xFigura Terms of Service
xFigura, Inc. (“xFigura”, “we”, “us”, or “our”) has made these Terms of Service (the “Agreement”) available to explain the terms and conditions by which you may access and use (a) xFigura’s products and services, (b) www.xfigura.ai, and (c) other related products and services that link to this Agreement (collectively, the “Platform”).
You must read this Agreement carefully as it governs your use of the Platform. By accessing or using the Platform, you signify that you have read, understand, and agree to be bound by this Agreement in its entirety. If you do not agree, you are not authorized to access or use our Platform and should not use our Platform.
PLEASE READ THESE TERMS OF SERVICE CAREFULLY, AS THEY CONTAIN AN AGREEMENT TO ARBITRATE AND OTHER IMPORTANT INFORMATION REGARDING YOUR LEGAL RIGHTS, REMEDIES, AND OBLIGATIONS. THE AGREEMENT TO ARBITRATE REQUIRES (WITH LIMITED EXCEPTION) THAT YOU SUBMIT CLAIMS YOU HAVE AGAINST US TO BINDING AND FINAL ARBITRATION, AND FURTHER (1) YOU WILL ONLY BE PERMITTED TO PURSUE CLAIMS AGAINST XFIGURA ON AN INDIVIDUAL BASIS, NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS OR REPRESENTATIVE ACTION OR PROCEEDING, (2) YOU WILL ONLY BE PERMITTED TO SEEK RELIEF (INCLUDING MONETARY, INJUNCTIVE, AND DECLARATORY RELIEF) ON AN INDIVIDUAL BASIS, AND (3) YOU MAY NOT BE ABLE TO HAVE ANY CLAIMS YOU HAVE AGAINST US RESOLVED BY A JURY OR IN A COURT OF LAW.
1. xFigura Platform
1.1 Our Platform
xFigura provides an AI-powered collaborative creative design platform that allows you to generate images, videos, and other content (“Output”) based on text, content, instructions or other input you provide to xFigura or other images, music, videos, and other content you may upload or provide to xFigura (“User Input”). We are constantly improving the Platform. You agree and acknowledge that the Platform is subject to modification and change, including but not limited to the algorithms and methods used to generate the Output, the Third-Party Models that are available to you, and any other features that may be available to you.
1.2 Registration
In order to use certain portions of the Platform, you must register an account by providing us with your name, email, and other information requested in our registration form. You agree to provide us with complete and accurate registration information. You may not attempt to impersonate another person in registration. If you are registering for our Platform on behalf of an organization, you warrant that you are authorized to agree to this Agreement on their behalf. You agree to be responsible for the security of your account. You accept that you are solely responsible for all activities that take place through your account, and that failure to limit access to your devices or browser may permit unauthorized use by third-parties. Only one user may use the Platform per registered account. Each user of the Platform may only have one account.
1.3 Third-Party Models
The Platform incorporates or allows you to connect certain AI models or services provided by third parties (“Third-Party Models”), which may be subject to additional terms imposed by the applicable provider (“Flow-Down Terms”). A current list of Third-Party Models is available at https://xfigura.notion.site/. By using a Third-Party Model, you agree to comply with any applicable Flow-Down Terms (if any), and xFigura may suspend or restrict your access to a Third-Party Model to comply with such terms or this Agreement. xFigura does not control, operate, endorse, or assume any responsibility for any Third-Party Model, and makes no representations or warranties with respect to any Third-Party Model or any Output generated thereby.
1.4 No Minors Permitted
Our Platform is not intended for minors under the age of 16. If you are a minor under the age of 16, please do not register for our Platform or send any personal information to us. If you have reason to believe that a minor under the age of 16 is using our Platform, please let us know immediately at info@xfigura.ai and we will seek to revoke access and delete any associated information as quickly as possible.
1.5 Additional Policies
You agree and acknowledge that your use of the Platform is subject to our Privacy Policy available at https://xfigura.ai/terms#privacy-policy.
2. Usage Requirements
2.1 Use of Platform
Subject to your compliance with this Agreement, we grant you a non-exclusive, non-transferable, non-sublicensable right to access and use the Platform in accordance with this Agreement. You will comply with this Agreement and all applicable laws when using the Platform. We and our affiliates own all rights, title, and interest in and to the Platform, including the underlying technology and intellectual property rights therein.
2.2 Content
You retain ownership of all User Input you provide to the Platform and all Output generated from your User Input. User Input and all Output is collectively referred to as “Customer Content”. Subject to your compliance with this Agreement and to the extent xFigura acquires any right in any Customer Content, xFigura hereby assigns to you all its right, title and interest in and to your Customer Content. During the term of this Agreement, xFigura may use your Customer Content as reasonably necessary to provide you with access to the Platform. In addition, during and after the term of this Agreement, xFigura may use your Customer Content to comply with applicable laws and enforce our policies and to maintain, improve, train, finetune, and enhance xFigura’s current and future products, services and technologies. You are responsible for all Customer Content, including for ensuring that it does not violate any applicable law or this Agreement.
2.3 Similar Output
Due to the nature of machine learning, Output may not be unique across users and the Platform may generate the same or similar output for xFigura or a third party. Other users may also provide similar User Input and receive the same or similar Output. Output that is requested by and generated for other users are not considered yours.
2.4 Third-Party Integrations
The Platform may integrate with or otherwise make available certain applications and materials that are developed or otherwise provided by a party other than xFigura, including design files, plugins, component libraries, services, products, platforms, integrations, and code components (collectively, “Non-xFigura Resources”). xFigura does not warrant or guarantee the functionality, availability, or reliability of any such Non-xFigura Resources. In addition, the use of such Non-xFigura Resources may require you to agree to additional terms and conditions imposed by the respective service providers, which are independent of this Agreement. xFigura reserves the right to modify or discontinue any Non-xFigura Resource at any time without prior notice. xFigura will not be liable for any damages or losses resulting from such modification or discontinuation.
2.5 Feedback
We appreciate feedback, comments, ideas, proposals and suggestions for improvements (collectively, “Feedback”). If you provide any Feedback to xFigura, you hereby grant xFigura the right to freely use such Feedback to maintain, improve, and enhance xFigura’s current and future products, services and technologies without restriction or compensation to you.
2.6 Usage Data
You agree that xFigura will have the right to collect and analyze data and other information relating to the access, use, and performance of the Platform (“Usage Data”), and xFigura will be free (during and after the term of this Agreement) to use Usage Data to maintain, improve, train, finetune, and enhance xFigura’s current and future products, services and technologies. Examples of Usage Data include textual inputs you provide to xFigura, technical logs, metadata, telemetry data, information about how you use and interact with the Platform, Third-Party Models and other Non-xFigura Resources.
2.7 Platform Restrictions
You may not (i) use the Platform in a way that infringes, misappropriates or violates any person’s rights; (ii) reverse assemble, reverse compile, decompile, translate or otherwise attempt to discover the source code or underlying components of models, algorithms, and systems of the Platform (except to the extent such restrictions are contrary to applicable law); (iii) use output from the Platform to develop models that compete with xFigura; (iv) use any automated or programmatic method to extract data or output from the Platform, including scraping, web harvesting, or web data extraction; (v) represent that output from the Platform was human-generated when it is not; (vi) send us any personal information of children under 13 or the applicable age of digital consent; or (vii) use the Platform in violation of any applicable laws and regulations (including any export control laws). You will comply with any rate limits and other requirements in our documentation.
2.8 User Conduct
You represent, warrant, and covenant that: (i) any Customer Content that you transfer via the Platform has been legally obtained and belong to you; (ii) you will not upload or create any Customer Content that contains gore, sexual abuse material or any content that exploits or promotes harm to any individual; (iii) you will not engage in any conduct (including to create any Output) that is or could be considered illegal, obscene, defamatory, threatening, intimidating, harassing, hateful or racially or ethnically offensive; (iv) you will not provide any false, inaccurate or misleading information while using the Platform, or engage in any activity that operates to defraud xFigura, other users of the Platform, or any other person or entity; (v) you will not interfere with or disrupt the Platform or servers or networks connected to the Platform, or disobey any requirements, procedures, policies, or regulations of networks connected to the Platform; (vi) you will not impersonate any person or entity, or falsely state or otherwise misrepresent your affiliation with a person or entity; (vii) you will not infringe, misappropriate or violate any intellectual property, privacy, publicity or other proprietary rights of xFigura or any third party; (viii) you will not disguise your location through IP proxying or other methods; and (ix) you will not obtain or attempt to access or otherwise obtain any content or information through any means not intentionally made available or provided for through the Platform, including attempting to avoid, bypass, remove, deactivate, impair, descramble or otherwise circumvent any technological measure implemented by us or any of our service providers or any other third party to protect the Platform.
2.9 Confidentiality
In connection with the Platform, you may be given access to certain Confidential Information of xFigura. You may use Confidential Information only as needed to use the Platform as permitted under this Agreement. You may not disclose Confidential Information to any third party, and you will protect Confidential Information in the same manner that you protect your own confidential information of a similar nature, using at least reasonable care. “Confidential Information” means nonpublic information that xFigura or its affiliates or third parties designate as confidential or should reasonably be considered confidential under the circumstances, including software, specifications, and other nonpublic business information. Confidential Information does not include information that: (i) is or becomes generally available to the public through no fault of yours (ii) you already possess without any confidentiality obligations when you received it under this Agreement (iii) is rightfully disclosed to you by a third party without any confidentiality obligations or (iv) you independently developed without using Confidential Information. You may disclose Confidential Information when required by law or the valid order of a court or other governmental authority if you give reasonable prior written notice to xFigura and use reasonable efforts to limit the scope of disclosure, including assisting us with challenging the disclosure requirement, in each case where possible.
3. Fees and Payments
3.1 Fees and Billing
To the extent the Platform is made available to you for a fee, you will pay all fees charged to your account (“Fees”) according to the prices and terms on our pricing page at https://xfigura.ai/pricing, or as otherwise agreed between us in writing. We have the right to correct pricing errors or mistakes even if we have already issued an invoice or received payment. You will provide complete and accurate billing information including a valid and authorized payment method. We will charge your payment method on an agreed-upon periodic basis, but may reasonably change the date on which the charge is posted. You authorize xFigura, and our third-party payment processor(s), to charge your payment method for the Fees. If your payment cannot be completed, we will provide you written notice and may suspend access to the Platform until payment is received. Fees are payable in U.S. dollars and are due upon invoice issuance. Payments are nonrefundable except as provided in this Agreement.
3.2 Automatic Renewal
If you have purchased a paid subscription, your subscription will automatically renew at the end of each billing period (monthly or annual, as selected at signup) for a successive period of the same length, unless you cancel before the renewal date. By starting a subscription, you authorize us to automatically charge your payment method on file for the then-current fees, plus applicable taxes, at the start of each renewal period, without further authorization from you, until you cancel.
3.3 Cancellation
You may cancel your Subscription at any time through your account settings, without contacting customer support. Cancellation will take effect at the end of your current billing period, and you will not be charged for any subsequent period. We do not provide refunds or credits for partial billing periods, except as required by applicable law or as otherwise stated in these Terms.
3.4 Right to Cancel for UK Consumers
If you are a consumer resident in the United Kingdom, you may cancel your subscription within 14 days of purchase, for any reason, by emailing us at info@xfigura.ai. We will refund all payments received from you within 14 days of receiving your cancellation notice, using your original payment method. If we have already begun providing the subscription at your request during this period, we may deduct a proportionate amount for the service provided before you cancelled.
3.5 Service Credits
We may offer the option to prepay for certain use of the Platform through the purchase of credits (“Service Credits”). Service Credits represent the amount you have paid in advance for use of the Platform. Service Credits are not legal tender or currency; are not redeemable, refundable, or exchangeable for any sum of money or monetary value; have no equivalent value in fiat currency; do not act as a substitute for fiat currency; and do not constitute or confer upon you any personal property right. Service Credits are non-transferable and may be used only in connection with the Platform. All sales of Service Credits are final. Service Credits are not refundable and expire one year after the date of purchase or issuance if not used, unless otherwise specified at the time of purchase.
3.6 Taxes
Unless otherwise stated, Fees do not include federal, state, local, and foreign taxes, duties, and other similar assessments (“Taxes”). You are responsible for all Taxes associated with your purchase, excluding Taxes based on our net income, and we may invoice you for such Taxes. You agree to timely pay such Taxes and provide us with documentation showing the payment, or additional evidence that we may reasonably require. xFigura uses the name and address in your account registration as the place of supply for tax purposes, so you must keep this information accurate and up-to-date.
3.7 Changes in Fees
We may change our prices by posting notice to your account and/or to our website. Price increases will be effective 14 days after they are posted, except for increases made for legal reasons or increases made to any free or beta services, which will be effective immediately. Any price changes will apply to the Fees charged to your account immediately after the effective date of the changes.
3.8 Free Tier
xFigura may make available a free-tier of the Platform. You may only use the free tier for non-commercial purposes only. In addition, you may not create more than one account to benefit from credits provided in the free tier of the Platform. If we believe you are not using the free tier in good faith, we may charge you standard fees or stop providing access to the Platform. xFigura reserves the right to modify or discontinue your access to the free tier of the Platform at any time without prior notice. xFigura will not be liable for any damages or losses resulting from such modification or discontinuation.
4. Term and Termination
4.1 Termination; Suspension
This Agreement takes effect when you first use the Platform and remain in effect until terminated. You may terminate this Agreement at any time for any reason by discontinuing the use of the Platform. We may terminate this Agreement for any reason by providing you at least 30 days’ advance notice. We may terminate this Agreement immediately upon notice to you if you materially breach this Agreement (including any breach of Sections 2.7 and 2.8), if there are changes in relationships with third party technology providers outside of our control, or to comply with law or government requests. We may suspend your access to the Platform, with or without notice, if you do not comply with this Agreement, if your use poses a security risk to us or any third party, or if we suspect that your use is fraudulent or could subject us or any third party to liability.
4.2 Effect on Termination
Upon termination, you will stop using the Platform and you will promptly return or, if instructed by us, destroy any Confidential Information. The sections of this Agreement which by their nature should survive termination or expiration should survive, including but not limited to Sections 2.2, 2.5, 2.6, 2.7, 2.8, 2.9, 4, and 5-8.
5. Proprietary Rights
5.1 Platform Content
You acknowledge and agree that the Platform may contain content, assets, or features made available by xFigura or other xFigura users (“Platform Content”) that are protected by copyright, patent, trademark, trade secret, or other proprietary rights and laws. Except as expressly set forth herein, we reserve all right, title and interest to the Platform Content.
5.2 Trademarks
The xFigura name and logos are trademarks and service marks of xFigura (collectively the “xFigura Trademarks”). Other company, product, and service names and logos used and displayed via the Platform may be trademarks or service marks of their respective owners who may not endorse or be affiliated with or connected to xFigura. This Agreement and the Platform do not grant you any license or right to use any of xFigura Trademarks, without our prior written permission.
5.3 Copyright Complaints
xFigura respects the intellectual property of others, and we ask our users to do the same. If you believe that your work has been copied in a way that constitutes copyright infringement, or that your intellectual property rights have been otherwise violated, you should notify xFigura of your infringement claim in accordance with the procedure set forth below.
xFigura will process and investigate notices of alleged infringement and will take appropriate actions under the Digital Millennium Copyright Act (“DMCA”) and other applicable intellectual property laws with respect to any alleged or actual infringement. A notification of claimed copyright infringement should be emailed to xFigura’s Copyright Agent at info@xfigura.ai (Subject line: “DMCA Takedown Request”).
To be effective, the notification must be in writing and contain the following information:
a physical or electronic signature of a person authorized to act on behalf of the owner of the copyright or other intellectual property interest that is allegedly infringed;
identification of the copyrighted work or other intellectual property that you claim has been infringed, or, if multiple copyrighted works or other intellectual property are covered by a single notification, a representative list of such works or other intellectual property;
identification of the content that is claimed to be infringing or to be the subject of infringing activity, and where the content that you claim is infringing is located within the Platform, with enough detail that we may find it within the Platform;
your address, telephone number, and email address;
a statement by you that you have a good faith belief that the disputed use is not authorized by the copyright or intellectual property owner, its agent, or the law; and
a statement by you that the information in your notice is accurate and, under penalty of perjury, that you are the copyright or intellectual property owner or are authorized to act on the behalf of the owner of the copyright or intellectual property that is allegedly infringed.
5.4 Counter-Notice
If you believe that your Customer Content that was removed (or to which access was disabled) is not infringing, or that you have the authorization from the copyright owner, the copyright owner’s agent, or pursuant to the law, to upload and use the content in your Customer Content, you may send a written counter-notice containing the following information to the Copyright Agent:
your physical or electronic signature;
identification of the content that has been removed or to which access has been disabled and the location at which the content appeared before it was removed or disabled;
a statement by you, made under penalty of perjury, that you have a good faith belief that the content was removed or disabled as a result of mistake or a misidentification of the content to be removed or disabled; and
your name, address, telephone number, and email address, a statement that you consent to the jurisdiction of the federal court located within the District of Massachusetts and a statement that you will accept service of process from the person who provided notification of the alleged infringement.
If a counter-notice is received by the Copyright Agent, xFigura will send a copy of the counter-notice to the original complaining party informing them that xFigura may replace the removed content or cease disabling it within ten (10) business days. Unless the owner of the applicable copyrighted work or other intellectual property files an action seeking a court order against xFigura or the user, the removed content may be replaced, or access to it restored, within ten (10) to fourteen (14) business days or more after receipt of the counter-notice, at our sole discretion.
5.5 Repeat Infringer Policy
In accordance with the DMCA and other applicable law, xFigura has adopted a policy of terminating, in appropriate circumstances and at xFigura’s sole discretion, the accounts of users who are deemed to be repeat infringers. xFigura may also at its sole discretion limit access to the Platform and/or terminate the accounts of any users who infringe any intellectual property rights of others, whether or not there is any repeat infringement.
6. Indemnification, Disclaimer, and Limitations on Liability
6.1 Indemnity
You agree to hold harmless, defend, and indemnify us and our officers, directors, employees, contractors, agents, affiliates, and subsidiaries from and against all claims, damages, obligations, losses, liabilities, costs, and expenses arising from: (a) your access to or use of our Platform (including any Customer Content) or (b) your violation of any term or condition of this Agreement, the right of any third party, or any other applicable law, rule, or regulation. You will not settle any such claim without our prior written consent, and we reserve the right, at our own expense, to assume the exclusive defense and control of any matter otherwise subject to indemnification by you, in which case you agree to cooperate with our defense of such claim.
6.2 Disclaimer
We plan to continue to develop and improve the Platform, but we make no guarantees or promises about how it operates or that it will function as intended, and your use is at your own risk. THE PLATFORM AND OUTPUT ARE PROVIDED “AS IS.” EXCEPT TO THE EXTENT PROHIBITED BY LAW, WE AND OUR AFFILIATES AND LICENSORS MAKE NO WARRANTIES (EXPRESS, IMPLIED, STATUTORY OR OTHERWISE) WITH RESPECT TO THE PLATFORM OR OUTPUT, AND DISCLAIM ALL WARRANTIES INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, SATISFACTORY QUALITY, NON-INFRINGEMENT, AND QUIET ENJOYMENT, AND ANY WARRANTIES ARISING OUT OF ANY COURSE OF DEALING OR TRADE USAGE. WE DO NOT WARRANT THAT THE PLATFORM WILL BE UNINTERRUPTED, ACCURATE OR ERROR FREE, OR THAT ANY CUSTOMER CONTENT WILL BE SECURE OR NOT LOST OR ALTERED. XFIGURA DOES NOT WARRANT OR SUPPORT, AND WILL NOT HAVE ANY RESPONSIBILITY OR LIABILITY OF ANY KIND FOR, NON-XFIGURA RESOURCES OR ANY OUTPUT GENERATED THEREFROM.
6.3 AI-Generated Output
OUTPUT IS GENERATED AUTOMATICALLY USING ARTIFICIAL INTELLIGENCE AND MAY BE INACCURATE, INCOMPLETE, OR SIMILAR TO THIRD-PARTY CONTENT, INCLUDING CONTENT THAT MAY RESEMBLE EXISTING COPYRIGHTED WORKS, TRADEMARKS, OR THE LIKENESS OF REAL INDIVIDUALS. WE DO NOT REVIEW OUTPUT BEFORE IT IS PROVIDED TO YOU AND MAKE NO GUARANTEE THAT OUTPUT IS FREE OF THIRD-PARTY RIGHTS OR SUITABLE FOR ANY PARTICULAR USE. YOU ARE SOLELY RESPONSIBLE FOR REVIEWING AND CLEARING OUTPUT BEFORE RELYING ON, PUBLISHING, OR COMMERCIALLY USING IT.
6.4 Limitations of Liability
UNDER NO CIRCUMSTANCES SHALL WE OR ANY OF OUR OFFICERS, DIRECTORS, EMPLOYEES, CONTRACTORS, AGENTS, AFFILIATES, OR SUBSIDIARIES BE LIABLE TO YOU FOR ANY INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, INCLUDING, BUT NOT LIMITED TO, DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, DATA, OR OTHER INTANGIBLE PROPERTY, ARISING OUT OF OR RELATING TO ANY ACCESS OR USE OF OR INABILITY TO ACCESS OR USE OF THE PLATFORM, NOR WILL WE BE RESPONSIBLE FOR ANY DAMAGE, LOSS, OR INJURY RESULTING FROM HACKING, TAMPERING, OR OTHER UNAUTHORIZED ACCESS OR USE OF OUR PLATFORM OR THE INFORMATION CONTAINED WITHIN IT, WHETHER SUCH DAMAGES ARE BASED IN CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE, ARISING OUT OF OR IN CONNECTION WITH AUTHORIZED OR UNAUTHORIZED USE OF OUR PLATFORM.
SOME JURISDICTIONS DO NOT ALLOW THE LIMITATION OF LIABILITY FOR PERSONAL INJURY, OR OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS LIMITATION MAY NOT APPLY TO YOU. IN NO EVENT SHALL OUR TOTAL LIABILITY TO YOU FOR ALL DAMAGES (OTHER THAN AS MAY BE REQUIRED BY APPLICABLE LAW IN CASES INVOLVING PERSONAL INJURY) EXCEED IN THE AGGREGATE (A) THE AMOUNTS YOU HAVE PAID US TO US IN THE SIX (6) MONTHS PRECEDING THE DATE OF THE CLAIM OR (B) ONE HUNDRED U.S. DOLLARS ($100.00 USD) OR ITS EQUIVALENT IN THE LOCAL CURRENCY OF THE APPLICABLE JURISDICTION.
THE FOREGOING LIMITATIONS WILL NOT APPLY TO THE EXTENT PROHIBITED BY LAW.
7. Dispute Resolution By Binding Arbitration
7.1 Agreement to Arbitrate
This Dispute Resolution by Binding Arbitration section is referred to in this Agreement as the “Arbitration Agreement.” You agree that any and all disputes or claims that have arisen or may arise between you and xFigura, whether arising out of or relating to this Agreement (including any alleged breach thereof), the Platform, and any aspect of the relationship or transactions between us, shall be resolved exclusively through final and binding arbitration, rather than a court, in accordance with the terms of this Arbitration Agreement, except that you may assert individual claims in small claims court, if your claims qualify. Further, this Arbitration Agreement does not preclude you from bringing issues to the attention of federal, state, or local agencies, and such agencies can, if the law allows, seek relief against us on your behalf. You agree that, by entering into this Agreement, you and xFigura are each waiving the right to a trial by jury or to participate in a class action. Your rights will be determined by a neutral arbitrator, not a judge or jury. The Federal Arbitration Act governs the interpretation and enforcement of this Arbitration Agreement.
7.2 Prohibition of Class and Representative Actions and Non-Individualized Relief
YOU AND XFIGURA AGREE THAT EACH OF US MAY BRING CLAIMS AGAINST THE OTHER ONLY ON AN INDIVIDUAL BASIS AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE ACTION OR PROCEEDING. UNLESS BOTH YOU AND XFIGURA AGREE OTHERWISE, THE ARBITRATOR MAY NOT CONSOLIDATE OR JOIN MORE THAN ONE PERSON’S OR PARTY’S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A CONSOLIDATED, REPRESENTATIVE, OR CLASS PROCEEDING. ALSO, THE ARBITRATOR MAY AWARD RELIEF (INCLUDING MONETARY, INJUNCTIVE, AND DECLARATORY RELIEF) ONLY IN FAVOR OF THE INDIVIDUAL PARTY SEEKING RELIEF AND ONLY TO THE EXTENT NECESSARY TO PROVIDE RELIEF NECESSITATED BY THAT PARTY’S INDIVIDUAL CLAIM(S), EXCEPT THAT YOU MAY PURSUE A CLAIM FOR AND THE ARBITRATOR MAY AWARD PUBLIC INJUNCTIVE RELIEF UNDER APPLICABLE LAW TO THE EXTENT REQUIRED FOR THE ENFORCEABILITY OF THIS PROVISION.
7.3 Pre-Arbitration Dispute Resolution
xFigura is always interested in resolving disputes amicably and efficiently, and most user concerns can be resolved quickly and to the user’s satisfaction by emailing support at info@xfigura.ai. If such efforts prove unsuccessful, a party who intends to seek arbitration must first send to the other, by certified mail, a written Notice of Dispute (“Notice”). The Notice to xFigura should be sent to 20 Fisher Avenue, Boston, Massachusetts, 02120, USA (“Notice Address”). The Notice must (i) describe the nature and basis of the claim or dispute and (ii) set forth the specific relief sought. If xFigura and you do not resolve the claim within sixty (60) calendar days after the Notice is received, you or xFigura may commence an arbitration proceeding. During the arbitration, the amount of any settlement offer made by xFigura or you shall not be disclosed to the arbitrator until after the arbitrator determines the amount, if any, to which you or xFigura is entitled.
7.4 Arbitration Procedures
To begin an arbitration proceeding, you must send a letter requesting arbitration and describing your dispute or claim or request for relief to the address set forth in Section 7.3. The arbitration will be conducted by JAMS, an established alternative dispute resolution provider. Disputes involving claims, counterclaims, or request for relief under $250,000, not inclusive of attorneys’ fees and interest, shall be subject to JAMS’s most current version of the Streamlined Arbitration Rules and procedures available at http://www.jamsadr.com/rules-streamlined-arbitration/; all other disputes shall be subject to JAMS’s most current version of the Comprehensive Arbitration Rules and Procedures, available at http://www.jamsadr.com/rules-comprehensive-arbitration/. JAMS’s rules are also available at www.jamsadr.com or by calling JAMS at 800-352-5267. If JAMS is not available to arbitrate, the parties will select an alternative arbitral forum. If the arbitrator finds that you cannot afford to pay JAMS’s filing, administrative, hearing and/or other fees and cannot obtain a waiver from JAMS, xFigura will pay them for you. In addition, xFigura will reimburse all such JAMS’s filing, administrative, hearing and/or other fees for disputes, claims, or requests for relief totaling less than $10,000 unless the arbitrator determines the claims are frivolous. You may choose to have the arbitration conducted by telephone, based on written submissions, or in person in the county where you live or at another mutually agreed location. Any judgment on the award rendered by the arbitrator may be entered in any court of competent jurisdiction.
7.5 Authority of Arbitrator
The arbitrator shall have exclusive authority to (a) determine the scope and enforceability of this Arbitration Agreement and (b) resolve any dispute related to the interpretation, applicability, enforceability or formation of this Arbitration Agreement including, but not limited to, any assertion that all or any part of this Arbitration Agreement is void or voidable. The arbitration will decide the rights and liabilities, if any, of you and xFigura. The arbitration proceeding will not be consolidated with any other matters or joined with any other cases or parties. The arbitrator shall have the authority to grant motions dispositive of all or part of any claim. The arbitrator shall have the authority to award monetary damages and to grant any non-monetary remedy or relief available to an individual under applicable law, the arbitral forum’s rules, and these Terms of Service (including the Arbitration Agreement). The arbitrator shall issue a written award and statement of decision describing the essential findings and conclusions on which the award is based, including the calculation of any damages awarded. The arbitrator has the same authority to award relief on an individual basis that a judge in a court of law would have. The award of the arbitrator is final and binding upon you and us.
7.6 Batch Arbitration
If seventy-five (75) or more claimants represented by the same or similar counsel file demands for arbitration raising substantially similar disputes within 90 days of each other, then you and xFigura agree that JAMS will administer them in batches of up to seventy-five (75) claimants each (“Batch”), unless there are less than seventy-five (75) claimants in total or after batching, which will comprise a single Batch. JAMS will administer each Batch as a single consolidated arbitration with one arbitrator, one set of arbitration fees, and one hearing held by videoconference or in a location decided by the arbitrator for each Batch in accordance with the JAMS Mass Arbitration Rules. If any part of this section is found to be invalid or unenforceable as to a particular claimant or Batch, it will be severed and arbitrated in individual proceedings.
7.7 Confidentiality
All aspects of the arbitration proceeding, and any ruling, decision, or award by the arbitrator, will be strictly confidential for the benefit of all parties.
7.8 Severability
If a court or the arbitrator decides that any term or provision of this Arbitration Agreement (other than Section 7.2 above) is invalid or unenforceable, the parties agree to replace such term or provision with a term or provision that is valid and enforceable and that comes closest to expressing the intention of the invalid or unenforceable term or provision, and this Arbitration Agreement shall be enforceable as so modified. If a court or the arbitrator decides that any of the provisions of Section 7.2 are invalid or unenforceable, then the entirety of this Arbitration Agreement shall be null and void, unless such provisions are deemed to be invalid or unenforceable solely with respect to claims for public injunctive relief. The remainder of this Agreement will continue to apply.
7.9 Future Changes to Arbitration Agreement
Notwithstanding any provision in this Agreement to the contrary, xFigura agrees that if it makes any future change to this Arbitration Agreement (other than a change to the Notice Address) while you are a user of the Platform, you may reject any such change by sending xFigura written notice within thirty (30) calendar days of the change to the Notice Address provided above. By rejecting any future change, you are agreeing that you will arbitrate any dispute between us in accordance with the language of this Arbitration Agreement as of the date you first accepted this Agreement (or accepted any subsequent changes to this Agreement).
8. Miscellaneous
8.1 Entire Agreement
These terms constitute the entire agreement between you and us with respect to the subject matter hereof. This Agreement supersedes any and all prior or contemporaneous written and oral agreements, communications and other understandings (if any) relating to the subject matter of the terms.
8.2 Assignment
You may not assign or transfer this Agreement, by operation of law or otherwise, without our prior written consent. Any attempt by you to assign or transfer this Agreement without our prior written consent shall be null and void. We may freely assign or transfer this Agreement. Subject to the foregoing, this Agreement will bind and inure to the benefit of the parties, their successors and permitted assigns.
8.3 Notice
We may provide any notice to you under this Agreement using commercially reasonable means, including using public communication channels. Notices we provide by using public communication channels will be effective upon posting.
8.4 Modifications
We may amend this Agreement from time to time by posting a revised version on the website, or if an update materially adversely affects your rights or obligations under this Agreement we will provide notice to you either by emailing the email associated with your account or providing an in-product notification. Those changes will become effective no sooner than 14 days after we notify you. All other changes will be effective immediately. Your continued use of the Platform after any change means you agree to such change.
8.5 Equitable Remedies
You acknowledge that if you violate or breach this Agreement, it may cause irreparable harm to xFigura, and xFigura shall have the right to seek injunctive relief against you in addition to any other legal remedies.
8.6 Severability
If any provision of this Agreement shall be determined to be invalid or unenforceable under any rule, law, or regulation of any local, state, or federal government agency, such provision will be changed and interpreted to accomplish the objectives of the provision to the greatest extent possible under any applicable law and the validity or enforceability of any other provision of this Agreement shall not be affected.
8.7 Special Notice for International Use; Export Controls
xFigura is headquartered in the United States. Whether inside or outside of the United States, you are solely responsible for ensuring compliance with the laws of your specific jurisdiction. Portions of the Platform and the transmission of applicable data, if any, is subject to United States export controls. No portion of the Platform may be downloaded or otherwise exported or re-exported in violation of U.S. export laws. Downloading, accessing or using the Platform is at your sole risk.
8.8 Governing Law
This Agreement will be governed by the laws of the State of Delaware, without regard to its conflict of law provisions. With respect to any disputes or claims not subject to arbitration, as set forth below, you and xFigura agree to submit to the personal and exclusive jurisdiction of the state and federal courts located within Suffolk County, Massachusetts. The failure of xFigura to exercise or enforce any right or provision of this Agreement will not constitute a waiver of such right or provision. If any provision of this Agreement is found by a court of competent jurisdiction to be invalid, the parties nevertheless agree that the court should endeavor to give effect to the parties’ intentions as reflected in the provision, and the other provisions of this Agreement remain in full force and effect.
DATA PROCESSING ADDENDUM
1. Purpose and Scope
This Data Processing Addendum ("DPA") forms part of, and is incorporated by reference into, the SaaS and Platform Agreement between Company and Client governing Client's access to and use of the Platform. This DPA applies solely to the extent Company Processes Client Personal Information on behalf of Client in connection with the provision of the Services under the SaaS and Platform Agreement, and only as required by Data Protection Laws.
This DPA supplements the SaaS and Platform Agreement and sets forth the additional terms, requirements, and conditions applicable to Company's Processing of Client Personal Information solely in its capacity as a "processor," "service provider," or equivalent role acting on behalf of Client, and only where and to the extent such role is required by Data Protection Laws. Nothing in this DPA is intended to, or shall be construed to, create a joint controller, joint venture, agency, fiduciary, or partnership relationship between Company and Client or to expand Company's obligations beyond those required under Data Protection Laws.
Except as expressly set forth in this DPA, Company acts as an independent controller with respect to any Personal Information it Processes for its own purposes, including to operate, secure, support, and improve the Services, or as otherwise permitted under the SaaS and Platform Agreement and Data Protection Laws and subject to the limitations and allocations of responsibility set forth therein.
This DPA becomes binding upon Client's execution of the SaaS and Platform Agreement or continued use of the Services, whichever occurs first. Company may update this DPA from time to time as necessary to comply with Data Protection Laws, subject to the notice and modification provisions of the SaaS and Platform Agreement; provided that any such updates shall not materially diminish Client's rights under this DPA except as required by Data Protection Laws.
2. Definitions
Capitalized terms not defined in this DPA shall have the meanings set forth in the SaaS and Platform Agreement. Additionally, the following capitalized terms shall be defined as follows whenever used in this DPA:
2.1 "Affiliate" means in relation to a party, any entity which (directly or indirectly) controls, is controlled by and/or under common control with that party, where "control" means ownership of more than fifty percent (50%) of the voting securities or other ownership interests of such entity, or the power to direct its management or policies;
2.2 "Client Personal Information" means any Personal Information that Client discloses, provides or otherwise makes available to Company through its use of the Services;
2.3 "Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Information under the SaaS and Platform Agreement, including, as applicable: (a) Regulation (EU) 2016/679 (the "GDPR"); (b) the GDPR as retained in United Kingdom law pursuant to the European Union (Withdrawal) Act 2018 (the "UK GDPR"), and the UK Data Protection Act 2018; (c) the Swiss Federal Act on Data Protection; (d) other U.S. federal, state, and local privacy, data protection, and data security laws and regulations; and (e) any amendments, replacements, successors, or implementing regulations to the foregoing, together with any binding guidance, rules, or codes of practice issued by a competent Supervisory Authority, in each case to the extent applicable to the Processing of Personal Information under the SaaS and Platform Agreement;
2.4 "ex-EEA Transfer" means a transfer of Personal Information subject to the GDPR from the European Economic Area ("EEA") to a recipient located in a country outside the EEA that is not the subject of an adequacy decision adopted by the European Commission pursuant to Article 45 of the GDPR.
2.5 "ex-UK Transfer" means any transfer of Personal Information subject to the UK GDPR from the United Kingdom ("UK") to a recipient located in a country outside the UK that is not the subject of an adequacy regulation adopted by the UK Secretary of State.
2.6 "Personal Information" means any information (a) relating to an identified or identifiable natural person or (b) defined as "personal data," "personally identifiable information," "personal information," or similar terms, as such terms are defined under Data Protection Laws;
2.7 "Personal Information Breach" means any accidental, unauthorized, or unlawful destruction, loss, alteration, or disclosure of, or access to, Client Personal Information;
2.8 "Process," "Processing," or "Processed" means any operation or set of operations which is performed upon Client Personal Information whether or not by automatic means, including collecting, recording, organizing, storing, adapting or altering, retrieving, consulting, using, disclosing, making available, aligning, combining, blocking, erasing and destroying Client Personal Information;
2.9 "SaaS and Platform Agreement" means the SaaS and Platform Agreement entered into between Company and Client governing Client's access to and use of the Platform, as amended from time to time;
2.10 "Services" means any services provided by Company to Client under the SaaS and Platform Agreement that involves the Processing of Personal Information, including the provision, operation, maintenance, and support of the Platform and any related Professional Services or ancillary services necessary to operate and support the Platform, as described in the SaaS and Platform Agreement;
2.11 "Standard Contractual Clauses" means, as applicable, (a) the standard contractual clauses for the transfer of Personal Information to third countries approved by the European Commission pursuant to Article 46 of the GDPR (including Decision (EU) 2021/914, as amended or replaced from time to time (the "EU SCCs")); (b) the International Data Transfer Addendum to such clauses issued by the UK Information Commissioner's Office (the "UK Addendum"); (c) any Swiss adaptations or equivalents thereto; and (d) any other standard contractual clauses, international data transfer addenda, or mandatory contractual mechanisms adopted pursuant to Data Protection Laws for the lawful transfer of Personal Information across international borders, in each case as amended, replaced, or superseded from time to time, and incorporated into this DPA by reference where applicable; and
2.12 "Supervisory Authority" means the relevant supervisory or regulatory authority with responsibility for privacy or data protection matters in the jurisdiction of Client.
3. Role of the Parties
3.1 Roles Under Data Protection Laws
Each Party may Process Client Personal Information in connection with the Services. The Parties acknowledge that their respective roles with respect to such Processing are determined by the factual circumstances and Data Protection Laws. Except as expressly set forth in this DPA or the SaaS and Platform Agreement, Client acts as the Controller of Client Personal Information and Company acts as a Processor Processing Client Personal Information on Client's behalf solely for the purpose of providing the Services.
3.2 Client Responsibilities
Client represents and warrants that it will, in its use of the Services and provision of instructions to Company, comply with all applicable Data Protection Laws. Client has sole responsibility for: (a) the accuracy, quality, and legality of Client Personal Information; (b) the means by which Client acquired Client Personal Information; and (c) providing all required notices and obtaining all required consents or other valid legal bases for Processing Client Personal Information under Data Protection Laws.
3.3 Independent Processing
Nothing in this DPA or the SaaS and Platform Agreement is intended to create, or shall be construed as creating, a joint controllership, partnership, or agency relationship between the Parties. To the extent Company Processes Personal Information outside the scope of Client's instructions (including for compliance with applicable law, security, fraud prevention, or internal operations consistent with the SaaS and Platform Agreement), Company acts as an independent controller with respect to such Processing and such Processing is subject to the applicable provisions of the SaaS and Platform Agreement and Data Protection Laws.
4. Processing Requirements
4.1
Company shall Process Client Personal Information only on documented instructions from Client unless Company is required to do otherwise by applicable law, in which case Company shall, unless legally prohibited from doing so, inform Client of such legal requirement. The Parties agree that the SaaS and Platform Agreement and this DPA constitute such documented instructions. Any disclosure of Client Personal Information required by applicable law or by proper legal or governmental authority will be handled in accordance with the notice, cooperation, and disclosure provisions of this DPA and the SaaS and Platform Agreement, as applicable.
4.2
Company shall comply with Data Protection Laws, to the extent applicable to Company in its role as a Processor (or service provider, contractor, or equivalent role) with respect to its Processing of Client Personal Information.
4.3
Company shall provide reasonable assistance to Client, taking into account the nature of the Processing and the information available to Company, and at Client's expense, with the fulfillment of Client's obligations under Data Protection Laws to respond to requests for exercising individuals' rights, together with Client's obligations regarding data security, notification by Client of Personal Information Breaches to the applicable Supervisory Authority, communication by Client of Personal Information Breaches to the affected individuals, data protection impact assessments, and prior consultation with the applicable Supervisory Authority, in each case to the extent such assistance is required by Data Protection Laws and relates to Company's Processing of Client Personal Information. Company shall not be required to take any action that would cause it to violate applicable law or materially disrupt its business operations. Any assistance provided pursuant to this Section 4.3 shall be subject to the limitations of liability and exclusions set forth in the SaaS and Platform Agreement.
5. Company Personnel
Company shall ensure that persons authorized by it to Process Client Personal Information are subject to appropriate obligations of confidentiality.
6. Processing and Storage Locations
6.1
The Parties agree that Company may transfer Client Personal Information Processed under this DPA outside of its country of origin including, without limitation, the EEA, the UK, or Switzerland as necessary to provide the Services. Client acknowledges that Company's primary Processing operations take place in the United States, and that the transfer of Client's Personal Information to the United States is necessary for the provision of the Services to Client. If Company transfers Client Personal Information protected under this DPA to a jurisdiction for which the relevant governmental authority has not issued an adequacy decision, Company will ensure that appropriate safeguards have been implemented for the transfer of Client Personal Information in accordance with Data Protection Laws.
6.2 Ex-EEA Transfers
The Parties agree that ex-EEA Transfers are made pursuant to the standard contractual clauses approved by the European Commission in Commission Decision 2021/914 dated 4 June 2021, for transfers of Personal Information to countries not otherwise recognized as offering an adequate level of protection for Personal Information by the European Commission (as amended and updated from time to time) (the "EU SCCs"), which are incorporated into this DPA by reference and deemed entered into and completed as follows: (a) Applicable Modules: (i) Module One (Controller to Controller) of the EU SCCs applies when Company is Processing Client Personal Information as a controller other than on behalf of Client, including where Company Processes Client Personal Information for its own business purposes as permitted under the SaaS and Platform Agreement and Data Protection Laws. (ii) Module Two (Controller to Processor) of the EU SCCs applies when Client is a controller and Company is Processing Client Personal Information on behalf of Client as a processor pursuant to this DPA. (b) For each applicable module: (i) The optional docking clause in Clause 7 does not apply. (ii) In Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of sub-processor changes shall be as set forth in Section 8.1 of this DPA. (iii) In Clause 11, the optional language does not apply. (iv) In Clause 17 (Option 1), the EU SCCs will be governed by the laws of Ireland. (v) In Clause 18(b), disputes will be resolved before the courts of Ireland. (vi) Attachment 1 to this DPA contains the information required in Annexes I through III of the EU SCCs.
6.3 Ex-UK Transfers
The Parties agree that ex-UK Transfers are made pursuant to the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner's Office (the "UK Addendum"), which is incorporated into this DPA by reference and applies to the EU SCCs as completed above. Attachment 1 to this DPA contains the information required in Annex 1A, Annex 1B, and Annex 2 of the UK Addendum.
6.4 Transfers from Switzerland
With respect to Client Personal Information transferred from Switzerland and subject exclusively to the Swiss Federal Act on Data Protection ("FADP"), the EU SCCs shall apply as the applicable transfer mechanism and shall be deemed modified as follows, to the extent required by the FADP: (a) References in the EU SCCs to the "General Data Protection" or "Regulation (EU) 2016/679" shall be understood as references to the FADP solely with respect to transfers governed by the FADP and not the GDPR. (b) The term "EU Member State" as used in the EU SCCs shall not be interpreted in a manner that would prevent data subjects in Switzerland from exercising their rights or bringing claims in their place of habitual residence, in accordance with Clause 18(c) of the EU SCCs. (c) For purposes of Annex I(C) (Competent Supervisory Authority) of the EU SCCs: (i) Where a transfer is subject exclusively to the FADP, the competent Supervisory Authority shall be the Swiss Federal Data Protection and Information Commissioner; and (ii) Where a transfer is subject to both the FADP and the GDPR, the Swiss Federal Data Protection and Information Commissioner shall be the competent authority to the extent the transfer is governed by the FADP, and the competent authority designated under the EU SCCs shall apply to the extent the transfer is governed by the GDPR.
6.5 Supplementary Measures
(a) To the extent required by Data Protection Laws, Company represents that, as of the effective date of this DPA, it has not received any formal legal requests from government intelligence or security agencies for access to Personal Information processed on behalf of its clients in connection with the Services. This statement is provided solely for purposes of satisfying Data Protection Laws and shall not be deemed a warranty or give rise to liability beyond that set forth in the SaaS and Platform Agreement. (b) If Company receives any legally binding request for disclosure of Client Personal Information from a governmental authority, Company shall, to the extent permitted by law, provide Client with reasonable notice and cooperate with Client's efforts to seek a protective order or other appropriate remedy. (c) If a Supervisory Authority requires suspension or modification of a transfer mechanism relied upon under this Section 6, Company may implement alternative lawful transfer mechanisms or suspend the affected transfers as required by Data Protection Laws.
7. Security of Personal Information
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing as well as the risk of varying likelihood and severity for the rights and freedoms of individuals, Company shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Data Protection Laws. Company shall ensure that any individuals authorized by Company to Process Client Personal Information are subject to appropriate confidentiality obligations and shall process such Client Personal Information only on Company's documented instructions, unless required to do otherwise by applicable law.
8. Sub-Processors
8.1
Client hereby provides its general written authorization for Company to engage sub-processors, including Company's Affiliates and third parties, to carry out Processing activities on behalf of Client as necessary to provide the Services. Company shall maintain a list of its current sub-processors, which may be made available to Client via a website or other reasonable means and may be updated by Company from time to time. Company shall provide reasonable advance notice of any material changes to such list and give Client the opportunity to object on reasonable data protection grounds.
8.2
Where Company engages a sub-processor for carrying out specific Processing activities on behalf of Client, Company shall enter into a written agreement with such sub-processor that imposes data protection obligations on the sub-processor that are no less protective than those set forth in this DPA, including, where required by Data Protection Laws, obligations sufficient to satisfy the requirements of (a) the Standard Contractual Clauses or other applicable international data transfer mechanisms, and (b) any "service provider," "processor," or "contractor" requirements under Data Protection Laws. Company shall remain responsible for the performance of such sub-processor's data protection obligations under the applicable written agreement, subject to the limitations and exclusions of liability set forth in the SaaS and Platform Agreement.
8.3
Client acknowledges and agrees that Company is authorized to subcontract and outsource Processing of Personal Information to its sub-processors identified in accordance with Section 8.1, including those engaged to provide infrastructure, hosting, analytics, security, support, and other services necessary to operate and support the Services.
8.4
If Client reasonably objects to the engagement of a new sub-processor on data protection grounds and Company cannot provide a commercially reasonable alternative within a reasonable period of time, Client may discontinue use of the affected portion of the Services by written notice to Company, without prejudice to any fees accrued prior to such discontinuation.
8.5
For purposes of any applicable Standard Contractual Clauses or similar mandatory transfer mechanisms, this Section 8 constitutes Client's prior written authorization for the engagement of sub-processors to the extent such authorization is required thereunder.
9. Breach Notification
9.1 Notification
Unless prohibited by applicable law, Company shall notify Client without undue delay after becoming aware of a Personal Information Breach involving Client Personal Information. Such notice shall include, to the extent known or reasonably available to Company at the time, information sufficient to enable Client to comply with its notification and reporting obligations under Data Protection Laws, provided that Company's obligation is limited to information reasonably available to Company at the time and shall not require Company to conduct forensic analysis or make legal determinations on Client's behalf.
9.2 Cooperation and Mitigation
Taking into account the nature of the Processing and the information available to Company, Company shall provide reasonable cooperation and assistance to Client, at Client's expense, as necessary to enable Client to: (a) notify the applicable Supervisory Authority or other governmental authority; and (b) communicate with affected individuals, in each case as required under Data Protection Laws. Company shall take reasonable measures to contain, investigate, and remediate the Personal Information Breach to the extent such measures are within Company's reasonable control, and consistent with Company's incident response procedures.
9.3 No Admission; Client-Caused Breaches
Company's notification of or response to a Personal Information Breach pursuant to this Section 9 shall not be construed as an acknowledgement of fault, liability, or wrongdoing by Company. The obligations in this Section 9 shall not apply to the extent the Personal Information Breach results from Client's or its Authorized User's acts or omissions, including Client's instructions, configuration choices, integrations, or failure to comply with Data Protection Laws. For the avoidance of doubt, all liability arising from or relating to a Personal Information Breach shall be governed exclusively by the liability, limitation of liability, and exclusion provisions of the SaaS and Platform Agreement, and nothing in this DPA creates any separate or additional indemnification or liability obligations.
10. Audit Rights
10.1 Records and Compliance Information
Company shall maintain appropriate records sufficient to demonstrate its compliance with its obligations under this DPA and shall, upon Client's reasonable written request, make available to Client information reasonably necessary to demonstrate such compliance, including copies of relevant certifications, summaries of audit reports, or other documentation customarily made available to Clients for this purpose, subject to reasonable confidentiality restrictions and provided that such information does not disclose Company confidential information unrelated to Client or Personal Information.
10.2 Audits
To the extent required by Data Protection Laws or Standard Contractual Clauses, Client (or an independent third-party auditor selected by Client and reasonably acceptable to Company) may conduct an audit of Company's compliance with this DPA, provided that: (a) such audit is limited in scope to matters relevant to Company's Processing of Client Personal Information under this DPA; (b) Client provides at least thirty (30) days' prior written notice; (c) audits occur no more than once in any twelve (12) month period, unless required by a competent Supervisory Authority or following a documented Personal Information Breach attributable to Company's Processing of Client Personal Information; (d) audits are conducted during Company's normal business hours and in a manner designed to minimize disruption to Company's business operations; (e) Client bears all costs and expenses of the audit, including reasonable reimbursement of Company's time and resources; (f) no access is provided to Company's confidential information unrelated to Client, including information relating to Company's other Clients, internal financial data, or proprietary systems; and (g) any third-party auditor enters into confidentiality obligations with Company that are reasonably acceptable to Company.
10.3 Alternative Measures
Where the provision of certifications, third-party audit reports, or other compliance documentation reasonably satisfies Client's audit requirements under Data Protection Laws or Standard Contractual Clauses, Client agrees not to exercise on-site audit rights unless otherwise required by a competent Supervisory Authority.
10.4 Standard Contractual Clause
To the extent the parties have entered into Standard Contractual Clauses pursuant to this DPA, the audit rights described in such Standard Contractual Clauses shall be exercised in accordance with this Section 10 and subject to the procedural limitations set forth herein, to the extent permitted by Data Protection Laws.
11. Deletion of Personal Information
Company shall, upon Client's request and at the choice of Client, delete or return all Client Personal Information that is Processed on Client's behalf following termination or expiration of the Services involving the Processing of such data, and delete existing copies thereof, in each case unless retention of such Client Personal Information is required or permitted by applicable law or expressly permitted under the SaaS and Platform Agreement. If return or deletion of Client Personal Information is impracticable or prohibited by applicable law, rule, or regulation, Company shall take commercially reasonable measures to restrict further Processing of such Client Personal Information (except to the extent required for its continued retention or Processing as required by applicable law) and shall continue to protect such Client Personal Information in accordance with this DPA for so long as it is retained. Any such retained Client Personal Information shall remain subject to the confidentiality, security, and use limitations set forth in this DPA. To the extent the Standard Contractual Clauses apply to the Processing of Client Personal Information, Company shall, upon Client's written request, provide certification of deletion as required under the applicable Standard Contractual Clauses and subject to the limitations of liability set forth in the SaaS and Platform Agreement.
12. Term
This DPA shall commence on the date it becomes effective pursuant to the SaaS and Platform Agreement and shall continue in full force and effect until the later of (a) the termination or expiration of the SaaS and Platform Agreement, or (b) completion of the last of the Services to be performed pursuant to the SaaS and Platform Agreement, and thereafter solely for so long as Company continues to Process Client Personal Information on Client's behalf.
13. Limitation of Liability; No Independent Obligations
13.1 Limitation of Liability
Except to the extent expressly prohibited by Data Protection Laws, all claims, liabilities, damages, losses, costs, and expenses arising out of or relating to this DPA (including any alleged failure to comply with Data Protection Laws) shall be subject to the limitations of liability, exclusions of damages, and allocation of risk set forth in the SaaS and Platform Agreement.
13.2 No Separate Liability Regime
This DPA does not create any additional liability, indemnification, or damages obligations beyond those expressly set forth in the SaaS and Platform Agreement.
14. Governing Law
This DPA shall be governed by and construed in accordance with the governing law and forum provisions set forth in the SaaS and Platform Agreement, which are incorporated herein by reference and shall apply equally to this DPA, unless and solely to the extent required otherwise by Data Protection Laws.
Attachment 1
The following includes the information required by Annex I and Annex III of the EU SCCs, and Table 1, Annex 1A, and Annex 1B of the UK Addendum.
ANNEX I
A. LIST OF PARTIES
Data exporter(s): Names and Addresses: As set forth in the SaaS and Platform Agreement or applicable Order. Contact details: As set forth in the notice provisions of the SaaS and Platform Agreement or Client account records. Execution: Not required; this Annex is deemed completed and incorporated by reference pursuant to the DPA and SaaS and Platform Agreement. Activities relevant to the data transferred under these Clauses: Described in Annex I.B. Role: Controller or Processor, as applicable, in accordance with the DPA and Data Protection Laws.
Data importer(s): Names and Addresses: Client name and address as set forth in the SaaS and Platform Agreement or applicable Order. Contact details: As set forth in the notice provisions of the SaaS and Platform Agreement. Execution: Not required, this Annex is deemed completed and incorporated by reference pursuant to the DPA and SaaS and Platform Agreement. Role: Controller or Processor, as applicable, in accordance with the DPA and Data Protection Laws.
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose Personal Information is transferred: Client's Authorized Users, end users, employees, contractors, and other individuals whose Personal Information is processed in connection with the Services.
Categories of Personal Information transferred: Identifiers, contact information, account information, usage data, and other Personal Information submitted to or generated through use of the Services, as determined by Client.
Sensitive data transferred (if applicable) and applied restrictions or safeguards: None, unless expressly agreed in writing by the Parties. The Services are not intended for the processing of special categories of Personal Information.
The frequency of the transfer: Continuous.
Nature of the processing: Collection, storage, hosting, transmission, retrieval, use, and deletion of Personal Information as necessary to provide, maintain, and support the Services in accordance with the SaaS and Platform Agreement and DPA.
Purpose(s) of the data transfer and further processing: Provision, operation, maintenance, security, and improvement of the Services, and related business operations, as instructed by Client.
The period for which the Personal Information will be retained: For the duration of the Services and thereafter in accordance with the data retention and deletion provisions of the DPA and SaaS and Platform Agreement.
For transfers to Sub-Processors, also specify subject matter, nature and duration of the processing: Subject Matter (Personal Information elements): The same categories of Personal Information described above. Nature of processing: Processing as necessary to support the Services in accordance with written agreements imposing data protection obligations consistent with this DPA.
C. COMPETENT SUPERVISORY AUTHORITY
The Supervisory Authority shall be the Supervisory Authority of the Data Exporter, as determined in accordance with Clause 13 of the Standard Contractual Clauses.
ANNEX III – List of Sub-Processors
Amazon Web Services (AWS) — United States / global regions — Cloud hosting and storage
Stripe, Inc. — United States — Payment processing
PostHog, Inc. — United States / EU regions — Product analytics
Clerk, Inc. — United States / EU regions — Authentication & SSO
ANNEX II – Technical and Organisational Measures
The following includes the information required by Annex II of the EU SCCs and Annex II of the UK Addendum. Company implements technical and organizational measures intended to protect Client Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, taking into account the nature of the processing and the risks involved. These measures include the following:
Encryption of Client Personal Information during transmission over public networks and while stored, using industry-standard encryption mechanisms.
Multi-factor authentication for administrative access to systems that process or store Client Personal Information.
Logical access controls, including role-based access and least-privilege access restrictions, to limit access to Client Personal Information to personnel with a legitimate operational need.
Monitoring and logging of system activity and security-relevant events, including the use of vulnerability detection or management tools.
Data backup mechanisms and tested restoration capabilities designed to support availability and integrity of Client Personal Information in the event of system failure or data loss.
Personnel confidentiality obligations, including confidentiality commitments applicable to individuals with access to Client Personal Information and security-related training provided as part of onboarding or ongoing employment.
Physical and environmental security controls implemented by third-party hosting or cloud service providers where Client Personal Information is stored or processed, such as controlled facility access and environmental safeguards.
Periodic review of security controls, including updates to technical safeguards where reasonably necessary in light of evolving security risks or platform changes.
Company may rely on security features and controls provided by its hosting, cloud infrastructure, or other service providers as part of the measures described above.
MODEL CANCELLATION FORM
(Complete and return this form only if you wish to withdraw from the contract)
To:
xFigura, Inc. 20 Fisher Avenue, 02120, Boston, MA, USA info@xfigura.ai
I/We hereby give notice that I/We cancel our contract of sale for the supply of the following service:
________________________________________________________________________________________________________________________________________
________________________________________________________________________________________________________________________________________
________________________________________________________________________________________________________________________________________
Ordered on (date): Name of consumer(s): Address of consumer(s): Signature of consumer(s) (only if this form is notified on paper): Date: