Terms and Conditions 26/06/2018 Onwards

Terms and Conditions for the supply of FIVE CRM software

This Agreement was entered into between:

Quality System Solutions (QSS), Company Number 2674775, having its head office at Lansdowne Court, Bumpers Way, Chippenham, Wiltshire, United Kingdom ("QSS"), AND you as the representative of ("the Customer").

TERMS

QSS Quality System Solutions

FIVE CRM Umbrella name for the suite of QSS products consisting of:

DigitalPro CRM

CallPro CRM

CallPro CRM: Lite

ManagePro CRM

ManagePro CRM: Lite

DataPro CRM

EmailPro CRM

For valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the parties agree as follows:

1. AGREEMENT

In the event of conflict between the provisions of this Agreement (the "Agreement") and its schedules, the provisions of the Agreement shall prevail, subject to any written stipulations or changes to the contrary.

2. AUTHORISATION

If you are entering into this Agreement on behalf of an entity, you represent that you have the authority to bind such entity to this Agreement. You may not access any Service unless, and by accessing the Service you represent and warrant that, you

(a) if an individual, are at least 18 years of age

(b) are not, in any manner affiliated with, a direct competitor of QSS

(c) will not access the Service to monitor their availability, functionality, or for any other benchmarking or competitive purposes, or any entity that you are affiliated with

(d) have not at any time breached a contract with QSS

(e) accept and agree to be bound by the provisions of this Agreement.

3. SERVICE

(a) The "Service" is access to the FIVE CRM application and database system (“such application and system together herein referred to as the “System”) served by QSS servers.

(b) QSS shall furnish to the Customer the services described on the terms and conditions set out in this Agreement. QSS may perform its obligations through its affiliates, agents or subcontractors (the "Third Party Providers"), provided that QSS shall not be relieved of its obligations under this Agreement by use of Third Party Providers.

(d) Customers will be provided access to server networks based in the US or European Union, whichever is appropriate for their needs. Data for EU customers will always be stored on European servers unless otherwise instructed.

(e) The System availability is targeted at a minimum of 99.95%. This is based on normal working operation and does not cover pre-planned maintenance, emergency maintenance or downtime resulting from DDoS and DoS attacks (ie. issues resulting from an external party that cause our service availability to be reduced). Essential maintenance shall be kept as far as possible to outside business hours.

(f) QSS shall supply the operating manuals, user instructions, technical literature and all other related materials in eye-readable form supplied to the Customer by QSS for aiding the use and application of the Service and the System (together the “System Documentation”) to the Customer on or prior to the date the Service commences.

(g) QSS cannot and does not guarantee the privacy, security or integrity of any customer data or of any other data transmitted by front end client side users.

(h) Support will be provided by email ticketing, and telephone Customer Success Support during UK business hours. UK business hours are 9am to 5pm Monday to Friday excluding public holidays. Time on telephone support is governed by a fair use policy (time in excess of 4 hours per month may result in suggestions for chargeable training sessions). All calls will be responded to within 4 hours. All onsite support will be charged at the prevailing QSS rate plus travel but QSS shall not incur any charges without the express written consent of the Customer.

(i) QSS will provide support for the FIVE CRM application and data in the FIVE CRM database; all hardware and other software are not covered.

(j) QSS does not provide support for integrations between the Service and third party applications, unless otherwise expressly agreed between the Parties in writing.

4. LICENCE

(a) QSS operates on concurrent licenses. The maximum number of users able to sign on to the Service at any one time will be limited to the number of licences that the Customer has subscribed to.

(b) The licence is not a sale of the rights of ownership of the Software, in particular QSS retains title and full rights of ownership in the original or any copy of this Software.

(c) The licence is not transferable except to companies wholly owned by the contracted Customer, or to the parent company of the contracted Customer.

(d) QSS grants the Customer a licence for the number of users to access the Service concurrently as invoiced, on receipt of payment for the duration as stated on the invoice.

5. COPYRIGHT

The entire copyright of this software is owned by QSS, and is protected by copyright law and international copyright treaty. The following are absolutely prohibited without the express prior written consent of QSS:

(a) Unauthorised copying of the Software, or the written materials, including Software that has been modified, merged, or included with other Software.

(b) Reverse engineering, disassembling, decompiling, or making any attempt to recover the source code of any of the Software.

(d) Creation of a comparable system based on the way of working of the FIVE CRM system.

(e) Creation of a comparable system to access and/or update the FIVE CRM database.

6. FEES

(a) The Customer undertakes, for the Initial Term and for any Renewal Term thereof, as the case may be, as these terms are defined herein, to pay all the agreed fees plus applicable taxes.

(b) The Customer undertakes to pay all agreed fees and other charges at or by the time they are due. Any amount payable under this Agreement and unpaid on its due date shall be subject to a late charge of two percent (2%) per month calculated from the due date until said amount is paid in full.

(d) Licence fees are due on or by the first day of the billing period and monthly thereafter

(e) The number of licences may be increased at any time, the charge for the current month at a rate commensurate with the time left in the current billing period.

(f) The Customer may notify QSS of a reduction in the number of licences required at any time. This will take effect at the end of the current Term. If they are additional licences it will be the end of the current month, otherwise it will be the end of the Term.

(g) Data storage. QSS operates a fair use policy and may charge for excessive data storage. QSS reserves the right to charge excess storage fees.

(h) Refund policy. All transactions between QSS and the Customer are final. QSS does not issue refunds.

(i) Billing errors. The Customer must notify QSS of any billing error in writing within 60 days of the error date. QSS reserves the right to disregard errors notified after 60 days.

(j) Data retention. QSS will permanently delete all data 30 days after the termination of this Agreement.

(k) QSS reserves the right to amend the Fees for the next Renewal Term by providing the Customer with at least thirty (30) days prior written/email notice of the amendment before the end of the current term.

(l) QSS reserves the right to restrict access to the system on non-payment of licence or other fees.

(m) FIVE CRM is provided on the basis of a continuous subscription. Late payments will cover the period from when the previous term ended.

7. TERM

(a) The initial term (the "Initial Term") of this Agreement shall expire a minimum of twelve (12) months from the date stated on the first service invoice following the Acceptance Date and the applicable Fees commence, unless otherwise terminated as provided herein.

(b) At the end of the Initial Term, this Agreement shall automatically renew and be binding for an additional twelve (12) month term (each a "Renewal Term") unless the Agreement is terminated in accordance with Section 15 hereof.

(c) At the end of each Renewal Term, an additional Renewal Term will commence unless the Agreement is terminated in accordance with Section 15 hereof.

8. CUSTOMER OBLIGATIONS

(a) The Customer undertakes to keep passwords secure and access to the Service restricted to internal personnel and such external personnel as are considered responsible. No access shall be given to persons who shall use the designs and ways of working as information to be used in conjunction with a competitor or creation of a competitive system.

(b) The Customer, its agents, employees or representatives shall not commit any act or cause or permit any act to be committed or provide any services which will conflict with, disrupt, or affect in any manner whatsoever QSS's provision of the Services stipulated herein. In the event of breach of this Section 5, the Customer shall be liable for all additional costs, liabilities and expenses incurred by QSS in providing the Services.

(c) The Customer agrees not to tamper with, alter or otherwise rearrange the Service nor shall it permit or assist others to abuse or fraudulently use the Service including but not limited to using the Service:

(i) in any manner which interferes unreasonably with the Service or QSS's network, or access thereto by other persons;

(ii) for any purpose or in any manner directly or indirectly in violation of applicable laws or in violation of any third party rights, or

(iii) in a manner to avoid the payment of Fees hereunder.

(d) The Customer shall solely be responsible for use of the Service by any of its employees, officers, directors, agents as well as its end users and agrees to take all necessary measures to ensure that such persons use the Service in accordance with the terms and conditions of this Agreement.

(e) The Customer shall be solely responsible for obtaining necessary licenses and/or authorizations for all software and equipment which are not provided by QSS. QSS shall not be responsible if any changes in the Service caused by equipment or hardware not provided by QSS to become obsolete, require modification or attention, or otherwise affect performance of same.

(f) The Customer shall not, for commercial purposes, resell or remarket all or any portion of the services provided under this Agreement.

(g) QSS reserves the right to take any measures it deems necessary, acting reasonably, to ensure compliance with this Section 8 and notably the right to immediately suspend Service or terminate this Agreement. Provided however that whenever practicable QSS shall provide Customer with reasonable written notice of such proposed suspension or termination. In case of termination of this Agreement pursuant to this section, the Customer agrees and irrevocably undertakes to pay QSS the Termination Charges stipulated in Section 15 hereof.

9. WARRANTY

QSS warrants that:

(a) QSS warrants that in fulfilling its obligations under this Agreement it will attain standards of care and skill commensurate with those currently prevailing in the software and/or software as a service and/or cloud based system industries and that all personnel will have qualifications and experience appropriate for the tasks to which they are allocated.

(b) QSS shall use its best endeavours to ensure that it and its servants, agents and subcontractors take all reasonable precautions to ensure that no known viruses, spyware or other malware for which detection and antidote software is generally available are coded or introduced into the Service and/or System.

(c) The obligation upon QSS set out at Clause 9.1 shall not apply to the extent of any non-conformance which is caused by use of the Service contrary to QSS's instructions, or modification or alteration of the Service by any party other than QSS or its duly authorised contractors or agents. If the Service does not so conform with the obligation, QSS will, at its expense, use its best endeavours to correct any such non-conformance promptly, or provide the Customer with alternative means of accomplishing the desired performance.

(d) QSS undertakes to provide the Service agreed upon in this Agreement in a timely and workmanlike manner.

(e) The Customer acknowledges and agrees that QSS offers no warranty that the Services will be uninterrupted or without defect, and acknowledges moreover that QSS offers no warranty in respect of the scope, availability, accuracy or any other aspect of any information, including notably and without limiting the scope of the foregoing, any data or file, regardless of the format or presentation, to which the Customer or its end users shall have access or shall have at their disposal arising from the use of the Services stipulated herein. QSS shall be permitted from time to time to interrupt the Service in order to provide maintenance to the Service, provided however, that whenever practicably QSS shall notify the Customer of such Service interruption due to maintenance.

(f) QSS warrants that it has obtained all necessary licences, as the case may be, for software used in the delivery of the Service. QSS warrants that title to all hardware used in the delivery of the Service has been obtained by QSS.

(g) The warranties provided in this Agreement are in lieu of all other warranties and conditions. The Customer hereby waives all other warranties and conditions, express, implied or statutory, including any warranty of merchantability, fitness of a particular purpose, or availability or reliability of the Service.

(h) QSS shall defend at its own expense any claim brought against the Customer alleging that the use of the Services and/or System infringes the Intellectual Property Rights of a third party (“Intellectual Property Claim”) and QSS shall pay all costs and damages awarded or agreed to in settlement of an Intellectual Property Claim provided that the Customer:

(i) Furnishes QSS with prompt written notice of the Intellectual Property Claim;

(ii) Provides QSS with reasonable assistance in respect of the Intellectual Property Claim; and

(iii) Gives to QSS the sole authority to defend or settle the Intellectual Property Claim.

(i) If, in QSS’ reasonable opinion, the use of the Service and/or System are or may become the subject of an Intellectual Property Claim then QSS shall either:

(i) Obtain for the Customer the right to continue using Service and/or the System which are the subject of the Intellectual Property Claim; or

(ii) Replace or, with the written consent of the Customer, modify the Service and/or the system which are the subject of the Intellectual Property Claim so they become non-infringing.

10. REMEDIES

(a) SUBJECT TO SECTION 8, each party’s TOTAL CUMULATIVE LIABILITY to the other, IF ANY, FOR DAMAGES ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT AND THE PROVISION OF THE SERVICE WILL UNDER NO CIRCUMSTANCES EXCEED THE TOTAL IN AGGREGATE MONTHLY CHARGES PAID BY THE CUSTOMER DURING THE PERIOD SUCH DAMAGES WERE SUSTAINED, SUCH PERIOD NOT TO EXCEED ONE (1) MONTH, FOR THE SPECIFIC SERVICE THAT, ACCORDING TO THE ALLEGATIONS, GAVE RISE TO THE DAMAGES.

(b) The parties’ SOLE AND EXCLUSIVE REMEDIES AGAINST each other IN RESPECT OF THE SERVICE AND THIS AGREEMENT SHALL BE AS STATED HEREIN.

11. DATA PROTECTION

The Parties undertake to comply with the provisions of the Data Protection Act 1998 and any related legislation in so far as the same relates to the provisions and obligations of this Agreement. See also section “Processing of Personal Data”.

12. LIMITATION OF LIABILITY

(a) UNDER NO CIRCUMSTANCES WILL QSS, ITS AGENTS, SUPPLIERS OR SUBCONTRACTORS BE LIABLE TO CUSTOMER OR THIRD PARTY FOR ANY INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES, EXPENSES, INCLUDING LOSS OF PROJECTED PROFITS OR REVENUES, LOSS OF DATA, LOSS OF USE OF ANY COMPUTER SYSTEM, FAILURE TO REALIZE EXPECTED SAVINGS AND ANY OTHER FINANCIAL OR ECONOMIC LOSS, LIABILITY, OR DAMAGE WHATSOEVER, EVEN IF QSS WERE NOTIFIED OF THE POSSIBILITY OF SUCH LOSSES OR DAMAGES AND WHETHER ARISING IN NEGLIGENCE, TORT, STATUTE, EQUITY, CONTRACT, COMMON LAW, OR ANY OTHER CAUSE OF ACTION OR LEGAL THEORY. CUSTOMER AGREES, ACKNOWLEDGES AND CONFIRMS THAT THE LIMITATIONS OF LIABILITY SET OUT IN THIS SECTION ARE FAIR AND REASONABLE IN THE COMMERCIAL CIRCUMSTANCES OF THIS AGREEMENT AND THAT QSS WOULD NOT HAVE ENTERED INTO THIS AGREEMENT BUT FOR CUSTOMER'S AGREEMENT TO LIMIT QSS’S, ITS AGENTS’, SUPPLIERS’ AND SUBCONTRACTORS’ LIABILITY IN THE MANNER, AND TO THE EXTENT, PROVIDED FOR HEREIN.

(b) QSS ASSUMES NO LIABILITY ARISING FROM (i) THE USE OF THE SERVICES PROVIDED BY QSS IN CONJUNCTION WITH SERVICES, PRODUCTS OR EQUIPMENT NOT PROVIDED BY QSS AND (ii) THE FAILURE BY THE CUSTOMER TO PERFORM ITS OBLIGATIONS.

(c) SECTIONS 10 AND 11 OF THIS AGREEMENT SHALL APPLY EVEN IN THE EVENT OF A BREACH OF CONDITION, A BREACH OF AN ESSENTIAL OR FUNDAMENTAL TERM, OR A FUNDAMENTAL BREACH OF THIS AGREEMENT.

13. CONTENT

(a) The Customer acknowledges that QSS neither owns nor controls the content, availability, accuracy or any other aspect of the information, data, files, images or content in any format or of any type (collectively referred to as the "Content") uploaded by the Customer or its end users through the Service.

(b) QSS warrants that for any customer data uploaded to FIVE CRM servers, QSS (a) will not to use it for any of its own purposes, (b) will not to pass such data to third parties, (c) will return such data to the Customer when the agreement terminates upon payment for such services. Customers are able to export all their data at any time free of charge so long as there is a current subscription in place.

14. INDEMNITY

(a) The Customer shall indemnify, hold harmless and take up the defence of QSS, its representatives and assignees against any liability in respect of any loss, liability or any damage of any nature whatsoever, and notably any disbursement, including reasonable counsel fees, arising from any and all claims by any third party, including end users and distributors ("Third Parties"), in connection with the use of the Services (and related equipment and software) or transmission of the Content by the Customer or any Third Party or the Customer's failure to comply with its obligations under this Agreement. This indemnity shall survive termination of this Agreement.

15. DISPUTE RESOLUTION

(a) In the event of any dispute, disagreement, claim or alleged breach of the provisions of this Agreement (each a "Dispute"), the Dispute shall be referred to the QSS Account Manager, as the case may be, and his or her counterpart at the Customer. If the Dispute is not resolved within fifteen (15) days of the date on which it was submitted for said purpose, it shall then be submitted to the superior of the QSS Account Manager and to the Customer's counterpart. Should the Dispute not be resolved by the office of QSS and the Customer within 30 days of its escalation, the Dispute shall be submitted to arbitration. The arbitration shall be conducted by either (a) an arbitrator selected by agreement of both parties or (b) if the parties are unable to agree on the choice of an arbitrator, by an arbitrator appointed by ACAS. The decision of the arbitrator shall be final and binding upon the parties and the expense of the arbitration shall be paid as the arbitrator determines.

(b) This Agreement (including any non-contractual matters and obligations arising therefrom or associated therewith) shall be governed by, and construed in accordance with, the laws of England and Wales.

16. TERMINATION AND MIGRATION

(a) Either party may cause this Agreement to be terminated at the end of the Initial Term or at the end of any Renewal Term by notifying the other in writing of such intention no later than Thirty (30) days prior to the end of the Initial Term or the Renewal Term, as the case may be.

(b) The Customer may request the termination of a part or all of the Service at the end of the subscription to the expiration of the Initial Term as well during Renewal Terms by providing QSS with a prior written notice, provided the Customer pays QSS, all amounts owed and unpaid under this Agreement; collectively referred to hereinafter as the "Termination Charges".

(c) If the Customer migrates to a Comparable Service (as defined herein), the Termination Charges may be waived by QSS. A "Comparable Service" is one offered by QSS or one or more of its affiliates, having a duration at least as long as this Agreement, and to which the applicable monthly fees are no lower than those under this Agreement.

(d) Either party may, in its absolute discretion, in addition to all other rights and remedies under this Agreement and in law, immediately terminate this Agreement or suspend delivery of any or all Service by notice to the other prior to the end of the term: for breach by the other of any term of this Agreement, including the failure by the Customer to make full payment of an invoice within 30 days of the issue date of the invoice, provided that the party not in breach provides the other party with notice of the breach and provided that the breach is not remedied within 15 days after the delivery of such notice to such party.

(e) Either party shall be entitled to terminate this Agreement immediately with notice in the event of the other party's insolvency, receivership or voluntary or involuntary bankruptcy or in the event that QSS ceases to offer the Service. In the event of default by the Customer, any and all payments required to be made to QSS, including but not limited to the Termination Charges, by the Customer shall be due and payable immediately.

(f) Termination of this Agreement shall not relieve the Customer from any liability, including amounts owing, accrued prior to the time that such termination becomes effective.

(g) The minimum number of active licences is the number assigned in this 12 month agreement.

17. CONFIDENTIAL INFORMATION

(a) "Confidential Information" means all information of whatever nature disclosed (whether in writing, orally, in disk form, electronically or by another means and whether directly or indirectly) by a party (the “Disclosing Party”) to the other party (the “Receiving Party”) whether before, during or after the date of this Agreement including, without limitation (i) the Disclosing Party’s products, services, reports, technical knowledge, know-how, methodology, intellectual property rights, data, drawings and other material, operations, processes, plans or intentions or strategies, product information, future products currently in development or about to be launched, design rights, trade secrets, market opportunities and business affairs, product costs and pricing qualities, payment terms, client details and customer account information; and (ii) (in the case of the Customer) Customer’s software and system used to provide its products and services and functionality and capability thereof, and (iii) any of the information referred to in (i) or (ii) of and/or relating to any subsidiaries or member of any group of the Disclosing Party;

(b) Neither party shall use Confidential Information other than solely for the purposes of this Agreement and shall keep the Disclosing Party's Confidential Information confidential and restrict access thereto to such of the Receiving Party's employees, agents or associated companies as need to know it for the purpose of this Agreement and as have been placed under confidentiality obligations and restrictions equivalent to those set out in this Agreement.

(i) The Receiving Party shall (and shall procure that is representatives shall):

(ii) Not use or exploit the Confidential Information in any way except for the purposes of this Agreement;

(iii) Not use any of the Confidential Information for any commercial gain or advantage and will not directly or indirectly commercially exploit it or any part of it;

(iv) Not disclose it or make available the Confidential Information in whole or in part to any third party, except as expressly permitted by this Agreement;

(v) Not copy, reduce to writing or otherwise record the Confidential Information except as strictly necessary for the purposes of this Agreement (and any such copies, reductions to writing or records shall be the property of the Disclosing Party); and

(vi) Apply the same security measures and degree of care to the Confidential Information as the Receiving Party applies to its own confidential information, which the Receiving Party warrants as providing adequate protection from unauthorised disclosure, copying or use.

(vii) without prejudice to the generality of the foregoing, QSS must not use, onward sell or profit from any of the Customer’s data

(c) Both parties' rights and obligations under this Section survive any expiration or termination of this Agreement by either party.

18. FORCE MAJEURE

(a) Save for the obligation to pay the Recurring Charges and Termination Charges, if the performance of this Agreement is interfered with, in whole or in part, by circumstances beyond the reasonable control of either party including, without limitation: fire, explosion, power failure, acts of God, war, terrorism, revolution, civil commotion, acts of public enemies, law, order, regulation, ordinance or requirement of any government or its representative or legal body having jurisdiction, or labour unrest such as strikes, slowdowns, picketing or boycotts, then the party affected shall be excused from such performance on a day by day basis to the extent that such party's obligations relate to the performance so interfered with; provided that the party so affected shall use commercially reasonable efforts to diligently remove such causes of non-performance.

19. GENERAL PROVISIONS

(a) Amendment: Except as otherwise provided, neither party may amend this Agreement other than by an instrument in writing executed by the authorised representatives of both parties hereto.

(b) Assignment: The Customer shall not assign or transfer this Agreement, in whole or in part without QSS’s prior written consent, which consent shall not be unreasonably withheld. Except as set forth herein, any attempt by the Customer to assign or transfer this Agreement, in whole or in part, without the prior written consent stipulated herein, shall be null and void. QSS is authorised, subject to prior written notice to the Customer or its authorization, to assign to any QSS affiliate, the rights or obligations incumbent upon it under this Agreement or its interests therein. Where QSS assigns to its assignee its rights, titles and interests as set out hereinabove, the Customer agrees to pay the assignee all the Recurring Charges, Termination Charges and other charges so assigned and owing under this Agreement, unconditionally, without reduction or compensation whatsoever, regardless of any real or alleged cause of action that the Customer has or claims to have against QSS or any other third party. If the Agreement is assigned, the assignee will take on all the rights and obligations of the party which originally signed the Agreement

(c) Entire Agreement: This Agreement constitutes the entire agreement between the Customer and QSS with respect to the subject matter, merging and superseding all prior agreements, understandings and representations on the subject matter. It is expressly agreed that if the Customer issues a purchase order or other document for the Service, such instrument will be deemed to be for the Customer's internal use only and any provisions contained therein shall not amend or be used in interpreting this Agreement.

(d) Enurement: This Agreement shall be binding upon and enure to the benefit of QSS and the Customer and their respective successors and permitted assigns.

(e) Governing Law: This Agreement shall be governed by and interpreted according to the laws in force in England.

(f) Interpretation: In this Agreement, the headings are for convenience of reference only and shall not affect its construction or interpretation.

(g) Non Waiver: No waiver of any term or provision or of any breach or default shall be valid unless in writing and signed by the party giving such waiver, and no such waiver shall be deemed a waiver of any other terms or provision of any subsequent breach or default of the same or similar nature.

(h) Notice: The notices stipulated in this Agreement may be given in writing or transmitted (i) by hand or by certified or registered mail, to the addresses of the recipients set out hereinabove, (ii) by facsimile, or (iii) electronically. Notices sent by facsimile or electronically shall be deemed to have been received upon receipt by the recipient of a bona fide transmission confirmation.

(i) Severability: The invalidity, illegality or unenforceability of any one or more provisions of this Agreement shall not affect or impair any other provisions of this Agreement.

(j) Employment Solicitation: For the duration of this Agreement, and for a period of 1 year following termination of this Agreement, (1) the parties agree not to solicit the employment of any employee of the other party, and (2) if a party is approached by an employee of the other party concerning employment, you then such party agrees to notify the other a least 30 days prior to making an offer of employment to such employee.

Processing of Personal Data

Roles of Parties

• Customer is Data Controller

• QSS is the Data Processor

• QSS uses external data centre companies who are sub-processors

Definition of Personal Data

Otherwise known as “Personally Identifiable Information (PII)”, Personal Data is data that can be used to identify a “natural person” (as defined by the EU regulations) and associated information.

Customer’s processing of Personal Data

The Customer is to process personal data using the FIVE CRM system in accordance with Data Protection Laws and Regulations. It is the Customer’s responsibility to ensure the accuracy and legality of personal data. It is also the Customer’s responsibility to ensure that any and all data is acquired and stored legally.

Subject matter and duration of processing

Since it is the Data Controller who decides what data to enter or import into the FIVE CRM system, this is totally under the control of the Data Controller. However, we anticipate that such data could include personal details such as name, address and telephone number(s), and such other data that the Controller sees fit to upload. The duration of processing will be the duration of the FIVE CRM contract. QSS will delete a customer’s database 30 days after the end of the contract or earlier by request.

Type of personal data and categories of data subject

The type and categories of data are totally under the control of the Data Controller and QSS has no knowledge or influence over the data.

Data Privacy functionality within FIVE CRM

QSS has developed functionality to specifically cater for the requirements of the GDPR which customers are strongly recommended to make full use of. Functionality includes:

• Ability to apply a Data Privacy record against every individual name. This includes the Lawful Basis, Category, Channel, date range and space to enter further information to justify the Lawful Basis

• Ability to search the data base using data privacy criteria to ensure the use of only legally permissible records for a particular purpose

• Ability to filter the database using data privacy criteria in order to delete data that cannot be legally justified

• Ability to apply a “withdrawn date” to a privacy record if an individual withdraws consent

• Ability to track data deleted for privacy reasons

• Ability to email confirmation to an individual of a request to be deleted

• Ability to setup a preference centre webpage to give individuals an easy way to see what consent is in place in addition to updating it

• Data Privacy Manager for easy and quick overviews and management of data

QSS’s processing of Personal Data

QSS shall treat Personal Data as confidential information and shall only process such data as per the Customer’s instructions. Such instructions will either be in writing, or oral and confirmed in writing. QSS will also process data for operational reasons, ie backups and maintenance of servers. QSS’s sub-processors (data centres) have no logical access to servers or their contents.

Data Subject Request

If QSS becomes aware of a Data Subject Request, it will do whatever is reasonable and lawful to notify the relevant Data Controller of the request. Various reports and functions exist in the FIVE CRM system to enable Data Controllers to comply with Data Subject Requests but if a Customer requires more assistance to comply then QSS will provide that assistance in accordance with its normal Customer Success & On-boarding processes.

Data security and encryption

QSS has, and will, always adhere to very strict security protocols. These include:

• Using only the largest and most regulatory and security compliant data centre companies in Europe and North America

• Using appropriate systems and methodologies to prevent unauthorised access to servers and data.

• Using secure protocols for client access to systems

• Ensuring every customer database is kept separate from every other customer’s database with different security and authentication on each.

• Access to customer data is limited to those personnel performing services in accordance with this agreement.

• Ensuring customer user passwords are of sufficient industry standard strength

• Ability to force users to regularly change their passwords without repetition

• Allowing customers to store certain fields in encrypted form. This includes the customer specifying which of their users are allowed to see the data unencrypted.

• Allowing customers to specify which of their users are allowed to export data.

• Application source code is kept secure to prevent unauthorised tampering

• All systems are subject to regular tests to ensure no unauthorised access

• QSS operates on the basis of Privacy by Design, whereby everything from application design and development, through to operational activities and customer management is treated with the same level of respect.

• Data is encrypted in transit (by use of SSL), but is not encrypted at rest and instead relies on other measures to ensure that data is secure.

Breach notification

If QSS becomes aware of a data breach, in accordance with its statutory obligations, it will notify the appropriate Data Controller and, if necessary, the Information Commissioner’s Office in the UK.

Data Protection Officer

Under the GDPR QSS is not obliged to appoint a Data Protection Officer, however, any and all queries can be directed to the Help Desk who will be able to assist.

Hosting locations and transfers to third countries

All European customers are hosted in EU data centres by default, and all North American customers are hosted in North American data centres. QSS will not move data outside of the EU unless specifically asked to do so by the customer.

Sub-processors

Under the GDPR customers have a right to object to the use of specific sub-processors. Within Europe FIVE CRM currently uses OVH Ltd and Hetzner Online GmbH for their data centre services. Customers will be notified in advance if any other sub-processors are intended to be used in Europe. If a customer objects to the use of a particular sub-processor FIVE CRM will use its best endeavours to provide an agreeable alternative. In the event an agreeable alternative cannot be found, FIVE CRM will refund any payments for future services as applicable.

Audits and inspections

In the event that a Data Controller requires an audit or inspection, QSS will consider such requests on a case by case basis as operational procedures are confidential by nature and releasing such information without good cause by definition weakens security of QSS’s systems.

QSS staff

All QSS staff have training on data protection and security of data. Employment contracts, internal policies and regular training ensure that data belonging to both QSS and the customer is treated with appropriate respect and according to all data protection regulations.

Obligation following termination of contract

Upon termination of its contract, customer is able to export all their data and also then delete all data in the database. QSS reserve the right to raise a charge if additional assistance is required. Following a written request, QSS will permanently delete the current live database and all its backups; on completion, QSS will provide a certificate of confirmation of deletion.