Master SaaS Terms of Service

About These Terms

These Master SaaS Terms ("Terms") govern your use of our software platform and services. Together with your Order, they form the complete agreement between:

• East-West Company Services Limited ("we," "us," or "our"), and
• The customer identified in the Order ("you" or "your")

Order of Precedence: In the event of any conflict: the Order prevails, then these Terms.

Acceptance: By signing an Order or using the Services, you agree to these Terms.

1. Your Access to the Services

What We Provide

We provide access to our cloud-based software platform, related tools, and support services (collectively, the "Services").

Your Licence

Subject to your compliance with this Agreement and payment of applicable fees, we grant you a non-exclusive, non-transferable, revocable licence for your authorized personnel to access and use the Services for your internal business purposes.

Security & Compliance

You agree to:

• Keep all access credentials secure and confidential
• Implement appropriate access controls for your users
• Notify us immediately of any unauthorized access
• Ensure your users comply with this Agreement

2. Important Limitations – Please Read Carefully

What We Are

We provide software tools and automation technology to support your business operations.

What We Are Not

We are not:

• A customs broker, freight forwarder, or logistics provider
• A law firm or legal adviser
• An accounting firm or tax adviser
• A regulatory compliance consultant
• A carrier or transportation company

Your Responsibility

All outputs from the Services are tools to assist your business decisions. You remain solely responsible for:

• Reviewing and validating all outputs before use
• Making final decisions on filings, shipments, and business operations
• Ensuring compliance with all applicable laws and regulations
• Obtaining appropriate professional advice when needed

The Services do not replace professional judgment, legal advice, or regulatory expertise.

2A. CRITICAL NOTICE – Review & Validation Required

The Services are software tools only. Outputs are NOT final, verified, or guaranteed to be accurate.

YOU MUST:

• Review every output before use – no exceptions
• Validate all outputs against source documents, regulations, and your business requirements
• Apply professional judgment and expertise to every output
• Obtain appropriate professional advice (legal, tax, customs, regulatory) where needed
• Never submit outputs directly to government agencies, regulators, customs authorities, or third parties without thorough human verification and validation
• Maintain appropriate internal controls including review, approval, and validation processes

WE ARE NOT LIABLE FOR:

• Errors, omissions, inaccuracies, or incompleteness in any outputs
• Decisions you make based on outputs
• Filings, submissions, declarations, or documents created using outputs
• Regulatory fines, penalties, sanctions, or enforcement actions
• Compliance failures or violations arising from outputs
• Customs duties, taxes, or charges assessed due to incorrect outputs
• Any losses, damages, or consequences arising from your failure to review and validate outputs
• Reliance on unverified, unvalidated, or incorrect outputs

YOUR ACKNOWLEDGMENT

BY USING THE SERVICES, YOU EXPRESSLY ACKNOWLEDGE AND ACCEPT:

• Outputs are unverified suggestions and assistance tools only
• You bear full and sole responsibility for reviewing, validating, and deciding whether to use any output
• You will implement appropriate validation and approval processes before relying on or submitting any output
• You will not hold us responsible for your use of outputs

If you do not agree to review and validate all outputs, you must not use the Services.

3. Your Responsibilities & Warranties

What You're Responsible For

You are solely responsible for:

(a) Data Quality – Ensuring all data, documents, and information you provide are accurate, complete, and current

(b) Legal Compliance – Complying with all applicable laws, including:

• Export controls and sanctions regulations
• Customs and trade compliance requirements
• Data protection and privacy laws
• Industry-specific regulations

(c) Internal Controls – Maintaining appropriate verification, validation, and approval processes for your business operations

(d) Third-Party Rights – Obtaining all necessary rights, licences, and consents to upload and process data (including personal data of individuals)

(e) Data Backup – Maintaining backups of your critical business records

(f) Proper Use – Using the Services in accordance with this Agreement and our documentation

Your Warranties

By using the Services, you represent and warrant that:

• You have full authority to enter into this Agreement
• Your data does not infringe any third-party rights
• You have all necessary consents to upload and process your data
• Your use complies with all applicable laws
• Your data does not contain viruses, malware, or harmful code

4. AI & Machine Learning Features

How Our Technology Works

Some features use artificial intelligence and machine learning to analyze data and generate outputs. These technologies are probabilistic by nature.

What This Means for You

AI-generated outputs:

• WILL contain errors, omissions, or inaccuracies – this is inherent to probabilistic AI technology and is unavoidable
• YOU MUST review and validate every single output before use – this is not optional and is a fundamental requirement of using the Services
• Are NOT suitable for direct submission to regulators, government agencies, customs authorities, or third parties without thorough human verification and validation
• Should NOT be treated as legal, tax, customs, or professional advice – they are suggestions only
• Are NOT verified by human experts – we do not review outputs before they are provided to you
• May be based on incomplete, outdated, or incorrect information – even if your input data is correct
• Improve over time through machine learning but are NEVER guaranteed to be perfect, complete, or compliant

Your Explicit Acknowledgment

YOU EXPRESSLY ACKNOWLEDGE AND AGREE that:

• All outputs are unverified suggestions only
• Outputs require independent human review, validation, and professional judgment
• You bear sole responsibility for any use, reliance, or submission of outputs
• We make no representations or warranties about the accuracy, completeness, compliance, or fitness of any outputs
• Errors in outputs are expected and inevitable – it is your responsibility to identify and correct them

Beta & Pre-Release Features

Features marked as "Beta," "Preview," "Experimental," or similar are:

• Provided on an "as is" basis with no warranties whatsoever
• Subject to change or withdrawal without notice
• Not recommended for production, mission-critical, or compliance-related operations
• Likely to contain more errors and inaccuracies than generally available features

5. Fees, Payment & Updates

Pricing

Fees and payment terms are set out in your Order. All prices are exclusive of applicable taxes, which you are responsible for paying.

Payment Terms

• Invoices are due 30 days from the invoice date (Net 30)
• Payments must be made in full without set-off or deduction (except for amounts disputed in good faith within 10 days of invoice)
• All payments are non-refundable except as expressly stated in this Agreement

Fee Updates

We may update our fees on at least 30 days' written notice, taking effect:

• On your next renewal date (for subscription fees), or
• At the start of your next billing cycle (for usage-based fees)

Late Payment

Late payments will accrue interest at 4% per annum over the Bank of England base rate, calculated daily and compounded monthly.

If undisputed amounts remain unpaid for 15 days after we send written notice, we reserve the right to suspend your access to the Services until payment is received (see Section 15).

6. Support, Availability & Service Changes

Our Commitments

We will:

• Provide reasonable technical support during business hours
• Use commercially reasonable efforts to maintain service availability
• Aim to provide advance notice of scheduled maintenance

Planned Maintenance & Downtime

We may schedule maintenance windows and updates. Emergency maintenance may occur with limited or no notice to address security issues or critical bugs.

Changes to the Services

We continuously improve our Services and may modify, update, or discontinue features from time to time.

Material Reductions: If a change materially reduces core functionality in a way that substantially impairs your ability to use the Services for their primary purpose, you may:

• Terminate the affected Services on 30 days' written notice, and
• Receive a pro-rata refund of prepaid unused fees

This right must be exercised within 30 days of our notice of the change.

7. Data, Privacy & Security

Your Data Ownership

You retain all ownership rights in your data. We do not claim ownership of any data, content, or files you upload to the Services.

Our Data Licence

You grant us a non-exclusive licence to host, process, and analyze your data as necessary to:

• Provide the Services to you
• Protect the security and integrity of our platform
• Prevent fraud and abuse
• Provide customer support

Use of De-Identified Data

We may use data that has been de-identified and aggregated (such that it can no longer identify any individual or entity) for:

• Service improvement and development
• Security analytics and threat detection
• Industry benchmarking and research
• Quality assurance and model training

Once properly de-identified, this data is no longer personal data.

Security Measures

We maintain appropriate technical and organizational security measures to protect your data, including:

• Encryption in transit and at rest
• Access controls and authentication
• Regular security testing and monitoring
• Employee background checks and training
• Incident response procedures

Personal Data Processing

Where we process personal data on your behalf, the Data Processing Addendum at the end of these Terms applies, covering:

• Our obligations as a processor
• Use of subprocessors (currently AWS for hosting)
• International data transfers
• Data subject rights and security requirements

8. Confidentiality

Mutual Obligations

Each party agrees to:

• Keep the other party's Confidential Information secure
• Use Confidential Information only for purposes of this Agreement
• Disclose it only to employees and contractors who need to know
• Protect it with at least the same care used for its own confidential information

What Is Confidential

"Confidential Information" includes business information, technical data, pricing, and any information marked or identified as confidential.

Exceptions

Confidential Information does not include information that:

• Is or becomes publicly available through no breach of this Agreement
• Was independently developed without use of the other party's Confidential Information
• Was lawfully received from a third party without restriction
• Must be disclosed by law or court order (with prompt notice where permitted)

8A. Acknowledgments & Risk Allocation

No Reliance on Representations

You acknowledge that you have not relied on any statement, promise, warranty, or representation not expressly set out in this written Agreement.

Fair Allocation of Risk

The parties agree that:

• The fees charged under this Agreement reflect the limitations of liability and warranties contained herein
• These limitations represent a fair allocation of risk between the parties
• These limitations form an essential basis of the bargain between us
• The Agreement would not have been entered into without these limitations

9. Intellectual Property Rights

Our Ownership

We (and our licensors) own all intellectual property rights in:

• The Services and underlying software
• AI models, algorithms, and methodologies
• User interface, design, and documentation
• All improvements and derivatives thereof

Outputs Licence

Subject to your compliance with this Agreement and payment of fees, we grant you a non-exclusive licence to use outputs generated by the Services using your data for your internal business purposes.

All intellectual property rights in the underlying technology, models, and processes remain ours. You may not reverse-engineer, extract, or recreate our models or methodologies from outputs.

Feedback

If you provide suggestions, ideas, or feedback about the Services, we may use them freely without restriction or obligation to you. Feedback does not create joint ownership or impose any obligations on us.

10. Third-Party Services & Integrations

Third-Party Dependencies

The Services may integrate with or depend upon third-party services, data feeds, and platforms (such as shipping carriers, government databases, or cloud infrastructure providers like AWS).

No Control or Responsibility

We do not control and are not responsible for:

• The accuracy, completeness, or timeliness of third-party data
• Availability or performance of third-party services
• Third-party terms, policies, or pricing changes
• Interruptions caused by third-party service issues

Your Obligations

You are responsible for:

• Obtaining and maintaining all necessary third-party accounts, licences, and consents
• Complying with third-party terms of service
• Any fees charged by third-party providers
• Ensuring you have rights to connect and use third-party data sources

11. Legal Compliance

You agree not to use the Services:

• In violation of any applicable law or regulation
• To facilitate sanctions evasion or export control violations
• For unlawful, fraudulent, or deceptive purposes
• To create false or misleading filings or documentation
• In any manner that could damage, disable, or impair the Services

11A. Prohibited Uses

High-Risk Activities

You will not use the Services for safety-critical or high-risk activities, including:

• Operation of life-support systems or medical devices
• Air traffic control or navigation systems
• Nuclear facility operations or control systems
• Any application where failure could result in death, personal injury, or significant environmental harm

Not a Substitute for Human Judgment

You will not treat system outputs as final determinations for legal, tax, customs, or regulatory matters without appropriate human review, validation, and professional oversight.

Sanctions & Export Compliance

You will not use the Services to evade or circumvent sanctions, export controls, or other legal restrictions.

12. Warranties & Disclaimers

Our Limited Warranty

We warrant that the Services will be provided with reasonable care and skill and will materially conform to the documentation we make available to you.

This warranty does not apply to:

• Beta, preview, or experimental features
• Third-party services, integrations, or data feeds
• Issues caused by your misuse, modifications, or failure to follow documentation
• Use with unsupported configurations or outdated systems
• Inaccuracies or errors in AI-generated outputs (which are probabilistic)
• Outputs or suggestions provided by the Services

This warranty is subject to the liability limitations in Section 13 below.

Your Sole Remedy

If we breach the above warranty, your sole and exclusive remedy is:

1. Notify us in writing within 30 days of discovering the issue

2. We will use reasonable efforts to correct the non-conformity

3. If we cannot correct it within a reasonable time, you may terminate the affected Services and receive a pro-rata refund of prepaid unused fees

Disclaimers

EXCEPT AS EXPRESSLY STATED ABOVE, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND.

We specifically disclaim, to the maximum extent permitted by law:

• Any implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, or non-infringement
• Any warranties arising from course of dealing or usage of trade

No Guarantees

We do not warrant or guarantee that:

• The Services will be uninterrupted, error-free, or completely secure
• AI-generated outputs will be accurate, complete, or suitable for regulatory filings
• All defects will be corrected
• The Services will meet your specific business requirements

Explicit Disclaimer on Fitness for Regulatory Use

WE EXPRESSLY DISCLAIM ANY WARRANTY that outputs are:

• Suitable, accurate, complete, or compliant for submission to customs authorities, tax agencies, regulators, or government bodies
• Fit for any particular purpose (including compliance, filing, regulatory use, or legal purposes)
• Complete, current, or in compliance with the latest regulations, tariff codes, or legal requirements
• Verified, validated, reviewed, or approved by human experts
• Free from errors or suitable for use without independent validation

Outputs are provided as unverified suggestions only. You must independently verify, validate, and review all outputs against applicable regulations, professional standards, and your business requirements before submission, filing, or reliance.

Your Acknowledgment

You acknowledge and agree that:

• AI and machine learning outputs will contain errors, omissions, or inaccuracies
• You must independently review and validate all outputs before relying on them
• The Services are tools to assist (not replace) professional judgment and expertise
• Outputs are not legal, tax, customs, or professional advice
• You bear sole responsibility for any use of outputs

13. Limitation of Liability

Liability Cap

Subject to the carve-outs below, our total aggregate liability arising out of or related to this Agreement (whether in contract, tort, negligence, or otherwise) will not exceed the total fees you paid to us in the 12 months immediately preceding the event giving rise to the claim.

Privacy Breach Sub-Cap

Subject to the carve-outs below, our aggregate liability for a personal data breach caused solely by our failure to implement appropriate security measures is limited to two times (2×) the fees you paid in the 12 months preceding the breach.

This is your sole and exclusive monetary remedy for such breaches.

Exclusion of Indirect Damages

We are not liable for:

• Lost profits, revenue, savings, or business opportunities
• Loss of data or goodwill
• Business interruption or downtime costs
• Regulatory fines, penalties, or sanctions
• Customs duties, taxes, or charges
• Compliance costs or remediation expenses
• Reputational harm or damage
• Any indirect, special, incidental, consequential, exemplary, or punitive damages

This exclusion applies even if we have been advised of the possibility of such damages.

Carve-Outs (Unlimited Liability)

Nothing in this Agreement limits or excludes liability for:

• Death or personal injury caused by negligence
• Fraud or fraudulent misrepresentation
• Gross negligence or willful misconduct
• Any other liability that cannot be limited or excluded under applicable law

Basis of the Bargain

These limitations reflect the fees charged and the allocation of risk between the parties. They apply to the fullest extent permitted by law and survive termination of this Agreement.

14. Your Indemnity Obligations

What You Indemnify Us For

You will defend, indemnify, and hold us harmless from and against any claims, losses, damages, costs, and expenses (including reasonable legal fees) arising from:

(a) Your data, content, or instructions to us

(b) Your filings, decisions, or use of system outputs, including:

• Submission of unverified or unvalidated outputs to regulators, government agencies, or customs authorities
• Reliance on outputs without independent validation or professional review
• Use of inaccurate, incomplete, erroneous, or non-compliant outputs
• Regulatory fines, penalties, sanctions, or enforcement actions arising from outputs you submitted or relied upon
• Customs duties, taxes, or charges assessed due to incorrect or non-compliant outputs
• Compliance failures or violations arising from your use of outputs

(c) Your use of the Services in breach of this Agreement or applicable law

(d) Infringement of third-party rights by your data or use of the Services

(e) Your breach of the warranties in Section 3

Our Rights

We may:

• Notify you promptly of any claim
• Allow you to control the defense (with counsel we reasonably approve)
• Cooperate reasonably in the defense (at your expense)
• Participate in the defense with our own counsel (at our expense)

You may not settle any claim that admits liability on our behalf or imposes obligations on us without our prior written consent.

15. Term, Suspension & Termination

Agreement Term

This Agreement begins on the Effective Date stated in your Order and continues for the Initial Term specified therein, automatically renewing for successive renewal periods unless either party provides written notice of non-renewal at least 30 days before the end of the then-current term.

Our Right to Suspend

We may immediately suspend your access to the Services if:

• Undisputed amounts remain unpaid for 15 days after written notice
• Your use creates a security risk or threatens the integrity of our platform
• Your use violates Sections 11 or 11A (legal compliance and prohibited uses)
• We are required to suspend by law, regulation, or court order
• You commit a material breach that poses immediate risk of harm

We will provide you with notice of suspension where reasonably practicable and will restore access promptly once the issue is resolved and any overdue amounts are paid.

Termination for Breach

Either party may terminate this Agreement if the other party:

• Commits a material breach, and
• Fails to cure that breach within 30 days of receiving written notice specifying the breach

Termination for Convenience

You may terminate this Agreement for convenience on 30 days' written notice, but you remain liable for all fees through the end of the then-current term.

Effects of Termination

Upon termination:

• You must immediately cease all use of the Services
• All outstanding fees become immediately due and payable
• Your access credentials will be deactivated

Data Retrieval & Deletion

Following termination or expiration:

30-Day Export Window: We will make export tools available for you to retrieve your data for 30 days (unless prohibited by law, court order, or undisputed amounts remain overdue).

Deletion Timeline: If you do not export your data within 30 days, we will securely delete it within a further 30 days (60 days total from termination).

Permitted Retention: We may retain:

• Minimal records and logs required by law or regulation
• Data necessary for establishment, exercise, or defense of legal claims
• Aggregated and de-identified data that cannot identify you or any individual

Surviving Provisions

The following provisions survive termination:

Sections 2A (Critical Notice), 3 (Your Responsibilities – for acts before termination), 5 (Fees – for amounts due), 7 (data licence and de-identified data use), 8 (Confidentiality), 8A (No Reliance), 9 (Intellectual Property), 12 (Disclaimers), 13 (Liability), 14 (Indemnities), 18 (Notices), 19 (Governing Law), and 20 (General), together with any other provision that by its nature should survive.

16. Force Majeure

Events Beyond Our Control

Neither party is liable for delay or failure to perform its obligations (other than payment obligations) due to events beyond its reasonable control.

Force Majeure Events include:

• Acts of God, natural disasters, or severe weather
• War, terrorism, civil unrest, or riot
• Pandemic, epidemic, or public health emergency
• Government action, regulation, or court order
• Failure of telecommunications, internet, or power infrastructure
• Strikes, labor disputes, or supply chain disruptions
• Cyberattacks or network intrusions beyond our reasonable control

Notice & Mitigation

The affected party must:

• Notify the other party promptly of the Force Majeure Event
• Use reasonable efforts to mitigate the impact and resume performance

Termination Rights

If a Force Majeure Event prevents performance of material obligations for more than 60 consecutive days, either party may terminate the affected Services (or the entire Agreement if substantially all Services are affected) on written notice.

If termination occurs due to Force Majeure:

• You remain liable for fees for Services provided before the event
• We will refund prepaid fees for Services not provided during the Force Majeure period

17. Changes to These Terms

How We Update Terms

We may update these Terms from time to time to reflect changes in our Services, legal requirements, or business practices. The current version is always available on our website and in the app.

Notice of Changes

We will provide at least 30 days' notice of any material changes by email to your account contact.

Your Rights

If a change to these Terms materially and adversely affects your rights, you may:

• Terminate the affected Services before the effective date of the change, and
• Receive a pro-rata refund of prepaid unused fees for the terminated Services

Continued use of the Services after the effective date constitutes acceptance of the updated Terms.

18. Notices

How to Send Notices

Formal legal notices must be sent to the notice contacts specified in your Order, or by email to:

To Us: legal@east-west.com

To You: The email address in your Order

When Notices Are Effective

A notice is deemed received:

• If sent during business hours: on the next business day
• If sent outside business hours: on the second business day after sending

19. Governing Law & Jurisdiction

This Agreement is governed by the laws of England and Wales, without regard to conflict of law principles.

The parties irrevocably submit to the exclusive jurisdiction of the courts of England and Wales for any disputes arising out of or related to this Agreement.

20. General Provisions

No Partnership or Agency

This Agreement does not create any partnership, joint venture, agency, or employment relationship. Neither party has authority to bind the other or make commitments on the other's behalf.

No Exclusivity

This Agreement does not grant you any exclusive rights or prevent us from providing services to other customers, including your competitors.

Assignment & Change of Control

Neither party may assign this Agreement without the other party's prior written consent (not to be unreasonably withheld or delayed), except that:

We may assign this Agreement without consent:

• To an affiliate or subsidiary
• In connection with a merger, acquisition, reorganization, or sale of all or substantially all of our assets or business

Any attempted assignment in violation of this provision is void.

Publicity & Marketing

We may use your name, logo, and a general description of your use of the Services in customer lists, case studies, and marketing materials. We will comply with your reasonable brand guidelines. You may opt out by providing written notice.

You may not publicly disclose the terms of this Agreement (including pricing) without our prior written consent.

Subcontracting

We may use subcontractors and service providers to fulfill our obligations, but we remain responsible for their performance.

Severability

If any provision of this Agreement is held to be invalid, illegal, or unenforceable, the parties will negotiate in good faith to replace it with a valid provision that reflects the original intent as closely as possible. The remaining provisions will remain in full force and effect.

Entire Agreement

This Agreement (comprising these Terms and your Order) constitutes the entire agreement between the parties and supersedes all prior or contemporaneous discussions, proposals, agreements, and understandings.

This Agreement may only be modified by a written amendment signed by both parties (except for updates to these Terms as expressly permitted in Section 17).

No Waiver

No failure or delay by either party in exercising any right or remedy will operate as a waiver. A waiver is only effective if in writing and signed by the waiving party. A waiver of one breach does not constitute a waiver of any subsequent breach.

Counterparts & Electronic Signatures

This Agreement may be executed in counterparts (including electronic copies, PDFs, and electronic signatures such as DocuSign or Adobe Sign), each of which is deemed an original and all of which together constitute one agreement.

Data Processing Addendum (UK GDPR)

Last Updated: 26 October 2025

This Data Processing Addendum ("DPA") forms part of the Agreement and applies where we process personal data on your behalf.

1. Definitions & Roles

Roles: You are the Controller. We are your Processor.

Definitions: Terms like "personal data," "processing," "data subject," "controller," and "processor" have the meanings given in UK GDPR and the Data Protection Act 2018.

2. Scope of Processing

Subject Matter & Duration

Processing of personal data you upload to the Services to deliver the Services, for the term of the Agreement plus 30 days for data export.

Nature & Purpose of Processing

• Hosting, storage, and retrieval
• Data transformation and analysis
• Quality assurance and analytics for security, safety, and abuse prevention
• Customer support and technical troubleshooting
• Service improvement using de-identified and aggregated data (which is no longer personal data)

Types of Personal Data

• Business contact information (names, email addresses, phone numbers)
• Shipment and consignment references
• Communications metadata
• End-customer and partner personnel data provided by you
• Any other personal data you choose to upload

We do not require special category data. You must not upload special category data or payment card numbers without our prior written consent.

Categories of Data Subjects

• Your employees and contractors
• Your customers and end-users
• Partners, suppliers, and service providers
• Any other individuals whose personal data you provide

3. Your Instructions & Our Obligations

Processing Instructions

We will process personal data only on your documented instructions, which consist of:

• This Agreement and your Order
• Your use and configuration of the Services
• Written instructions issued by authorized personnel

Note: Our use of de-identified and aggregated data as described in Section 7 of the Terms is not processing of personal data.

Our Core Obligations

We will:

(a) Confidentiality: Ensure that personnel authorized to process personal data are subject to confidentiality obligations

(b) Security: Implement appropriate technical and organizational measures to protect personal data (see Section 8 below)

(c) Sub-processing: Currently we use AWS for hosting. We impose equivalent data protection obligations on subprocessors and remain fully liable for their performance

(d) Data Subject Rights: Assist you in responding to data subject requests (access, rectification, erasure, objection, etc.) to the extent reasonably possible

(e) Security Incidents: Notify you without undue delay after becoming aware of a personal data breach

(f) DPIAs & Consultations: Assist you with data protection impact assessments and prior consultations with supervisory authorities, where required

(g) Deletion or Return: Delete or return personal data at the end of the Services, subject to legal retention requirements (see Section 15 of the Terms)

(h) Compliance Information: Make available information necessary to demonstrate compliance upon reasonable request

Unlawful Instructions

If we reasonably believe an instruction violates UK GDPR or other data protection laws, we will promptly inform you and may suspend the instruction until you confirm or modify it.

4. Subprocessors

Current Subprocessors

We currently use the following subprocessors:

• Amazon Web Services (AWS) – cloud infrastructure and hosting (EU/UK regions)

Subprocessor Changes

We will notify you of any material changes to subprocessors (additions or replacements) at least 30 days in advance by email.

Your Right to Object

If you reasonably object to a new subprocessor on data protection grounds, you must notify us in writing within 30 days.

We will use reasonable efforts to make available an alternative configuration. If we cannot resolve your objection within 30 days, you may terminate the affected Services and receive a pro-rata refund of prepaid unused fees.

5. International Data Transfers

Transfers Outside UK/EEA

Where we transfer personal data outside the United Kingdom or European Economic Area, we will ensure appropriate safeguards are in place, including:

• Use of the UK International Data Transfer Agreement (IDTA) and/or EU Standard Contractual Clauses (with UK Addendum where applicable)
• Transfers to countries with adequacy decisions from the UK or EU
• Additional technical and organizational measures where appropriate (e.g., encryption)

Our primary infrastructure provider (AWS) maintains data centers in EU and UK regions.

6. Audits & Compliance

Compliance Information

Upon reasonable written request, we will provide information about our security measures and compliance with this DPA.

Audits

You may conduct (or appoint an independent third-party auditor to conduct) an audit of our relevant processing activities:

Frequency: Once per year on 30 days' prior written notice, or immediately following a personal data breach affecting your data

Conditions:

• Conducted during normal business hours
• Execution of reasonable confidentiality undertakings
• Minimizing disruption to our operations
• Reimbursement of our reasonable costs if the audit reveals no material non-compliance

7. Security Incident Notification

Our Obligations

We will notify you without undue delay (and in any event within 72 hours where feasible) after becoming aware of a personal data breach.

Notification Contents

The notification will include, to the extent known:

• Nature of the breach and categories/numbers of data subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact point for further information

Your Obligations

You remain responsible for:

• Determining whether to notify data subjects and supervisory authorities
• Compliance with breach notification requirements under UK GDPR

8. Security Measures

We maintain appropriate technical and organizational security measures, including:

Technical Measures

• TLS 1.2+ encryption for data in transit
• AES-256 encryption for data at rest
• Role-based access control
• Multi-factor authentication for administrative access
• Regular security monitoring and logging
• Automated backups (retained for 35 days on a rolling basis)

Organizational Measures

• Employee background checks and security training
• Confidentiality agreements
• Incident response procedures
• Regular security reviews

Infrastructure

• Secure cloud infrastructure (AWS EU/UK regions)
• Industry-standard data center security
• Geographically distributed infrastructure for redundancy

9. Data Retention & Deletion

Retention Periods

We retain personal data only for as long as necessary to:

• Provide the Services to you
• Comply with legal obligations
• Establish, exercise, or defend legal claims

Backup Retention: Encrypted backups are retained for 35 days on a rolling basis and are then automatically deleted.

Deletion Upon Termination

Following termination, we will delete personal data as described in Section 15 of the main Terms:

• 30-day export window for you to retrieve data
• Deletion within 60 days total (if not exported)
• Retention of minimal records as permitted by law

10. Your Instructions & Prohibited Data

Standard Instructions

The standard instructions for processing are set out in this DPA and include:

• Providing the Services as described in the Agreement
• Responding to your support requests
• Security and abuse prevention

Prohibited Data

You must not upload:

• Special category data (sensitive personal data) without our prior written agreement
• Payment card primary account numbers (PANs)
• Government secrets or classified information
• Data you are not authorized to process

Special category data includes data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation.

11. Contact for Data Protection Matters

For all data protection inquiries, requests, or concerns, please contact:

Email: privacy@east-west.com

12. Term

This DPA remains in effect for the term of the Agreement and survives for 30 days thereafter to allow for data export and deletion procedures.

East-West Company Services Limited is committed to providing innovative software tools while ensuring customers understand their responsibilities. Questions? Contact us at legal@east-west.com