Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Verdocs Subscription Terms and Conditions or other written agreement governing Customer’s use of the Services (the “Agreement”) and applies to the extent Verdocs processes Customer Personal Data on behalf of Customer in connection with the Services.

This DPA automatically applies when Verdocs acts as a processor or subprocessor of Customer Personal Data. No separate signature or Order Form is required for this DPA to apply. If Customer and Verdocs have separately executed a data processing agreement, that executed agreement will supersede this DPA with respect to the processing covered by it.

Definitions

“Applicable Data Protection Laws” means all laws and regulations applicable to the processing of Customer Personal Data under the Agreement, including, where applicable, Regulation (EU) 2016/679 (“GDPR”), the United Kingdom GDPR, and applicable U.S. state privacy laws.

“Customer Personal Data” means Personal Data processed by Verdocs on behalf of Customer in connection with the Services.

“Free Services” means Services made available to Customer on an ongoing no-fee production basis, excluding Trial Services as defined in the Agreement.

“Personal Data,” “Controller,” “Processor,” “Data Subject,” and “Processing” have the meanings given to them under Applicable Data Protection Laws.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. A Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as unsuccessful log-in attempts, pings, port scans, denial-of-service attacks, or other network attacks on firewalls or networked systems.

“Subprocessor” means a third party engaged by Verdocs to process Customer Personal Data on behalf of Customer.

• Roles. Customer is the Controller of Customer Personal Data or, where Customer processes Personal Data on behalf of another Controller, a Processor. Verdocs processes Customer Personal Data as a Processor on behalf of Customer and acts as a Subprocessor where Customer is itself a Processor. Each party will comply with its respective obligations under Applicable Data Protection Laws. Customer is responsible for ensuring that its instructions to Verdocs comply with Applicable Data Protection Laws and that it has all necessary rights, notices, consents, and other lawful bases required for Verdocs to process Customer Personal Data in accordance with the Agreement and this DPA. The subject matter, duration, nature and purpose of the Processing, categories of Data Subjects, and types of Personal Data are described in Annex 1.
• Processing Instructions. Verdocs will process Customer Personal Data only on documented instructions from Customer, including with respect to transfers of Customer Personal Data to a third country or international organization, unless Verdocs is required to process such Personal Data by applicable law. Where Verdocs is required by applicable law to process Customer Personal Data other than on Customer’s documented instructions, Verdocs will inform Customer of that legal requirement before Processing unless applicable law prohibits such notice. The Agreement, this DPA, any applicable Order Form, Customer’s configuration and use of the Services, and other documented instructions submitted by Customer through the Services or to Verdocs constitute Customer’s documented instructions. Verdocs will promptly inform Customer if, in Verdocs’ reasonable opinion, an instruction infringes Applicable Data Protection Laws.
• Confidentiality. Verdocs will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations and are permitted to process Customer Personal Data only as necessary to provide, support, secure, and maintain the Services and otherwise comply with Customer’s documented instructions.
• Security Measures. Taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risks to Data Subjects, Verdocs will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Such measures will include, as appropriate, the measures described in Annex 2 and will be designed to satisfy the requirements of Article 32 of the GDPR where applicable. Verdocs may update its technical and organizational measures from time to time, provided that such updates do not materially decrease the overall security of the Services.
• Subprocessors. Customer provides general written authorization for Verdocs to engage Subprocessors to process Customer Personal Data in connection with the Services. Verdocs will maintain a current list of its Subprocessors and will provide the current list to Customer upon request. For Restricted Transfers subject to the EU SCCs, Verdocs will provide Customer with the then-current Subprocessor list upon commencement of the applicable Restricted Transfer. The Subprocessors identified on such list are authorized by Customer for purposes of this DPA. Verdocs will provide Customer with at least thirty (30) days’ prior written notice of any intended addition or replacement of a Subprocessor that processes Customer Personal Data, thereby giving Customer a reasonable opportunity to object to the change on legitimate data protection grounds. If Customer reasonably objects to a new Subprocessor, the parties will work in good faith to identify a commercially reasonable alternative. If no commercially reasonable alternative is available, Customer may terminate the affected portion of the Services, and any fees, refunds, or other financial consequences of such termination will be determined in accordance with the Agreement. Verdocs will enter into a written agreement with each Subprocessor imposing data protection obligations that are no less protective than those imposed on Verdocs under this DPA to the extent applicable to the Subprocessor’s Processing. Verdocs remains responsible for the performance of its Subprocessors’ data protection obligations to the extent required by Applicable Data Protection Laws.
• US State Privacy Obligations: To the extent Applicable Data Protection Laws include U.S. state privacy laws under which Verdocs acts as a processor, service provider, contractor, or similar regulated recipient of Customer Personal Data, Verdocs will not sell or share Customer Personal Data; retain, use, or disclose Customer Personal Data outside the business purposes specified in the Agreement and this DPA except as permitted by Applicable Data Protection Laws; or combine Customer Personal Data with Personal Data received from or on behalf of another person except as permitted by Applicable Data Protection Laws.

Verdocs will provide the same level of privacy protection required of processors, service providers, contractors, or similar regulated recipients under Applicable Data Protection Laws and will notify Customer if Verdocs determines that it can no longer meet its applicable obligations.

Customer may take reasonable and appropriate steps to help ensure that Verdocs uses Customer Personal Data in a manner consistent with Customer’s obligations under Applicable Data Protection Laws and, upon notice to Verdocs, may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.

• Breach Notification. Verdocs will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. To the extent reasonably available, Verdocs will provide Customer with information regarding the nature of the Personal Data Breach, including the categories and approximate number of affected Data Subjects and Personal Data records, the likely consequences of the Personal Data Breach, and the measures taken or proposed to address and mitigate its effects. Verdocs will reasonably cooperate with Customer in investigating, mitigating, and responding to the Personal Data Breach and in meeting Customer’s applicable breach-notification obligations. Verdocs’ notification of a Personal Data Breach will not be construed as an acknowledgment of fault or liability. If Customer determines that a Personal Data Breach must be notified to a supervisory authority, Data Subjects, the public, or other third parties, and such notification directly or indirectly identifies Verdocs, Customer will, where permitted by applicable law and without limiting Customer’s ability to meet any mandatory notification deadline, provide Verdocs with reasonable advance notice of the notification and consider in good faith any clarifications or corrections Verdocs reasonably requests concerning the description of Verdocs’ involvement in the Personal Data Breach.
• Assistance.
• Data Subject Requests. Taking into account the nature of the Processing, Verdocs will provide reasonable assistance through appropriate technical and organizational measures, insofar as reasonably possible, to assist Customer in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Laws. If Verdocs receives a request directly from a Data Subject concerning Customer Personal Data processed on Customer’s behalf, Verdocs will direct the Data Subject to Customer and will not independently respond to the substance of the request unless required by applicable law.
• Security, DPIAs, and Regulatory Assistance. Taking into account the nature of the Processing and the information available to Verdocs, Verdocs will provide reasonable assistance to Customer in meeting its applicable obligations relating to security of Processing, Personal Data Breach notifications, data protection impact assessments, and consultations with supervisory authorities, including obligations under Articles 32 through 36 of the GDPR.
• Return/Deletion. Upon termination or expiration of the Services involving Processing of Customer Personal Data, Verdocs will, at Customer’s choice, return Customer Personal Data to Customer or delete such Customer Personal Data and existing copies, unless applicable law requires continued retention. Customer may exercise its right to return Customer Personal Data through the export functionality made available as part of the Services or through any applicable wind-down or transition period under the Agreement. Customer Personal Data retained in backup or archival systems will remain subject to the protections of this DPA and will be deleted in accordance with Verdocs’ ordinary backup-retention cycle, except where continued retention is required by applicable law.
• Artificial Intelligence and Machine Learning. Verdocs will not use Customer Personal Data to train, fine-tune, develop, or improve any artificial intelligence or machine learning model, whether Verdocs’ own or a third party’s, except (a) to the extent reasonably necessary to provide the Services in accordance with Customer’s documented instructions, or (b) as expressly authorized by Customer in writing. Verdocs will contractually prohibit its Subprocessors, including any providers of artificial intelligence models or services, from using Customer Personal Data to train, fine-tune, develop, or improve their own models, except as expressly authorized by Customer in writing. If the Services involve automated decision-making that produces legal or similarly significant effects concerning Data Subjects, Verdocs will disclose the existence of such Processing to Customer, provide meaningful information about the logic involved to the extent reasonably available to Verdocs and without disclosure of trade secrets or confidential information, and reasonably cooperate with Customer as required by Applicable Data Protection Laws to enable Data Subjects to exercise their applicable rights.
• Compliance Information & Audit. Verdocs will make available to Customer information reasonably necessary to demonstrate Verdocs’ compliance with its obligations under this DPA and Applicable Data Protection Laws, including, as applicable, then-current independent audit reports, certifications, security documentation, and written responses to reasonable compliance inquiries. Customer may audit Verdocs’ compliance with this DPA no more than once during any twelve-month period, unless an additional audit is required by Applicable Data Protection Laws, a competent supervisory authority, following a Personal Data Breach reasonably related to Verdocs’ compliance with this DPA, or where Customer has a reasonable documented basis to believe that Verdocs is in material breach of this DPA. Audits will ordinarily be satisfied through review of Verdocs’ then-current independent audit reports, certifications, security documentation, and other relevant information. If such materials are reasonably insufficient to demonstrate compliance, Customer may conduct, itself or through an independent third-party auditor that is not a competitor of Verdocs and is bound by appropriate confidentiality obligations, a further audit or inspection upon reasonable prior written notice. Any audit or inspection will be conducted during normal business hours, limited to information reasonably necessary to verify compliance with this DPA, and performed in a manner that minimizes disruption to Verdocs’ operations and does not compromise the confidentiality, security, or privacy of other customers or third parties. Customer will bear its own audit costs unless the audit identifies a material breach of this DPA by Verdocs.
• International Data Transfers. If a transfer of Customer Personal Data requires a transfer mechanism under Applicable Data Protection Laws, the transfer mechanisms specified in Annex 3 will apply. In the event of a conflict between the applicable Standard Contractual Clauses or UK Addendum and this DPA or the Agreement, the applicable Standard Contractual Clauses or UK Addendum will control to the extent of the conflict.
• Liability. Except to the extent prohibited by Applicable Data Protection Laws, the limitations of liability and exclusions of damages set forth in the Agreement apply to this DPA. For Customers using only Free Services, the Enhanced Liability Cap will be ten thousand dollars ($10,000). For all other Customers, the Enhanced Liability Cap will be three (3) times the aggregate fees paid or payable by Customer to Verdocs under the Agreement during the twelve (12) months preceding the event giving rise to the claim. Claims arising from a party’s breach of this DPA will be subject to the Enhanced Liability Cap. If the Agreement expressly provides a different enhanced liability cap applicable to data protection claims, the Agreement will control.
• Precedence. In the event of a conflict between this DPA and the Agreement regarding the Processing or protection of Customer Personal Data, this DPA will control solely with respect to such data protection matters. In all other respects, the Agreement remains in full force and effect. If Customer and Verdocs enter into a separately executed data processing agreement, that executed agreement will supersede this DPA with respect to the Processing covered by that agreement. This DPA will remain in effect for so long as Verdocs Processes Customer Personal Data, notwithstanding the expiration or termination of the Agreement, including during any retention, backup, transition, or deletion period described in this DPA.
• Updates. Verdocs may update this DPA from time to time to reflect changes in Applicable Data Protection Laws or the Services, provided that no update will materially decrease the overall protection of Customer Personal Data applicable to Customer’s then-current use of the Services. Verdocs will provide reasonable notice of material changes.

Annex 1 – Details of Processing

Subject Matter

Provision of Verdocs’ eSignature, workflow, API, SDK, embedded, hosting, support, security, and related Services.

Duration

For the duration of Customer’s use of the Services and any applicable transition, retention, backup, or deletion period.

Nature and Purpose of Processing

Processing necessary to provide the Services, including hosting, storage, transmission, organization, retrieval, document and eSignature workflow processing, authentication, audit-trail creation, support, security, maintenance, and other activities performed on Customer’s documented instructions.

Categories of Data Subjects

May include:

• Customer’s personnel and Authorized Users;
• Customer’s customers and end users;
• document senders, recipients, signers, and counterparties; and
• other individuals whose Personal Data Customer or its Authorized Users submit to the Services.

Types of Personal Data

May include:

• names;
• email addresses;
• telephone numbers;
• IP addresses and device information;
• account and user identifiers;
• signature and signing information;
• timestamps and audit-trail information;
• authentication information;
• information contained in documents, forms, fields, and workflows submitted through the Services; and
• other Personal Data submitted by Customer or its Authorized Users.

Special Categories / Regulated Data

Customer will not submit Protected Health Information or electronic Protected Health Information unless the parties have entered into an applicable Business Associate Addendum.

Customer is responsible for determining whether other special-category or regulated Personal Data is appropriate for Processing through the Services and for providing any instructions or safeguards required by Applicable Data Protection Laws.

Annex 2 – Technical and Organizational Measures

Verdocs maintains technical and organizational safeguards appropriate to the nature of the Services and Customer Personal Data, which include, as applicable to the relevant Services:

• encryption of Customer Personal Data in transit and at rest using industry-standard encryption;
• logical access controls, role-based access, least privilege, unique user IDs, and multi-factor authentication for administrative access;
• logging and monitoring of administrative and security-relevant access;
• secure software development lifecycle controls, code review, vulnerability management, and patch management;
• backups, disaster recovery, and business continuity measures;
• incident response procedures and post-incident remediation;
• workforce confidentiality, security awareness training, access provisioning, and timely deprovisioning;
• tenant and logical data-segregation controls; and
• vendor and Subprocessor security management.

Verdocs may modify these measures as its Services and security practices evolve, provided that such modifications do not materially decrease the overall level of security provided for Customer Personal Data.

Annex 3 – International Transfer Terms

1. Applicability

This Annex 3 applies to any transfer of Customer Personal Data from the European Economic Area (“EEA”), United Kingdom, or Switzerland to Verdocs or a Subprocessor in a country that is not recognized under Applicable Data Protection Laws as providing an adequate level of protection for Personal Data (a “Restricted Transfer”).

The parties may rely on any lawful transfer mechanism available under Applicable Data Protection Laws, including an applicable adequacy decision. To the extent a Restricted Transfer requires Standard Contractual Clauses or another contractual transfer mechanism, the provisions below will apply.

By entering into the Agreement, the parties are deemed to have entered into and executed the applicable Standard Contractual Clauses and other transfer terms incorporated by this Annex 3. No separate signature is required unless required by Applicable Data Protection Laws.

In the event of a conflict between this Annex 3, the DPA, and the Agreement, the applicable mandatory transfer mechanism will control solely with respect to the Restricted Transfer.

2. European Economic Area

2.1 Incorporation of Standard Contractual Clauses

For Restricted Transfers subject to the GDPR, the Standard Contractual Clauses issued by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914, as amended, replaced, or superseded from time to time (the “EU SCCs”), are incorporated into this DPA by reference.

2.2 Applicable Module

The applicable module of the EU SCCs will be determined by the roles of the parties with respect to the relevant Processing:

• Module Two (Controller to Processor) applies where Customer is a Controller and Verdocs is a Processor; and
• Module Three (Processor to Processor) applies where Customer is a Processor and Verdocs is a Subprocessor.

Where Customer acts in different roles with respect to different categories of Customer Personal Data, the applicable module will apply separately to the relevant Processing.

2.3 SCC Elections

For purposes of the EU SCCs:

Clause 7 – Docking Clause. The optional docking clause will apply.

Clause 9 – Use of Subprocessors. Option 2, General Written Authorization, will apply. For Module Two, Customer provides general written authorization for Verdocs to engage Subprocessors in accordance with Section 5 of the DPA. For Module Three, Customer represents that the applicable Controller has provided the general authorization necessary for Verdocs to engage Subprocessors. Customer will provide Verdocs with the contact information or other reasonable means necessary for Verdocs to provide the applicable Controller with notices required by Clause 9(a). Verdocs will provide the applicable Controller and Customer with at least thirty (30) days’ prior written notice of any intended addition or replacement of a Subprocessor.

Clause 11 – Redress. The optional language in Clause 11(a) will not apply.

Clause 17 – Governing Law. The EU SCCs will be governed by the laws of Ireland.

Clause 18 – Choice of Forum and Jurisdiction. The parties submit to the jurisdiction of the courts of Ireland for purposes of the EU SCCs.

Nothing in these elections limits any mandatory rights of Data Subjects or supervisory authorities under Applicable Data Protection Laws.

3. EU SCC Annex I – Parties and Description of Transfer

A. List of Parties

Data Exporter

Name: Customer identified in the Agreement or applicable Order Form.

Address: The address associated with Customer’s account, Agreement, or applicable Order Form.

Contact: The Customer contact identified in the Agreement, applicable Order Form, or Customer account.

Activities relevant to the transfer: Customer’s use of the Services and submission of Customer Personal Data to Verdocs for Processing in accordance with the Agreement and DPA.

Role: Controller for purposes of Module Two or Processor for purposes of Module Three, as applicable.

Data Importer

Name: Verdocs, Inc.

Address: 200 Vesey St. 24 Floor, New York, NY 10281

Contact: Head of Privacy

Email: hello@verdocs.com

Contact: The privacy or legal contact identified by Verdocs in the Agreement, DPA, Privacy Policy, or other applicable legal notice.

Activities relevant to the transfer: Provision of the Services described in the Agreement and Processing of Customer Personal Data as described in this DPA.

Role: Processor for purposes of Module Two or Subprocessor for purposes of Module Three, as applicable.

The parties are deemed to have signed the EU SCCs as of the date Customer becomes bound by the Agreement.

B. Description of the Transfer

Categories of Data Subjects

The categories of Data Subjects are described in Annex 1 of the DPA.

Categories of Personal Data

The categories of Customer Personal Data are described in Annex 1 of the DPA.

Special Categories of Personal Data

Special-category or other regulated Personal Data may be processed only to the extent permitted under the Agreement and DPA and subject to any additional safeguards required by Applicable Data Protection Laws.

To the extent Special Categories of Personal Data are processed, applicable safeguards may include encryption, role-based and least-privilege access controls, logging and monitoring, data minimization, and the other measures described in Annex 2, as appropriate to the nature and risk of the Processing.

Protected Health Information and electronic Protected Health Information may not be submitted to the Services unless the parties have entered into an applicable Business Associate Addendum.

Frequency of Transfer

Transfers may occur on a continuous or recurring basis during Customer’s use of the Services.

Nature of Processing

The nature of Processing is described in Annex 1 of the DPA and may include collection, transmission, hosting, storage, organization, retrieval, access, eSignature and workflow Processing, authentication, audit-trail generation, support, security, maintenance, deletion, and other Processing necessary to provide the Services in accordance with Customer’s documented instructions.

Purpose of Processing

The purposes of Processing are described in Annex 1 of the DPA and include providing, securing, supporting, maintaining, and operating the Services in accordance with the Agreement and Customer’s documented instructions.

Duration of Processing

Processing will continue for the duration specified in Annex 1 of the DPA.

Subprocessor Transfers

Where Verdocs transfers Customer Personal Data to a Subprocessor, the subject matter, nature, and duration of the Subprocessor’s Processing will be limited to what is reasonably necessary for the Subprocessor to provide the relevant services to Verdocs in connection with the Services.

C. Competent Supervisory Authority

The competent supervisory authority will be determined in accordance with Clause 13 of the EU SCCs and Applicable Data Protection Laws based on the circumstances of the applicable Data Exporter and Restricted Transfer.

4. EU SCC Annex II – Technical and Organizational Measures

The technical and organizational measures applicable to Restricted Transfers are described in Annex 2 of the DPA, which is incorporated into the EU SCCs for purposes of Annex II.

Verdocs will maintain such measures in accordance with Section 4 of the DPA.

5. Subprocessor List for General Written Authorization

Because Clause 9(a), Option 2 (General Written Authorization) applies, Verdocs will maintain a current list of Subprocessors engaged to process Customer Personal Data under the general authorization granted by Customer. The current list will be provided to Customer upon request and constitutes the agreed list of Subprocessors for purposes of Clause 9(a), Option 2 of the EU SCCs. Verdocs will provide Customer with at least thirty (30) days’ prior written notice of any intended addition or replacement of a Subprocessor in accordance with Section 5 of the DPA.

6. United Kingdom

Where a Restricted Transfer is subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner’s Office (the “UK Addendum”), as amended, replaced, or superseded from time to time, is incorporated into this DPA.

For purposes of the UK Addendum:

Table 1 – Parties

The parties, contact information, and roles are those identified in Section 3.A of this Annex 3.

Table 2 – Selected SCCs, Modules, and Clauses

The version of the EU SCCs, applicable module, and elections described in Sections 2.1 through 2.3 of this Annex 3 will apply.

Table 3 – Appendix Information

The information required for:

• Annex I.A of the EU SCCs is set forth in Section 3.A of this Annex 3;
• Annex I.B is set forth in Section 3.B and Annex 1 of the DPA;
• Annex I.C is determined as provided in Section 3.C;
• Annex II is set forth in Annex 2 of the DPA; and
• Annex III, Clause 9(a), Option 2 (General Written Authorization) applies. The current agreed list of Subprocessors is maintained by Verdocs and will be provided to Customer upon request in accordance with Section 5 of the DPA and Section 5 of this Annex 3.

Table 4 – Ending this Addendum when the Approved Addendum Changes: Importer and Exporter.

Either party may terminate the UK Addendum to the extent permitted under the applicable version of the UK Addendum if the Information Commissioner issues a revised approved addendum that materially changes the obligations of the parties and the parties are unable to agree upon commercially reasonable replacement terms.

The parties are deemed to have entered into the UK Addendum as of the date the applicable Restricted Transfer begins.

7. Switzerland

Where Customer Personal Data subject to the Swiss Federal Act on Data Protection (“Swiss FADP”) is transferred to a country that does not provide an adequate level of data protection, the EU SCCs will apply as modified by this Section.

For such transfers:

• references in the EU SCCs to the “GDPR” will include the Swiss FADP to the extent applicable to the relevant Processing;
• references to “personal data” will include personal data as defined under the Swiss FADP;
• references to an EU or EEA supervisory authority will include the Swiss Federal Data Protection and Information Commissioner where applicable;
• references to an EU Member State will be interpreted to include Switzerland to the extent necessary to give effect to the applicable rights and obligations under the Swiss FADP; and
• the EU SCCs will be interpreted so that Data Subjects located in Switzerland receive the protections required under the Swiss FADP.

To the extent the GDPR also applies to the relevant Processing, the GDPR-specific provisions of the EU SCCs will continue to apply without modification.

8. Alternative Transfer Mechanisms

Nothing in this Annex 3 prevents Verdocs or Customer from relying on another lawful transfer mechanism permitted under Applicable Data Protection Laws, including an applicable adequacy decision or other officially recognized transfer framework, where that mechanism validly applies to the relevant Restricted Transfer.

If a transfer mechanism relied upon by the parties becomes invalid, unavailable, or otherwise insufficient under Applicable Data Protection Laws, the parties will cooperate in good faith to implement an alternative lawful transfer mechanism.

Unless and until an alternative mechanism is implemented, the EU SCCs, UK Addendum, or other applicable contractual safeguards described in this Annex 3 will apply to the extent legally available.

9. Transfer Impact and Supplementary Measures

To the extent required by Applicable Data Protection Laws, Verdocs will provide Customer with information reasonably available to Verdocs and reasonably necessary for Customer to assess the circumstances of a Restricted Transfer and the safeguards applicable to Customer Personal Data.

Verdocs will implement supplementary technical, organizational, or contractual measures where reasonably necessary to provide a level of protection for Customer Personal Data consistent with Applicable Data Protection Laws.

Customer and Verdocs will reasonably cooperate with one another in connection with any legally required transfer impact assessment or similar evaluation relating to the Services.