Data Processing Addendum

1. Definitions & Roles

In addition to the defined terms in the Terms of Service, the following roles apply under this DPA:

• Personal Data: information relating to an identified or identifiable individual, processed in connection with the Service.
• Process / Processing: any operation performed on Personal Data, whether or not by automated means, including collection, recording, storage, transmission, use, disclosure, restriction, and deletion.
• Customer Content: the data and material the Customer or its Authorized Users provide to, create in, transmit through, or generate via the Service (including screen streams, files, clipboard data, Recordings, and network/payload traffic), as defined in the Terms of Service.
• Subprocessor: a third party engaged by Vexaro to Process Personal Data in order to provide the Service, as listed in the Subprocessor List.

The parties agree on the following roles:

1. Customer as controller. The Customer determines the purposes and means of Processing the Personal Data it submits to, or generates through, the Service, including all Customer Content. The Customer decides what data is transmitted, captured, recorded, or stored, who is granted access, and on what lawful basis the Processing is carried out. The Customer is responsible for ensuring it has the authority and a valid lawful basis to provide that data to Vexaro for Processing.

2. Vexaro as processor for Customer Content. With respect to Customer Content and other Personal Data that Vexaro Processes solely on the Customer’s behalf, Vexaro acts as a processor and Processes that data only on the Customer’s documented instructions (see Section 4), except where Vexaro is required to Process it to comply with an applicable mandatory rule, in which case Vexaro will inform the Customer of that requirement before Processing unless that rule prohibits such notice on important grounds.

3. Vexaro as an independent controller for certain data. For a limited and exhaustive set of Personal Data, Vexaro acts as an independent controller and determines the purposes and means of Processing itself. Those categories are, and are limited to: (i) account and registration data; (ii) authentication and access data; (iii) billing and payment metadata; (iv) support correspondence; and (v) security, fraud-prevention, audit, and service-integrity data. Vexaro Processes this data to operate, secure, account for, and improve the Service, to meet its own financial-record and regulatory obligations, and as further described in the Privacy Notice. Subject to the limits below, this DPA’s processor obligations (Sections 4 to 11) do not apply to data for which Vexaro is an independent controller; that data is otherwise governed by the Privacy Notice.

   Security, audit, and service-integrity data is treated as independent-controller data only to the extent it does not include the content of Customer Content or session/connection data that identifies the Customer’s End Users, which remains processor data under this DPA. Vexaro’s commitment to notify the Customer of a Personal-Data Incident (Section 8) applies to Account, authentication/access, and audit data relating to the Customer’s account even where Vexaro acts as an independent controller for that data.

Each party is responsible for complying with the obligations applicable to it under applicable data-protection rules in respect of the Processing it carries out.

2. Subject Matter & Duration

Subject matter. The subject matter of the Processing is the provision of the Service to the Customer, namely: remote access and support (Vexaro Desk); encrypted mesh networking and corporate VPN connectivity (Vexaro Mesh, once it is available; it is in development); security-testing and assessment services (Vexaro Security); and custom software and engineering services (Vexaro Development), together with the supporting platform functions (authentication, signaling, relay, device management, policy enforcement, audit logging, and configuration) needed to deliver them.

Nature and purpose. Vexaro Processes Personal Data as a processor only to provide, maintain, secure, and support the Service in accordance with the Customer’s instructions, the Terms of Service, the applicable Product Supplement, and the Order Form.

Duration. Processing as a processor continues for the term of the agreement between the Customer and Vexaro, and for any wind-down period required to export or delete data as set out in Section 10. Sections, and the obligations within them, that by their nature are intended to survive termination remain in effect until all Personal Data Processed on the Customer’s behalf has been deleted or returned in accordance with Section 10. These include Section 1 (roles), Section 6 (to the extent Personal Data is still held), Section 8 (incident notice), Section 9 (assistance), Section 10 (deletion and export), Section 11 (audit and verification), Section 12 (transfer safeguards for any retained data), Section 14 (liability), and the confidentiality and personnel-confidentiality commitments in Sections 1 and 6.

3. Categories of Data & Data Subjects

Categories of data subjects. The individuals whose Personal Data may be Processed include the Customer’s employees, contractors, Authorized Users, Operators, and End Users, and other individuals whose data the Customer chooses to transmit through, capture in, or generate via the Service.

Categories of Personal Data (platform data). Depending on the Products used and the Customer’s configuration, the platform Processes:

• Account data: names, email addresses, organisation or team identifiers, role and permission assignments, and authentication credentials.
• Device data: operating-system type and version, hostname, device and Agent identifiers, and Agent version.
• Connection and log data: session timestamps (start and end), session duration, round-trip-time and connection-quality metrics, IP addresses of the participating endpoints, the relay path used (direct P2P or relay), and audit-log events (sign-in, session initiation, administrative actions, and policy changes).
• Support data: the content of support requests and related correspondence and diagnostics.
• Billing metadata: plan, subscription status, transaction references, and payment-provider references. Full payment-card details are handled by the applicable payment provider or Merchant of Record and are not stored by Vexaro (see the Billing Terms and the Subprocessor List).

Account, device, and connection/log data described above are Processed by Vexaro as an independent controller as described in Section 1.3 and the Privacy Notice, except to the extent such data forms part of, or is generated specifically to deliver, Customer Content Processed on the Customer’s instructions, in which case Vexaro acts as a processor. Connection/log data that identifies the Customer’s End Users is Processed by Vexaro as a processor under this DPA as provided in Section 1.3, and the incident-notice commitment in Section 8 applies to it.

Categories of Personal Data (Customer Content). Where the Customer transmits, captures, records, or stores content through the Service, the Customer Content may itself contain Personal Data of any category the Customer chooses to include. This may comprise screen streams, transferred files, clipboard data, Recordings, and network or payload traffic. Vexaro does not control, and is generally not aware of, the categories of Personal Data contained within Customer Content; the Customer determines and is responsible for that content. The Customer must not submit special categories of data through the Service unless the Customer has a valid lawful basis and any additional measures required for such data are in place. Vexaro does not require, and asks the Customer not to provide, special categories of Personal Data except where strictly necessary and lawfully supported.

4. Customer Instructions

Vexaro Processes Personal Data as a processor only on the Customer’s documented instructions, including with regard to transfers, unless required to act otherwise by an applicable mandatory rule. The Customer’s documented instructions are constituted by:

1. the Terms of Service, this DPA, the applicable Product Supplement, and the Privacy Notice;
2. the Order Form and any Statement of Work;
3. the configuration choices, policies, and settings the Customer selects in the administrative console, including access modes, logging, routing, and provisioning settings, and the plan the Customer selects, which determines whether sessions are recorded and how long Recordings are kept; and
4. instructions the Customer issues through Vexaro’s support channels in the ordinary course of using the Service.

The Customer is responsible for ensuring its instructions are lawful and that it is entitled to provide the relevant data to Vexaro for Processing. Vexaro will inform the Customer if, in its reasonable opinion, an instruction infringes an applicable data-protection rule. Vexaro is not required to carry out an instruction that it reasonably considers infringes applicable data-protection rules, and may suspend the affected instruction until it is amended, confirmed in writing, or withdrawn, without that suspension being a breach of the agreement. Processing outside the scope of these instructions requires the Customer’s prior written agreement (which may be recorded in an Order Form).

5. Customer Content

The Customer controls what Customer Content is Processed through the Service and how. Vexaro Processes Customer Content only as configured and instructed by the Customer.

Live session media is encrypted in transit and is not stored by Vexaro. Between Vexaro apps the media is encrypted end-to-end, whether the devices connect directly (peer-to-peer) or through a relay because a direct connection is not possible: the two devices agree the keys of each session, no Vexaro component holds them, and a relay forwards data it cannot read. This needs version 0.2.13 or later of the Vexaro app on both devices; where one of them runs an older version, a relayed session is encrypted with a key the relay supplies and is not end-to-end encrypted against the relay. A browser-viewed session is opened by a Vexaro server component (the browser bridge) to deliver it to the browser, without being stored. Accordingly, Vexaro does not store or inspect the content of live sessions, and the video of a Recording stays on the Customer’s computers, as described below.

Session recording is off unless the Customer turns it on. On the Team, Business, and Enterprise plans (including the Team trial), an owner or administrator of the Customer’s organisation can turn recording on in the administrative console and choose where the recording files are kept: on the computer that is accessed, on the operator’s computer, or on both. The operator’s computer keeps a copy only when the operator connects with the Vexaro Windows app and is a member of the Customer’s organisation; otherwise the computer that is accessed keeps the file. The files are written on those computers by the Vexaro Windows app (version 0.2.15 or later; older versions do not record) and are never uploaded to Vexaro. Vexaro stores only each Recording’s details (the session, the time, which computer keeps the file and where on it, its size and duration) and its event timeline, retained for the recording-retention period of the Customer’s plan; each time the Vexaro app finishes a recording on a computer, it deletes the recording files older than that period from its recordings folder there. A Recording is Customer Content; its details are accessible to the owners, administrators, and auditors of the Customer’s organisation, and its owners and administrators may delete them before the retention period ends.

The Customer is responsible for notifying its End Users about remote access, monitoring, logging, and Recording on plans that include it, and for establishing and maintaining a lawful basis for that Processing. Further detail is set out in the Recording & Monitoring Notice.

6. Security Measures

Vexaro maintains technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures take into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, and include, as applicable to the relevant systems:

• Access control: role-based access control (RBAC) and the principle of least privilege; multi-factor authentication (MFA) for Vexaro staff accounts with platform-administrator rights in the Service; key-based SSH from authorised machines over a private network for administrative access to production servers; and audit logging of administrative actions taken through the Service.
• Encryption: encryption of data in transit, and at rest for sensitive account fields and for backups, using commercially reasonable, widely deployed cryptographic protections appropriate to the relevant channel and deployment model; session media is protected using the protocols supported by the applicable Product and configuration. Encryption is described further in the Encryption Overview.
• Logging and monitoring: logging of relevant administrative and data operations, monitoring for anomalous activity, and audit-log functionality available to the Customer per plan.
• Resilience and backups: encrypted backups and recovery processes designed to restore availability and access to Personal Data in a timely manner following an incident.
• Vulnerability handling: regular security testing, a vulnerability-management process, and a vulnerability-disclosure channel (see the Vulnerability Disclosure Policy).
• Personnel and process: confidentiality commitments for personnel with access to Personal Data, security awareness practices, and change-management controls.

Vexaro operates an information-security program designed and operated to align with the principles of recognised information-security-management, service-organisation-control, and application-security-verification frameworks. A fuller description is provided in the Security Overview.

Personnel confidentiality. Vexaro ensures that the personnel it authorises to Process Personal Data on the Customer’s behalf are bound by an appropriate, enforceable obligation of confidentiality (whether contractual or statutory) that survives the end of their engagement, and that access is limited to those who need it to provide the Service.

Nothing in this Section is a representation that the Service is free of vulnerabilities or that any particular outcome is guaranteed; security is a shared responsibility between Vexaro and the Customer, and the Customer is responsible for the configuration choices, credentials, and access controls within its control.

7. Subprocessors

The Customer provides a general authorisation for Vexaro to engage Subprocessors to Process Personal Data in order to provide the Service. The current Subprocessors are listed in the Subprocessor List, which Vexaro keeps current. On request, Vexaro tells the Customer the countries in which each Subprocessor Processes Personal Data.

Where Vexaro engages a Subprocessor, it imposes on that Subprocessor, by written contract, data-protection obligations equivalent in substance to those in this DPA, and remains responsible to the Customer for the Subprocessor’s performance of those obligations. Those obligations include, in particular, confidentiality, security measures, assistance, Personal-Data Incident notification, and deletion or return of Personal Data on termination, equivalent in substance to this DPA. On the Customer’s reasonable request, Vexaro will make available the relevant data-protection terms of its agreement with a Subprocessor (which may be redacted to protect confidential or commercial information).

When Vexaro adds or replaces a Subprocessor, it updates the Subprocessor List and notifies the Customer by email, in the Service, or in the Legal Center. The change takes effect when the updated list is published. The Customer may reasonably object to a new Subprocessor on documented data-protection grounds within 14 days of the notice. The parties will work in good faith to address a reasonable objection. If a reasonable objection cannot be resolved, Vexaro will use commercially reasonable efforts to make the Service available without the objected Subprocessor or to offer an equivalent alternative; failing that, the Customer may suspend the affected Processing where feasible or terminate the affected Service in accordance with the Terms of Service, and Vexaro will refund pre-paid fees for the unused term on a pro-rata basis.

8. Personal-Data Incident Notice

If Vexaro becomes aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data Processed by Vexaro on the Customer’s behalf (a “Personal-Data Incident”), Vexaro will notify the Customer without undue delay after becoming aware of the Personal-Data Incident, and within any period required by applicable mandatory rules. Vexaro will work to confirm the scope of the incident in parallel rather than as a precondition to its initial notice, and will not unreasonably delay that confirmation.

The notice will, to the extent then known and as information becomes available, include:

• the nature of the Personal-Data Incident, including where possible the categories and approximate number of data subjects and records affected;
• the likely consequences of the incident;
• the measures Vexaro has taken or proposes to take to address the incident and to mitigate its possible adverse effects; and
• a point of contact from whom further information can be obtained.

Vexaro will provide information in phases where it is not all available at once, will reasonably assist the Customer in meeting any obligation the Customer may have to notify a competent authority or affected individuals, and will document Personal-Data Incidents, including the facts, effects, and remedial action taken. Notification of, or response to, a Personal-Data Incident is not an acknowledgement by Vexaro of fault or liability.

9. Data-Subject Requests

Taking into account the nature of the Processing, Vexaro will assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in responding to requests from individuals seeking to exercise their rights in respect of their Personal Data, including rights of access, correction, deletion, restriction, portability, and objection, as well as any right to withdraw consent. Vexaro provides administrative-console functionality and, where reasonably required, reasonable support to enable the Customer to locate, export, correct, restrict, or delete the relevant data.

If Vexaro receives a request directly from an individual relating to Personal Data that Vexaro Processes as a processor on the Customer’s behalf, Vexaro will not respond to the request itself except on the Customer’s instruction or as required by an applicable mandatory rule, and will forward the request to the Customer within a commercially reasonable period unless prohibited from doing so. For Personal Data for which Vexaro is an independent controller, Vexaro handles such requests itself as described in the Privacy Notice.

Taking into account the nature of the Processing and the information available to Vexaro, Vexaro will provide the Customer with reasonable assistance, on request, with (a) the security of Processing; (b) Personal-Data Incident notification and communication; and (c) any data-protection risk or impact assessment the Customer is required to carry out, and any prior consultation with a competent authority that may follow from it, in each case as required by applicable data-protection rules.

10. Deletion & Export on Termination

On expiry or termination of the agreement:

• Export window. During the export period shown in the Product, account, plan, checkout, invoice, or Order Form, the Customer may export or retrieve its Customer Content and other Personal Data Processed by Vexaro on its behalf, using the export functionality of the Service or, where reasonably required, with Vexaro’s reasonable assistance.
• Deletion from active systems (default). Unless the Customer elects in writing within the export window to have its Personal Data returned, Vexaro will delete the Personal Data it Processes on the Customer’s behalf under its standard termination and deletion process. A timely election to return suspends deletion of the elected data until return is complete. Absent any election, deletion is the default disposition.
• Residual backups. Residual copies present in encrypted backups are purged as those backups expire in the ordinary backup lifecycle, after which they are no longer available for restoration in the ordinary course.
• Confirmation. On the Customer’s written request, Vexaro will provide written confirmation (a certificate of deletion) that it, and each relevant Subprocessor, has deleted the Personal Data Processed on the Customer’s behalf, save for copies retained under the mandatory-retention exception below and residual backup copies pending their scheduled purge.

Vexaro may retain Personal Data only to the extent, and for the period, required by an applicable mandatory rule (for example, financial-record and tax rules), in which case Vexaro will keep that data confidential, isolate it from active Processing where practicable, and Process it only as necessary for the purpose that requires its retention. This Section operates alongside, and does not extend, the data-retention periods set out in the Privacy Notice. Where a data category is Processed by Vexaro as an independent controller (for example, session/connection metadata that does not identify the Customer’s End Users, retained for the period stated in the Privacy Notice), that controller-role retention period governs that category; the deletion timelines in this Section apply to Personal Data Processed by Vexaro as a processor on the Customer’s behalf. Where the Customer has not deleted Customer Content that it controls before the end of the export window, that content will be deleted in accordance with this Section.

11. Audit & Verification

Vexaro will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, and will contribute to audits and inspections as set out below.

The Customer may, on reasonable prior written notice and at a reasonable frequency (or more often where required by a competent authority or following a confirmed Personal-Data Incident affecting the Customer’s data), conduct an audit of Vexaro’s relevant Processing activities. Audits are conducted during normal business hours, in a manner that does not unreasonably disrupt Vexaro’s operations, with reasonable advance scoping, subject to confidentiality undertakings, and without access to other customers’ data, Vexaro’s confidential security details that would compromise the security of the Service, or any third party’s data.

As an alternative to an on-site audit, Vexaro may satisfy a request by providing relevant, up-to-date security documentation and, where available, a third-party assessment or assurance report, together with responses to reasonable supplementary questions. The provision of such material is for verification purposes only and is not, and must not be relied upon as, a representation by Vexaro that it holds any particular certification; certification status, if any, is confirmed only in writing where applicable.

Where Vexaro does not have a current third-party assessment report, it will instead complete the Customer’s reasonable security questionnaire and provide supporting documentation, and will permit an on-site or remote audit (including by an independent auditor under confidentiality) where the questionnaire is insufficient or following a Personal-Data Incident. The exclusions in the preceding paragraph (including the protection of other customers’ data, third parties’ data, and confidential security details whose disclosure would compromise the security of the Service) may not be applied so as to defeat the purpose of the audit or to prevent the Customer from verifying Vexaro’s compliance with this DPA.

12. International Transfers

12.1 Processing locations and reliance on transfer mechanisms

Vexaro stores the Personal Data it Processes on the Customer’s behalf in one location, on servers that Vexaro operates at a hosting provider named in the Subprocessor List, and uses relays and Subprocessors that may be located in other countries, including countries without an adequacy decision. The Customer instructs Vexaro to Process Personal Data in this way. Where such Processing involves a transfer of Personal Data subject to the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection from the European Economic Area (EEA), the United Kingdom, or Switzerland to a country without an adequacy decision, Sections 12.2 to 12.5 apply, together with the technical and organisational measures described in Section 6. Where a transfer is made to a country covered by an adequacy decision, that decision is relied upon. Onward transfers to a Subprocessor rely on the EU-US Data Privacy Framework where that Subprocessor is certified under it, and otherwise on the EU SCCs (Section 12.2) or another safeguard under Article 46 GDPR. The Customer is responsible for assessing whether the mechanisms described here, together with its own configuration, meet the requirements applicable to it.

12.2 EU Standard Contractual Clauses

The Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021 (the “EU SCCs”) are incorporated into and form part of this DPA by reference, and apply to transfers of Personal Data subject to the GDPR to which this Section applies, as follows:

• Module in operation. Where the Customer is a controller and Vexaro a processor, Module Two (controller-to-processor) applies. Where the Customer acts as a processor on behalf of a third-party controller, Module Three (processor-to-processor) applies. Where Vexaro makes an onward transfer to a Subprocessor, the corresponding Module applies between Vexaro and that Subprocessor.
• Clause 7 (docking clause) applies.
• Clause 9 (use of sub-processors): Option 2 (general written authorisation) applies, and the Customer is informed of changes of Subprocessor as stated in Section 7 of this DPA.
• Clause 11 (redress): the optional independent-dispute-resolution wording does not apply.
• Clause 17 (governing law): the EU SCCs are governed by the law of Ireland.
• Clause 18 (choice of forum and jurisdiction): disputes are resolved before the courts of Ireland.

In the event of a conflict between the EU SCCs and this DPA, the EU SCCs prevail with respect to the transfers they govern.

12.3 Annexes to the EU SCCs

The Annexes to the EU SCCs are completed as follows:

• Annex I.A (List of parties): the data exporter is the Customer (and, for Module Three, the third-party controller); the data importer is Vexaro, LLC (and, for onward transfers, the relevant Subprocessor). Contact details are those in the Order Form, the account record, and Section 15.
• Annex I.B (Description of transfer): the categories of data subjects, the categories of Personal Data, the nature and purpose of the Processing, and the duration are those described in Sections 2 and 3 of this DPA. The frequency of the transfer is continuous for the term of the agreement.
• Annex I.C (Competent supervisory authority): the supervisory authority determined in accordance with Clause 13 of the EU SCCs.
• Annex II (Technical and organisational measures): the measures set out in Section 6 of this DPA.
• Annex III (List of subprocessors): the Subprocessors listed in the Subprocessor List, as updated in accordance with Section 7.

12.4 United Kingdom transfers

For transfers of Personal Data subject to the UK GDPR, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner under Section 119A of the Data Protection Act 2018 (version B1.0, in force from 21 March 2022) (the “UK Addendum”) is incorporated by reference and applies to those transfers. The EU SCCs as completed above are the “Approved EU SCCs” for the purpose of the UK Addendum; Tables 1 to 3 are completed with the information in this DPA and its Annexes, and Table 4 is completed as “neither Party” may terminate. The start date is the effective date of this DPA.

12.5 Swiss transfers

For transfers of Personal Data subject to the Swiss Federal Act on Data Protection (the “FADP”), the EU SCCs apply with the following adaptations: references to the GDPR are read as references to the FADP to the extent the FADP applies; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner for transfers governed by the FADP; the term “Member State” is read so as not to deprive data subjects in Switzerland of the right to bring proceedings in their place of habitual residence; and, for so long as required by the FADP, the EU SCCs also protect the data of legal entities.

12.6 Government and third-party access requests

If Vexaro receives a legally binding request from a public authority for Personal Data Processed on the Customer’s behalf, Vexaro will, to the extent legally permitted, notify the Customer without undue delay; review the legality of the request and challenge or seek to narrow any request it considers unlawful, overbroad, or inconsistent with applicable data-protection rules; and disclose only the minimum amount of Personal Data necessary to respond to a valid and binding request. Vexaro maintains the safeguards described in the EU SCCs (including Clauses 14 and 15) in relation to such requests. These commitments apply together with the contractual and technical safeguards that Vexaro applies to transfers of Personal Data between regions: encryption of data in transit, encryption at rest of sensitive account fields and of database backups (Section 6), contractual data-protection commitments imposed on recipients (including Subprocessors), access controls, and data-minimisation practices.

13. Self-Hosted Deployments

Where the Customer uses a Self-Hosted Deployment, the Customer installs and operates the relevant Vexaro components on its own infrastructure. In that case, the Customer is primarily responsible for the security, availability, and configuration of that infrastructure, including its own network, operating systems, storage, backups, access controls, key management, logging, and any third parties the Customer chooses to engage. The platform Subprocessors listed in the Subprocessor List may not apply to a Self-Hosted Deployment, and Vexaro generally does not Process the Customer Content held within a Self-Hosted Deployment. The division of responsibility between the Customer and Vexaro for Self-Hosted Deployments is set out in the Self-Hosted Responsibility Matrix. This DPA’s processor obligations apply to Vexaro only in respect of Personal Data that Vexaro actually Processes; they do not transfer to Vexaro responsibility for infrastructure under the Customer’s control.

14. Liability

Each party’s liability arising out of or related to this DPA, whether in contract, tort, or otherwise, is subject to the exclusions and limitations of liability set out in the Terms of Service, and any reference in those limitations to liability arising under the Terms of Service includes liability arising under this DPA. This Section does not limit liability that cannot be limited under applicable mandatory rules.

15. Contact

Questions or requests regarding this DPA, or relating to data protection generally, may be directed to:

• Privacy / data-protection contact: [email protected]
• Legal & contracting: [email protected]

Data importer identity (for the Standard Contractual Clauses and the UK International Data Transfer Addendum incorporated in Section 12). The data importer is Vexaro, LLC, a limited liability company organized under the laws of the State of Delaware, USA, with its registered office at 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States (registered agent: Legalinc Corporate Services Inc.); privacy contact: [email protected]; legal contact: [email protected].

Contracting and notice details are also provided on invoices and Order Forms.

---

This document is part of the Vexaro Legal Center.