Terms of Service

These Terms of Service were last updated and are effective on September 28, 2021.

These Terms of Service (collectively, the "Terms" or "these Terms") consist of:

Part I - General Terms of Service

Part II - Developer Terms

Appendix I - List of Prohibited Content and Conduct

Appendix II - Input Data and GDPR - Data Processing Agreement

THESE TERMS ARE IMPORTANT BECAUSE THEY FORM A LEGAL AGREEMENT BETWEEN US AND YOU. PLEASE READ THROUGH THEM CAREFULLY BEFORE USING THE BIOLIB SERVICES. THESE TERMS ALSO INCLUDE YOUR AGREEMENT TO RESOLVE ANY DISPUTE WITH US THROUGH MANDATORY ARBITRATION.

Part I · General Terms of Service

Introduction

Welcome and thank you for your interest in BioLib! BioLib connects developers of biological data science applications to the people who need them.

In contracts, terms often have very specific meanings. When we use the terms "we", "our", "us" or "BioLib" in these Terms, we mean our company called BioLib Technologies ApS, a Danish company registered with the Danish Business Authority with CVR-no. 40705341.

These Terms apply to you whenever you browse, visit or use our Website (at biolib.com), our Desktop Application, our APIs, or any other software provided by us; create an account with us; sign in to your account; explore, open, use or buy any apps in our App Database; or develop, publish, or sell apps in or through our App Database. These Terms apply to all BioLib Services, including:

(1) our Platform, which covers our website biolib.com and its subdomains and any other website we may establish in the future, our Desktop Application, our APIs, and any other software provided by us (collectively, the "Platform"),

(2) the app database available on the Platform (the "App Database"),

(3) the BioLib app development interface, instructions and related APIs available on our Platform (the "BioLib Developer Tools"), and

(4) any other service or computer software developed by us and incorporated therein, whether now existing or incorporated in the future, such as a marketplace for apps (all of the above collectively, the "BioLib Services").

If you are accepting these Terms on behalf of a company or other entity, you represent and warrant that you have full authority to bind that company or entity to these Terms. By using the BioLib Services, you hereby agree to these Terms. If you do not agree to these Terms, you may not use the BioLib Services and should not use them.

If you use BioLib and there is a separate written contract between us and you, these Terms shall have priority in case of conflicting terms, unless specifically excluded, in whole or in part, in such separate contract.

Note to Developers

If you build, create, develop, modify, submit, publish or sell apps through the BioLib Services, all of these Terms apply to you, including the Developer Terms in Part II of these Terms. Please review them carefully.

Note on Input Data and GDPR

The Input Data (as defined in Appendix II) you submit when running apps through the BioLib Services is governed by these Terms. You acknowledge and agree that Appendix II (Input Data and GDPR - Data Processing Agreement) shall govern our processing of such data.

Support and Questions

We are here to help! If you have any questions about the use of the BioLib Services or have technical difficulties, please e-mail us at support@biolib.com. Please note that we are not the developer of all the apps in our App Database, you must contact the app developer directly for support and questions regarding the use of individual apps.

Changes to these Terms and BioLib Services

We may modify these Terms from time to time. The most current Terms will be available on the BioLib website and the date of the latest update is indicated at the top of these Terms. We strive to (but are not required to) communicate major changes with a special notice on the BioLib Services or by email. You accept such modified Terms by continuing to use the BioLib Services.

We may also change the way the BioLib Services work at any time, such as require sign-in to browse apps, require account holders to verify their accounts and contact information, change the process for building or submitting apps using the BioLib Developer Tools, or any other change we deem appropriate to help BioLib Services grow and work better.

We reserve the right to display the apps in the BioLib Services in a manner as determined by us at our sole discretion and to introduce new features or change the manner that the apps are displayed in the BioLib Services from time to time.

Requirements for Use of the BioLib Services

You hereby agree to use the BioLib Services in accordance with these Terms. Please note that our App Database and BioLib Developer Tools are currently optimized for Firefox and Chrome, and we make no representation whether they will work on any other browser.

You represent and warrant that you are aged 18 years or older.

Privacy Policy

The BioLib Services are subject to our Privacy Policy, which can be found on our website https://biolib.com/legal/privacy-policy/. Please take a moment to review it because it also contains useful security information.

Your Account

In order to create an account with us, you must provide us with your full name, your valid e-mail address and create a password. A human must create your account and one person cannot have more than 10 accounts. To create an account you must also agree to these Terms and to our Privacy Policy. BioLib reserves the right to revoke any user's account at our sole discretion.

In the future, we may require further verification (e.g. of your identity) and/or require you to provide us more information and your continued use of the BioLib Services will be subject to you meeting such requirements.

You are responsible for any content and activity in your account and keeping your account secure and must keep your password confidential. We will not be liable for any loss or damage from your failure to keep your account secure. You must notify us in writing immediately if you become aware of any disclosure of your password or unauthorized access to your account. You must not use any other person's account to access the BioLib Services, unless you have that person's express permission to do so.

We may, at our sole discretion, and without prior notice to you, stop (permanently or temporarily) providing the BioLib Services (or any features within the BioLib Services) to you or prohibit or restrict your use of the BioLib Services.

You agree that, to provide you with the BioLib Services, we may provide companies affiliated with us (including subsidiaries, our parent company and all its subsidiaries) and their data processors, with your account data along with any Developer Content (as defined in Part II of these Terms) you submit to us.

Limited License to Use

You are hereby granted a non-exclusive, revocable and nontransferable license in accordance with these Terms to access and use the BioLib Services to browse our Platform and to browse, open, use, develop, publish, buy and sell apps in our App Database.

Prohibited Uses of BioLib Services

You must comply with all laws and regulations that apply to you when using the BioLib Services. This includes, but is not limited to data privacy, copyright, patent and trademark laws. You are responsible for ensuring that your use of the BioLib Services is in compliance with applicable laws and regulation.

In addition, you agree to comply with Appendix I (List of Prohibited Content and Conduct) which lists content and conduct prohibited on BioLib Services.

BioLib's Intellectual Property Rights

You agree that the BioLib Services, including but not limited to their content, graphics, user interface, audio clips, video clips, editorial content, and the scripts and software used to implement the BioLib Services, contain proprietary information and material that is owned by BioLib and/or its affiliates and licensors, and are protected by applicable intellectual property and other laws, including but not limited to copyright. We and our affiliates and licensors own all title and rights to the BioLib Services, including, but not limited, to all copyrights, patents, trademarks, know-how and other intellectual property rights included therein, including in the BioLib Developer Tools and any apps in our database that have been created by BioLib.

You may not reproduce (whether by linking, framing or any other method), rent, loan, transfer, distribute, store, modify, reverse engineer, decompile, disassemble, or create derivative works of, publicly display, or commercially exploit any part of the BioLib Services.

The look and feel of the BioLib Services are the copyright of BioLib, Inc., one of our affiliates and licensors. All rights reserved. You may not, without express written permission from us, duplicate, copy, or reuse any part of the BioLib Services including without limitation any of the code, HTML/CSS, JavaScript, or visual design elements or concepts.

The BioLib name, logo, and graphics and logos used in connection with the BioLib Services are trademarks or registered trademarks of BioLib or its affiliates in the USA and/or other countries. You are granted no right or license with respect to any of the aforesaid trademarks, graphics or logos.

All rights in the BioLib Services not expressly granted to you by us in these Terms are retained by us and our affiliates and licensors.

If you believe that any content appearing in the BioLib Services has been copied in a way that constitutes an infringement of your copyright, please contact us at legal@biolib.com.

About Apps in Our App Database and Developer Responsibilities

Our App Database contains apps developed primarily by third parties (not BioLib). The apps have been generated with the BioLib Developer Tools.

Apps made available to you via our App Database are licensed, not sold, to you by the developer of the app. The developer of the app may make their app subject to a license agreement created by the developer. Your agreement to use the app is between you and the developer of that app. BioLib is not a reseller of the apps but solely provides the online platform to make the app available through our App Database (and collecting any applicable app fees and taxes for that app on behalf of the developer). Responsibility for an app lies solely with the Developer. You should also check whether the developer has their own privacy policy available for you to review.

BioLib does not provide support, bug fixes or updates for the apps available in our App Database. BioLib is also not liable or responsible for how the app works or does not work - or whether the results are as indicated or promised by the developer. These are the responsibility of the developer and your recourse is against the developer.

BioLib assumes no liability for the apps available in our App Database. YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT USE OF THE APPS IS AT YOUR SOLE RISK. The developers of apps will have to comply with these Terms, including the Part II - Developer Terms but BioLib cannot and will not guarantee compliance. If you have paid for an app that does not work or becomes unavailable, BioLib will not issue you a refund but your recourse is solely against the developer of that app.

When using paid apps, we (or our payment processor) - on behalf of the developer - will charge your selected payment method (such as your credit card, debit card, gift card/code, or other payment method we make available), including any applicable taxes. If we cannot charge your selected payment method for any reason (such as expiration or insufficient funds), you remain responsible for any uncollected amounts, and we will attempt to charge the payment method again as you may update your payment method information.

Third Party Links and Services

We may through BioLib Services provide links or references to third party developed websites, features, apps or services on our Platform, blogs, discussion forums, social media accounts or otherwise. Please note that we have no control of such third-party websites, features, apps or services and do not assume any responsibility or liability for any damage or loss of any kind for or due to their content, functionality, or practices. If you decide to access these third-party websites, features, apps or services, you do so at your own risk.

Suggestions and Ideas

We love feedback - also when it is critical - and are always looking for ways to improve the experience of using the BioLib Services. You may propose to us feedback, ideas and suggestions for modifications or improvements to all or any part of the BioLib Services. By choosing to disclose such idea or suggestion to us, you by accepting these Terms agree that: (1) your submissions and their contents along with related intellectual property rights will automatically become the property of BioLib, without any compensation to you; (2) we may use or redistribute the submissions and their contents for any purpose and in any way on an unrestricted basis; (3) there is no obligation for us to review the submissions; and (4) there is no obligation to keep any submissions confidential.

WARRANTY DISCLAIMER

THE BIOLIB SERVICES ARE PROVIDED BY US "AS IS" AND "AS AVAILABLE".

NEITHER WE NOR OUR PARTNERS, SUPPLIERS, OR AFFILIATES MAKE ANY REPRESENTATIONS OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, AS TO THE OPERATION OF THE BIOLIB SERVICES, THEIR CONTENTS, OR ANY INFORMATION, DEVELOPER CONTENT OR APPS MADE AVAILABLE FOR FREE OR PURCHASE BY OR THROUGH THE BIOLIB SERVICES. IN ADDITION, WE AND OUR PARTNERS, SUPPLIERS AND AFFILIATES DISCLAIM ALL WARRANTIES WITH RESPECT TO THE BIOLIB SERVICES, INCLUDING ANY APPS AND OTHER DEVELOPER CONTENT AVAILABLE IN OUR DATABASE, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES AND/OR CONDITIONS OF MERCHANTABILITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE, SATISFACTORY QUALITY, ACCURACY, QUIET ENJOYMENT AND NON-INFRINGEMENT OF THIRD-PARTY RIGHTS.

FURTHERMORE, WE DO NOT WARRANT THAT YOUR USE OF THE BIOLIB SERVICES, ANY DEVELOPER CONTENT OR APPS AVAILABLE IN OUR APP DATABASE WILL BE UNINTERRUPTED, AVAILABLE AT ANY TIME OR FROM ANY PARTICULAR LOCATION, SECURE OR ERROR-FREE, THAT DEFECTS WILL BE CORRECTED, OR THAT ANY APPS IN OUR DATABASE ARE FREE OF VIRUSES OR OTHER POTENTIALLY HARMFUL COMPONENTS.

Limitation of Liability

IN NO EVENT WILL WE OR ANY OF OUR AFFILIATES BE LIABLE FOR DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, EXEMPLARY, COLLATERAL OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION THOSE RESULTING FROM LOST PROFITS, LOST DATA, BURGLARY, PROPERTY DAMAGE, PERSONAL INJURY OR BUSINESS INTERRUPTION) ARISING OUT OF THE USE, INABILITY TO USE, OR THE RESULTS OF USE OF THE BIOLIB SERVICES OR ANY APPS AVAILABLE IN OUR APP DATABASE, WHETHER SUCH DAMAGES ARE BASED ON WARRANTY, CONTRACT, TORT OR ANY OTHER LEGAL THEORY AND WHETHER OR NOT WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

OUR AGGREGATE LIABILITY, ARISING FROM OR RELATING TO THE BIOLIB SERVICES (REGARDLESS OF THE FORM OF ACTION OR CLAIM, E.G. CONTRACT, WARRANTY, TORT, STRICT LIABILITY, NEGLIGENCE, OR ANY OTHER LEGAL THEORY) IS LIMITED TO $100. In some locations applicable mandatory law may not allow certain of the limitations described above, in which case such limitations will apply to the maximum extent allowed by such applicable law.

Indemnity

You agree to defend, indemnify and hold us and our partners, affiliates, service providers, licensors, officers, directors, employees and agents harmless from and against any claims, actions or demands, including but not limited to reasonable legal and accounting fees, alleging or resulting from: (a) your violation of these Terms; or (b) your violation of our intellectual property rights, any third party rights or any applicable law.

Local Law and Export Control

In relation to your purchase and use of the BioLib Services, you agree to comply with the laws of your local jurisdiction as well as with any export restrictions of your local jurisdiction on exporting products or information.

We do not intend use of the BioLib Services to create obligations for us under the US Health Insurance Portability and Accountability Act, as amended ("HIPAA"), and make no representations that the BioLib Services satisfy HIPAA requirements. If you are (or become) a "covered entity" or "business associate" as defined in HIPAA, you will not use the BioLib Services for any purpose or in any manner involving transmitting protected health information to us.

Notice to US Government Users

The BioLib Services (and the software included therein) and accompanying documentation are deemed to be "commercial computer software" and "commercial computer software documentation", respectively, pursuant to DFAR Section 227.7202 and FAR Section 12.212, as applicable. Any use, modification, reproduction, release, performance, display or disclosure of the software and accompanying documentation by the United States Government shall be governed solely by these Terms.

Termination and Restriction Measures

You may discontinue your use of the BioLib Services at any time. If you wish to terminate your account, please notify us by e-mail that you wish to terminate your account. After we have terminated your account, you will no longer have access to any of your data, apps or purchases. We also reserve the right to delete your account and data if your account has been inactive for a period of more than two (2) years.

If you violate these Terms, or if we reasonably suspect that you have violated these Terms, we may:

• send you one or more formal warnings;
• temporarily suspend your access to the BioLib Services;
• permanently prohibit you from accessing the BioLib Services;
• block computers using your IP address from accessing the BioLib Services;
• contact any or all of your internet service providers and request that they block your access to the BioLib Services, or take any other technical measures we deem appropriate to prevent you from accessing BioLib Services or to stop you from violating these Terms;
• remove any of your apps from our App Database;
• commence legal action against you, whether for breach of contract or otherwise; and/or
• suspend or delete your account.

We may change or discontinue, in whole or in part, the BioLib Services at any time without notice. We may discontinue, in whole or in part, the BioLib Services to you if we are no longer, for whatever reason, able to process any personal data submitted as part of a developer's Input Data in accordance with Appendix II (Input Data and GDPR). You acknowledge that we are not liable to you or to any third party for any such action.

You represent and warrant that (i) you are not located in a country that is subject to a U.S. or EU Government embargo, or that has been designated by the U.S. or EU Government as a "terrorist supporting" country; and (ii) you are not listed on any U.S. or EU Government list of prohibited or restricted parties.

Governing Law and Disputes

The United Nations Convention on Contracts for the International Sale of Goods shall not apply to these Terms or your purchase of any element of the BioLib Services.

These Terms shall be governed by and construed in accordance with the laws of Denmark without regard to the principles of conflicts of law of any jurisdiction.

Both parties shall use their best efforts to settle by amicable negotiations any disputes which may occur between them arising out of or relating to these Terms; the existence, validity, termination, interpretation of any term hereof; and disputes regarding your use of the BioLib Services. If the parties fail to reach an amicable settlement, either party may refer such dispute to binding arbitration. Any dispute, controversy or claim arising out of or in connection with these Terms, or the breach, termination or invalidity thereof, shall be finally settled by arbitration in accordance with the with the rules of simplified arbitration procedure adopted by The Danish Institute of Arbitration. The seat of arbitration shall be Copenhagen, Denmark. The language of the arbitral proceedings shall be English.

The arbitration shall be conducted by a single arbitrator who shall be a professional, legal or otherwise, but shall not be, or have previously been associated with either party (the "Arbitrator"). The arbitral award shall be final, binding and non-appealable. The Arbitrator's award must be reasoned and issued in writing within thirty (30) days of the hearing, unless otherwise agreed to by we and you.

Notwithstanding the previous section, if you are a consumer residing in any country where the law does not allow consumers to agree on Arbitration, any dispute, controversy or claim arising out of or in connection with these Terms of Service, or the breach, termination or invalidity thereof, shall be exclusively settled by Danish law, with venue in City District Court in Copenhagen, Denmark.

Notwithstanding the foregoing, in recognition of the irreparable harm that a breach by you of our intellectual property rights would cause, we may seek an injunction against such violation or breach in a court of competent jurisdiction.

General

English language shall govern all documents, notices, and interpretations of these Terms. The following subsections of these Terms shall survive and remain in effect after your license or access to use the BioLib Services has terminated for any or no reason:

Part I: BioLib's Intellectual Property Rights, About Apps in our App Database and Developer Responsibilities, Suggestions and Ideas, Warranty Disclaimer, Limitation of Liability, Indemnity, Local Law and Export Control, Notice to US Government Users, Termination and Restriction Measures, Governing Law and Disputes, and General.

Part II: Your Responsibilities and Reservation of Rights.

Appendix II: The Data Processor Agreement shall apply for as long as we process data as a data processor on behalf of a data controller.

Our failure to exercise or enforce any right or provision of these Terms will not constitute a waiver of such right or provision unless acknowledged and agreed to by us in writing. These Terms and the Privacy Policy constitute the entire agreement between you and us with respect to the subject matter herein and supersede any and all prior or contemporaneous oral or written agreements. You may not assign this agreement to any other party and any attempt to do so is void.

Address: BioLib Technologies ApS, Vesterbrogade 74, 3., 1620 Copenhagen V, Denmark.

Part II · Developer Terms

Introduction

Thank you for your interest in building apps on BioLib! We have tremendous respect for people like you - the researchers, programmers and innovators who bit by bit, line by line, and app by app are moving the world of bioinformatics forward.

You may build, create, develop, modify, submit, publish and sell apps through the BioLib Services and such app(s) are called "your apps" in these Terms. This can be done with the BioLib Developer Tools. This means you will have to submit to us and upload your own content for your apps, such as executable code, user documentation, instructions, images, results (or statements or promises you make regarding the results), parameters, settings, and a description of your app (the "Developer Content").

In building, creating, developing, modifying, submitting, publishing or selling your app, you are subject to these Developer Terms (in addition to the rest of these Terms).

Ownership of Developer Content

Your Developer Content is your property. The BioLib Services are owned by BioLib and/or its affiliates and licensors. We need the right to display and make available your app. Therefore, you hereby grant us and our affiliates and licensors the right to store, parse, host, run, distribute, display and make incidental copies of the Developer Content that you submit when creating or modifying your apps. You further acknowledge and accept that BioLib and its affiliates and licensors may display these on the BioLib Services and that BioLib and its affiliates and licensors are not responsible for any public display or misuse of such Developer Content.

Your Responsibilities

You represent and warrant to us that you have all required rights (including intellectual property rights) and permissions to submit to us your Developer Content and that your Developer Content does not violate the intellectual property rights of any third party. You represent and warrant to us that no Developer Content that you submit to us constitutes personal information under GDPR about any other natural person than you. You are solely responsible for:

• uploading and configuring your app on the BioLib services;
• the content of, and for any harm or liability resulting from, any Developer Content that you post, upload, link to or otherwise make available via the BioLib Services, regardless of the form of that Content;
• complying with all applicable laws with respect to your apps, including the content of your apps;
• any damages or liability resulting from your apps, the use of (or inability to use) your apps by end users or the removal of your app from our App Database;
• end user support, handling complaints and inquiries with respect to your apps or results;
• for paid apps, providing and maintaining accurate contact information to end users for support and legal purposes;
• any refunds (if your app is paid);
• providing your own license terms and privacy policy (if applicable) for your app;
• providing clear pricing and licensing information to the end user;
• not using the BioLib Services to advertise, promote, endorse or market, directly or indirectly, any products, services, offerings, solutions or other technologies that, in our sole discretion, compete with the products, services, offerings, solutions or technologies of BioLib; or
• not making any statements that imply an endorsement, certification, warranty or support of your app by BioLib or your affiliation or partnership with BioLib, unless this has been agreed in a separate agreement between us and you

Licensing and Pricing

When you make an app available through our App Database, you determine on what basis the app is licensed to the user. You will need to clearly communicate in your app description otherwise what licensing terms and privacy policy (if applicable) apply to your app. BioLib has no responsibility to ensure that users enter into a valid and binding agreement for the use of your app.

You will determine the pricing of your app. We will set up a payment process via the BioLib Services and submit to you amounts paid for your app. You and us will also separately agree - in writing - on a fee you will pay to us for collecting user fees on your behalf and which we will then deduct from amounts payable to you. We may also ask you to agree to separate terms and conditions for the payment processing on your behalf. We will not be your reseller or distributor but will only facilitate your transaction and payment process via the BioLib Services.

There is no guarantee of any revenue or level of sales of any app. There is also no commitment by BioLib to market or promote your app unless we mutually agree to do so in a separate written agreement signed by you and BioLib.

Reservation of Rights

We reserve the right to remove any Developer Content or indeed any app, at our sole discretion. If we find that you, an app you have created or your Developer Content violate these Terms or other BioLib policies, we may take actions including but not limited to removing or restricting access to your apps or closing your account. We will where feasible provide you a written warning prior to any access restriction measures.

You may remove, edit, delete or make private any app or Developer Content that you have created at any time. Removing, deleting or making private an app does not affect the rights of end-users who have previously purchased your app. If you remove, delete or make private a paid app, that app may remain accessible to the end-users who are licensed to use that app for as long as the relevant licenses remain valid. BioLib may take whatever action it deems necessary to enforce the provisions of this paragraph, provided, however, that you are responsible and liable for any claims, damages or liability by or to end-users or BioLib resulting from your removal, editing, deleting or making private any of your apps.

BioLib may upon removal of your app, whether by us or by you, retain, use and distribute your information, including Developer Content, as necessary to resolve disputes, enforce our agreements and comply with our legal obligations.

Appendix I · List of Prohibited Content and Conduct

Here is a list of content and conduct that are prohibited in connection with using the BioLib Services, any of which constitutes a violation of the Terms:

Prohibited Content

You are not allowed to provide, upload, host, execute, or transmit any data, code, app or other content to the BioLib Services that:

• you do not have the permission or right to use, upload, host, execute or transmit;
• is false, fake or misleading, such as providing us a false or fake identity or e-mail account when creating an account with us, impersonating any person or entity or when communicating with us by phone, e-mail or other means;
• is unlawful, violates applicable export regulations, promotes unlawful activities or violates any applicable laws (such as the GDPR or any other privacy laws);
• contains or installs any active malware or exploits, or uses the BioLib Services for exploit delivery (such as part of a command and control system);
• infringes any proprietary right of any party, including patent, trademark, trade secret, copyright, right of publicity, or other right;
• is or contains sexually obscene, defamatory, false or fraudulent content; or
• is discriminatory or abusive toward any individual or group.

Prohibited Conduct

When using the BioLib Services, you are not allowed to:

• use apps in the App Database that you are not licensed to use;
• reproduce, duplicate, copy, sell, resell or exploit any portion of the BioLib Services;
• take any action that imposes an unreasonable or disproportionately large load on the infrastructure of the BioLib Services (such as our servers), including using our servers for any form of excessive automated bulk activity (for example, spamming or cryptocurrency mining), to place undue burden on our servers through automated means, or to relay any form of unsolicited advertising or solicitation through our servers;
• disrupt or to attempt to disrupt, or to gain or to attempt to hack or otherwise gain unauthorized access to, any part of the BioLib Services (including our servers) or any account created in the BioLib Services;
• perform an action with the intent of introducing any viruses, worms, defects, Trojan horses, malware, or any items of a destructive nature to the BioLib Services;
• use any device, software or routine to interfere or attempt to interfere with the proper working of the BioLib Services, any app in our database or any transaction being conducted via the BioLib Services, or with any other person's use of the BioLib Services;
• probe, scan or test the vulnerability, or breach any security or authentication measure, of the BioLib Services or any network connected to the BioLib Services;
• use any "deep-link", "robot", spider or any other device or process to acquire, copy, extract or monitor any portion of the BioLib Services;
• Reverse engineer or attempt to extract the source code included in any BioLib Services or from any app available in our App Database;
• remove any watermarks, labels or other legal or proprietary notices included in any app, or attempt to modify any app, including any modification for the purpose of disguising or changing any indications of the ownership or source of any app;
• violate the privacy of any third party; or
• harass, abuse, threaten, or incite violence towards any individual or group, including our employees, officers, and agents, or other users of BioLib Services.

Appendix II · Input Data and GDPR

Appendix II Section I - Introduction

BioLib Services are designed with privacy in mind and protecting your input data is a key priority to us. When using the BioLib Services you can submit different types of data and information.

In this Appendix II we set out the agreement which governs specifically the data you acting as or on behalf of a data controller submit when running an app ("Input Data") and our processing of such data. If you, as a private person, submit to us Input Data where you yourself, and only you, are the data subject you are not a data controller, and such Input shall be governed by our Privacy Policy. For more information about how we process other types of personal data (such as your account data, data about your usage of the BioLib Services, transaction data and Developer Content), please refer to our Privacy Policy.

The execution mode in which you choose to run an app has implications for how we treat your Input Data:

• When you run an app on your machine ("Local Execution Mode"), your input data never leaves your machine, and we never get access to or, in any other way, receive, store, parse or process your input data. Hence, BioLib does not become a data processor or sub-processor in the context of GDPR.
• When you run an app on servers belonging to us or one of our sub-processors ("Remote Execution Mode"), your input data is sent to us over the internet.

When you as a data controller run an app in Remote Execution Mode, if the input data you submit constitutes personal data under GDPR, that personal data and our processing of it shall be governed by this Appendix II, Section II. When running an app in Remote Execution Mode, to submit data which constitutes personal data under the GDPR, you must have and be signed into a BioLib account. Hence, as a Guest User, you may not submit data constituting personal data under GDPR, when running an app in Remote Execution Mode.

You acknowledge and agree that to the extent BioLib is a processor or sub-processor of Personal Data subject to the GDPR, the Data Processing Agreement set forth in this Appendix II, Section II shall govern that processing.

Appendix II Section II - Data Processing Agreement

1 - Context

This Data Processing Agreement (the "Clauses") is based on the Standard Contractual Clauses published by the Danish Data Protection agency for the purpose of Article 28(3) of Regulation 2016/679 (the "GDPR"). The Standard Contractual Clauses have undergone minor modifications (such as removal of the table of content, use of the term Supplement instead of Appendix, and the addition of certain clarifying notes), to avoid confusion when the document is used in the context of these Terms.

You (the data controller) and us (the data processor), each a 'party'; together 'the parties' have agreed on the following Contractual Clauses (the "Clauses") in order to meet the requirements of the GDPR and to ensure the protection of the rights of the data subject.

This Appendix II, Section II governs specifically and only data which constitutes personal data under the GDPR and is submitted as input data when running apps in Remote Execution Modes. In the remainder of these Clauses the term "personal data" shall refer specifically to such data.

2 - Preamble

1. These Contractual Clauses (the Clauses) set out the rights and obligations of the data controller and the data processor, when processing personal data on behalf of the data controller.
2. The Clauses have been designed to ensure the parties' compliance with Article 28(3) of Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
3. In the context of the provision of the BioLib Services, the data processor will process personal data on behalf of the data controller in accordance with the Clauses.
4. The Clauses shall take priority over any similar provisions contained in other agreements between the parties.
5. Four supplements are attached to the Clauses and form an integral part of the Clauses.
6. Supplement A contains details about the processing of personal data, including the purpose and nature of the processing, type of personal data, categories of data subject and duration of the processing.
7. Supplement B contains the data controller's conditions for the data processor's use of sub-processors and a list of sub-processors authorized by the data controller.
8. Supplement C contains the data controller's instructions with regards to the processing of personal data, the minimum security measures to be implemented by the data processor and how audits of the data processor and any sub-processors are to be performed.
9. Supplement D contains provisions for other activities which are not covered by the Clauses.
10. The Clauses along with appendices shall be retained in writing, including electronically, by both parties.
11. The Clauses shall not exempt the data processor from obligations to which the data processor is subject pursuant to the General Data Protection Regulation (the GDPR) or other legislation.

3 - The rights and obligations of the data controller

1. The data controller is responsible for ensuring that the processing of personal data takes place in compliance with the GDPR (see Article 24 GDPR), the applicable EU or Member State (References to "Member States" made throughout the Clauses shall be understood as references to "EEA Member States") data protection provisions and the Clauses.
2. The data controller has the right and obligation to make decisions about the purposes and means of the processing of personal data.
3. The data controller shall be responsible, among other, for ensuring that the processing of personal data, which the data processor is instructed to perform, has a legal basis.

4 - The data processor acts according to instructions

1. The data processor shall process personal data only on documented instructions from the data controller, unless required to do so by Union or Member State law to which the processor is subject. Such instructions shall be specified in Supplements A and C. Subsequent instructions can also be given by the data controller throughout the duration of the processing of personal data, but such instructions shall always be documented and kept in writing, including electronically, in connection with the Clauses.
2. The data processor shall immediately inform the data controller if instructions given by the data controller, in the opinion of the data processor, contravene the GDPR or the applicable EU or Member State data protection provisions.

5 - Confidentiality

1. The data processor shall only grant access to the personal data being processed on behalf of the data controller to persons under the data processor's authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and only on a need to know basis. The list of persons to whom access has been granted shall be kept under periodic review. On the basis of this review, such access to personal data can be withdrawn, if access is no longer necessary, and personal data shall consequently not be accessible anymore to those persons.
2. The data processor shall at the request of the data controller demonstrate that the concerned persons under the data processor's authority are subject to the abovementioned confidentiality.

6 - Security of processing

1. Article 32 GDPR stipulates that, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the data controller and data processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
2. The data controller shall evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. Depending on their relevance, the measures may include the following:
3. a. Pseudonymization and encryption of personal data;
4. b. the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services;
5. c. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
6. d. a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.
7. According to Article 32 GDPR, the data processor shall also - independently from the data controller - evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. To this effect, the data controller shall provide the data processor with all information necessary to identify and evaluate such risks.
8. Furthermore, the data processor shall assist the data controller in ensuring compliance with the data controller's obligations pursuant to Articles 32 GDPR, by inter alia providing the data controller with information concerning the technical and organizational measures already implemented by the data processor pursuant to Article 32 GDPR along with all other information necessary for the data controller to comply with the data controller's obligation under Article 32 GDPR.
9. If subsequently - in the assessment of the data controller - mitigation of the identified risks require further measures to be implemented by the data processor, than those already implemented by the data processor pursuant to Article 32 GDPR, the data controller shall specify these additional measures to be implemented in Supplement C.

7 - Use of sub-processors

1. The data processor shall meet the requirements specified in Article 28(2) and (4) GDPR in order to engage another processor (a sub-processor).
2. The data processor shall therefore not engage another processor (sub-processor) for the fulfilment of the Clauses without the prior general written authorization of the data controller.
3. The data processor has the data controller's general authorization for the engagement of sub-processors. The data processor shall inform in writing the data controller of any intended changes concerning the addition or replacement of sub-processors at least 7 days in advance, thereby giving the data controller the opportunity to object to such changes prior to the engagement of the concerned sub-processor(s). Longer time periods of prior notice for specific sub-processing services can be provided in Supplement B. The list of sub-processors already authorized by the data controller can be found in Supplement B.
4. Where the data processor engages a sub-processor for carrying out specific processing activities on behalf of the data controller, the same data protection obligations as set out in the Clauses shall be imposed on that sub-processor by way of a contract or other legal act under EU or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the Clauses and the GDPR.
5. The data processor shall therefore be responsible for requiring that the sub-processor at least complies with the obligations to which the data processor is subject pursuant to the Clauses and the GDPR.
6. A copy of such a sub-processor agreement and subsequent amendments shall - at the data controller's request - be submitted to the data controller, thereby giving the data controller the opportunity to ensure that the same data protection obligations as set out in the Clauses are imposed on the sub-processor. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement, shall not require submission to the data controller.
7. The data processor shall agree a third-party beneficiary clause with the sub-processor where - in the event of bankruptcy of the data processor - the data controller shall be a third-party beneficiary to the sub-processor agreement and shall have the right to enforce the agreement against the sub-processor engaged by the data processor, e.g. enabling the data controller to instruct the sub-processor to delete or return the personal data.
8. If the sub-processor does not fulfil his data protection obligations, the data processor shall remain fully liable to the data controller as regards the fulfilment of the obligations of the sub-processor. This does not affect the rights of the data subjects under the GDPR - in particular those foreseen in Articles 79 and 82 GDPR - against the data controller and the data processor, including the sub-processor.

8 - Transfer of data to third countries or international organizations

1. Any transfer of personal data to third countries or international organizations by the data processor shall only occur on the basis of documented instructions from the data controller and shall always take place in compliance with Chapter V GDPR.
2. In case transfers to third countries or international organizations, which the data processor has not been instructed to perform by the data controller, is required under EU or Member State law to which the data processor is subject, the data processor shall inform the data controller of that legal requirement prior to processing unless that law prohibits such information on important grounds of public interest.
3. Without documented instructions from the data controller, the data processor therefore cannot within the framework of the Clauses:
4. a. transfer personal data to a data controller or a data processor in a third country or in an international organization
5. b. transfer the processing of personal data to a sub-processor in a third country
6. c. have the personal data processed by the data processor in a third country
7. The data controller's instructions regarding the transfer of personal data to a third country including, if applicable, the transfer tool under Chapter V GDPR on which they are based, shall be set out in Supplement C.6.
8. The Clauses shall not be confused with standard data protection clauses within the meaning of Article 46(2)(c) and (d) GDPR, and the Clauses cannot be relied upon by the parties as a transfer tool under Chapter V GDPR.

9 - Assistance to the data controller

1. Taking into account the nature of the processing, the data processor shall assist the data controller by appropriate technical and organizational measures, insofar as this is possible, in the fulfilment of the data controller's obligations to respond to requests for exercising the data subject's rights laid down in Chapter III GDPR.
2. This entails that the data processor shall, insofar as this is possible, assist the data controller in the data controller's compliance with:
3. a. the right to be informed when collecting personal data from the data subject
4. b. the right to be informed when personal data have not been obtained from the data subject
5. c. the right of access by the data subject
6. d. the right to rectification
7. e. the right to erasure ('the right to be forgotten')
8. f. the right to restriction of processing
9. g. notification obligation regarding rectification or erasure of personal data or restriction of processing
10. h. the right to data portability
11. i. the right to object
12. j. the right not to be subject to a decision based solely on automated processing, including profiling
13. In addition to the data processor's obligation to assist the data controller pursuant to Clause 6.3., the data processor shall furthermore, taking into account the nature of the processing and the information available to the data processor, assist the data controller in ensuring compliance with the data controllers obligations under GDPR (if applicable to the data controller):
14. a. The data controller's obligation to without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority, The Danish Data Protection Agency, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons;
15. b. the data controller's obligation to without undue delay communicate the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons;
16. c. the data controller's obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a data protection impact assessment);
17. d. the data controller's obligation to consult the competent supervisory authority, The Danish Data Protection Agency, prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the data controller to mitigate the risk.
18. The parties shall define in Supplement C the appropriate technical and organizational measures by which the data processor is required to assist the data controller as well as the scope and the extent of the assistance required. This applies to the obligations foreseen in Clause 9.1. and 9.2.

10 - Notification of personal data breach

1. In case of any personal data breach, the data processor shall, without undue delay after having become aware of it, notify the data controller of the personal data breach.
2. The data processor's notification to the data controller shall, if possible, take place within 24 hours after the data processor has become aware of the personal data breach to enable the data controller to comply with the data controller's obligation to notify the personal data breach to the competent supervisory authority, cf. Article 33 GDPR.
3. In accordance with Clause 9(2)(a), the data processor shall assist the data controller in notifying the personal data breach to the competent supervisory authority, meaning that the data processor is required to assist in obtaining the information listed below which, pursuant to Article 33(3)GDPR, shall be stated in the data controller's notification to the competent supervisory authority:
4. a. The nature of the personal data including where possible, the categories and approximate number of data subjects concerned, and the categories and approximate number of personal data records concerned;
5. b. the likely consequences of the personal data breach;
6. c. the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
7. The parties shall define in Supplement C all the elements to be provided by the data processor when assisting the data controller in the notification of a personal data breach to the competent supervisory authority.

11 - Erasure and return of data

1. On termination of the provision of personal data processing services, the data processor shall be under obligation to delete all personal data processed on behalf of the data controller and certify to the data controller that it has done so unless Union or Member State law requires storage of the personal data.

The data processor commits to exclusively process the personal data for the purposes and duration provided for by this law and under the strict applicable conditions.

12 - Audit and inspection

1. The data processor shall make available to the data controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 and the Clauses and allow for and contribute to audits, including inspections, conducted by the data controller or another auditor mandated by the data controller.
2. Procedures applicable to the data controller's audits, including inspections, of the data processor and sub-processors are specified in Supplements C.7. and C.8.
3. The data processor shall be required to provide the supervisory authorities, which pursuant to applicable legislation have access to the data controller's and data processor's facilities, or representatives acting on behalf of such supervisory authorities, with access to the data processor's physical facilities on presentation of appropriate identification.

13 - The parties' agreement on other terms

1. The parties may agree other clauses concerning the provision of the personal data processing service specifying e.g. liability, as long as they do not contradict directly or indirectly the Clauses or prejudice the fundamental rights or freedoms of the data subject and the protection afforded by the GDPR.

14 - Commencement and termination

1. The Clauses shall become effective on the date when these Terms become effective.
2. Both parties shall be entitled to require the Clauses renegotiated if changes to the law or inexpediency of the Clauses should give rise to such renegotiation.
3. The Clauses shall apply for the duration of the provision of personal data processing services. For the duration of the provision of personal data processing services, the Clauses cannot be terminated unless other Clauses governing the provision of personal data processing services have been agreed between the parties.
4. If the provision of personal data processing services is terminated, and the personal data is deleted or returned to the data controller pursuant to Clause 11.1. and Supplement C.4., the Clauses may be terminated by written notice by either party.

15 - Data controller and data processor contacts/contact points

1. The parties may contact each other using the following contacts/contact points: The data controller may be contacted using the email address associated with their Account. The data processor may be contacted using legal@biolib.com or the contact information provide on our website.
2. The parties shall be under obligation continuously to inform each other of changes to contacts/contact points.

Supplement A - Information about the processing

The parties acknowledge and agree that the subject-matter of these Clauses is limited to data constituting personal data within the scope of the GDPR, and only such data which the data controller submits as input data to apps executed in Remote Execution Mode (Personal Data).

In any instance where the party referred to as the data controller is a data processor and where BioLib is a sub-processor, the party referred to in these Clauses as the data controller warrants to BioLib that any instructions including appointment of BioLib as a processor or sub-processor, have been authorized by the relevant data controller.

A.1. The purpose of the data processor's processing of personal data on behalf of the data controller is:

The nature and purpose of the processing shall be to provide the BioLib Services as requested and instructed by the data controller in their use and configuration of the BioLib Services.

A.2. The data processor's processing of personal data on behalf of the data controller shall mainly pertain to (the nature of the processing):

Scientific data processing, including among other: data analysis, transformation, combination, visualization, and computation.

A.3. The processing includes the following types of personal data about data subjects:

Scientific data as submitted by the data controller using the BioLib Services. These may include biological, clinical, health related or other data that the data controller has gathered from their research subjects or that the data controller has access to through third parties. The purpose of the apps is mainly to process scientific data. The data that a controller may process in different apps may however vary and the processor will thus process any such data that a data controller chooses to upload to any app.

A.4. Processing includes the following categories of data subject:

The categories of data subjects are those that appear in the data which the data controller submits. These may include research subjects, like patients or other data subjects who figure in research data bases.

A.5. The data processor's processing of personal data on behalf of the data controller may be performed when the Clauses commence. Processing has the following duration:

The Clauses will remain in effect for the duration of the data controller's right to use the BioLib Services.

The processing of Personal Data will terminate as soon as the requested execution of a requested app has been completed and a result has been returned to the data controller, at which point the personal data will be deleted from the data processor's servers.

Supplement B - Authorized sub-processors

B.1. Approved sub-processors

On commencement of the Clauses, the data controller authorizes the engagement of the following sub-processors:

• Sub-processor: BioLib, Inc.
• Address: 651 N. Broad Street, Suite 206, Middletown, DE 19709, USA
• Description of Processing: Execution of automated data processing including data transformation, combination and visualization using BioLib infrastructure. The sub processor is established outside of the EEA. Please refer to Supplement C.6.
• Sub-processor: Amazon Web Services EMEA SARL and their Affiliate entities. You can find a full list of Amazon Web Services Affiliate entities at https://aws.amazon.com/compliance/sub-processors/ .
• Address: 38 Avenue John F. Kennedy, L-1855, Luxembourg
• Description of Processing: Execution of automated data processing including data transformation, combination and visualization using BioLib software-infrastructure executed on Amazon Web Services.
• Sub-processor: Microsoft Ireland Operations, Ltd. and their Affiliate entities.
• Address: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland
• Description of Processing: Execution of automated data processing including data transformation, combination and visualization using BioLib software-infrastructure executed on Microsoft Azure.

B.2. Prior notice for the authorization of sub-processors

The addition of any new or replacement sub-processor shall be communicated to the data controller using the on-file contact details at least 7 days prior to this sub-processor processing any personal data. The data controller's continued use of the BioLib Services shall constitute the data controller's consent to the addition of this new or replacement sub-processor. If the data controller cannot accept the addition of this new or replacement sub-processor, we may terminate the data controller's account.

Supplement C - Instruction pertaining to the use of personal data

C.1. The subject of/instruction for the processing

The data processor's processing of personal data on behalf of the data controller shall be carried out by the data processor performing the following:

Providing the data controller computation and data transformation, analysis or visualization as requested and instructed by the data controller through their use and configuration of the BioLib Services.

The data controller acknowledges and agrees that these Terms along with the data controller's use and configuration of features in the BioLib Services constitute the data controller's complete and final documented instructions to the data processor for the processing of personal data.

Subsequent instructions can be given by the data controller throughout the duration of the processing of personal data using the user or application interfaces of the BioLib Services or in writing, including electronically, in connection with these Clauses.

C.2. Security of processing

The level of security shall take into account: that the processing may involve personal data subject to Article 9 GDPR on 'special categories of personal data' which is why a 'high' level of security should be established.

The data processor shall hereafter be entitled and under obligation to make decisions about the technical and organizational security measures that are to be applied to create the necessary (and agreed) level of data security.

Personal data submitted using BioLib Services is always encrypted during transfer and when stored at rest.

C.3. Assistance to the data controller

The data processor shall insofar as this is possible - within the scope and the extent of the assistance specified below - assist the data controller in accordance with Clause 9.1. and 9.2. by implementing the following technical and organizational measures:

Given the nature of the processing and the design of the BioLib Services it is not technically possible for the data processor to provide the data controller or any other party with any information about particular data subjects.

The data processor shall comply with reasonable requests by the data controller to assist with the data controller's response to data subject requests. If the data processor receives a request from a data subject to exercise one or more of its rights under the GDPR in connection with the BioLib Services where BioLib is a data processor or sub-processor, BioLib will redirect the data subject to make its request directly to the data controller. The data controller will be responsible for responding to any such request.

C.4. Storage period/erasure procedures

Personal data will be deleted immediately after the requested computations have been completed and the results returned to the data controller.

Since the data processor does not store personal data submitted through apps on BioLib beyond completion of the requested computations, it is not possible for the data processor to restore submitted personal data after results have been returned. The data controller acknowledges and agrees that the data processor has no liability for the deletion of any personal data submitted through the BioLib Services.

The data processor shall maintain all records about the carried-out processing as required by Article 30(2) of the GDPR and, to the extent applicable to the processing of Personal Data on behalf of the data controller, make them available to the data controller upon request.

C.5. Processing location

Processing of the personal data under the Clauses cannot be performed at other locations than the following without the data controller's prior written authorization:

• In Denmark or another EU country by BioLib Technologies Aps, or approved sub-processors at their server facilities
• In the United States of America by affiliated companies, or their approved sub-processors at their server facilities

C.6. Instruction on the transfer of personal data to third countries

If the data controller does not in the Clauses or subsequently provide documented instructions pertaining to the transfer of personal data to a third country, the data processor shall not be entitled within the framework of the Clauses to perform such transfer.

The data controller agrees that data may be transferred to and stored and processed to countries in the EU or the USA where approved sub-processors operate. All transfers of Personal Data to a third country or an international organization will be subject to appropriate safeguards as described in Article 46 of the GDPR and such transfers and safeguards will be documented according to Article 30(2) of the GDPR. When data is transferred to, stored, or processed in a third country, the data processor will prior to the any sub-processor's processing of Personal Data have entered into the unchanged version of the EU Commission's Standard Contractual Clauses (controller to processor -2010/87/EU) for the transfer of personal data to third countries. When doing so the data controller will accede to the EU Commission's Standard Contractual Clauses between the data processor and the third country sub-processor and the data processor will enforce the Standard Contractual Clauses against the sub-processor on behalf of the Data Controller.

C.7. Procedures for the data controller's audits, including inspections, of the processing of personal data being performed by the data processor

The data controller will send any request for an audit under Section 12.2 to the data processor as set out in section 15.

The data processor and the data controller will discuss and agree in advance on the reasonable start date, scope and duration of, and security and confidentiality controls applicable to, any audit or inspection.

Costs associated with any audit or inspection requested by the data controller will be covered by the data controller. The data processor may charge a reasonable fee for any audit or inspection. The data processor will provide the data controller with further details of any applicable fees, and the basis of its calculation, in advance of any such audit.

The data processor may object to any third party auditor appointed by the data controller to conduct any audit if the auditor is, in the data processor's reasonable opinion, not suitably qualified or independent, a competitor of the data processor or otherwise manifestly unsuitable. Any such objection by the data processor will require the data controller to appoint another auditor or conduct the audit itself.

If the data controller requests an auditor's report from an independent third party concerning the data processor's compliance with the GDPR, the applicable EU or Member State data protection provisions and these Clauses, the data controller will within reason, taking into account the nature and duration of the data processing, seek to accommodate such requests. The cost of producing such auditor's reports shall, unless otherwise agreed in writing, be covered by the data controller. Any such report would be provided in confidentiality and under a non-disclosure agreement.

C.8. Procedures for audits, including inspections, of the processing of personal data being performed by sub-processors

The data processor or the data processor's representative shall have access to inspect, including physically inspect, the places, where the processing of personal data is carried out by the sub-processor, including physical facilities as well as systems used for and related to the processing. Such an inspection shall be performed, when the data processor deems it required.

Documentation for such inspections shall without delay be submitted to the data controller for information. The data controller may contest the scope and/or methodology of the report and may in such cases request a new inspection under a revised scope and/or different methodology. The data controller may on its own initiative request an audit or inspection of the sub processor on the same terms and conditions as set out in section C.7.

If the data controller requests an auditor's report from an independent third party concerning a sub-processor's compliance with the GDPR, the applicable EU or Member State data protection provisions and these Clauses, the data controller will within reason, taking into account the nature and duration of the data processing, seek to accommodate and facilitate such requests. The cost of producing such auditor's reports shall, unless otherwise agreed in writing, be covered by the data controller.

Supplement D - The parties' terms of agreement on other subjects

The Clauses in this Appendix II (and its Supplements) are a part of the Terms. The provisions of the Terms shall apply to this Appendix II to the extent such provisions do not contradict provisions herein.