USER AGREEMENT
effective 05.10.2023
This User Agreement (the “Terms” or “Agreement”) is made and entered into between you
and Trust Fractal GmbH, Wiener Straße 10, 10999 Berlin, Germany (referred to as “Fractal ID”,
“we”, and “us”) and establishes the terms and conditions that apply and govern your use of
the idOS and all related software and applications (“idOS”). These terms are legally binding,thus we ask that you read them very carefully.
These Terms do not alter or control in any way other written terms or conditions or otheragreements you have agreed to with us. Additionally, if you are representing a legal entity(such as a business), by using idOS you are warranting that you have authority to bind that
entity to these terms. You must also have the legal capacity to agree to these legal terms andconform to the eligibility requirements found below to agree to these terms and use idOS.
By clicking “I agree” or otherwise using the idOS you agree to be bound by these Terms andany other terms referenced by these Terms.
1.

idOS

The idOS (identity operating system) is a solution that aims to enable decentralized identity
across the web3 space and is made up of two key elements: (i) a dStorage Network of Nodes(“dStorage Network of Nodes”), managed by Node Operators (“Node Operators”) that hostinformation (“Stored Information”), which is user-encrypted and that may also be issued into
idOS as Verifiable Credentials by an identity verification provider (“Identity Provider”) uponuser instruction, while the dataset state is harmonized by a consensus mechanism(“Consensus Mechanism”); and (ii) an Access Management Protocol (“Access Management
Protocol”), allowing idOS users (“Users”) to manage their stored information and grant/revoke
access to such stored information to third parties viewers (e.g. dApps)(“Viewers”), while suchaccess may be set for a predetermined period of time. Additionally, the idOS provides an SDK
for viewers to integrate the idOS (“SDK”) and a User Data Dashboard (“Dashboard”), whereusers can manage their stored information, credentials and access grants (“Access Grants”).
Within idOS, users can own, edit and grant/revoke access to their stored information tointeract with viewers. Node operators host stored information while viewers request read or
write access to stored information or credentials and identity providers verify stored
information, issue credentials and may add them to users’ idOS accounts. The idOS
distributes all stored information among its node operators and uses the consensus
mechanism to harmonize the dataset state. In case users grant access to their stored
information, the actual information is decrypted by the user, encrypted using the viewer's
public key and then re-uploaded to the idOS nodes.
When you create an idOS account, you instruct the relevant node operator, as theintermediary, to create an idOS account for you and when you edit and/or add information toyour idOS account via a node operator, you also instruct the relevant node operator, as theintermediary, to update/upload such information into idOS for you. Additionally, in thecontext of users granting access to stored information to viewers, a record is created in thesmart contract in the respective blockchain that the idOS monitors and when a user grants
access to stored information to a viewer, you both instruct that your corresponding walletaddresses are recorded in such smart contracts in the relevant blockchain.
This User Agreement sets out the rules governing: (a) your use of the idOS (including its
website and all related software and applications); and (b) the transmission, uploading,storage and processing of information by you, or by any other person, when using the idOS.
2.

Eligibility to use the idOS

By using or registering for the idOS you represent and agree that:1.
You are 18 years or older and of full age in your jurisdiction of residency, and not
restricted by any court or any orders in your ability to agree to contracts;
2.
You will follow these Terms;
3.
You have not been suspended from using the idOS before;
4.
You will provide updated and accurate information;
5.
Only you or a legally authorized representative of yours will use your account;
6.
You will maintain the security of your account and never transfer it;
7.
You will only register for one account that is on behalf of yourself when registering as anatural person;
8.
You will not use the idOS in any unlawful, illegal, fraudulent, deceptive or harmful way
or in connection with any unlawful, illegal, fraudulent, deceptive or harmful purpose or
activity;
9.
You will ensure that all stored information you upload into idOS complies with theprovisions of this Terms;
10. You will not use the idOS in any way that causes, or may cause, damage or
impairment of the availability or accessibility of the idOS;
11.
You are not sanctioned or restricted in a way that would make your use of the idOS
unlawful according to any applicable laws or treaties;
12.
You automatically succeed and fully comply to this Agreement and any other terms
referenced or included into these Terms;
13.
You will otherwise follow the law.
3.

Registration

You may be required to provide certain information as part of the registration process of idOS,or as part of your continued use of the idOS. Any information you give must always be
accurate and up to date and you will inform us promptly of any updates. The information you
provide must not misrepresent you or be intentionally inaccurate. By registering or creating
an account, you agree that you are fully responsible for all activities that occur under youraccount.

You acknowledge that you have control over to whom you grant access to the stored
information you uploaded in the idOS. Within your registration process, you shall maintainthe security of your idOS account, including by not using the same password within idOS thatyou use for other services or products, not disclose your password or keys to any third party,
and immediately notify us if you suspect or discover any unauthorized activities in connection
with the idOS or your account. You acknowledge and agree that if you lose your keys, you
may not be able to recover stored information uploaded.
In case you become aware of any unauthorized use of or access to your account, you shallnotify us. You shall be liable for damages, losses, liability, expenses and attorneys’ fees
incurred by a third party or us as a result of someone else using your account. You confirm
you understand and agree that we may require you to provide information that may be used
to confirm your identity, account ownership and help ensure the security of your account. We
shall not be liable for any damages, loss, liability, expenses or attorneys’ fees that you may
incur as a result of someone else using your account or password, with or without yourknowledge and/or authorization, and regardless if you have or have not warned us of theunauthorized use.
Fractal ID partners with viewers and third-parties - together, “Partners” - to offer you a variety
of “Deals” (e.g., bonuses for registering with Partners, discounts in trading fees when using
Partners’ services, etc.). You instruct Fractal ID to find Deals for you and send you
communications notifying you of the Deals Fractal ID sourced and providing you with theinformation you need to participate.
4.

Availability

We may change, limit or discontinue the idOS, any portions or features of it with or without
notice. This includes for maintenance purposes. We are also entitled to temporarily prevent or
restrict your use of the idOS if and to the extent required for the security and functioning of
the idOS. We have no obligation to maintain the uptime of idOS, but shall try our best to
make it reliable and available to you.
5.

Prohibited Use

When using the idOS, you may not (or allow those acting on your behalf to):A. Utilize the idOS for unauthorized or unlawful purposes, to engage in or support any
unlawful activities, in a way that contradicts any applicable guidance, orders,regulations, or rules of ours or idOS or any presiding government, court, law
enforcement agency, supervisory authority and/or regulatory agency, or to facilitate
any activities that can lead to death, personal injury or environmental damage;B. Use the idOS for a third-party or enable a third-party to use idOS by disclosing,offering or selling your account information or by any other means except to your own
legally authorized representatives;
C. Copy, reverse engineer or attempt to extract any non-open source code from any
component of the idOS;
D. Introduce into any component of the software: any viruses, worms, defects, Trojan
horses, malware, or any items of a destructive nature;
E. Interfere with or disrupt in any way idOS or the servers or networks providing the idOS;
F. Use unauthorized bots or applications to access the idOS;
G. Submit false, incorrect, incomplete or unencrypted information through the idOS.
By using or registering for the idOS you further represent and agree that:
5.1.

Stored information you upload into idOS will not be illegal or unlawful, infringe any
person's legal rights, and will not be capable of giving rise to legal action against any
person, in each case in any jurisdiction and under any applicable law. We do notcontrol, own or endorse any information that is processed, transmitted, uploaded orstored within idOS.

5.2.

Stored information you upload into idOS, and the use of stored information you
upload into idOS by us and/or viewers or third-parties in any manner licensed orotherwise authorized by you, will not:5.2.1.
be libelous or maliciously false;
5.2.2.
be obscene or indecent;5.2.3.
infringe any copyright, moral right, database right, trademark right,
design right, right in passing off, or other Intellectual Property Rights;
5.2.4.
infringe any right of confidence, right of privacy or right under Data
Protection Laws;
5.2.5.
constitute negligent advice or contain any negligent statement;
5.2.6.
constitute an incitement to commit a crime, instructions for thecommission of a crime or the promotion of criminal activity;
5.2.7.
be in contempt of any court, or in breach of any court order;
5.2.8.
constitute a breach of racial or religious hatred or discrimination
legislation;
5.2.9.
be blasphemous;
5.2.10.
constitute a breach of official secrets or business secrets legislation; or5.2.11.
constitute a breach of any contractual obligation owed to any person.

5.3.

Stored information you upload into idOS is not and has never been the subject of any
threatened or actual legal proceedings or other similar complaint.

5.4.

Stored information you upload into idOS will be appropriate for all persons who haveaccess to or are likely to access it, and will not depict violence in an explicit, graphic or
gratuitous manner as well as it will not be pornographic or sexually explicit.

5.5.

You are solely responsible for ensuring that stored information you upload into idOS iscompliant with all applicable laws and is stored encrypted.

5.6.

You will comply with applicable all laws and regulations, including laws andregulations for data protection.

5.7.

Stored information you upload into idOS will not consist of or contain any legal,financial, investment, taxation, accountancy, medical or other professional advice, andyou shall not use the idOS to provide any legal, financial, investment, taxation,accountancy, medical or other professional advisory services unless you are a memberof a special profession which allow you to use or share such information. It will notconsist of or contain any advice, instructions or other information that may be acted
upon and could, if acted upon, cause death, illness or personal injury, damage toproperty, or any other loss or damage.

5.8.

Stored information you upload into idOS will not be offensive, deceptive, threatening,abusive, harassing, menacing, hateful, discriminatory or inflammatory and will not beliable to cause annoyance, inconvenience or needless anxiety. You will not use theidOS to send any hostile communication or any communication intended to insult,harass, threaten, or defame any person or entity, including such communications
directed at a particular person or group of people and will not use the idOS for the
purpose of deliberately upsetting or offending others.

5.9.

Stored information you upload into idOS will not constitute or contain spam, and you
will not use the idOS to store or transmit spam, which for these purposes shall include
all
unlawfulmarketingcommunications
andunsolicitedcommercial
communications. You will not use the idOS to promote or operate any chain letters,ponzi schemes, pyramid schemes, matrix programs, multi-level marketing schemes,"get rich quick" schemes or similar letters, schemes or programs.

5.10.

You will not use the idOS for any purpose relating to gambling, betting, lotteries, prize
competitions or any gambling-related activity.

5.11.

You acknowledge that we do not guarantee the maintenance of any stored
information and are not responsible for any loss, misuse, or deletion of stored
information or any failure of any stored information uploaded into idOS to be stored or
encrypted. You are responsible for configuring and using the idOS to upload andmanage stored information and for maintaining appropriate security of the accountand corresponding stored information as well as for ensuring that stored information
you upload into idOS is encrypted, backed up and for maintaining copies of it.

5.12.

You are strictly prohibited to process personal data unauthorized, in particular but notlimited to unauthorized collection, recording, organization, structuring, storage,adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination, restriction,
erasure or destruction of personal data. You will process personal data always inaccordance with applicable law and observe the principles of processing of applicablelaw. If GDPR/UK-GDPR is applicable to the processing of personal data, you willprocess only in accordance with the principles of GDPR/UK-GDPR.

7.

Indemnification

Unless prohibited by applicable law, you will defend and indemnify us, and our affiliates,
directors, officers, employees, and Users, against all liabilities, damages, losses, costs, fees(including legal fees), and expenses, including all damages we may incur relating to any
allegation or third-party legal proceeding to the extent it arises from your misuse of the idOSor your violation of these Terms.
8.

Disclaimer

EXCEPT AS EXPRESSLY SET OUT IN THE TERMS, WE DO NOT MAKE ANY SPECIFIC PROMISESABOUT THE idOS OR ANY OF ITS COMPONENTS OR ANY STORED INFORMATION. FOR
EXAMPLE, WE DO NOT MAKE ANY COMMITMENTS ABOUT THE SPECIFIC FUNCTIONS OF
THE idOS, OR THE idOS’ OR THE STORED INFORMATION’S RELIABILITY, AVAILABILITY, OR
ABILITY TO MEET YOUR NEEDS. WE ALSO DO NOT REPRESENT OR WARRANT THAT THE
CONTENT OR THE idOS OR THE STORED INFORMATION ARE COMPLETELY ACCURATE,COMPLETE, RELIABLE, CURRENT, OR VIRUS-FREE, ERROR-FREE, FREE OF HARMFULCOMPONENTS AS WELL AS MALICIOUS CODE, OR THAT ANY DEFECTS WILL BE FIXED. WE
PROVIDE THE idOS "AS IS". YOU ALSO ACKNOWLEDGE THAT, BECAUSE OF THE NATURE OF
THE INTERNET, MOBILE NETWORKS, AND THE DEVICES WHICH ACCESS THE INTERNET
AND/OR MOBILE NETWORKS, THE idOS MAY NOT BE ACCESSIBLE WHEN NEEDED, AND
THAT INFORMATION, DATA, AUDIO AND VIDEO TRANSMITTED OVER THE INTERNET AND/OR
MOBILE NETWORKS MAY BE SUBJECT TO INTERRUPTION OR THIRD PARTY INTERCEPTION
AND MODIFICATION THAT IS OUTSIDE OUR CONTROL. ADDITIONALLY, WE CANNOTWARRANT OR REPRESENT THAT YOUR USE OF THE INTERNET OR idOS IS SAFE AND YOU
SHOULD USE REASONABLE SAFETY MEASURES TO PROTECT YOURSELF FROM ANY
HARMFUL COMPONENTS. YOU EXPRESSLY AGREE THAT YOUR USE OF THE idOS OR THE
STORED INFORMATION AND YOUR RELIANCE UPON ANY OF THE CONTENT IS AT YOUR
SOLE RISK. WE NOT MAKE ANY REPRESENTATIONS OR WARRANTIES OF ANY KIND,ESPECIALLY AS TO THE RETRIEVABILITY, STORAGE, MAINTENANCE, OR CONDITION OF
STORED INFORMATION. WE MAKE NO GUARANTEES THAT ANY STORED INFORMATIONWILL BE RETRIEVABLE OR AVAILABLE. WE DO NOT SPONSOR, CONTROL, ENDORSE, OR
ADOPT ANY STORED INFORMATION AND HAVE NO OBLIGATION TO EDIT, SCREEN OR
MONITOR STORED INFORMATION AND ARE NOT LIABLE OR RESPONSIBLE FOR ANY
STORED INFORMATION. YOU UNDERSTAND AND CONFIRM YOU AGREE THAT WE HAVE NOSUPPORT, INDEMNITY, OR OTHER OBLIGATIONS WITHIN THIS AGREEMENT. WE EXCLUDEOUR RESPONSABILITY FOR ANY DAMAGE OR LOSS TO STORED INFORMATION. YOU ARERESPONSIBLE FOR ENSURING THE ENCRPTION OF AND MAINTAINING BACKUP COPIES OF
ALL STORED INFORMATION AT ALL TIMES AND WE ARE NOT RESPONSIBLE FOR ANY LOSSOR DAMAGE TO STORED INFORMATION UPLOADED. WE DO NOT GUARANTEE OR CLAIM
THAT idOS IS APPROPRIATE FOR STORING CERTAIN KINDS OF DATA OR FOR ANY SPECIFIC
USE, NOR THAT STORING PERSONAL OR SENSITIVE INFORMATION ON idOS COMPLIESWITH ANY LEGAL OR REGULATORY STANDARDS.
SOME JURISDICTIONS PROVIDE FOR CERTAIN WARRANTIES, LIKE THE IMPLIED WARRANTY
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
EXCEPT AS EXPRESSLY PROVIDED FOR IN THESE TERMS, TO THE EXTENT PERMITTED BY
LAW, WE EXCLUDE ALL WARRANTIES, GUARANTEES, CONDITIONS, REPRESENTATIONS,AND UNDERTAKINGS.
9.

Limitation of Liability

UNLESS PREVENTED BY LAW, WE WILL NOT BE RESPONSIBLE FOR LOST PROFITS,
REVENUES, OR DATA; FINANCIAL LOSSES; OR INDIRECT, INCIDENTAL, SPECIAL,CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES AND ANY LIABILITY SHALL BE
LIMITED TO INJURY TO BODY, LIFE, OR HEALTH. WE ARE NOT RESPONSIBLE FOR
MONITORING ANY TRANSACTION BETWEEN YOU AND THIRD-PARTIES AND ARE NOT
LIABLE FOR THE ILLEGAL OR OFFENSIVE BEHAVIOUR OR CONDUCT OF ANY THIRD PARTY.
IN ALL CASES, WE WILL NOT BE LIABLE FOR ANY EXPENSE, LOSS, OR DAMAGE THAT IS NOTREASONABLY FORESEEABLE IRRESPECTIVE OF THE LEGAL BASIS. WE ARE NOT LIABLE IN
CASE ANY UNENCRYPTED PERSONAL DATA IS UPLOADED INTO idOS. WHERE LIABILITY IS
BASED ON FAULT, OUR LIABILITY FOR DAMAGES CAUSED BY INTENTIONAL ACTS ANDGROSS NEGLIGENCE SHALL BE UNLIMITED. IN ALL OTHER CASES, OUR LIABILITY IS
EXCLUDED.
10.

Termination

You may terminate this Agreement at any time without notice and without stating reasons,by contacting us in writing, or simply by stopping your use of the idOS. We reserve the rightto terminate the Agreement with you at any time and for any reason with you by giving you
reasonable notice. We also reserve the right to discontinue the idOS or any portion or featureor your access thereto for any reason and at any time without liability or other obligation toyou.
If you or we terminate this agreement, we may block your account at the effective date of
termination. After which it will no longer be possible to use the idOS without agreeing tothese terms.
11.

PrivacyPlease refer to idOS’s Privacy Policy for information about how it collects, uses, and discloses
information about you. By accepting these Terms, you confirm you read and acknowledge
the terms described in our Privacy Policy and Transparency Document.
The general terms and conditions for data protection, which include, among other things, allfive versions of the EU Standard Contractual Clauses, the UK International Data Transfer
Agreement, the UK Addendum to the EU Standard Contractual Clauses, a Data Processing
Agreement governed by UK law, a CCPA-CPRA Contractor Agreement and a Data Protection
and Confidentiality Agreement for suppliers, will automatically form part of all agreements
entered into with us. By entering into any other agreement with us, including in the case you
are a node operator, you automatically agree to the respective terms. In detail:A. EU Standard Contractual Clauses 2021/915 between Controller and Processor:
If you are an EU/EEA-based vendor of ours that processes personal data on our behalf, byconducting business for or with us, you automatically consent to the applicability of ourpublished Standard Contractual Clauses 2021/915. If we are your processor, the Standard
Contractual Clauses 2021/915 published by us will also automatically apply between you andus.
B. EU Standard Contractual Clauses 2021/914 MODULE ONE: Transfer Controller toController:
To the extent that you are a vendor of ours located in a third country and receive personal
data (protected by the GDPR, Member State law or European Economic Area law) from us asa Controller and act as a Controller, by conducting business for or with us, you automaticallyconsent to the applicability of the published Standard Contractual Clauses 2021/914 Module
One. The same applies if you act as a Controller and transfer personal data to us as aController.
C. EU Standard Contractual Clauses 2021/914 MODULE TWO: Transfer Controller toProcessor:
To the extent that you are a vendor of ours located in a third country and receive personal
data (protected by the GDPR, Member State law or European Economic Area law) from us asa Controller and act as a Processor, by conducting business for or with us, you automaticallyconsent to the applicability of the published Standard Contractual Clauses 2021/914 Module
Two. The same applies if you act as a Controller and transfer personal data to us as a
Processor.
D. EU Standard Contractual Clauses 2021/914 MODULE THREE: Transfer Processor toProcessor:
To the extent that you are a vendor of ours and we are acting as a Processor (e.g., for a
subsidiary or a third party), you are located in a third country and receive international datatransfers of personal data (protected by the GDPR, Member State law or European Economic
Area law), and you are therefore a (Sub)Processor, by conducting business for or with us, you
automatically consent to the applicability of the published Standard Contractual Clauses
2021/914 Module Three. The same applies if you act as a Processor and transfer personal data
to us as a (Sub)Processor.

E. EU Standard Contractual Clauses 2021/914 MODULE FOUR: Transfer Processor toController:
To the extent that you are a vendor of ours and we are acting as a Processor (e.g., for a
subsidiary or a third party), you are located in a third country and receive international datatransfers of personal data (protected by the GDPR, Member State law or European Economic
Area law), and you are a Controller, by conducting business for or with us, you automaticallyconsent to the applicability of the published Standard Contractual Clauses 2021/914 Module
Four. The same applies if you act as a Processor and transfer personal data to us as aController.
F. Confidentiality and Data Protection Agreement for Vendors:
If you are a vendor of ours that is not a processor, or if you receive other and non-personal
data from us, by conducting business for or with us, you automatically consent to theapplicability of the published Confidentiality and Data Protection Agreement for Vendors.
G. Confidentiality and Data Protection Agreement for Customers:
If you are a customer of ours and data is exchanged between us, we may separately agree tothe published Confidentiality and Data Protection Agreement for Customers by a concurring
statement. This Confidentiality Agreement shall only become effective upon a separately
declaration of intent by the parties.
H. International Data Transfer Agreement (United Kingdom)To the extent that you are a party to an agreement with us, and personal data transferred byus to you belongs to individuals who are from the United Kingdom or we are based in the
United Kingdom, and you yourself are based outside the United Kingdom and receive
personal data (protected by the UK GDPR or UK law) from us, by conducting or transacting
business for or with us, you automatically consent to the applicability of the published"International Data Transfer Agreement".
I. International Data Transfer Addendum to the European Commission's Standard
Contractual Clauses for International Data Transfers (United Kingdom)To the extent that you are a party to an agreement with us, and personal data we transfer toyou belongs to individuals who are based in the UK or where we are based in the UK and you
yourself are based outside the UK and receive personal data (which is protected by the UK
GDPR or UK law) from us, by carrying out or transacting business for or with us, you
automatically consent to the applicability of the published " International Data Transfer
Addendum to the European Commission's Standard Contractual Clauses for International
Data Transfers".
J. Data Processing Agreement for the United Kingdom
To the extent that you are a party to an agreement with us, and both we and you have ourregistered office in the United Kingdom, and you process personal data (which is protectedby the UK GDPR or UK law) on our behalf, you automatically agree to the applicability of the
published "Data Processing Agreement for the United Kingdom" by executing or conducting
business for or with us. The same applies if you act as a Controller and transfer personal data
to us as a Processor.

K. CCPA-CPRA CONTRACTOR AGREEMENT for California
To the extent that you are a contractor of ours, and we or you have a place of business in
California, or employ or engage employees, service providers, processors, or other persons
from California, and if the Contractor processes consumer data protected by CCPA-CPRA or
California law as part of the relationship, you automatically enter into the CCPA-CPRA
CONTRACTOR AGREEMENT published by us with us by each execution or handling ofbusiness, either as a Business or as a Contractor.
7.1.

Transfers to the United States via EU-U.S. Data Privacy Framework

The European Commission adopted the EU-U.S. Data Privacy Framework on July 10, 2023.
The EU-U.S. Data Privacy Framework is an adequacy decision that allows transfers of personal
data from the European Economic Area (EEA), which includes the 27 EU member states andNorway, Iceland, and Liechtenstein, to any U.S. company that has undergone a specified
self-certification process. U.S. companies certified through the EU-U.S. Data Privacy
Frameworkarelistedonthefollowing
website:https://www.dataprivacyframework.gov/s/participant-search
Until the EU-U.S. Data Privacy Framework is invalidated by the Court of Justice of theEuropean Union (CJEU) or the European Commission, or superseded by a new adequacy
decision, the Controller will transfer Personal Data from the EEA to all companies certified
through the EU-U.S. Data Privacy Framework and identified in this Privacy Policy or in the Listof Processors and Data Recipients based on the EU-U.S. Data Privacy Framework. Thesetransfers are permitted under Article 45 GDPR.
The Controller points out that in the case of transfers based on the EU-U.S. Data Privacy
Framework, neither an analysis of the legal situation in the recipient country (so-called
Transfer Impact Assessment) nor supplementary measures, such as encryption to protect
transferred personal data from access by U.S. authorities, are required or implemented.
The EU-U.S. Data Privacy Framework obligates certified companies from the U.S. to comply
with defined data protection principles, which are based on the requirements of GDPR, andto fulfill data subject rights (e.g., right of access and deletion).
Data Subjekts from the EEA who believe that the requirements of the EU-U.S. Data Privacy
Framework are not being observed by a certified U.S. company may complain to theEuropean Data Protection Authority responsible for them. This Data Protection Authority will
forward the complaint to the European Data Protection Board, which subsequently transmits
it to the U.S. authority responsible for handling the complaint.
EEA Data Subjects also have legal remedies before independent arbitration bodies in the
United States.
If the Controller is based in the U.S. and certified under the EU-U.S. Data Privacy Framework,
the Controller acts as a data importer and complies with the requirements of the EU-U.S.
Data Privacy Framework.
If you have any questions about the EU-U.S. Data Privacy Framework, you may contact theData Protection Officer of the Controller at any time.

Our sub-processor list is available upon request. You instruct us to transfer your personal data
to such sub-processors, as without it we would not be able to provide you the idOS. You areaware of such processing and explicitly instructs us to do so.

12.

General Provisions

These Terms constitute the entire agreement between you and us, unless a separate
agreement has formed between you and us. Unless indicated elsewhere, these Terms shallsupersede any oral agreements, and all supplements and modifications must be made inwriting. Where this agreement conflicts with separate agreements between you and us
related to the idOS, these Terms shall be superseded by any conflicting parts of thoseagreements.
You confirm that you understand that we may transfer the entire Agreement with you,including rights and obligations, in whole or in part, in case we conclude a sale of business,shares or stocks, applications or other assets, transfer or restructuring of our business, that
may or may not result in the performance of this Agreement under the same or a newprovider, legal form or company name.
We may modify these Terms and any other documents linked or referred to in these Terms(together, “Documents”), or any portion of the Documents. You should look at these
documents regularly. We may notify you of modifications to the Documents by posting a
notice or otherwise by sending you a communication if possible, as we may determine, at oursole discretion, on a case-by-case basis. Changes will not apply retroactively and will become
effective after a reasonable time, as stated by us, after they are posted, or as soon as
applicable law allows. If you do not agree with the modifications to the Documents and/or to
the functionalities of the idOS, you should terminate these Terms. Your continued use of theidOS constitutes your acceptance of the modification to the Documents and/or to thefunctionalities of the idOS. You instruct us to, whenever the Documents are modified, to post
them online or to send you via any available communication means, as we may determine in
our sole discretion, and confirms that you will be responsible for reviewing the Documents
link or the communication and in case of non-agreement, you will send a reply informing usof the same.
You and us each agree to contract in the English language. If we provide a translation ofthese Terms, we do so for your convenience only and the English language terms will solely
govern our relationship. These Terms do not create any third party beneficiary rights or any
agency, partnership, or joint venture. Nothing in these Terms will limit either your or ourability to seek injunctive relief. You are not entitled to set-off, unless your claims are legally
established. If you do not comply with these Terms, and we do not take action right away, thisdoes not mean that we are giving up any rights that we may have (such as taking action in
the future). If a particular term is not enforceable under law, this will not affect any otherterms.

These Terms shall be construed in accordance with German law. The laws of Germany will
apply to any disputes arising out of or related to these Terms or the idOS and ALL CLAIMSARISING OUT OF OR RELATING TO THESE TERMS OR THE idOS WILL BE LITIGATEDEXCLUSIVELY IN THE COURTS OF BERLIN, GERMANY, AND YOU AND US CONSENT TOPERSONAL JURISDICTION IN THOSE COURTS.