Customer Agreement

Data Processing Agreement

Last updated: 22.05.2024

‍Appendices to the Processing AgreementAppendix 1 Categories of Personal Data
‍
Appendix 2 Technical and Organisational Security Safeguards
Appendix 3 Documentation for compliance with obligations
Appendix 4 Controller’s obligations
Appendix 5 Sub-processors

1. The Agreement and the Parties

   1. This Data Processing Agreement (the “Processing Agreement”) and underlying appendices is an agreement between Salto X OÜ, registry code 16360806, VAT number EE102439757, registered at Estonia, Harju maakond, Tallinn, Põhja-Tallinna linnaosa, Telliskivi tn 60a/8, 10412 (“Processor”, “we” or “Salto X”) and you or the entity you represent (“Controller”, or “you”), collectively referred to as the Parties and individually as a Party.

   2. The Parties have agreed to the provision of certain services from the Processor to the Controller, as described in more detail in the Parties’ separate agreement to this effect, the Controller’s Customer Agreement with Salto X, and possibly further service-specific appendices. This Processing Agreement governs the Controller’s usage of the Salto X provided services, such as Salto X Platform and the Controller’s consumption of Services in relation hereto.

   3. In this connection, the Processor processes Personal Data on behalf of the Controller, and for that purpose, the Parties have entered into this Processing Agreement.

   4. You enter into this Processing Agreement when you enter into the Customer Agreement, and this Processing Agreement is incorporated into and forms part of the Customer Agreement between Salto X and you.

2. Definitions

   1. Unless otherwise defined herein, all terms beginning with a capital letter defined in the Customer Agreement shall have the same meanings herein unless the context hereof otherwise requires.

   2. "Data Protection Regulations" means (i) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of personal data and the free movement of such data ("GDPR"); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; and (iii) any applicable national regulations, whether developing or transposing European or international regulations.

   3. "Data Controller," "Data Processor," "Data Subject," "Personal Data," "Processing," "Appropriate Technical and Organizational Measures," "Standard Contractual Clauses," and "Personal Data Breach" as used in this Processing Agreement shall have the meanings ascribed to them in the Data Protection Regulations.

3. Changes to this agreement

   1. You agree that Salto X may modify this Processing Agreement at any time in its sole discretion and without prior notice. Any changes will be published online and will be effective upon such publishing. We will notify you directly if there are any changes to this Processing Agreement.  We encourage you to review this Processing Agreement periodically to ensure familiarity with its then-current terms and conditions. Your continued use of the Services shall constitute your acceptance of this Processing Agreement, and your continued use of the Services following any modification of this Processing Agreement shall constitute your acceptance of the Processing Agreement, as amended. 

   2. You may object to any substantial change to this Processing Agreement by terminating the Processing Agreement for cause immediately upon notice, on condition that you provide such notice within 90 days of being informed of the change to this Processing Agreement. This termination right is your sole and exclusive remedy if you object to any change in the Processing Agreement.

4. Purpose

   1. The purpose of the Processing Agreement is to ensure that the Processor complies with all laws and regulations, including those of the European Union, the European Economic Area, and their member states, applicable to the Processing of Personal Data under the Customer Agreement in force as may be amended from time to time.

5. Scope

   1. The Processor is authorised to process Personal Data on behalf of the Controller on the terms and conditions set out in the Processing Agreement.

   2. The Processor may only process Personal Data subject to documented instructions from the Controller. This Processing Agreement, including appendices, constitutes the instructions at the date of the Processing Agreement.

   3. The Processor may process any Personal Data provided by the Controller as part of consuming the Services. Restrictions apply to the categories of Personal Data the Controller may provide, cf. Appendix 4.

   4. The Processor keeps the Personal Data provided by the Controller until the Controller requests its deletion as part of the termination of this Processing Agreement.

   5. The Processor can optimise the quality and usefulness of the Services and their communication with the Controller by internally registering and analysing how the Controller and its representatives consume the Services. To the extent that any Personal Data is part of such internal data processing, the processing of that data adheres to the obligations set out in this Processing Agreement.

   6. If the instructions within the Processing Agreement are regarded by the Processor as unlawful (in breach of Data Protection Regulations) at any time, the Processor shall notify the Controller without undue delay.

   7. Unless explicitly agreed otherwise in writing, the Processor may use all relevant technical and non-technical aids, including IT systems, subject to their appropriate security level.

6. Duration

   1. The duration of this Processing Agreement will be the same as that of the Customer Agreement. This means that this Processing Agreement will automatically terminate upon the termination of the Customer Agreement or when resolved earlier by the terms of this Processing Agreement.

7. Processor’s obligations

   1. Technical and organisational security measures

      1. The Processor is responsible for implementing necessary (a) technical and (b) organisational measures to ensure an appropriate security level to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. The measures must be implemented with due regard to the current state of the art, costs of implementation, the nature, scope, context and purposes of the processing and the risk of varying likelihood and severity to the rights and freedoms of natural persons. The Processor shall take the category of Personal Data described in Appendix 1 into consideration in the determination of such measures.

      2. The Processor shall implement the technical and organisational security measures specified in Appendix 2 of this Processing Agreement.

      3. Documentation for compliance with obligations

         1. Upon written request and by Appendix 3, the Processor shall document to the Controller that the Processor:

            1. meets its obligations under this Processing Agreement,
            2. meets the provisions of the Data Protection Regulation in force from time to time concerning the Personal Data processed on behalf of the Controller.

         2. The Processor will provide documentation within a reasonable time.

      4. Security breach

         1. The Processor shall notify the Controller of any known Personal Data breach that may lead to accidental or unlawful destruction, alteration, unauthorised disclosure of, or access to, Personal Data processed for the Controller (“Security Breach”).

         2. Security Breaches must be reported to the Controller without undue delay. A Security Breach report shall, to the extent this is possible at the time of reporting, provide the Controller with

            1. information about the nature of the Security Breach, including the categories and volumes of Personal Data affected,
            2. information about the potential consequences of the Security Breach,
            3. contact information of a Processor representative where further information can be obtained,
            4. a description of measures undertaken or planned by the Processor, if any, to mitigate the consequences of the Security Breach.
            5. In case of complex situations, the Processor may inform the Controller in steps as more becomes known about the Security Breach. In such situations, the Processor will report regularly to the Controller until all necessary information that can possibly and realistically be obtained regarding the Security Breach has been provided.

   2. Assistance

      1. The Processor shall, to the necessary and reasonable extent, assist the Controller in the performance of its obligations in the processing of the Personal Data covered by this Processing Agreement, including in connection with:

         1. responses to data subjects on the exercise of their rights (basic operations and support for performing such operations are available as part of the Services at no cost),
         2. Security Breaches;
         3. impact assessments, and
         4. prior consultation with the supervisory authorities.

      2. In this connection, the Processor shall obtain the information to be included in a notification to the supervisory authority provided that the Processor is best suited to do so.

      3. The Processor may assist with any extra tasks agreed in writing between the Processor and the Controller.

      4. The Processor is entitled to payment for time spent (at an hourly rate of 100 EUR ex. VAT, depending on the type of assistance) and materials consumed for assistance pursuant to this clause. However, to the extent assistance in accordance with 7.5.1.1 and 7.5.1.2 is required by GDPR or other applicable law, such assistance will not entitle the Processor to any payments.

8. Controller's obligations

   1. Controller's obligations are set out in Appendix 4.

9. Sub-processors

   1. As part of the Processor’s delivery of the Services, the Processor may use a third party for the processing of Personal Data for the Controller (a “Sub-Processor”). This Processing Agreement constitutes the Processor’s prior general and specific consent to the Processor’s use of Sub-Processors.

   2. The Processor will ensure that each Sub-Processor adheres to an equivalent level of data protection obligations towards the Processor as those adhered to by the Processor towards the Controller (including in pursuance of this Processing Agreement).

   3. Moreover, the Sub-Processor also acts only under the instructions of the Processor.

   4. The Processor is directly responsible for the Sub-Processor’s processing of Personal Data in the same manner as if the Processor had carried out the processing.

   5. Upon request, the Processor shall provide the Controller with documentation of what Sub-Processors it uses. A list of Sub-Processors as of the Effective Date is included in Appendix 5.

10. Transfer to third countries

    1. The Controller approves that the Processor may transfer Personal Data to countries outside the EU or international organisations without further or prior notice, as long as such transfers are part of data transfers to and from approved Sub-Processors.

    2. In any case, Personal Data may only be transferred to the extent permitted under the Data Protection Regulations in force from time to time, and the Processor shall ensure that the Sub-Processor is subject to an EU Commission-approved third-country transfer legal mechanism at all times.

11. Limitation of liability

    1. For the avoidance of doubt, each Party’s liability, taken together in the aggregate, arising out of or related to these terms, whether in contract, tort or under any other theory of liability, is subject to the limitations and exclusions of liability contained within the Customer Agreement, and any reference to the liability of a Party means the aggregate liability of that Party under the Customer Agreement and this Processing Agreement together.

12. Force majeure

    1. The regulation of force majeure in the Customer Agreement on delivery of the Services also applies to this Processing Agreement as if it were an integral part of it.

13. Termination

    1. The Processing Agreement may only be terminated according to the provisions on termination in the Customer Agreement on delivery of the Services.

    2. The Processor’s authority to process Personal Data on behalf of the Controller lapses on termination of the Processing Agreement for whatever reason.

    3. The Processor may continue to store Personal Data for up to ten years after the termination of the Processing Agreement to the extent that this is necessary to take the required statutory measures. During the same period, the Processor is entitled to let the Personal Data be included in the Processor’s usual backup procedure. The processing by the Processor during this period is assumed to comply with the instructions given in this Processing Agreement.

    4. The Processor and any Sub-Processors shall return all Personal Data processed by the Processor under this Processing Agreement to the Controller upon termination of the Processing Agreement; if the Controller is already in possession of the aforementioned Personal Data, the Parties may agree to skip this procedure. Then, the Processor will, without undue delay, delete all Personal Data from the Controller, and the Controller may request adequate documentation about such deletion, except where such a deletion contradicts record-keeping or other lawful obligations on the Processor in force from time to time.

14. Disputes

    1. The regulation of dispute resolution, including governing law and venue, in the Customer Agreement on delivery of the Services also applies to this Processing Agreement as if it were an integral part thereof.

15. Precedence

    1. If there are any discrepancies between this Processing Agreement and the Customer Agreement regarding the delivery of the Services, this Processing Agreement takes precedence.

16. Contact And Notice

    1. The contact information of the Parties and the regulation of notice in the Customer Agreement on delivery of the Services also apply to this Processing Agreement as if it were an integral part thereof.

Appendix 1: Categories of Personal Data

1. Categories of Personal Data

   1. The Processor will process the following categories of Personal Data:

      1. General Personal Data includes any data about an identified or identifiable data subject, including personal ID codes, date of birth, or social security numbers. Examples of such data include but are not limited to, first name, middle name, last name, title, emails, phone numbers, addresses, IP addresses, un-hashed cookies, civil/social security numbers, other personal identifiers, birthdays, and sex.

   2. The Processor does not process the following categories of Personal Data:

      1. Sensitive Personal Data, including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or data concerning health or sex life or sexual orientation, genetic data and biometric data.
      2. Other Personal Data relating to criminal offences and serious social problems.

2. Categories of Data Subjects processed

   1. The Processor may process Personal Data for the Controller concerning the following categories of Data Subjects:

      • the Controller’s and its affiliated companies End Users, if any,
      • the Controller’s and its affiliated companies employees,
      • the Controller’s and its affiliated companies contact persons,
      • the Controller’s and its affiliated companies direction and board,
      • the Controller’s and its affiliated companies shareholders, option holders, warrant holders, debtholders, and other stakeholder with a commercial, financial or other interest in or relation to the Controller,
      • other Data Subjects whose details are provided by the Controller to the Processor.

Appendix 2: Technical and Organisational Security Safeguards

1. The following specific safeguards are made for the Processor’s physical security:

   • Access control to physical facilities,
   • Password-protection of physical equipment and outsourced systems (including databases) by suitably strong passwords,
   • Only authenticated, encrypted traffic for administrative access to systems (including databases),
   • Data centre redundancy of all critical infrastructure, eliminating physical risks to equipment such as fire, power failure, or similar,
   • Periodical monitoring for known vulnerabilities, e.g. scans against OWASP top 10, and established process(es) for addressing such vulnerabilities without undue delay.

2. The following specific safeguards are made for the Processor’s technical security:

   • At an application level, Salto X Platform requires sign-in via email or a Google OAuth protocol for authentication and authorisation,
   • On a network communication level, any communication with Salto X Platform is encrypted, as is application-database traffic,
   • As for data storage, Salto X Platform uses state-of-the-art data centres for storage of database data and documents, which means that data is safe, encrypted at rest, backed up, and roll-backable in case of incidents,
   • Data centre redundancy, deployment and rollout methods and contingency plans enable suitable and timely recovery of the entire Salto X Platform (in case of a major incident),
   • The Processor’s internal data networks are secured by expert third parties.

3. The following specific safeguards are made for the Processor’s organisational security:

   • All relevant Processor employees are briefed regularly on the Processor’s security matters and how to respond to security incidents,
   • All the Processor’s employees follow the Processor’s internal policies, which spell out relevant best practice employee security behaviour,
   • The Processor undertakes regular security reviews to secure a constantly sufficient level of security and develops and implements its business using the principles of privacy by design and privacy by default.

4. The following specific safeguards are made for the Processor’s deletion of Personal Data:

   • The Processor keeps a digital record of what Personal Data is stored where on behalf of the Controller and for how long, so when deleting data is mandated, the Processor knows which data to delete. 

5. The Processor shall ensure that Sub-Processors implement the appropriate technical and organisational measures to ensure that the processing meets the requirements of the GDPR.

Appendix 3: Documentation for compliance with obligations

The following points must be completed and observed by the Processor as part of its demonstration to the Controller of compliance with its obligations according to clause 7.3 of the Processing Agreement.

1. Statement of Assurance

   1. Upon request and against separate payment of a fee, the Processor shall arrange for the preparation and submission of statements of assurance regarding the Processor’s information security level and the measures taken by the Processor. Scope and payment of such undertakings shall be agreed in more detail on a request by request basis.

2. Physical meeting

   1. Upon request, the Processor shall participate in a physical meeting at the premises of the Processor or the Controller. At the meeting, the Processor must be able to give an account of compliance and how compliance is ensured. A request for a meeting must be made subject to at least 14 working days’ notice. Scope and payment related to preparation, execution, and follow-up shall be agreed upon in more detail on a request-by-response basis.

3. Audit

   1. Upon written request, the Processor shall contribute to and give access to the audit.

   2. The Processor is entitled to payment for time and materials spent on assistance; the hourly rate for time spent is set to EUR 100 – EUR 150, ex. VAT, depending on the nature of the assistance.

   3. The Processor is not entitled to payments if an audit shows substantial non-compliance with the obligations under this Processing Agreement or Data Protection Regulations.

4. Other conditions

   1. The above points should not be considered exhaustive, and the Processor, therefore, undertakes to take any such actions and measures as are necessary to demonstrate its obligation under the Processing Agreement.

   2. According to Appendix 3, the Processor is not obliged to follow a request from the Controller if the request violates the Data Protection Regulations. The Processor shall notify the Controller if it finds that this is the case.

Appendix 4: Controller’s obligations

1. Obligations

   1. The Controller has the following obligations

      1. To ensure that any Personal Data provided to the Processor is controlled by the Controller on a lawful basis and is kept accurate, minimised, complete, and up-to-date,
      2. Ensure that any obligations towards Data Subjects relating to the right to be informed about the Controller’s controlling of that Data Subjects’ data are met,
      3. To not provide the Processor with any Personal Data that is not General Personal Data as defined in Appendix 1 (thus excluding the disclosure or provision of any Sensitive Personal Data, data relating to criminal offences, or data relating to serious social problems).
      4. To ensure that the Instructions are lawful in relation to the Data Protection Regulation in force from time to time.

2. Other conditions

   1. By agreeing to the Processing Agreement, the Controller agrees that the Processor has given sufficient and relevant guarantees regarding the technical and organisational safeguards related to securing the registered Data Subject’s rights and Personal Data at the time of signing this Processing Agreement. Notwithstanding the aforementioned, Controller and Processor agree that the Processor is expected to implement changes that will be required to meet what is considered “appropriate technological and organisational measures” as technology evolves, implementation cost of technology changes, and/or directions from supervisory authorities change.

Appendix 5: Sub-Processors

1. Third parties

   1. The Processor and its affiliates engage the following third-party entities to assist them in delivering the Services. This list of Sub-Processors is subject to change at the Processor’s discretion. The Processor will inform the Controller of any changes to the list of Sub-Processors.

2. APPLICATION AND DATA STORAGE
   
   These third-party Sub-Processors provide us with virtual application infrastructure and data storage:

These Salto X terms and conditions govern the relationship between Salto X and the Customers of the Salto X Platform and, together with the Order and Data Processing Agreement, constitute an Agreement.BY USING ALL OR ANY PORTION OF THE SERVICES, YOU ACCEPT ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT. YOU AGREE THAT THIS AGREEMENT IS ENFORCEABLE LIKE ANY WRITTEN NEGOTIATED AGREEMENT SIGNED BY YOU. IF YOU DO NOT AGREE, YOU SHOULD NOT USE ANY PART OF THE SERVICES. SALTO X AND CUSTOMER HEREBY AGREE AS FOLLOWS:

1. Definitions and Interpretations

   1. Definitions
      
      The definitions and rules of interpretation in this clause apply to this Agreement:
      Affiliate

      any entity that directly or indirectly controls is controlled by, or is under common control with another entity. As used herein, “control” means the power to direct the management or affairs of an entity or the beneficial ownership of more than 50% of the voting equity shares or other equivalent voting interests of an entity.

      Admin

      an individual who registered the User Account on behalf of the Company and/or interacts with Salto X Platform on behalf of the Company. 

      Agreement

      this agreement between the Customer and Salto X comprises the Order, these terms and conditions, and the Data Processing Agreement.

      Assisted Onboarding

      the assisted onboarding services provided by Salto X to the Customer enable the Customer to access and use the Services and Salto X Platform.

      Business Day (s)

      any day on which banks in Estonia are operating, except Saturdays, Sundays and public holidays.

      Confidential Information

      means (without limitation) all confidential information (however recorded or preserved) disclosed by one party or its employees, officers, representatives or advisers (together “Representatives”) to the other party and the other party’s Representatives, including the terms and conditions of this Agreement, the business, affairs, customers, clients, suppliers, plans, intentions, market opportunities, operations, processes, product information, services, know-how, technical information or trade secrets of the disclosing party.

      Company

      the Customer's legal entity that is registered on the Platform.

      Customer

      the customer detailed in Salto X Platform.

      Customer Content

      any content, data, text, documents, and general files, audio, video or images uploaded, shared, transferred or otherwise communicated electronically by the Customer to the Services, whether directly or indirectly via any third-party application. Customer Content does not include any Derived Data.

      Customer End Users

      those individuals authorised by the Customer to directly or indirectly: (i) access or use Customer Content via the Services; or (ii) otherwise access or use the Services on behalf of the Customer through the Customer’s account, pursuant to this Agreement.

      Data Protection
      Legislation

      means all applicable data protection and privacy legislation in force from time to time including the General Data Protection Regulation ((EU) 2016/679) which apply to the processing of personal data pursuant to this Agreement as further detailed in the Data Processing Agreement.

      Data Processing
      Agreement

      the data processing agreement is located at the link, as it may be updated by Salto X from time to time which is incorporated into this Agreement by reference.

      Default

      any act or omission by the Customer or a failure by the Customer to perform any relevant obligation.

      Derived Data

      any data which is derived from the Customer’s or the Customer End User’s use of the Services or the processing of Customer Content, which shall include: (i) any data which is processed and stored as mathematical constructs; (ii) statistical or aggregated data; and (iii) any other analytical and marketing data such as number and duration of user sessions and page visits, and technical reports on the performance of the Services. Derived Data shall not include personal data except where such personal data has been anonymised.

      Effective Date

      the effective date of this Agreement as set out in the Order and, if not specified, shall be the date on which the Customer subscribes to the Services on Salto X Platform.

      Fees

      the Subscription Fees and any other additional fees as agreed by the parties, as set out in the Order or in writing as agreed by the parties.

      Intellectual Property
      Rights 

      patents, rights to inventions, copyright and neighbouring and related rights, trademarks and service marks, business names and domain names, rights in get-up and trade dress, goodwill and the right to sue for passing off or unfair competition, rights in designs, database rights, rights to use and protect the confidentiality of confidential information (including know-how and trade secrets) and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted, renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world.

      Privacy Policy

      the privacy policy of Salto X is available on Salto X Platform as amended from time to time.

      Salto X

      Salto X OÜ, registry code 16360806, VAT number EE102439757, registered at Estonia, Harju maakond, Tallinn, Põhja-Tallinna linnaosa, Telliskivi tn 60a/8, 10412.

      Salto X Platform

      websites and apps created and serviced by Salto X, merged under the domain name saltox.co.

      Sanctions

      any sanctions administered or enforced by the U.S. Department of Treasury’s Office of Foreign Assets Control, the United Nations Security Council, the European Union, Her Majesty’s Treasury, or other relevant sanctions authority. 

      Services

      equity management software as a service solution and secondary sales as a service solution. 

      Subscription Fees

      the subscription fees set out in the Order payable by the Customer to Salto X for the use of the Services.

      Term

      the term of this Agreement as specified in the Order and, if not specified, shall commence on the Effective Date and continue for as long the customer uses the Salto X Platform unless terminated in accordance with this Agreement. 

      Third-Party Content

      any third-party content, including but not limited to links, advertisements, promotions, or any other materials or information. 
   2. In this Agreement: (i) clause, schedule, and paragraph headings shall not affect the interpretation of this Agreement; (ii) unless the context otherwise requires, words in the singular shall include the plural and in the plural shall include the singular; (iii) a reference to writing or written includes e-mail; (iv) any words following the terms including, include, in particular for example or any similar expression shall be construed as illustrative and shall not limit the sense of the words, description, definition, phrase or term preceding those terms.
   3. A reference to “we” or “us” is a reference to Salto X and a reference to “you” or “your” is a reference to each Customer of the Salto X Platform. 
   4. A reference to a particular law is a reference to it, as it is in force for the time being, taking account of any amendment, extension or re-enactment, and includes any subordinate legislation for the time being in force made under it.

2. Scope and Access to the Services

   1. Subject to the Customer paying the Fees in accordance with this Agreement, Salto X hereby grants to the Customer a non-exclusive, non-transferable, non-sublicensable right for the Customer and the Customer End Users to access and use the Services during the Term in accordance with this Agreement and solely for the benefit of the Customer’s internal business operations.

   2. On the Salto X Platform, the Customer may set up and manage the capitalisation tables of its Company (-ies), add and manage the Customer End Users with respect to their participation in the capital of the Company, as well as perform other activities with respect to the capital of the Company on the Salto X Platform.

   3. In addition, on the Salto X Platform, you can access educational and informational materials and be provided with certain web tools. These tools and materials are designed to complement and enrich your interactions with Salto X Platform, providing you with a more robust and rewarding digital experience.

   4. Salto X may, from time to time, run special offer campaigns on the  Salto X Platform. In such cases, special terms of use will be applicable. 

   5. Salto X acts only as a “Software as a Service” and provides tools for the Customer to set up and manage the capitalisation table of the Company and for the Customer End User to access information with respect to their participation. 

   6. The Customer may request, and Salto X may provide the Customer with additional Services, including but not limited to training sessions with respect to the employee incentive plans, secondary sales of the shares of the Company and preparing customised educational materials.

   7. Details about our Services may be found in this Agreement as well as on the Salto X Platform and related materials. 

   8. It is the responsibility of the Customers to independently assess in detail the implications of the Services and products provided by the Salto X Platform on their business, individual financial position, or tax obligations.

   9. We reserve the right to change this Agreement as prescribed further in this Agreement and/or to modify, discontinue, disable or terminate the access (or any part or feature thereof) to Salto X Platform at any time without prior notice.

3. Limitation of the Services 

   1. In providing the Services pursuant to this Agreement, Salto X does not act as a credit institution, financial services provider, or law firm. 

   2. Further, Salto X does not perform any investment advisory, exchange or custodian services. In particular, no investment recommendations, accounting, tax or legal advice is provided through the Salto X Platform and are out of the scope of the Services provided by Salto X.

   3. Salto X is not responsible for any tax obligations that may arise as a result of your use of the Salto X Platform, as well as it has no obligation to notify you about any tax obligations that may arise as a result of your use of the Salto X Platform.

4. Representations of the Customers

   1. The Customer shall provide Salto X with all necessary co-operation in relation to this Agreement and all necessary access to information as may be required by Salto X to fulfil its obligations under this Agreement, including granting Salto X full and unrestricted access to Customer’s account in order to provide support or fix any errors. The Customer shall carry out all of its responsibilities in this Agreement in a timely and efficient manner.

   2. The Services may enable Customer End Users to share Customer Content or invite third-party users to use and access the Services. Such third-party users may access, view, download, and share Customer Content or receive Customer Content via email (such emails may be sent on Customer’s behalf, provided that any such emails sent on the Customer’s behalf are sent solely as required for the Services). Customer understands and agrees that: (i) it is solely Customer’s, and its Customer End Users’, choice to share Customer Content, and consents to the Services sending any emails on its behalf; (ii) Salto X cannot control third parties with whom Customer or Customer End Users have shared Customer Content; and (iii) Customer and/or its Customer End Users are solely responsible for their sharing of any Customer Content through the Services (including without limitation, where the Services send emails on the Customer’s behalf in accordance with this clause).

   3. The Customer shall ensure that all Customer End Users use the Services strictly in accordance with the terms and conditions of this Agreement and the Customer shall be responsible for any Customer End User’s breach of the same.

   4. By using the Services, you acknowledge that you are not located in a jurisdiction where the use of the Services and the publication and sharing of any materials via the Services is in any way illegal or restricted by applicable law. If you are located in such a jurisdiction, Salto X will not provide you with access to the Services and you should immediately discontinue your use of the Services.

   5. Documents generated by the Services may be executed by electronic signature. You agree that any such agreements or other documents executed by you via electronic signature are enforceable like any written negotiated agreement signed by you. You and the relevant third party are responsible for the content and execution process in respect of such documents.

   6. The Customers acknowledge and represent to Salto X that:

      • the Customer has taken all necessary actions and has all requisite power and authority to enter into and perform the Agreement in accordance with its Agreement;
      • the Agreement constitutes valid, legal, and binding obligations to the Customer;
      • the Customer will not use Salto X Platform for any unlawful purpose;
      • the execution by the Customer of the Agreement, and compliance with its terms will not breach or constitute a Default under any agreement or instrument to which the Customer is a party or by which the Customer is bound or of any order, judgement, decree, or other restriction applicable to the Customer;
      • the Customer understands that financial regulations, financial codes, financial ethics, and contractual requirements vary worldwide, and it is the Customer’s responsibility to make sure to comply with all laws and regulations applicable to Customers before using the Services;
      • the Customer, its Affiliates, directors or officers are not:
        1. subject to Sanctions and 
        2. ​located, organised or resident in a country or territory that is the subject of Sanctions (including, without limitation, Russia, Belarus, Burma/Myanmar, Cuba, Iran, North Korea, Sudan and Syria); and
        3. knowingly engaged in, are not now knowingly engaged in, and will not engage in, any dealings or transactions with any person, or in any country or territory, that at the time of the dealing or transaction is or was the subject of Sanctions.
      • if the Customer is a natural person, the person is at least 18 years old and has not been declared to have a limited legal capacity due to a mental disorder.

   7. You are obliged to immediately inform us in case of suspicion or evidence of any misuse of your Customer account by any unauthorised third parties.

   8. We encourage you to secure, protect and back up your account and Your Content by, for instance, regularly archiving copies of Your Content outside Salto X in a suitably secured location.

   9. Documents generated by the Salto X Platform may be executed by electronic signatures. By entering your electronic signature into a document on the Salto X Platform, you consent to the use of your e-signature to create a legally binding document.

   10. Customer's (End Users) generating documents using the Salto X Platform are responsible for the content of these documents. Furthermore, if Customer's (End Users) choose to get the documents signed electronically using the Salto X Platform, they are responsible for the process.

   11. Certain payments made on Salto X Platform are made through our payment and escrow provider. Personal information we collect from you will be shared with our payment and escrow service provider for the purposes of processing payments. The payment information you supply directly to the payment and escrow provider is not within our control and is subject to the payment and escrow provider's own privacy policy and terms and conditions presented to you at the moment of transaction. 

   12. By accessing and using Salto X Platform, you understand and acknowledge that any content provided on and by Salto X, including but not limited to articles, information, or any other materials, is intended for general informational purposes only. You acknowledge that the content on Salto X Platform is not intended to constitute professional advice, including but not limited to tax, accounting, legal, financial, investment, or any other specialised advice. Salto X does not guarantee the content’s accuracy, completeness, reliability, or timeliness.

5. Representation and warranties of Salto X

   1. Salto X does not warrant that the use of the Services (including Salto X Platform) shall be uninterrupted or error-free, nor is any warranty given as to the results that may be obtained from using the Services. The Services are provided on an “as is” and “as available” basis and without warranty of any kind.

   2. Salto X Platform may include or provide access to the Third-Party Content. The Third-Party Content is provided for informational purposes only, and Salto X does not endorse or guarantee the accuracy, reliability, or legality of any Third-Party Content.

6. Subscription Fees and Payments

   1. The Customer shall pay the Fees set out in the Order in accordance with this Agreement.

   2. The Customer is responsible for providing complete and accurate billing and contact information to Salto X and notifying Salto X of any changes to such information.

   3. Fees for the Services may be collected via a payment processor as notified to the Customer from time to time. Salto X may suspend the Customer’s access to the Services if any payment is not successfully settled due to expiration, insufficient funds or otherwise. For some payment methods, the issuer may charge certain fees, such as foreign transaction fees or other fees relating to the processing of the payment method, which shall be due and payable by the Customer. The Customer may be required to accept the terms and conditions of the issuer of the payment method or the third-party payment processor to make the relevant payment as set out in the Order.

   4. Fees are payable in the currency detailed in the Order and are non-cancellable and non-refundable. Fees are stated exclusive of value-added tax or relevant sales tax, which shall be added to Salto X’s invoice(s) at the appropriate rate.

   5. Fees for the Services 

      • Free Services
        ‍Some Services on Salto X Platform are currently free of charge for the Customers. Salto X may introduce Fees for these Services at any time.
      • Paid Services
        ‍In order to get access to certain Services on Salto X Platform, payment of the relevant Fees is required. These Fees are clearly specified on the Salto X Platform, as well as during the Order confirmation or on the invoice. Once payment of the Fees has been successfully processed, access to the paid Services will be granted.

   6. Changes to the Fees
      ‍In the event of any changes to the Fees, Salto X will notify Customers through email, Salto X Platform or other means. The notification will be sent at least 30 (thirty) calendar days before implementing the Fees. By continuing to use Salto X Platform and its Services after receiving the notification, the Customer acknowledges and agrees to the new Fees, as applicable.

   7. Additional Services
      If you request Salto X to provide additional Services, we may charge you additional Fees for such additional Services as may be agreed upon separately between the parties. 

   8. Order of payment
      ‍Access to the paid Services is available only upon payment of the Fees. Payment of the Fees shall happen through a third-party payment processor available at that moment on Salto X Platform or bank transfer in case of an invoice. Unless otherwise provided by law, all purchases are final and non-refundable.

7. Liability of Salto X

   1. You agree to defend, indemnify, and hold Salto X harmless and its affiliates, officers, directors, employees, agents, successors and assigns from and against any and all losses, damages, expenses (including reasonable attorneys' fees), rights, claims, actions of any kind, and injury (including death) arising out of or relating to your use of Salto X Platform, any content you submit or share on Salto X Platform, your connection to Salto X Platform, your violation of this Agreement, or your violation of any rights of another party.

   2. Salto X shall have no liability to the Customer or any third party for any special, indirect, incidental, or consequential loss or damages arising under or in connection with this Agreement, including, without limitation, damages resulting from delay of delivery or from loss of profits, data, business or goodwill.

   3. In any case, even if Salto X is held liable, the aggregate total liability of Salto X arising under or in connection with this Agreement shall not exceed the amount equal to the Fees paid by the Customer to Salto X under the Agreement for the preceding 3 (three) months from the alleged breach (if any).

   4. If Salto X’s performance of any of its obligations under the Agreement is prevented or delayed by Default of the Customer, then until the Customer remedies the Default, Salto X shall not be liable for any costs or losses sustained or incurred by the Customer arising directly or indirectly from Salto X’s failure or delay to perform any of its obligations.

   5. Salto X is not liable for any actions, omissions and proper fulfilment of any obligations by the Customers. Salto X shall not be liable for unauthorised, fraudulent or other unlawful activity connected to the Customer's use of Salto X Platform. Salto X shall not be liable for any costs, losses or damages caused due to inaccurate or incomplete data provided by the Customers.

8. Confidentiality

   1. Know-how, trade secrets and other information of a confidential nature (including but not limited to all proprietary technical, industrial and commercial information as well as any information related to the business or contents of the Agreement), however, recorded or preserved, that is disclosed or made available (in any form or medium), directly or indirectly, by one party as the information provider to the other party as the information recipient is regarded as confidential information,  unless:

      • that it is or becomes generally available to the public other than as a direct or indirect result of the information being disclosed by the information recipient in breach of the Agreement;
      • was already lawfully known to the information recipient before the information provider disclosed it; or
      • has been received by the information recipient from a third-party source that is not connected with the information provider and such source was not under any obligation of confidence regarding that information.

   2. The information recipient undertakes to the information provider that it shall:

      • keep the confidential information secret and confidential, and
      • not use or exploit the confidential information in any way except for or in connection with the performance under the Agreement.

   3. Each party may disclose the confidential information to any of its officers, employees, advisers, subcontractors and contractors that need to know the relevant confidential information for the performance under the Agreement, provided that it procures that each such person to whom the confidential information is disclosed complies with the obligations set out in the Agreement as if they were the information recipient.

   4. Each party may disclose the confidential information to the minimum extent required by:

      • any order of any court of competent jurisdiction or any regulatory, judicial, governmental or similar body or taxation authority of competent jurisdiction; or
      • the laws or regulations of any country to which its affairs are subject.

   5. The above obligations relating to confidentiality are not limited in time or by the validity of the Agreement.

9. Intellectual Property

   1. Excluding any open-source software or third-party software that the Salto X Platform or the Services incorporates the content as set out below, Salto X is entitled to any rights to the Salto X Platform and the Services, including but not limited to all rights relating to algorithms, APIs, databases, data collections, diagrams, formulae, logos, designs, names, methods, network configurations and architectures, processes, protocols, schematics, specifications, software, software code (in any form, including source code and executable or object code), subroutines, techniques, Customer interfaces, URLs, websites, and other forms of technology (whether or not embodied in any tangible form and including all tangible embodiments of the foregoing) as well as technology, content and other materials used, displayed or provided on the Salto X Platform or in connection with the Services (including all intellectual property rights subsisting therein). Such material is protected by copyright, trademark, data protection laws (as applicable) and/or other intellectual property laws. As applicable and to the extent legally permissible, in particular, complying with applicable data protection laws, each Customer transfers and grants the respective aforementioned rights to Salto X exclusively and unlimited in time, scope and space. Any use, transmission and/or copy of any content on Salto X Platform or Services not aligned with this Agreement or without the prior consent of Salto X is a violation of this Agreement and strictly prohibited.

10. Force Majeure

    1. Neither the Customers nor Salto X will be responsible for any failure to perform any of its obligations under the Agreement due to any reason that is independent of that person’s will and has resulted from a force majeure event. A force majeure event will apply only and solely if that person has taken all steps that depend on it in order to perform the obligation. Once the force majeure event has finished, that person must immediately resume the performance of the obligation. The following circumstances will be considered as force majeure events:

       • extraordinary and unavoidable circumstances, including natural disasters, fire, flood, earthquake, warfare, terror acts, riots and strikes;
       • technical failures, delays or malfunctions, failure of computers, communications systems, hardware and/or software, power supply malfunctions, or other critical infrastructure malfunctions at Salto X, which Salto X could not have prevented or predicted;
       • decisions and/or activities of local and/or foreign public authorities and/or international organisations; and 
       • entry into force, amendments and/or suspension of a statutory act binding on Salto X and/or any relevant Customer affecting the performance of obligations under this Agreement.

11. Term and Termination

    1. This Agreement shall commence as of the Effective Date and, unless terminated sooner as provided herein, shall continue for the Term.

    2. Salto X may terminate any Service under Salto X Platform by notifying the Customers via email registered on Salto X Platform or otherwise at least 10 (ten) Business Days in advance unless this Agreement or the regulations of the Republic of Estonia stipulate otherwise.

    3. Salto X may terminate the Agreement at any time with immediate effect if a material breach occurs. 

    4. The Customers may terminate the Agreement at any time by notifying Salto X via email or Salto X Platform or any other by Salto X accepted means at least 10 (ten) Business Days in advance. On receipt of the notification, Salto X will restrict the Services available to the Customer on Salto X Platform.

    5. All outstanding payment obligations, confidentiality obligations, and obligations arising out of the liability provisions of this Agreement shall survive the termination of this Agreement. 

12. Amendment of the Agreement

    1. Salto X reserves the right to amend the Agreement with effect for the future by posting an updated version on Salto X Platform.

    2. Salto X will inform you of such amendments via email, through Salto X Platform, or in any other manner as it deems necessary.

    3. Any such amendments shall be considered accepted by you provided that you continue to use our Services and Salto X Platform after one month from the date of amendments. However, you may withdraw from the use of our Services and Salto X Platform by sending a notification to Salto X, and Salto X shall terminate the Agreement with you by the end of a one-month period from the date the notification is received. 

    4. Amendments shall be in force on the date provided in the amendments. 

13. Governing law and dispute resolution

    1. The Agreement and the legal relations deriving from it between the Customers and Salto X shall be governed by the laws of the Republic of Estonia.

    2. If any disputes arise out of or relating to the Agreement, the parties shall attempt to resolve them through negotiations. If the matter is not resolved by negotiations, the Harju County Court located in Estonia shall have the exclusive jurisdiction as a court of first instance of all disputes arising out of or relating to the Agreement.

14. Processing of the Personal Data 

    1. The Customer shall own all rights, titles and interests in and to all the Customer Content and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Content.

    2. If any disputes arise out of or relating to the Agreement, the parties shall attempt tSalto X may track and analyse the Customer’s and any Customer End User’s use of the Services for security purposes and to help Salto X improve the Services and Salto X Platform.o resolve them through negotiations. If the matter is not resolved by negotiations, the Harju County Court located in Estonia shall have the exclusive jurisdiction as a court of first instance of all disputes arising out of or relating to the Agreement.

    3. Salto X may use the Customer Content to provide Services and to improve the performance and functionality of Salto X Platform, including for developing Improvements, updates, upgrades, modifications, and derivative works thereof. Salto X shall own all rights, title and interest in and to all of the Derived Data. Any personal data contained in your Customer Content or generated by Salto X Platform shall be processed by Salto X in accordance with the Data Processing Agreement, which is in addition to, and does not relieve, remove, or replace, each of the parties’ obligations or rights under the Data Protection Legislation.

    4. Salto X may identify complementary services provided by its partners and relevant third parties, which would benefit Customer and may notify the Customer of such services. With the Customer’s permission, Salto X shall share the contact data of the Customer with such third parties, as further explained in the Privacy Policy.

    5. Salto X will use all reasonable endeavours to implement appropriate technical and organisational security measures to secure your Customer Content against accidental loss, theft, or unauthorised access or disclosure, including encryption and regular backups as further detailed in the Data Processing Agreement.

    6. The Customer hereby indemnifies Salto X from and against all losses, damages, liabilities and claims arising from or in relation to any third-party claims that the processing and use of the Customer Content in accordance with this Agreement infringes or misappropriates any third-party rights or breaches Data Protection Legislation.

    7. At all times during the Term, Customer shall have the ability to access, extract, and delete Customer Content. Salto X will retain Customer Content stored in the Services for thirty (30) days after expiration or termination of Customer’s subscription so that Customer may extract Customer Content, and Salto X may charge for any assistance required by Customer to extract Customer Content at its then current daily rates for data extraction. After said 30-day period ends, Salto X will disable Customer’s account and delete all Customer Content and personal data (within thirty (30) days), save to the extent that Salto X is required by any applicable law to retain some or all of such Customer Content. In such event, Salto X shall extend the protections of the Agreement to such retained Customer Content and limit any further processing of such Customer Content only to those limited purposes for which, and only for so long as, such retention is required by applicable law. Nothing contained herein shall require Salto X to alter, modify, delete, or destroy backup tapes or other media created in the ordinary course of business for purposes of disaster recovery and business continuity, so long as such tapes or other media are kept solely for such purposes and are overwritten, recycled, or otherwise remediated in the ordinary course of business. Salto X  has no liability for the deletion of Customer Content or personal data as described in this clause.

15. General

    1. This Agreement constitutes the entire agreement between the parties. It extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter.

    2. Assignment. The Customer shall not assign, transfer, charge, sub-contract or deal in any other manner with all or any of its rights or obligations under this Agreement without the prior written consent of Salto X. Salto X may at any time assign, transfer, charge, sub-contract or deal in any other manner with all or any of its rights or obligations under this Agreement, and Salto X may assign this Agreement in its entirety (including all Orders hereunder) to an Affiliate. In the ordinary course of its business, Salto X uses third-party service providers (collectively, “Vendors”) to support the provision of the Services or support generally (i.e., not specifically for Customers). In addition, Salto X may provide the Services or support through one or more Affiliates. Salto X reserves the right to engage and substitute Vendors and Affiliates as it deems appropriate to provide the Services and support hereunder but shall remain responsible for the acts or omissions of such Vendors or Affiliates undertaken in connection with this Agreement.

    3. If any provision or part-provision of the Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable. If that modification is not possible, the relevant provision or part-provision shall be deemed deleted. Any modification to or deletion of a provision or part-provision under this clause shall not affect the validity and enforceability of the rest of the Agreement.

    4. Nothing in the Agreement is intended to, or shall be deemed to, establish any partnership or joint venture between any of the parties.

    5. Severance. If any provision or part-provision of this Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable. If such modification is not possible, the relevant provision or part-provision shall be deemed deleted. Any modification to or deletion of a provision or part-provision under this clause shall not affect the validity and enforceability of the rest of this Agreement.

    6. Third-party rights. A person not a party to this Agreement shall not have any rights to enforce any term of this Agreement.

    7. Counterparts. This Agreement may be executed in any number of counterparts, each of which, when executed, shall constitute a duplicate original, but all the counterparts shall together constitute one agreement.

16. Notices

    1. You can contact Salto X or give Salto X notice under this Agreement by emailing info@saltox.co. Any such communication (in the absence of a failed delivery receipt) shall take effect at 9.00 am on the next Business Day after transmission.

    2. We may contact you or give you notice under this Agreement by emailing the relevant email address associated with your Customer account. Any such communication shall take effect at 9.00 am on the next Business Day after transmission. It is your responsibility to notify Salto X of any changes to your email address associated with your Customer account.

    3. All notices given under this Agreement must be in the English language.