STANDARD CONTRACTUAL CLAUSES (SCC)

PURPOSE AND SCOPE

The purpose of these Standard Contractual Clauses (SCCs) is to ensure that the processing of personal data by the Data Importer, on behalf of the Data Exporter, complies with applicable data protection laws, including the General Data Protection Regulation (GDPR). These SCCs establish the terms and conditions under which personal data can be transferred from the Data Exporter (QuantCare) to the Data Importer (sub-processor) and processed in a manner that ensures adequate protection of the data subjects’ rights and freedoms. The scope of these clauses covers all personal data transferred from the Data Exporter to the Data Importer, including any subsequent transfers to additional sub-processors. It outlines the responsibilities and obligations of both parties to ensure data protection compliance.

DEFINITIONS

For these Standard Contractual Clauses, the following definitions apply:

• Data Exporter: QuantCare transfers personal data to the Data Importer.
• Data Importer: The sub-processor receives personal data from the Data Exporter and processes it on behalf of the Data Exporter.
• Data Subject: The identified or identifiable natural person to whom the personal data relates.
• Personal Data: Any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR.
• Processing: Any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• Controller: The natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data.
• Processor: A natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.
• Sub-Processor: Any processor engaged by the Data Importer or by any other sub-processor of the Data Importer who agrees to receive personal data exclusively intended for processing activities to be carried out on behalf of the Data Exporter after the transfer in accordance with its instructions, the terms of the clauses, and the terms of the written subcontract from the Data Importer or any other sub-processor of the Data Importer.
• Supervisory Authority: An independent public authority established by a Member State pursuant to Article 51 of the GDPR.
• Technical and Organizational Measures: Measures taken by the Data Importer to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, particularly where the processing involves data transmission over a network and against all other unlawful forms of processing.

CLAUSE 1: DATA PROTECTION PRINCIPLES

Compliance with GDPR: The Data Importer agrees to process personal data in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. This includes implementing appropriate technical and organisational measures to ensure a level of security appropriate to the risk and adhering to the principles of data protection as outlined in these clauses.

Data Subject Rights: The Data Importer shall assist the Data Exporter in fulfilling its obligations to respond to requests from data subjects to exercise their rights under the GDPR. This includes but is not limited to, the rights of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing.

Lawfulness, Fairness, and Transparency: The Data Importer shall ensure that personal data regarding the data subject is processed lawfully, fairly, and transparently. The data subject shall receive clear and understandable information about the processing activities.

Purpose Limitation: The Data Importer shall collect and process personal data only for specified, explicit, and legitimate purposes as instructed by the Data Exporter. Personal data shall not be processed in a manner incompatible with these purposes.

Data Minimization: The Data Importer shall ensure that the personal data processed is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. This principle aims to reduce the amount of data collected and processed to the minimum necessary.

Accuracy: The Data Importer shall take all reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date. Personal data that is inaccurate, with regard to the purposes for which it is processed, shall be erased or rectified without delay.

Storage Limitation: The Data Importer shall retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable laws and regulations. Upon the termination of the data processing agreement or the Data Exporter’s request, the Data Importer shall return or delete all personal data in its possession.

Integrity and Confidentiality: The Data Importer shall process personal data in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and accidental loss, destruction, or damage, using appropriate technical or organisational measures. This includes ensuring that personal data is kept confidential and secure from unauthorised access or disclosure.

CLAUSE 2: OBLIGATIONS OF THE DATA EXPORTER

Instructions to Data Importer: The Data Exporter shall provide clear, documented instructions to the Data Importer regarding processing personal data. These instructions must cover the scope, nature, and purpose of the processing, the types of personal data to be processed, and the categories of data subjects. The Data Exporter ensures the instructions comply with applicable protection laws and regulations.

Ensuring Compliance: The Data Exporter shall take reasonable steps to ensure that the Data Importer complies with its obligations under these Standard Contractual Clauses and applicable data protection laws. This includes conducting due diligence on the Data Importer’s data protection practices and regularly monitoring compliance through audits.

Data Subject Requests: The Data Exporter shall handle all requests from data subjects to exercise their rights under the GDPR. If the Data Importer receives a request directly from a data subject, it shall promptly inform the Data Exporter and provide necessary assistance to facilitate its response to the request. This includes rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing.

Security Measures: The Data Exporter shall ensure that appropriate technical and organisational measures are in place to protect personal data during transfer and processing by the Data Importer. These measures must provide a level of security appropriate to the risk, including but not limited to encryption, access controls, and regular security assessments. The Data Exporter must also ensure that the Data Importer is informed of any specific security requirements that must be met.

Sub-Processor Approvals: The Data Exporter must provide written authorisation before the Data Importer can engage any sub-processors to process personal data. The Data Exporter has the right to object to the engagement of any sub-processor that may not comply with the requirements outlined in these Standard Contractual Clauses or applicable data protection laws. The Data Exporter shall ensure that similar data protection obligations bind any approved sub-processor as imposed on the Data Importer under these Clauses.

CLAUSE 3: OBLIGATIONS OF THE DATA IMPORTER

Processing According to Instructions: The Data Importer shall process personal data only in accordance with the documented instructions provided by the Data Exporter. Any processing outside of these instructions is prohibited unless required by law, in which case the Data Importer must inform the Data Exporter of that legal requirement before processing unless the law prohibits such information on important public interest grounds.

Confidentiality: The Data Importer shall ensure that any person authorised to process the personal data is subject to a duty of confidentiality. This obligation shall continue even after the termination of the data processing agreement. The Data Importer shall also ensure that access to personal data is limited to personnel who need it to fulfil their role in the processing activities.

Security Measures: The Data Importer shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk associated with the processing of personal data. These measures include but are not limited to, encryption, pseudonymisation, access controls, regular security testing, and the establishment of processes to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.

Cooperation with Data Exporter: The Data Importer shall cooperate with the Data Exporter to ensure compliance with data protection laws and the obligations set forth in these Standard Contractual Clauses. This includes making available to the Data Exporter all information necessary to demonstrate compliance and allowing for and contributing to audits, including inspections, conducted by the Data Exporter or another auditor mandated by the Data Exporter.

Data Subject Requests: The Data Importer shall promptly notify the Data Exporter of any direct requests from data subjects concerning their data. The Data Importer shall only respond to such requests if authorised by the Data Exporter. The Data Importer shall assist the Data Exporter by providing necessary information and taking appropriate actions to respond to data subject requests, including requests for access, rectification, erasure, restriction of processing, data portability, and objections to processing.

Notification of Data Breaches: The Data Importer shall notify the Data Exporter without undue delay and within 24 hours upon becoming aware of any personal data breach. The notification shall include all available information regarding the nature of the breach, the affected data, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects. The Data Importer shall cooperate fully with the Data Exporter in investigating and responding to the violation, including providing any additional information and assistance required by the Data Exporter to comply with its legal obligations.

CLAUSE 4: DATA SUBJECT RIGHTS

Access, Rectification, and Erasure Requests: The Data Importer shall assist the Data Exporter in responding to data subjects’ requests for access to their data, as well as requests for the rectification of inaccurate data and the erasure of data when it is no longer needed or if the data subject withdraws their consent. Upon receiving a request from a data subject, the Data Importer shall promptly inform the Data Exporter and provide all necessary information and assistance to enable the Data Exporter to respond to the request within the timeframes required by applicable data protection laws.

Data Portability: The Data Importer shall assist the Data Exporter in ensuring the right to data portability, allowing data subjects to receive their data in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance. Upon request, the Data Importer shall provide the necessary data in the specified format to the Data Exporter or directly to the data subject, as instructed by the Data Exporter.

Restriction of Processing: The Data Importer shall comply with requests from data subjects to restrict the processing of their data under certain circumstances, such as when the accuracy of the data is contested, the processing is unlawful, or the data is no longer needed for processing purposes but required by the data subject for legal claims. The Data Importer shall implement technical measures to ensure that restricted data is only processed for the reasons permitted under applicable data protection laws and inform the Data Exporter of such requests.

Right to Object: The Data Importer shall respect the right of data subjects to object to processing their data based on legitimate interests or for direct marketing purposes. Upon receiving an objection, the Data Importer shall promptly inform the Data Exporter and cease processing the data for the contested purpose unless the Data Exporter provides overriding legitimate grounds for the processing or the processing is required for legal claims.

Automated Decision-Making: The Data Importer shall ensure that data subjects are not subject to decisions based solely on automated processing, including profiling, which produces legal or similarly significant effects on them. If the Data Importer engages in automated decision-making, it shall provide the Data Exporter with sufficient information to explain the logic involved, as well as the significance and envisaged consequences of such processing for the data subject. The Data Importer shall assist the Data Exporter in providing data subjects with the necessary safeguards, including the right to obtain human intervention, to express their point of view, and to contest the decision.

CLAUSE 5: LIABILITY

Liability of the Parties: The Data Exporter and the Data Importer shall be liable for any damages caused by any breach of these Standard Contractual Clauses or applicable data protection laws. Each party shall be held responsible for its acts and omissions, and neither party shall be liable for any breaches committed by the other party. The parties agree to cooperate fully in investigating and resolving any claims or disputes related to data protection and to mitigate any damages resulting from a breach.

Indemnification: The Data Importer agrees to indemnify, defend, and hold harmless the Data Exporter from and against any and all claims, damages, losses, and expenses (including reasonable legal fees) arising out of or in connection with any breach of these Standard Contractual Clauses or applicable data protection laws by the Data Importer. Similarly, the Data Exporter agrees to indemnify, defend, and hold harmless the Data Importer from and against any and all claims, damages, losses, and expenses (including reasonable legal fees) arising out of or in connection with any breach of these Standard Contractual Clauses or applicable data protection laws by the Data Exporter.

Limitation of Liability: Except in cases of intentional misconduct or gross negligence, neither party shall be liable to the other for any indirect, incidental, consequential, special, or punitive damages, including but not limited to loss of profits, revenue, data, or business opportunities, arising out of or in connection with these Standard Contractual Clauses. The total liability of each party to the other under these Clauses shall be limited to the amount paid for the services giving rise to such liability, or one hundred thousand euros (€100,000), whichever is greater, except that this limitation shall not apply to any indemnification obligations or damages arising from a party’s breach of confidentiality obligations or data protection requirements.

CLAUSE 6: SUPERVISION

Cooperation with Supervisory Authorities: The Data Importer agrees to cooperate with supervisory authorities, including providing all necessary information and assistance, to fulfil the Data Exporter’s obligations under applicable data protection laws. This includes responding promptly to inquiries or requests from supervisory authorities and assisting the Data Exporter in complying with any directives, orders, or investigations such authorities initiate. The Data Importer shall notify the Data Exporter immediately if it receives any inquiry, audit, investigation, or request for information from a supervisory authority about processing personal data under these Standard Contractual Clauses.

Data Protection Impact Assessments: The Data Importer shall assist the Data Exporter in conducting Data Protection Impact Assessments (DPIAs) when required under applicable data protection laws. This assistance includes providing relevant information about processing activities, security measures, and potential risks to data subjects. The Data Importer shall also assist in consultations with supervisory authorities, where required, by supplying necessary details and cooperating with the Data Exporter throughout the assessment process. The aim is to identify and mitigate any risks associated with data processing activities and ensure compliance with data protection requirements.

Audits and Inspections: The Data Importer agrees to allow the Data Exporter, or an independent auditor mandated by the Data Exporter, to conduct audits and inspections of its data processing activities to ensure compliance with these Standard Contractual Clauses and applicable data protection laws. Such audits and inspections may include, but are not limited to, reviews of data processing systems, security measures, records, and procedures. The Data Importer shall provide access to all necessary information, facilities, and personnel to facilitate the audit or inspection. The Data Exporter shall give reasonable notice of any audit or inspection, and both parties shall cooperate to ensure minimal disruption to the Data Importer’s operations. Any findings or recommendations resulting from the audit or inspection shall be addressed promptly by the Data Importer to ensure ongoing compliance with data protection requirements.

CLAUSE 7: INTERNATIONAL TRANSFERS

Mechanisms for Transfers: The Data Importer agrees to utilise recognised legal mechanisms for international transfers of personal data, including but not limited to Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or other appropriate safeguards as outlined in the GDPR. These mechanisms ensure that personal data transferred outside the European Economic Area (EEA) is adequately protected and that data subjects’ rights are upheld. The Data Importer shall ensure that any subsequent transfers to third parties or sub-processors outside the EEA are conducted using these recognised legal mechanisms.

Obligations for International Transfers: The Data Importer shall adhere to all responsibilities outlined in the applicable legal mechanisms for international transfers. This includes ensuring that any third party or sub-processor involved in the processing of personal data complies with equivalent data protection standards and provides the same level of protection as required by these Standard Contractual Clauses. The Data Importer shall inform the Data Exporter of any new or intended international data transfers and obtain prior written consent from the Data Exporter before proceeding with such transfers. Additionally, the Data Importer shall maintain records of all global data transfers and make these records available to the Data Exporter and relevant supervisory authorities upon request.

Compliance with SCCs: The Data Importer shall ensure full compliance with these Standard Contractual Clauses (SCCs) when transferring personal data internationally. This includes implementing all necessary technical and organisational measures to protect personal data during transit and processing, conducting regular reviews of data protection practices, and addressing any deficiencies promptly. The Data Importer shall also ensure that all contractual arrangements with third parties and sub-processors involved in international data transfers include provisions that mirror the obligations and protections provided by these SCCs. In the event of any conflict between these SCCs and other agreements, the provisions of these SCCs shall prevail to the extent necessary to ensure compliance with GDPR and adequate protection of personal data.

CLAUSE 8: USE OF SUB-PROCESSORS

Approval of Sub-Processors: The Data Importer shall only engage a sub-processor to carry out processing activities on behalf of the Data Exporter if they obtain prior specific or general written authorisation from the Data Exporter. In the case of general written consent, the Data Importer shall inform the Data Exporter of any intended changes concerning the addition or replacement of sub-processors, thereby allowing the Data Exporter to object to such changes within a reasonable period. The Data Importer shall maintain an up-to-date list of sub-processors and make this list available to the Data Exporter upon request.

Sub-Processor Obligations: The Data Importer shall ensure that any sub-processor it engages complies with obligations equivalent to those set out in these Standard Contractual Clauses. This includes entering into a written agreement with each sub-processor that imposes data protection obligations no less protective than those imposed on the Data Importer under these Clauses, particularly in terms of providing sufficient guarantees to implement appropriate technical and organisational measures to ensure that processing meets the requirements of applicable data protection laws. The Data Importer shall regularly monitor the performance of its sub-processors to ensure ongoing compliance with these obligations.

Liability for Sub-Processors: The Data Importer shall remain fully liable to the Data Exporter for performing the subprocessor’s obligations per these Standard Contractual Clauses. The Data Importer shall be responsible for any acts or omissions of its sub-processors that cause it to breach any of its obligations under these Clauses. If a sub-processor fails to fulfil its data protection obligations, the Data Importer shall promptly take appropriate remedial actions to ensure compliance and mitigate potential damage. The Data Importer shall indemnify the Data Exporter against any loss, damage, or expense incurred due to the sub-processor’s failure to comply with its data protection obligations.

CLAUSE 9: SECURITY MEASURES

Technical and Organizational Measures: The Data Importer shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk associated with the processing of personal data. These measures shall include but are not limited to encryption of personal data both at rest and in transit, access controls to restrict access to personal data to authorised personnel only, pseudonymisation and anonymisation techniques where applicable, regular monitoring and testing of security measures, and maintaining secure backup procedures to ensure data integrity and availability.

Incident Response: The Data Importer shall establish an incident response plan to address personal data breaches or security incidents promptly. Upon becoming aware of a personal data breach, the Data Importer shall notify the Data Exporter without undue delay and, in any event, within 24 hours, providing sufficient details to enable the Data Exporter to comply with its legal obligations. The notification shall include the nature of the breach, the categories and approximate number of data subjects and personal data records concerned, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its possible adverse effects. The Data Importer shall cooperate fully with the Data Exporter in investigating and responding to the violation, including providing additional information and assistance as required.

Regular Security Audits: The Data Importer shall conduct regular security audits to assess the effectiveness of its technical and organisational measures in protecting personal data. These audits shall be performed at least annually and include vulnerability assessments, penetration testing, and reviews of security policies and procedures. The Data Importer shall promptly address identified vulnerabilities or weaknesses and implement necessary improvements to enhance data security. The Data Importer shall provide the Data Exporter with a summary of the audit findings and the actions taken to address any issues identified. The Data Exporter reserves the right to request a copy of the full audit report and to conduct its audits or inspections, either directly or through an independent auditor, to verify the Data Importer’s compliance with these Standard Contractual Clauses and applicable data protection laws.

CLAUSE 10: DATA BREACH NOTIFICATION

Notification Obligations: The Data Importer shall notify the Data Exporter without undue delay and, in any event, within 24 hours upon becoming aware of any personal data breach. The notification to the Data Exporter shall include sufficient details to enable it to meet its legal obligations, including the obligation to notify the relevant supervisory authority and affected data subjects where required by law. The Data Importer shall provide ongoing updates as more information becomes available.

Incident Reporting: The Data Importer’s notification of a personal data breach to the Data Exporter shall include, at a minimum, the following information:

1. A description of the nature of the breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records affected.
2. The name and contact details of the Data Importer’s data protection officer or another relevant contact point where more information can be obtained.
3. A description of the likely consequences of the personal data breach.
4. A description of the measures taken or proposed by the Data Importer to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

Mitigation and Remediation: The Data Importer shall promptly take all necessary measures to mitigate the personal data breach’s effects and remedy the violation. This includes implementing measures to prevent the recurrence of similar incidents in the future. The Data Importer shall fully cooperate with the Data Exporter, including providing any necessary information and assistance, to ensure an effective response to the breach. The Data Importer shall document the violation, including its effects and the remedial actions taken, and provide this documentation to the Data Exporter upon request.

CLAUSE 11: TERMINATION AND CONSEQUENCES OF TERMINATION

Termination Conditions: These Standard Contractual Clauses shall remain in effect until the data processing agreement between the Data Exporter and the Data Importer is terminated. Termination may occur under the following conditions:

• Mutual agreement between the Data Exporter and the Data Importer.
• Breach of these Clauses by either party that is not remedied within a reasonable period after notice of such breach.
• The Data Exporter determines that the Data Importer cannot comply with these Clauses or applicable data protection laws.

Data Return and Deletion: Upon termination of the data processing agreement, the Data Importer shall, at the choice of the Data Exporter, return all personal data to the Data Exporter and/or securely delete all personal data in its possession. The Data Importer shall certify in writing to the Data Exporter that it has returned or deleted all personal data as instructed. The Data Importer shall ensure that any sub-processors comply with these obligations and provide similar data return or deletion certifications. If the return or deletion of the data is not feasible, the Data Importer shall inform the Data Exporter of the reasons for this and continue to protect personal data in accordance with these Clauses and applicable data protection laws.

Post-Termination Access: In cases where personal data cannot be returned or deleted immediately upon termination, the Data Importer shall ensure that access to the personal data is restricted to authorised personnel and that any further processing is limited to what is necessary for the completion of the return or deletion process. The Data Importer shall provide the Data Exporter with reasonable access to the personal data for the duration of this process to facilitate the transfer of data to the Data Exporter or another designated party. The Data Importer shall continue to comply with its obligations under these Clauses and applicable data protection laws during this post-termination period until all personal data has been returned or securely deleted.

CLAUSE 12: MISCELLANEOUS PROVISIONS

Governing Law: These Standard Contractual Clauses shall be governed by and construed in accordance with the laws of the jurisdiction where the Data Exporter is established, without regard to its conflict of law principles. This ensures that the Clauses are interpreted and enforced under a consistent legal framework, providing certainty and predictability for both parties.

Amendments: Any amendments or modifications to these Standard Contractual Clauses must be made in writing and signed by both the Data Exporter and the Data Importer. A waiver of any provision of these Clauses shall be effective only if it is in writing and signed by the party against whom the waiver will be enforced. This ensures that both parties document and agree upon any changes to the agreement.

Severability: If a court of competent jurisdiction finds any provision of these Standard Contractual Clauses invalid or unenforceable, such invalidity or unenforceability shall not affect the other provisions of these Clauses, which shall remain in full force and effect. The parties agree to negotiate in good faith to replace the invalid or unenforceable provision with a valid and enforceable provision that achieves the parties’ original intent as closely as possible. This ensures the Clauses remain effective and enforceable, even if one part is invalid.

Entire Agreement: These Standard Contractual Clauses, together with any annexes or appendices, constitute the entire agreement between the Data Exporter and the Data Importer with respect to the subject matter hereof and supersede all prior and contemporaneous understandings, agreements, representations, and warranties both written and oral, relating to such subject matter. This ensures that all terms and conditions governing the data processing relationship are contained in a comprehensive document.

Notices: All notices, requests, consents, claims, demands, waivers, and other communications under these Standard Contractual Clauses shall be in writing and shall be deemed to have been duly given (i) when delivered by hand, with written confirmation of receipt; (ii) when received by the addressee if sent by a nationally recognised overnight courier, receipt requested; (iii) on the date sent by email, with confirmation of transmission, if sent during normal business hours of the recipient, and on the next business day if sent after normal business hours of the recipient; or (iv) on the third day after the date mailed, by certified or registered mail, return receipt requested, postage prepaid. Notices shall be sent to the addresses and email addresses outlined in the data processing agreement or to such other address or email address as either party may specify in writing.

 ANNEXES

ANNEX I: DETAILS OF PROCESSING ACTIVITIES

Categories of Data Subjects: Specify the categories of data subjects whose personal data is being processed (e.g., customers, employees, patients).

Types of Personal Data: List the types of personal data being processed (e.g., names, addresses, email addresses, health information).

Special Categories of Data: Indicate if any special categories of data (e.g., health data, biometric data) are being processed.

Purpose of Processing: Describe the specific purposes for processing the personal data (e.g., providing healthcare services, processing payments).

Duration of Processing: Specify how the personal data will be processed and retained.

ANNEX II: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Access Control: Measures to ensure that access to personal data is restricted to authorised personnel only (e.g., role-based access control, authentication mechanisms).

Data Encryption: Details of encryption methods used for data at rest and in transit (e.g., AES-256 encryption).

Data Minimization: Practices to ensure that only necessary personal data is collected and processed (e.g., data masking, anonymisation).

Physical Security: Measures to protect physical locations where personal data is stored (e.g., secure facilities, CCTV monitoring).

Incident Response: Procedures for responding to data breaches and security incidents (e.g., incident response plan, breach notification procedures).

Regular Audits: Processes for conducting regular security audits and assessments (e.g., vulnerability assessments, penetration testing).

ANNEX III: LIST OF SUB-PROCESSORS

Sub-Processor Name: The name of each sub-processor engaged by the Data Importer.

Location: The geographic location where the sub-processor operates.

Description of Processing: A brief description of the processing activities performed by the sub-processor (e.g., cloud storage provider, email marketing service).

Security Measures: A summary of the security measures implemented by the sub-processor to protect personal data.

Approval Status: Indicates whether the data exporter has approved the Subprocessor (e.g., yes, no, pending).

Legal

Terms of Service

Privacy Policy

Website Terms of Use