates shall include such entities whether now existing or later established by investment, merger or otherwise, including the successors and assigns of such entities;

“Agreement” means a written agreement between VikingCloud and a Client for the provision of Services;

“ANPD” means the Brazilian National Data Protection Authority (the Autoridade Nacional de Proteção de Dados);

“APA” means the Australian Privacy Act 1988;

“APIPA” means the Albertan Personal Information Protection Act 2003;

“BCPIPA” means the British Columbian Personal Information Protection Act 2003;

“Brazilian LGPD” means Brazil Law No. 13,709, the General Law on Protection of Personal Data, as amended;

“CCPA” means the California Consumer Privacy Act 2018, as amended by the California Privacy Rights Act of 2020 or “CPRA”, along with all rules issued by the California Privacy Protection Agency;

“Client” means the party to whom VikingCloud provides the Services, being either: (a) a party subject to an agreement with VikingCloud in respect of the Services; or (b) a party subject to a Partner Agreement in respect of the Services.

“Controller to Controller Clauses” means the Standard Contractual Clauses that apply to Controller to Controller transfers and to which the Module One elements of the Standard Contractual Clauses apply;

“Controller to Processor Clauses” means the Standard Contractual Clauses that apply to Controller to Processor transfers and to which the Module Two elements of the Standard Contractual Clauses apply;

“Cross Border Transfer Restrictions” means the applicable Data Protection Legislation which restrict the cross border transfer of personal data, including, but not limited to, EU Data Protection Law, the Brazilian LGPD, and the South African POPIA, and which require an International Data Transfer Mechanism;

“Data Protection Legislation” means European Data Protection Law, APA, APIPA, BCPIPA, the Brazilian LGPD, CCPA, PIPEDA, QARPPIS, the South African POPIA and, any and all data protection and privacy laws applicable to the processing of personal data under or in connection with the Services;

“Effective Date” means: (a) the date of the Agreement, or (b) the date of the Partner Agreement; as applicable;

“European Data Protection Law” means all data protection laws and regulations applicable to Europe, including the GDPR, the UK GDPR and the Swiss FDPA;

“GDPR” means the General Data Protection Regulation (EU) 2016/679;

“International Data Transfer Addendum” means, in case of transfers outside the UK which require an International Data Transfer Mechanism, the international data transfer addendum to the Standard Contractual Clauses, as outlined in Schedule 3 to this DPA, for the transfer of personal data to controllers or processors established in third countries which do not ensure an adequate level of protection as set out by the UK’s ICO, in each case as updated, amended, replaced or superseded from time to time;

“International Data Transfer Mechanism” means a specific transfer mechanism required when transferring personal data to a recipient in another jurisdiction, where the law in that jurisdiction does not protect personal data in a manner equivalent to the transferring entity’s jurisdiction, for example, the Standard Contractual Clauses;

“Irish DPC” means the Irish Data Protection Commission;

“IRSA” means the Information Regulator (South Africa);

“Partner Agreement” means a written agreement between a VikingCloud Partner and the Client under which the Services are provided to the Client.

“Party” means each of VikingCloud and the Client, and “Parties” means both of them.

“PIPEDA” means the Canadian Personal Information Protection and Electronic Documents Act 2000;

“Processor to Processor Clauses” means the Standard Contractual Clauses that apply to Processor to Processor transfers and to which the Module Three elements of the Standard Contractual Clauses apply;

“Public Authority” means a government agency or law enforcement authority, including judicial authorities;

“QARPPIS” means the Quebecois Act Respecting the Protection of Personal Information in the Private Sector 1993 as amended;

“Security Breach” means the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the Services Personal Data;

“Services” means the services provided by VikingCloud that are supplied to the Client under: (a) the Agreement; or (b) the Partner Agreement; as applicable;

“Services Personal Data” means the personal data processed by VikingCloud, in accordance with the Client’s instructions, in order to deliver the Services, including the personal data set out in Schedule 1;

“South African POPIA” means the Protection of Personal Information Act 2013 (South Africa);

“Standard Contractual Clauses” or “SCCs” means the Standard Contractual Clauses for the transfer of personal data from the European Economic Area (“EEA”) to third countries, pursuant to Regulation (EU) 2016/679 of the European Parliament and the Council approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as currently set out at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.;

“Sub-Processor” means any processor engaged by VikingCloud, to provide some or all of the Services. Sub-Processors may include third parties or VikingCloud Affiliates;

“Supervisory Authority” means a regulator, government department of other judicial or regulatory body with powers under the Data Protection Legislation.

“Swiss FDPA” means the Federal Act on Data Protection of 25 September 2020 (Switzerland);

“Third Party / Third Parties” means any third party to whom personal data is disclosed, under or in connection with the Services;

“UK GDPR” means the GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 and all associated laws, including applicable secondary legislation made under that Act and the UK Data Protection Act 2018;

“UK ICO” means the UK Information Commissioner’s Office;

“VikingCloud Partner” means a third party that has entered into an agreement with VikingCloud authorising such third party to resell, supply, or otherwise make available the Services to its own customers.

1.3   “controller”, “data subject”, “personal data”, “processing”, “processor” and “supervisory authority” shall have the meanings given to those terms in the GDPR, and where applicable, terms which are broadly equivalent to these as provided for by any other applicable Data Protection Legislation (for example, where CCPA is applicable, ‘controller’ shall be interpreted as ‘business’, ‘processor’ as ‘service provider’, ‘data subject’ as ‘consumer’ and 'personal data’ as ‘personal information’).

1.4   A reference to this DPA includes its schedules.

1.5   Words in the singular include the plural and vice versa.

1.6   Any words that follow ‘include’, ‘includes’, ‘including’, ‘in particular’ or any similar words and expressions shall be construed without limitation.

1.7   Clause, schedule or other headings in this DPA are included for convenience only and shall have no effect on the interpretation of this DPA.

1.8   A reference to any statute, statutory provision, rule, regulation or any requirement shall be construed as including references to it as modified, consolidated, re-enacted or superseded from time to time and shall include all subordinate legislation made from time to time under that statute or statutory provision.

1.9   A reference to any regulator or regulatory board shall include a reference to any replacement or successor bodies from time to time.

1.10   Where the Services are provided under an Agreement, this DPA supplements and forms part of the Agreement, and all of the terms and conditions of the Agreement apply to this DPA, provided that in the case of conflict or ambiguity between: (a) the terms of this DPA and the terms of the Agreement relating to data processing, the terms of this DPA shall prevail; (b) the terms of any provision contained in the main body of this DPA and, to the extent applicable, the terms of any Standard Contractual Clauses entered into between the Parties, the provisions of the Standard Contractual Clauses shall prevail.

1.11   Where the Services are supplied under a Partner Agreement, this DPA takes effect as a separate agreement between VikingCloud and the Client, accepted by the Client on the earlier of: (a) the date the Client enters into a Partner Agreement that incorporates or references this DPA; and (b) the date the Client first receives or uses the Services. VikingCloud Partner is not a party to this DPA, and no term of a Partner Agreement varies this DPA or imposes any obligation on VikingCloud.

1.12   Where the Services are provided to the Client under more than one Agreement (or Partner Agreement, as applicable), this DPA applies separately in respect of each, and references to the Agreement (or the Partner Agreement, as applicable) are to the one under which the processing in question is carried out.

2   Roles and Responsibilities

2.1   Controllers. The Parties accept that both Parties will, at times, act as independent controllers. The controller is responsible for the accuracy of personal data and the legality of the means by which it acquires personal data.

(a)  VikingCloud as Controller. In certain situations, VikingCloud may act as a controller in respect of personal data processed in connection with the Services. This includes, but is not limited to, administration or billing purposes, and purposes incidental to the provision of the Services.

(b)  Client as Controller.

(i)  The Client shall be the controller (or processor where the Client processes personal data on behalf of its own customers) in respect of Services Personal Data processed by VikingCloud under this DPA. The Client will ensure that its instructions to process personal data comply with all applicable Data Protection Legislation and is responsible for the accuracy and quality of the Services Personal Data provided to VikingCloud.

(ii)  The Client may also act as controller when processing personal data provided by VikingCloud’s representatives to facilitate the Services, this includes screening / vetting information relating to VikingCloud personnel, where the Client has an agreed requirement for, and / or a legal basis to conduct screening (in addition to the screening VikingCloud already conducts). VikingCloud consultant’s personal data will not be held for more than three (3) months after each consultant’s direct involvement with a Client has ceased, unless the Client informs VikingCloud of any legal obligations which require the retention of this personal data. The client agrees that this data will not be used for any other purposes and that the data will only be shared with relevant colleagues and third parties on a strict need to know basis and ensure such parties are party to confidentiality obligations in respect of the personal data.

(c)  Responsibilities of the Parties as Controllers.

Each Party shall:

(i)  determine the lawful basis(es) along with the purpose for and the means by which personal data is processed and / or transferred; and

(ii)  ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

(d)  Cooperation and assistance.

Each Party shall cooperate and provide assistance to the other Party in order to comply with all applicable requirements of the Data Protection Legislation. In particular, each Party shall, as relevant:

(i)  promptly inform the other upon receipt of any data subject rights requests;

(ii)  provide the other with reasonable assistance in complying with any data subject rights requests; and

(iii)  at the cost of the requesting Party, provide any other assistance to facilitate compliance with the Data Protection Legislation with respect to security, personal data breach notifications, data protection impact assessments and consultations with supervisory authorities or regulators.

2.2   Third Parties.

(a)  Third Party provider as controller. Certain VikingCloud Services use tools and services from Third Party providers, where the Third Party processes personal data as an independent controller, Client acknowledges and agrees that: (i) the Third Party’s processing activities shall be governed by its own privacy notice; (ii) VikingCloud shall not be responsible for, nor exercise control over, the Third Party’s processing activities undertaken in its capacity as an independent controller; and (iii) the Third Party will be independently responsible for compliance with its obligations as controller.

For the avoidance of doubt, a Third Party’s status as a processor to VikingCloud for certain processing activities shall not prevent that Third Party from acting as an independent controller in relation to separate processing activities where it determines the purposes and means of such processing. A list of Third Parties as controllers can be found here https://www.vikingcloud.com/subprocessors , any changes to this list will be notified to the Client in advance in accordance with the notification process set out in clause 4.1(a).

(b)  Third Party partner. Where Client purchases services through a VikingCloud Partner, , and / or where Client otherwise requests or authorises VikingCloud to provide a Third Party (including a VikingCloud Partner) with access to Services Personal Data, Client acknowledges and agrees that such Third Party’s processing or further use of the Services Personal Data is not covered by this DPA. Any such processing or further use shall be governed by a separate agreement between Client and relevant Third Party. VikingCloud shall not be responsible for the Third Party’s processing or use of Services Personal Data except to the extent expressly agreed between VikingCloud and the Client or otherwise required by applicable Data Protection Legislation.

2.3   Processor. In respect of any Services Personal Data processed by VikingCloud under this DPA, the Parties acknowledge that the Client shall be the controller or primary processor (as applicable) and VikingCloud shall be a processor (or sub-processor).

To the extent that VikingCloud processes Services Personal Data, as a processor or sub-processor, pursuant to this DPA, VikingCloud shall:

(a)  process the Services Personal Data only for the permitted purpose(s) set forth in the Agreement and / or as necessary to provide the Services and in accordance with instructions from the Client, or where otherwise expressly permitted under the Data Protection Legislation. VikingCloud shall notify the Client of such legal requirement before such processing occurs or is permitted, unless that law prohibits such notification on grounds of public interest;

(b)  implement and at all times maintain appropriate technical and organizational measures to ensure the security of the Services Personal Data taking into account: (i) the state of the art; (ii) the costs of implementation; (iii) the nature, scope, context and purposes of the processing; and (iv) the inherent risk of the processing activities to data subjects;

(c)  immediately notify the Client if an instruction is believed to breach applicable Data Protection Legislation or otherwise notify the Client if it is unable to meet its obligations under the Data Protection Legislation. Notwithstanding the foregoing, VikingCloud shall have no obligation to proactively review the lawfulness of any instruction received from Client;

(d)  grant the Client the right to take reasonable and appropriate steps as required by the applicable Data Protection Legislation, to ensure that VikingCloud’s use of Services Personal Data is consistent with its privacy and security obligations under the Data Protection Legislation;

(e)  not sell or share Services Personal Data (“sell” or “share” are as defined by the CCPA);

(f)  ensure that all personnel authorized to process the Services Personal Data are party to confidentiality obligations in respect of the personal data;

(g)  taking into account the nature of processing and the information available to VikingCloud, co-operate as reasonably requested by the Client and as required by the applicable Data Protection legislation: (i) to enable the Client to comply with any exercise of rights by a data subject under the Data Protection Legislation in respect of personal data; (ii) to determine reasonable and appropriate steps to stop and remediate unauthorised use; (iii) where the Client conducts a data protection impact assessment (or similar assessment) including any prior consultation with regulators; and (iv) assist Client in taking any actions deemed reasonably necessary or appropriate to deal with complaints or allegations in connection with a failure to comply with the Data Protection Legislation.

(h)  notify the Client if VikingCloud receives a request from a data subject to exercise any of their rights under the Data Protection Legislation. VikingCloud shall not respond directly to such data subject but will provide reasonable assistance in accordance with 2.3(g)(i);

(i)  notify the Client, without undue delay, of any Security Breach and provide reasonable assistance with assessing the nature and impact of the Security Breach in order to support the Client with meeting mandatory breach notifications.

3   International Transfers

3.1   The Client hereby agrees to the transfer of Services Personal Data processed under this DPA from a territory with Cross Border Transfer Restrictions PROVIDED that in effecting any such transfer of Services Personal Data, VikingCloud shall ensure that: (a) it has authorization in accordance with clause 4; and (b) it has appropriate safeguards in place in relation to the transfer, which may include an International Data Transfer Mechanism.

3.2   The following provisions shall apply to the extent that Services Personal Data is subject to the applicable Data Protection Legislation of the relevant territories below:

(a)  The EEA. For transfers of Services Personal Data to a third country for which an Adequacy Decision has not been adopted, nor is an alternative appropriate safeguard in place, the Standard Contractual Clauses shall apply in addition to this DPA. The SCCs, pursuant to this Clause 3.2(a), shall be structured as follows:

(i)  Module Two (Controller to Processor Clauses) terms shall apply, and where the Client acts as a Processor, Module Three (Processor to Processor Clauses) terms shall also apply;

(ii)  Clause 7 – shall be deleted in its entirety and the Parties acknowledge that they may add additional entities to this DPA by executing an additional DPA;

(iii)  Clause 9 – Option 2 shall apply, and the time period shall be 14 days prior to the engagement of the Sub-Processor (as detailed in Clause 4.1 of this DPA);

(iv)  Clause 11(a) - The optional language shall not apply;

(v)  Clause 13(a)- Supervision. Clause 13 shall apply as follows: The Irish DPC shall be the competent supervisory authority for transfers from the EEA;

(vi)  Clause 17 - Option 1 shall apply, the Standard Contractual Clauses will be governed by the laws of Ireland for transfers from the EEA; and

(vii)  Clause 18(b) - the exclusive jurisdiction of the Irish courts shall apply for transfers from the EEA.

(b)  Switzerland. For transfers of Services Personal Data, the applicable Standard Contractual Clauses, as referred to in Clause 3.2(a), shall be modified as follows:

(i)  references to “Regulation (EU) 2016/679” shall be interpreted as references to the Swiss FADP;

(ii)  references to “EU”, “Union”, and “Member State” shall be amended to include Switzerland;

(iii)  references to the “competent supervisory authority” and “competent courts” shall be interpreted as references to the “Swiss Federal Data Protection and Information Commissioner” and the “competent Swiss courts”;

(iv)  the term “member state” as used in the Standard Contractual Clauses shall not be interpreted in a way that would preclude data subjects in Switzerland from exercising their rights at their place of habitual residence; and

(v)  the Standard Contractual Clauses shall be governed by the laws of Switzerland and disputes shall be resolved before the Swiss courts having appropriate jurisdiction.

(c)  UK. For transfers of Services Personal Data to a country for which the UK ICO has not adopted an Adequacy Decision, the Parties will supplement the applicable Standard Contractual Clauses, as referred to in Clause 3.2(a), with the International Data Transfer Addendum. The details of transfer required under the International Data Transfer Addendum are outlined in Schedule 3 to this DPA.

(d)  Brazil / South Africa. For transfers of Services Personal Data subject to Brazilian LGPD and South African POPIA:

(i)  to a third country for which the relevant transferring country has not adopted an Adequacy Decision, the Parties hereby agree to enter into the Controller to Processor Clauses and / or the Processor to Processor Clauses, as applicable;

(ii)  where applicable, VikingCloud will (1) provide its Services under the express obligations imposed by the LGPD and / or POPIA on a data processor; and (2) as required under Articles 33 through 36 of the LGPD and / or Article 72 of POPIA, transfer Services Personal Data on the basis of the Standard Contractual Clauses as set out in clause 3.2(a), as modified in accordance with the LGPD and / or POPIA; and

(iii)  where the Standard Contractual Clauses apply, reference to:

(A)  “member state” will be interpreted to mean Brazil and South Africa, as applicable;

(B)  Clause 13(a) – the Supervisory Authority will be the ANPD or IRSA, as applicable;

(C)  Clause 17 - Option 1 (governing law) of the SCCs will be Brazil or South Africa, as applicable; and

(D)  Clause 18(b) – the exclusive jurisdiction of the courts of Brazil or South Africa, as applicable.

To the extent that the Parties process Services Personal Data to which PIPEDA, QARPPIS, APIPA, BCPIPA and APA applies, VikingCloud will ensure that the provisions of this DPA will continue to be applicable to any Services Personal Data transferred outside of the relevant jurisdiction.

For the avoidance of doubt, should the transfer mechanisms identified in this Clause 3.2 be deemed invalid by a Supervisory Authority or court with applicable authority, the Parties shall endeavor in good faith to negotiate an alternative mechanism (if available and required) to permit the continued transfer of personal data.

3.3   For jurisdictions not covered by Clause 3.2, the Standard Contractual Clauses, and / or standard contractual clauses that may be approved by a European Commission decision, shall be utilized where required, and / or permitted, for the lawful transfer of personal data, provided that such terms shall be amended to align with Data Protection Legislation, as well as to reflect the appropriate choice of law and location of disputes.

3.4   Where personal data is shared between the parties as independent Controllers, pursuant to clause 2.1, the Controller to Controller clauses shall apply in accordance with clause 3.2, with the exception Clause 9 of the SCCs (which is not applicable to the Controller to Controller clauses).

3.5   If VikingCloud receives a legally binding request from a Public Authority to access Services Personal Data, VikingCloud shall, unless otherwise legally prohibited, notify Client and include in such notification a summary of the nature of the request. To the extent VikingCloud is prohibited by law from providing such notification, VikingCloud shall use commercially reasonable efforts to obtain a waiver of the prohibition to enable VikingCloud to communicate to Client as much information as possible, as soon as possible. Further, VikingCloud shall use commercially reasonable efforts to challenge the Public Authority in relation to the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful. If VikingCloud is obliged to disclose Services Personal Data, VikingCloud will ensure that only the minimum information necessary to meet the request is provided.

4   Sub-Processors

4.1   The Client hereby authorizes VikingCloud to use its Affiliates and third parties to process Services Personal Data in order to provide the Services provided:

(a)  VikingCloud shall notify the Client in advance of any proposed use of a Sub-Processor, and any replacement or addition to them and the Client shall have the right to object on reasonable grounds to the use of / or change to any Sub-Processor within 14 days of VikingCloud notifying the Client of the change. In the event of the Client raising such an objection, the Parties will cooperate as reasonably necessary in order to agree additional controls or a suitable alternative solution, as appropriate;

(b)  in engaging any Sub-Processor VikingCloud agrees to adopt adequate data protection arrangements that are materially equivalent to those set out in this DPA; and

(c)  VikingCloud shall at all times remain liable for the acts and omissions of any Sub-Processor as if such acts and omissions were those of VikingCloud.

4.2   For the purpose of this Clause 4, the Client is hereby notified of the current Sub-Processors used by VikingCloud at: https://www.vikingcloud.com/subprocessors.

5   Audit

5.1   VikingCloud shall make available all information reasonably requested by the Client to satisfy itself that VikingCloud is complying with its data protection obligations under this DPA.

5.2   Client (and its third party representatives) shall be permitted to audit VikingCloud's premises, systems, and facilities during normal business hours PROVIDED THAT:

(a)  Such audit will occur, at a maximum of, once per annum, unless the Client holds a reasonable belief that there is a risk of a breach of the applicable Data Protection Legislation and / or this DPA, or as reasonably necessary to comply with any applicable Supervisory Authority request;

(b)  Client shall provide at least 30 days' prior written notice of its intention to carry out an audit;

(c)  all expenses incurred by VikingCloud shall be promptly discharged by Client;

(d)  VikingCloud may request that any third party representative performing an audit on behalf of Client shall provide written confidentiality undertakings to the reasonable satisfaction of VikingCloud and VikingCloud shall be entitled to refuse access to any of its premises or records until such time as it has received such undertakings; and

(e)  nothing in this DPA shall entitle Client to access or inspect any records which contain information relating to any other client of VikingCloud and VikingCloud shall be entitled to restrict or prevent access to any part of its premises which it considers in its sole discretion could compromise the security of any information or data relating to such other clients.

5.3   Any information obtained by the Client in connection with this Clause 5 or in the course of any such audit and any written description of the security, technical and organisational measures used by VikingCloud shall be maintained by the Client in confidence in a manner in which it treats its own confidential information, shall be used solely for the purposes of determining whether VikingCloud is complying with its obligations under this DPA and shall not be used or disclosed for any other purpose.

6   Term and Termination

6.1   This DPA shall be effective as and from the Effective Date and shall remain in force until such time as VikingCloud ceases to process any and all Services Personal Data.

6.2   On termination of this DPA, VikingCloud shall, at the written direction of the Client, delete or return personal data and copies thereof to the Client save to the extent that VikingCloud is required by applicable law and / or the Payment Card Industry Security Standards Council to retain the Services Personal Data. Client accepts that information within backups will be retained in accordance with VikingCloud’s backup retention policy, subject to VikingCloud ensuring that controls are in place to ensure that any Services Personal Data is further deleted in the case of a backup being restored.

7   General

7.1   Any notice or other communication required to be given to a Party under or in connection with this DPA shall be in writing and shall be delivered by email to dataprotectionprivacy@vikingcloud.com. Any notice or communication shall be deemed to have been received on the first working day after the time of transmission.

7.2   Where the Services are supplied under an Agreement, each Party's aggregate liability, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for all claims arising out of or in connection with this DPA is subject to the exclusions and limitations of liability set out in that Agreement, and this DPA does not increase, extend, or create any liability beyond those limits. For the avoidance of doubt, liability under this DPA counts towards, and is not excluded from, any aggregate cap in that Agreement.

7.3   Where the Services are supplied under a Partner Agreement: (a) VikingCloud's aggregate liability to the Client, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for all claims, damages, costs, losses, expenses, and other amounts arising out of or relating to this DPA shall not exceed the fees paid to VikingCloud by VikingCloud Partner for the Services supplied in respect of the Client in the twelve months preceding the date of the first event giving rise to such claim; (b) VikingCloud shall not be liable to the Client for any indirect, special, incidental, consequential, or punitive damages, whether foreseeable or unforeseeable, of any kind whatsoever, arising out of or in connection with this DPA, including but not limited to, lost profits, loss of revenue, loss of business opportunities, loss or damage to goodwill, loss of use of system(s) or network or the recovery of such, business interruption or downtime; and (c) VikingCloud shall have no liability to the Client in respect of any loss for which the Client has been compensated by VikingCloud Partner.

7.4   This DPA and all disputes arising from this DPA whether contractual or non-contractual in nature shall be governed by and construed in accordance with the laws of Ireland. The Parties irrevocably submit to the exclusive jurisdiction of the Irish courts in relation to all matters arising out of or in connection with this DPA.