Privacy Policy Template for SaaS

This Policy applies to all Personal Data processed by the Provider in connection with the Provider's websites, the Service, the Provider's marketing, sales, support and billing activities, and any communications between the Provider and its Users, Business Customers and prospective customers.

This Policy does not apply to third-party websites, services, integrations or applications that may be linked to or interoperate with the Service and that are not owned or controlled by the Provider. The Provider is not responsible for the privacy practices of such third parties, and Users are encouraged to review the applicable policies of those third parties before submitting Personal Data to them.

The Service is intended for use by businesses and professionals and not for personal, family or household purposes. Persons who use the Service on behalf of a Business Customer do so subject to the instructions, policies and settings determined by that Business Customer.

In this Policy, headings are for convenience only and do not affect interpretation. The words "including" and "includes" shall be construed without limitation. References to the singular include the plural and vice versa. References to a "section" are to sections of this Policy.

This Policy shall be interpreted in accordance with its purpose of providing transparent information regarding the processing of Personal Data. Where mandatory provisions of Applicable Data Protection Law grant rights or impose obligations that cannot be excluded or varied by agreement, such provisions shall prevail over any inconsistent term of this Policy to the minimum extent necessary.

If any provision of this Policy is held to be invalid, illegal or unenforceable, the remaining provisions shall continue in full force and effect, and the affected provision shall be replaced by a valid provision that most closely reflects its original intent.

The Provider may publish this Policy in several language versions. In the event of any discrepancy, the English language version shall prevail to the extent permitted by Applicable Data Protection Law.

"Account" means the user profile and associated credentials created by or for a Business Customer or User to access and use the Service.

"Applicable Data Protection Law" means all laws, regulations, binding codes and regulatory requirements in force from time to time in [Jurisdiction] or otherwise applicable to the Processing of Personal Data by a party under this Policy, including laws concerning privacy, data protection, data security and electronic communications.

"Business Customer" means any legal entity, organization or professional that has entered into an agreement with the Provider for access to and use of the Service, whether on a paid, trial or free basis, and that determines the purposes for which the Service is used.

"Controller" means the person that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, including any equivalent term under Applicable Data Protection Law.

"Customer Data" means all data, content, files, records and information, including any Personal Data contained therein, that are submitted, uploaded, stored or otherwise made available to the Service by or on behalf of a Business Customer or its Users, and that are processed by the Provider in the course of providing the Service.

"Data Subject" means an identified or identifiable natural person to whom Personal Data relates.

"Personal Data" means any information relating to a Data Subject, including any information that falls within the meaning of "personal data", "personal information" or any equivalent term under Applicable Data Protection Law.

"Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, transfer, restriction, erasure or destruction, and "Process" and "Processed" shall be construed accordingly.

"Processor" means a person that Processes Personal Data on behalf of a Controller, including any equivalent term under Applicable Data Protection Law such as "service provider".

"Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed by the Provider.

"Service" means the software-as-a-service platform known as [Service Name], including all associated software, features, interfaces, application programming interfaces, documentation, updates and support services made available by the Provider.

"Sub-Processor" means any third party engaged by the Provider that Processes Customer Data on behalf of the Provider in connection with the provision of the Service.

"User" means any individual who is authorized by a Business Customer, or who otherwise accesses the Service, including administrators, employees, contractors and agents of a Business Customer.

The Provider acts as a Controller with respect to Personal Data that it Processes for its own purposes, including Account registration data, billing and payment administration data, website and usage analytics, marketing and sales communications, security monitoring, and the improvement and development of the Service.

The Provider acts as a Processor with respect to Customer Data that it Processes on behalf of a Business Customer. In that capacity, the Business Customer is the Controller (or, where the Business Customer itself acts on behalf of another person, a Processor), and the Provider Processes Customer Data only in accordance with the Business Customer's documented instructions, the applicable agreement between the Provider and the Business Customer, and this Policy.

The Business Customer is solely responsible for determining the purposes and means of Processing Customer Data, for ensuring that it has a lawful basis for the Processing, for providing all required notices to and obtaining all required consents from Data Subjects, and for ensuring that its instructions to the Provider comply with Applicable Data Protection Law.

The Business Customer's use of the Service, including its configuration of settings and features, constitutes its documented instruction to the Provider. The Provider shall inform the Business Customer if, in the Provider's reasonable opinion, an instruction infringes Applicable Data Protection Law, but the Provider shall have no obligation to conduct legal assessment of such instructions and may suspend the relevant Processing pending clarification.

Where the Provider is required by law, regulation or a binding order of a competent authority to Process Customer Data other than in accordance with the Business Customer's instructions, the Provider shall, to the extent legally permitted, inform the Business Customer before such Processing.

Where a Data Subject contacts the Provider regarding Customer Data, the Provider may direct that Data Subject to the relevant Business Customer. The Provider is not responsible for the acts, omissions or privacy practices of any Business Customer.

The Provider may Process Personal Data derived from Customer Data in aggregated, de-identified or anonymized form for the purposes of operating, securing, analyzing and improving the Service, in which case the Provider shall act as Controller of such data, provided that such data does not identify any Business Customer or Data Subject.

The Provider may collect identity and contact data, including name, business email address, telephone number, job title, employer name, business address and communication preferences.

The Provider may collect Account data, including usernames, hashed passwords, authentication credentials, role and permission settings, security questions, profile information and Account configuration preferences.

The Provider may collect billing and transaction data, including billing contact details, tax identification numbers, invoicing records, subscription plan details, payment status, and limited payment instrument information such as the last digits of a card or the identity of a payment method, with full payment credentials being Processed by third-party payment providers.

The Provider may collect technical and usage data, including internet protocol addresses, device identifiers, browser type and version, operating system, language settings, time zone, referring and exit pages, log files, timestamps, features used, error reports, performance data and interaction events within the Service.

The Provider may collect communications data, including the content of support requests, feedback, survey responses, correspondence with the Provider, and recordings or transcripts of calls or meetings where the participants have been informed.

The Provider may collect marketing and relationship data, including event registrations, preferences for receiving communications, and records of interactions with the Provider's marketing materials.

Customer Data may contain any category of Personal Data that a Business Customer elects to submit to the Service. The Provider does not request and does not require special categories or sensitive Personal Data for the use of the Service, and Business Customers shall not submit such data unless the Service is expressly designated to support it in a written agreement with the Provider.

The Provider collects Personal Data directly from individuals when they register for an Account, complete forms, subscribe to communications, request demonstrations, contact support, participate in surveys or otherwise provide information voluntarily.

The Provider collects Personal Data from Business Customers, including where a Business Customer or its administrator creates or invites Users, uploads Customer Data, configures integrations or provides billing information on behalf of the Business Customer.

The Provider collects Personal Data automatically through the Service and the Provider's websites by means of server logs, cookies, software development kits, pixels, tags and similar technologies, as further described in this Policy.

The Provider may receive Personal Data from third parties, including payment processors, identity and single sign-on providers, integration partners selected by a Business Customer, business information and lead generation providers, referral partners, resellers, publicly available sources and professional networking platforms.

Where a Business Customer enables an integration with a third-party product, the Provider may receive Personal Data from that third-party product in accordance with the permissions granted by the Business Customer. The Provider is not responsible for the accuracy of Personal Data received from third parties.

Where the provision of Personal Data is necessary for the creation of an Account, the performance of the Provider's agreement with a Business Customer or compliance with a legal obligation, a failure to provide such Personal Data may prevent the Provider from providing the Service in whole or in part.

The Provider Processes Personal Data to provide, operate, maintain and support the Service, including creating and managing Accounts, authenticating Users, delivering features, responding to inquiries, and performing its contractual obligations to Business Customers.

The Provider Processes Personal Data to manage billing, subscriptions, collections, taxation, accounting, audit and financial reporting, and to enforce its rights under its agreements.

The Provider Processes Personal Data for its legitimate interests, including securing the Service, preventing fraud and abuse, monitoring performance, conducting analytics, improving and developing the Service, direct marketing to business contacts, managing its business relationships, and establishing, exercising or defending legal claims, except where such interests are overridden by the rights and interests of the Data Subject.

The Provider Processes Personal Data to comply with legal and regulatory obligations, including responding to lawful requests by public authorities, maintaining records, and fulfilling tax, accounting and compliance requirements.

Where Applicable Data Protection Law requires consent, including for certain cookies, electronic marketing communications or other optional Processing, the Provider shall Process Personal Data on the basis of the consent of the Data Subject. Consent may be withdrawn at any time without affecting the lawfulness of Processing carried out before withdrawal.

Where Applicable Data Protection Law does not require the identification of a legal basis, references in this Policy to legal bases shall be understood as a description of the purposes and justifications for Processing. The Provider shall not Process Personal Data for purposes materially incompatible with those stated in this Policy without providing notice and, where required, obtaining consent.

When the Provider acts as a Processor, the legal basis for the Processing of Customer Data is determined by the relevant Business Customer as Controller.

To create an Account and subscribe to the Service, a Business Customer or User must provide accurate, current and complete information, including identity, contact and billing details. The Business Customer is responsible for keeping such information up to date.

The Provider uses Account information to authenticate Users, manage access rights, deliver the Service, send service-related notices, and administer the relationship with the Business Customer. Service-related notices, including notices about security, changes to the Service, maintenance and billing, are not marketing communications and may be sent regardless of marketing preferences.

Subscription fees, billing cycles, payment terms and applicable taxes are set out in the agreement between the Provider and the Business Customer or in the applicable order form, at the rate of [Subscription Fee] per [Billing Period], payable in [Currency].

Payments are processed by third-party payment service providers selected by the Provider. The Provider does not store complete payment card numbers or full payment credentials on its own systems, and the Processing of such data by a payment service provider is governed by that provider's own terms and privacy practices.

The Provider may retain billing records, invoices, transaction histories and related correspondence for as long as necessary to meet its accounting, tax, audit and legal obligations and to establish, exercise or defend legal claims, as further provided in this Policy.

The Provider may share billing information with its financial, tax, legal and accounting advisers, collection agencies, payment processors, banks and fraud prevention service providers to the extent reasonably necessary for the purposes stated in this section.

A Business Customer that designates a billing contact or other individual is responsible for ensuring that such individual has been informed that his or her Personal Data will be provided to the Provider.

The Provider Processes Customer Data solely to provide, maintain, secure and support the Service for the Business Customer, in accordance with the Business Customer's documented instructions, and as otherwise permitted by this Policy or required by law.

The Provider shall not sell Customer Data, and shall not use Customer Data for the Provider's own advertising or marketing purposes. The Provider shall not retain, use or disclose Customer Data outside of the direct business relationship with the Business Customer, except as permitted by this Policy or by Applicable Data Protection Law.

The Provider shall ensure that its personnel authorized to Process Customer Data are bound by appropriate obligations of confidentiality and receive appropriate training concerning the protection of Personal Data.

Taking into account the nature of the Processing, the Provider shall provide reasonable assistance to the Business Customer, through appropriate technical and organizational measures and at the Business Customer's cost where such assistance exceeds ordinary support, in responding to Data Subject requests and in meeting the Business Customer's obligations concerning security, impact assessments and consultations with competent authorities, in each case to the extent such assistance relates to the Processing of Customer Data by the Provider.

The Business Customer represents and warrants that it has all rights, authorizations, notices and consents necessary to submit Customer Data to the Service and to permit the Provider to Process Customer Data as described in this Policy, and that Customer Data will not violate Applicable Data Protection Law or the rights of any third party.

The Business Customer is responsible for the content, accuracy and legality of Customer Data, for managing User access and permissions, for maintaining independent backups where it considers necessary, and for configuring the Service in a manner consistent with its own compliance obligations.

Upon termination or expiry of the Business Customer's subscription, the Provider shall make Customer Data available for export for a period of [Export Period] and thereafter shall delete or anonymize Customer Data in accordance with the retention provisions of this Policy, unless retention is required by law.

The Provider shall make available to the Business Customer, upon reasonable written request and no more than once in any period of [Audit Interval], information reasonably necessary to demonstrate compliance with this section, which may be satisfied by providing summaries of independent audit reports or certifications. Any on-site audit shall be subject to prior written notice, confidentiality undertakings, reasonable scope and the Business Customer's bearing of all costs.

The Business Customer authorizes the Provider to engage Sub-Processors to Process Customer Data. The Provider shall enter into written agreements with each Sub-Processor imposing data protection obligations that are materially no less protective than those applicable to the Provider under this Policy.

The Provider maintains a list of Sub-Processors, including their function and location of Processing, which is available at [Sub-Processor List URL] or upon written request. The Provider shall give notice of the intended addition or replacement of a Sub-Processor by updating that list or by notifying the Business Customer's designated contact at least [Sub-Processor Notice Period] in advance.

A Business Customer may object to a new Sub-Processor on reasonable and documented data protection grounds by written notice within [Objection Period] after the notice. The parties shall discuss the objection in good faith. If the objection is not resolved, the Business Customer's sole and exclusive remedy shall be to terminate the affected Service by written notice, without any right to a refund of fees prepaid for the period already commenced, except as required by law.

The Provider remains responsible for the acts and omissions of its Sub-Processors in the performance of their Processing obligations to the same extent as the Provider would be responsible if it were performing the services directly, subject to the limitations of liability set out in the applicable agreement between the Provider and the Business Customer.

The Provider may disclose Personal Data to affiliates, professional advisers, auditors, insurers, hosting and infrastructure providers, communication and support tools providers, analytics providers, payment processors and other service providers who need access to such data to perform services for the Provider, and who are bound by appropriate confidentiality and data protection obligations.

The Provider may disclose Personal Data to public authorities, courts or other third parties where the Provider believes in good faith that disclosure is required by law, legal process or governmental request, or is necessary to protect the rights, property or safety of the Provider, its customers or the public. Where lawful and practicable, the Provider shall notify the affected Business Customer before disclosing Customer Data.

In the event of a merger, acquisition, financing, reorganization, sale of assets or similar transaction, Personal Data may be disclosed to the relevant counterparties and their advisers and transferred to a successor, subject to this Policy or a materially equivalent policy.

The Provider does not sell Personal Data for monetary consideration and does not share Personal Data with third parties for cross-context behavioral advertising, except as may be disclosed through cookie preferences and permitted by Applicable Data Protection Law.

The Provider uses cookies, local storage, pixels, tags, web beacons, software development kits and similar technologies (collectively, "Tracking Technologies") on its websites and within the Service to enable core functionality, maintain security, remember preferences, measure performance and understand how the Service is used.

Tracking Technologies are classified as strictly necessary, functional, analytics and performance, and marketing and advertising. Strictly necessary Tracking Technologies are required for the operation of the Service, including authentication and session management, and cannot be disabled within the Service.

Where required by Applicable Data Protection Law, the Provider shall obtain consent before placing non-essential Tracking Technologies, and shall provide a mechanism for Users to manage and withdraw their preferences, available at [Cookie Preferences Location].

The Provider uses analytics services, which may be operated by third parties, to collect and analyze usage data, including pages viewed, features used, session duration and device information. Such third-party providers may process this data in accordance with their own privacy policies, and the Provider does not control such Processing except as contractually agreed.

Users may also manage Tracking Technologies through browser settings, including blocking or deleting cookies. Disabling certain Tracking Technologies may impair the functionality or performance of the Service, for which the Provider shall have no liability.

The Provider responds to browser-based opt-out preference signals only to the extent required by Applicable Data Protection Law. Because there is no uniform standard for "do not track" signals, the Provider does not otherwise undertake to respond to them.

Further details regarding specific Tracking Technologies, their purposes and their duration may be provided in a cookie notice available at [Cookie Notice URL], which forms part of this Policy.

The Provider may Process and store Personal Data in, and transfer Personal Data to, countries other than the country in which the Data Subject or Business Customer is located, including the countries in which the Provider, its affiliates and its Sub-Processors operate, which may be [Transfer Locations].

Such countries may have data protection laws that differ from, and may offer a lower level of protection than, those of the Data Subject's country of residence. By using the Service, the Business Customer acknowledges and accepts such transfers in accordance with this section.

Where Applicable Data Protection Law restricts the cross-border transfer of Personal Data, the Provider shall ensure that such transfers are made only where an appropriate transfer mechanism is in place, which may include a determination of adequacy by a competent authority, standard contractual clauses approved by a competent authority, binding corporate rules, certification schemes or another lawful mechanism.

The Provider shall implement supplementary technical, contractual and organizational measures, such as encryption in transit and at rest, access controls and data minimization, where reasonably appropriate in light of the nature of the data and the destination of the transfer.

Where the Provider acts as a Processor, the Business Customer authorizes such transfers and agrees that, where necessary, the Provider and the Business Customer shall enter into the contractual transfer instruments required by Applicable Data Protection Law, which shall be incorporated into the agreement between them by reference.

Data Subjects may request further information about the transfer mechanisms applied by the Provider by contacting the Provider at [Privacy Contact Email].

The Provider retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, to provide the Service, to comply with legal, accounting, tax and reporting obligations, to resolve disputes, to enforce agreements and to protect the Provider's legitimate interests.

Unless a different period is stated in this Policy or required by law, Account data is retained for the duration of the subscription and for a period of [Account Retention Period] thereafter; billing and transaction records are retained for [Billing Records Retention Period]; support communications are retained for [Support Records Retention Period]; and log and analytics data are retained for [Log Retention Period].

Customer Data is retained for the duration of the Business Customer's subscription and, following termination or expiry, for the export period described in this Policy. After that period, the Provider shall delete or anonymize Customer Data from its active systems within [Deletion Period], subject to the following sentence. Customer Data may persist in encrypted backup systems for up to [Backup Retention Period] until overwritten in the ordinary course, during which period it shall remain protected and shall not be used for any other purpose.

The Provider may retain Personal Data for longer periods where required by law, where necessary for the establishment, exercise or defense of legal claims, or where a legal hold, investigation or regulatory request applies.

Where Personal Data is no longer required, the Provider shall securely delete it or irreversibly anonymize it so that it can no longer be associated with a Data Subject. Anonymized data is not subject to this Policy and may be retained and used without restriction.

A Business Customer may request earlier deletion of Customer Data through the Service functionality or by written request. The Provider may require verification of authority and shall not be liable for any loss arising from deletion carried out in accordance with such instructions.

The Provider implements and maintains appropriate technical and organizational measures designed to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, alteration or disclosure, taking into account the state of the art, the costs of implementation and the nature, scope and risks of the Processing.

Such measures include encryption of Personal Data in transit and, where appropriate, at rest; logical access controls based on the principle of least privilege; multi-factor authentication for administrative access; network and application security monitoring; vulnerability management and periodic security testing; secure development practices; personnel confidentiality obligations and training; and business continuity and backup procedures.

Business Customers and Users are responsible for the security of their own environments and credentials, including maintaining the confidentiality of passwords, enabling available security features, promptly revoking access of former Users, and notifying the Provider without undue delay of any suspected unauthorized access to an Account.

The Provider shall notify the affected Business Customer without undue delay, and in any event within [Incident Notification Period], after becoming aware of a Security Incident affecting Customer Data. The notification shall, to the extent known, describe the nature of the Security Incident, the categories and approximate volume of Personal Data affected, the likely consequences, and the measures taken or proposed to address it.

The Provider shall take reasonable steps to contain, investigate and remediate a Security Incident. Where the Provider is a Controller, it shall notify competent authorities and affected Data Subjects where and as required by Applicable Data Protection Law. Where the Provider is a Processor, the Business Customer is responsible for determining whether notification to authorities or Data Subjects is required.

A notification of, or a response to, a Security Incident shall not be construed as an acknowledgment by the Provider of any fault or liability.

No method of transmission over the internet or method of electronic storage is completely secure. Accordingly, the Provider does not and cannot guarantee absolute security, and the Provider's obligations in respect of security are obligations of reasonable effort and not of result.

Subject to Applicable Data Protection Law, Data Subjects may have the right to request access to their Personal Data, rectification of inaccurate data, erasure, restriction of Processing, portability of data, objection to Processing based on legitimate interests or direct marketing, and withdrawal of consent, as well as the right not to be subject to decisions based solely on automated Processing producing legal or similarly significant effects. The Provider does not currently engage in such automated decision-making in connection with the Service.

Requests may be submitted to the Provider by email to [Privacy Contact Email], through [Request Portal or Form], or by post to [Provider Address]. The Provider may require the requester to provide information reasonably necessary to verify identity and, where a request is made through an agent, the agent's authority.

The Provider shall respond to a verifiable request within the period required by Applicable Data Protection Law, or, absent such requirement, within [Response Period], which may be extended where the request is complex or numerous, in which case the requester shall be informed of the extension and the reasons for it.

Where a request relates to Customer Data, the Provider acts as a Processor and shall, unless prohibited by law, refer the Data Subject to the relevant Business Customer and shall assist the Business Customer in responding in accordance with this Policy. The Provider shall not respond substantively to such a request except on the instructions of the Business Customer or as required by law.

The Provider may refuse or limit a request, or charge a reasonable fee, where the request is manifestly unfounded, excessive or repetitive, where compliance would adversely affect the rights of others, reveal confidential or privileged information or trade secrets, or where an exemption under Applicable Data Protection Law applies. The Provider shall provide reasons for any refusal where required.

Data Subjects may unsubscribe from marketing communications at any time by using the unsubscribe mechanism in the relevant communication or by contacting the Provider. Opting out of marketing shall not prevent the Provider from sending service-related notices.

A Data Subject who is dissatisfied with the Provider's response has the right to lodge a complaint with the competent supervisory or regulatory authority. The Provider encourages Data Subjects to first contact the Provider so that concerns may be resolved promptly.

The Service is designed for and directed at businesses and professionals and is not intended for, and may not be used by, children. The Provider does not knowingly collect Personal Data from individuals below the age of [Minimum Age], or any higher age of majority or digital consent that applies under Applicable Data Protection Law.

Each Business Customer shall ensure that it does not authorize any individual below the minimum age to access the Service and shall not submit to the Service the Personal Data of children except where it has a lawful basis and any required parental or guardian consent.

If the Provider becomes aware that it has collected Personal Data from a child without verifiable authorization required by law, it shall take reasonable steps to delete that data and to terminate any associated Account as soon as practicable.

A parent or guardian who believes that a child has provided Personal Data to the Provider may contact the Provider at [Privacy Contact Email], and the Provider shall take reasonable steps to investigate and respond to the request.

The Provider does not knowingly sell or share the Personal Data of children for advertising purposes.

Where a Business Customer submits children's Personal Data as part of Customer Data, the Business Customer is solely responsible, as Controller, for compliance with all legal requirements applicable to such Processing.

The Provider may amend, update or replace this Policy from time to time to reflect changes in the Service, its Processing practices, technology, business operations, Applicable Data Protection Law or regulatory guidance.

The Provider shall publish the amended Policy at [Policy URL] and shall update the Effective Date indicated at the beginning of this Policy. For material changes, the Provider shall give notice not less than [Amendment Notice Period] before the changes take effect, by email to the Business Customer's designated contact, by notice within the Service or by prominent notice on the Provider's website.

Amendments shall take effect on the date stated in the amended Policy or, if no date is stated, upon publication. Continued access to or use of the Service after the effective date of an amendment constitutes acceptance of the amended Policy to the extent permitted by Applicable Data Protection Law.

Where Applicable Data Protection Law requires consent to a material change in Processing, the Provider shall obtain such consent before applying the change to Personal Data previously collected.

A Business Customer that does not agree to an amendment may cease to use the Service and terminate its subscription in accordance with its agreement with the Provider before the amendment takes effect. Termination shall not entitle the Business Customer to a refund of prepaid fees except as provided in that agreement or required by law.

Prior versions of this Policy may be made available upon written request to the Provider.

This Policy and any dispute, claim or controversy arising out of or in connection with it, including its existence, validity, interpretation, performance, breach or termination, and any non-contractual obligations arising out of or in connection with it, shall be governed by and construed in accordance with the laws of [Governing Law Jurisdiction], without regard to its conflict-of-laws principles.

The parties shall first attempt in good faith to resolve any dispute through informal negotiation by giving written notice of the dispute to the other party, and shall negotiate for a period of [Negotiation Period] from receipt of such notice before commencing formal proceedings.

Any dispute not resolved by negotiation shall be finally resolved by [Courts or Arbitration Institution] seated in [Seat or Venue], in the [Language of Proceedings] language. Where arbitration applies, the tribunal shall consist of [Number of Arbitrators] arbitrator(s), and the award shall be final and binding on the parties.

To the fullest extent permitted by Applicable Data Protection Law, disputes shall be resolved on an individual basis, and no party may bring a claim as a plaintiff or class member in any purported class, collective or representative proceeding.

Nothing in this section shall prevent either party from seeking urgent injunctive or other interim relief from a court of competent jurisdiction, or prevent a Data Subject from exercising any right to lodge a complaint with a competent authority or to bring proceedings where such right cannot lawfully be excluded.

Where a Business Customer has entered into a written agreement with the Provider that contains governing law and dispute resolution provisions, those provisions shall govern disputes between the Provider and that Business Customer concerning Customer Data and the Service in priority to this section.

The total aggregate liability of the Provider arising out of or in connection with this Policy, to the extent permitted by Applicable Data Protection Law, shall be subject to the limitations and exclusions set out in the agreement between the Provider and the relevant Business Customer or, where none applies, shall not exceed [Liability Cap].