Terms of Business

Last update: 30th March 2026

AmagisTech is a group of companies composed of:

  • AmagisTech Limited with a registered office in Gzira (Malta), Level 4, 266, Triq Ix-Xatt and a branch in Italy (with an office in Via Durini 25, Milan 20122 and Vat no. 12664770968); and
  • AmagisTech Italia Srl, with registered office in Via Durini 25 Milan 20122, Italy and the Vat no. 14438530967 and share capital 10,000.00 EURO;

hereinafter referred to, as applicable, as “AmagisTech”, “Amagis” or “Provider”. The counterparty of each agreement with a client is indicated in the relevant order form.

These general terms and conditions (also “T&C”) apply to any purchase orders placed by any client willing to purchase the services and product described below from the Provider. The Provider Offers are valid for a period of 15 calendar days starting from the date of the offer, unless otherwise agreed with, or indicated by, the Provider in the order form.

The party contracting with the Provider shall be referred in these T&C as the “Client”. The Provider and the Client are hereinafter each referred to as “Party” and collectively as “Parties”.

1. Scope

These terms of Business (also “ToB”) apply to any engagement letters, provide offers countersigned for acceptance, purchase orders or agreements having as a contract object the Services and made between the Parties (hence referred only as “Order Form(s)” or “Agreement”) placed by any client willing to purchase Services from the Provider.

The Client with the execution of the Agreement/Order Form accepts the integral application of these ToB. Any amendments to these ToB shall be valid only if agreed in a written agreement signed by the Provider. In the event of any conflict and /or inconsistencies between the ToB and the Agreement, the latter shall prevail.

The Services provided are identified in the relevant Order Forms/Agreements and, unless otherwise expressly agreed by the Parties in the Order Form or in a separate document signed by both Parties, (a) shall not cover in any way whatsoever any further activity, service, nor actions otherwise connected, directly or indirectly, to the business carried out by the Client, and (b) shall not involve the provision of ongoing assistance.

2. Appointment of AmagisTech as Provider and limits of the engagement

The Provider offers, which are included in the Order Form, are valid for a period of 15 calendar days starting from the date of the offer, unless otherwise agreed with, or indicated by, the Provider.

By signing the Order Form or executing the Agreement (“Engagement”), the Client (i) accepts any provisions of these ToB; (ii) appoints the Provider for provisioning of the Services indicated in the relevant Agreement starting from the date reported therein (“Effective Date”) and (iii) agrees to be
subjected to either a background due diligence and to a technical due diligence, whenever allowed to assess a feasibility study related to the execution of the Services.

The Provider shall not do anything that may conflict, in its sole opinion, with any local or foreign laws or regulations and the execution of the Services is limited to the scope of the terms of the Provider’s permits, licences or codes of practice, if any, issued by the competent authorities. Furthermore, the Services may be immediately suspended if the Provider might be exposed to any risk of civil or criminal liability or prosecution in any part of the world.

3. Duration and Termination

The duration of the contractual relationship between the Provider and the Client is the one indicated in the Agreement. The duration of the relationship between Provider and its Client might not be equal to the term indicated in the Order Form, considering that the Service might require to be activated on a following date, after a technical assessment (also “Service Start Date”). Unless terminated earlier in accordance with these ToB or specific provisions reported in the agreement, the Services shall commence on the Services Start Date and will continue for the Order Term (the period indicated in the Order Form starting from the Service Start Date), subject to earlier termination in accordance with these ToB. If the Agreement terminates before the end of the Order Term for reasons other than the Provider uncured material breach of the provisions herein contained, all unpaid fees (if any) during the Order Term will become due and payable on the effective date of the termination.

Without prejudice of clause 2.3, the Provider may suspend the supply of Products and the Services if: (a) the Client breaches their payments obligations, (b) if the Client breaches the law or these ToB or those contained in the Agreement, and (c) if a third party (including IT Vendor) suspends the supply of Services or Products necessary to execute the Order Form (altogether referred as “Suspension”). The Client acknowledges and agrees that, in case the Provider enforces this clause, the Client is not entitled to any damage arising in connection with the Suspension. If Amagis becomes aware that any of the Client’s data, assets, actions violates the ICT Vendor’s acceptable use policy, Amagis will (as applicable) immediately suspend the Services or Client’s access, and/or remove the relevant Client’s data.

Notwithstanding anything to the contrary in these ToB:

  • the Provider may terminate any existing Agreement with a written notice (i) in case ICT Vendors shall terminate in their discretion the contract with the Provider (“Principal Agreement”) which allows the execution of the Agreement and/or Order Form. In such a case, the termination date of the Agreement/Order Form shall be the date of the termination of the Principal Agreement; (ii) if the Provider and/or ICT Vendors reasonably determine that it is impracticable to continue providing the Services in light of applicable laws or if the Provider believes, in good faith, that Client or its end users, if any, are reasonably likely to breach any clause of these ToB or cause ICT Vendors or the Provider to violate any law or regulation; (iii) the Client, including its directors, is charged with any criminal offence or it is the subject of any criminal, judicial or regulatory investigation in any jurisdiction; (iv) it gives to the Client a written notice of 30 calendar days; and
  • each Party may terminate an Agreement if: (i) the other Party is in material breach of these ToB or any existing Agreement the applicable laws and fails to cure that breach within thirty (30) days after receipt of written notice, (ii) the other Party enters into an arrangement or composition with or for the benefit of its creditors, goes into administration, receivership or administrative receivership, is declared bankrupt or insolvent or is dissolved or (iii) if the other Party does not hold or loses an authorisation, licence, permit – necessary to the provision of the Services – granted by a private third party, if that be the case, or by a regulatory public authority.

Neither Party shall be entitled to compensation or damages of any kind from the other Party in respect of termination if any Agreement/Order Form is terminated by such other Party in accordance with these ToB. Upon the termination date of an Agreement: (i) all rights and licences granted by one party to the other will immediately cease; (ii) each party will promptly return to the other party, or destroy and certify the destruction of, all of the other party’s Confidential Information, as defined below; (iii) subject to clause 4 all payments owed by the Client to AmagisTech become immediately due and the Client shall not be entitled to any refund of the Fees already paid. Termination of the Agreement or Order Form shall not affect any rights, remedies, obligations or liabilities of the Parties that have accrued up to the date of termination, including the right to claim damages in respect of any breach of the Agreement which existed at or before the Termination Date.

Those provisions of these ToB which are said or intended to survive the termination of an Agreement shall survive termination, including clauses 5, 6, 7, 8, 10 and 13.

4. Obligations of the Client

The Client is aware that (i) the only obligation of the Provider is to provide the Services, (ii) the delivery date indicated in the Order Forms are indicative and not mandatory, considering that Provider shall receive the Products from a third party.

The Client shall be responsible for the items below:

  • The Client must comply with these ToB and the Other Related Terms, as defined below, including payment of the Fees to the Provider.
  • The Client acknowledges and agrees and it will permit the Provider to disclose its data [either personal or technical, also referred as “Client Data”) to ICT Vendors in accordance with the relevant regulations and these ToB (including applicable confidentiality, data processing and security terms). The Client also acknowledges and agrees that the Provider may disclose Client Data to ICT Vendors as reasonably required by them so that they can provide technical support to Provider for Client’s support issues regarding the Products.
  • Client expressly acknowledges and agrees that it will be subject to the ICT Vendors terms and policy requirements other than those set forth or referenced in these ToB, including policies, licence agreements, system-access terms and conditions, that may be imposed by ICT Vendors on Client in connection with accessing or otherwise using the Product (collectively, hereinafter referred to as “Other Related Terms”). These Other Related Terms will be brought to the attention of the Client before or after the Engagement.
  • Client expressly acknowledges and agrees that the Provider shall not be liable for any breach of these ToB or Other Related Terms, if any damages, costs, or expenses incurred are consequences of actions or omissions of ICT Vendors discretion
  • The Client must maintain the confidentiality and security of its accounts and its End User Accounts and associated passwords. The Client agrees that ICT Vendors’ responsibilities do not extend to the internal management or administration of the Products for the Client or any End User.
  • The Client is responsible for providing the necessary notices, and obtaining and maintaining any consent, access, or authorisation required for allowing the Provider to access its IT assets (including the End Users) of the Client and its End Users to allow the Provider and ICT Vendors to perform their respective contractual obligations related to the Client. Any delay or direct and indirect consequences thereof in obtaining any consent, access or privilege not caused by the Provider shall be borne by the Client itself.
  • The Client shall, at its own expense, (i) before the Engagement, provide any and all documentation and information to carry out the checks required by the applicable regulations or these ToB, (ii) support and collaborate, if needed, to permit the Provider to carry out the technical due diligence, and (iii) after the Engagement, supply to the Provider any and all information and assistance required to execute the Order Form.

End Users and Security Codes. If the Products and the Services provided allow the Client to allow its directors, employees, trainees, partners, contractors the use of more than an account (“End Users”), the Client shall be responsible for all End Users created in its name. Responsibilities include, without limitation, identifying and authenticating users, preventing unauthorised access, and maintaining the confidentiality of usernames, passwords, and account information (collectively “Security Codes”). The Client agrees to notify the Provider immediately of any unauthorised use of the Products or loss or theft of the Security Codes.

Technical Support Services. The Provider might provide technical support services, if any, in relation to the resale of the Products and to the supply of the Products-related services to the Client, in accordance with these ToB and the Other Related Terms. For each Product the Provider will answer to specific requests of the Client with 8×5 SLA and first response within 5 business days. The. Each support package will name named Product Support (e.g. for SentinelOne Services it will be simply called SentinelOne Services Support) and it will be charged starting from 15% of the total fees payable for that Product.

Fees. The Client agrees to pay the remuneration as is set out in the Agreement (the “Remuneration”). Unless expressly stated otherwise therein, the Remuneration set out in the relevant Agreement is net of VAT and net of all the administrative costs which may be sustained by the Provider in performing the Services, including, but not limited to, reasonable out-of-pocket disbursement or expenses as set out below, any fees due to the relevant authority, and which shall be borne exclusively by the Client (the “Additional Costs”). In addition to the Remuneration and Additional Costs, the Provider may apply for certain complementary Services a “Technology Fee” equal to the 4% of the Remuneration. The Remuneration, the Technology Fees, and the Additional Costs are the fees due to the Provider for the Services (the “Fees”).

Billing and Payment Terms. The Provider will invoice the Client for the Fees in accordance with the Agreement. All payments are due in the currency described in the invoice. Payments due by Client to the Provider shall be made by bank transfer within thirty (30) calendar days from the invoice, unless otherwise indicated by the Provider in the Order Form or Invoice. In case of failure to pay the invoice within the aforementioned terms, the Provider shall send a reminder to Client with the relevant unpaid invoice (“Reminder”). If Client fails to pay the invoice within fifthteen (15) business days from the Reminder, the Provider may decide, at its own judgement, to suspend the provision of the Product until the payment of the relevant invoice is made. In case of delay in payment, the Client shall pay legal interests as defined in the governing law

Currency and Invoicing. Unless otherwise expressly agreed in an Order Form, all Fees are quoted and payable in Euro (EUR). In the event that an Order Form is executed in a currency other than Euro (the “Order Currency“), Amagis reserves the right to issue invoices according to one of the following methods:

  • Invoicing in EUR (Default): Amagis may issue invoices in Euro (EUR). The conversion from the Order Currency to Euro shall be calculated using the highest (maximum) daily reference exchange rate published by the European Central Bank (ECB) (available at https://www.ecb.europa.eu/) during the period equal in length to the Order Term immediately preceding the date of the invoice (e.g., if the Order Term is twelve months, the maximum rate within the last twelve months shall apply).; or
  • Invoicing in Order Currency or other foreign currency: Amagis may, upon mutual written agreement with the Customer, issue invoices in the original Order Currency or any other foreign currency (e.g., USD).

Italian SDI. It is agreed between the Parties that the invoices issued for relationship with Clients residing – or having its registered offices in Italy – might be managed electronically through the Italian branch of the Provider availing the “Sistema di Interscambio”. All the other Clients agree to accept to receive the invoices at an email address indicated to the Provider

5. Confidentiality and Non-Disclosure Obligations

Confidential Information. Confidential Information means all information disclosed (whether in oral, written, or other tangible or intangible form) by one Party (the “Disclosing Party”) to the other Party (the “ ) concerning or related to the execution of an Agreement/Order Form or the Disclosing Party that is marked as confidential or proprietary, or that the Receiving Party knows or reasonably should know is confidential information of the Disclosing Party given the facts
and circumstances surrounding the disclosure of the information by the Disclosing Party. Confidential Information includes, but is not limited to, these ToB and any Agreement, proprietary and/or non-public technical, business, commercial, financial and/or legal information, such as, without limitation, any and all Services information generally shared with the Client and as specifically related to the Client, Service Information gained by the Client through use of the Services, business plans, product information, pricing, financial plans, know how, the Client Data, strategies, and other similar information. The terms of the Order Form shall be considered confidential. The definition of Disclosing Party contains any company or the same Group of such Party

Obligations. Except as expressly authorised herein, the Receiving Party agrees to: (i) use the Confidential Information of the Disclosing Party only for the execution of any Agreement under these ToB; (ii) treat all Confidential Information of the Disclosing Party with at least the same degree of care used for the treat of its own Confidential Information; and (iii) disclose the Disclosing Party’s Confidential Information only to those employees, contractors, customers of the Receiving Party on a need to know basis (“Authorised Personnel”), provided that any Authorised Personnel is subject to confidentiality obligations at least as restrictive as those herein, and the Receiving Party shall remain liable for any non-compliance of such Authorised Personnel for breach of this Clause.

Exceptions. Confidential Information will not include information such as the following: (i) it is in or enters the public domain without breach of these ToB through no fault of the Receiving Party; (ii) the Receiving Party can reasonably demonstrate was in its possession prior to first receiving it from the Disclosing Party; (iii) the Receiving Party can demonstrate was developed by the Receiving Party independently, and without use of or reference to, the Confidential Information; or (iv) the Receiving Party receives from a third party without restriction on disclosure and without breach of such third party’s nondisclosure obligation. In addition, the Receiving Party may disclose Confidential Information that is required to disclose by law, or by a subpoena or order issued by a court of competent jurisdiction (each, an “Court Order”), and where such Court Order is received the Receiving Party shall: (a) give the Disclosing Party written notice of the Court Order within
twenty four (24) hours after receiving it; and (b) cooperate fully with the Disclosing Party before disclosure to provide the Disclosing Party with the opportunity to interpose any objections it may have to disclosure of the information required by the Court Order and seek a protective order or other appropriate relief. In the event of any dispute between the Parties as to whether specific information is within one or more of the exceptions set forth in this Clause 8.2, Receiving Party will
bear the burden of proof, by clear and convincing evidence, that such information is within the claimed exception(s).

6. Intellectual property

Nothing in these ToB will function to transfer any of either party’s Intellectual Property to the other party, and each party will retain exclusive interest in and ownership of its Intellectual Property developed before an Agreement/Order Form or developed outside their scope. However, for the avoidance of any doubt, (i) the Client Data shall remain the property of the Client and (ii) the Intellectual Property used by the Provider for the Services and the execution of any Order Form/Agreement under these ToB shall remain the property of the Provider or its licensors, and (iii) Provider or Provider’s licensors’ Intellectual Property are not in any case to be considered as transferred or assigned to the Client, neither during an Agreement nor after its termination.

7. Representations and Warranties

Each Party represents and warrants the following:

  • The Provider, the ICT Vendors and the Client are independent contractors with respect to the resale of the Product and they each act only on their own name and on their own behalf;
  • it is validly existing and in good standing under the laws of the place of its establishment or incorporation;
  • it has full corporate power and authority to execute, deliver and perform its obligations under the Order Form and these ToB;
  • the person signing the Order Form on its behalf has been duly authorised and empowered to act to do so;
  • any Agreement is valid, binding and enforceable against it in accordance with these ToB;
  • it will perform its obligations under these ToB in accordance with applicable laws or regulations;
  • no other or implied conditions, representations, warranties, or other terms apply to any Products, Services or to any other goods or services supplied by ICT Vendors or the Provider unless expressly stated in these ToB or any related Agreement or the Other Related Terms;
  • the Provider does not warrant that operations for the resale of the Product or the performance of Services will be error-free or uninterrupted.

Use Restrictions. Client will not, and will not allow any third parties under its control to access or use the services for (i) high risk activities, (ii) in a manner intended to avoid incurring Fees; (iii) for material or activities that are subject to the international traffic in arms regulations maintained by the Department of US State, (iv) in manner that breaches or causes the breaches of the applicable Export Laws, (v) on behalf of or for the benefit of entity or person who is legally prohibited from using the Product, (vi) transmit, store, or process health information subject to US HIPAA Regulations, (vii) use the PRoduct to operate or enable any telecommunications service, or place or receive calls from any public switched telephone network, or (viii) provide hosting, outsourced or managed Product to unaffiliated third parties, expect as part of a service that provides value disting from the Product.

The Client represents and warrants that it (a) will not use its access to Products to attempt to or build a competitive product or service, or copy any features or functions of the Products; and; (b) will not copy, modify, create a derivative work of, reverse engineer, decompile, translate, disassemble, or otherwise attempt to extract any of the source code of the Products.

Except for the representations and warranties set forth in these ToB, the Provider disclaims and excludes any other representation and warranties (in any form, even if implied or allegedly arising from the legal systems) with respect to the Products and the Services.

The representations and warranties herein contained are made by the Provider as independent contractor and not on behalf of ICT Vendors.

8. Liability and Indemnity

Indemnity. The Client, at its sole expense, will indemnify the Provider and its directors, officers, employees and agents or other authorised representatives (“Client Indemnitees”) from and against all third-party claims, suits, actions, or proceedings (each a “Claim”), and be liable for any related damages, payments, deficiencies, fines, judgments, settlements, liabilities, losses, costs and expenses (including, but not limited to, reasonable attorneys’ fees, costs, penalties, interest and disbursements) arising out of or related to: (a) the Client Assets (meaning any property belonging to the Client, including but not limited to monies, infrastructures, and investments), the Client Data, or any third-party software used by the Client or its End Users; (b) willful misconduct, negligent act or omission by the Client; (c) breach of the Client warranties set out in these ToB; (d) any use of the Products by the Client and the End Users in violation of these ToB or the Agreement; (e) any use of Products by the Client in breach of law; (f) any dispute between Client and any third-party.

Liabilities. The Client acknowledges and agrees that the Provider will not incur in any liability for: (a) discontinue the sale of the Products or relevant Services; or (b) any change of the features of the Products

Damages arising from the Services. Without prejudice of this Clause, the Client assumes all risk as to the implementation, the results and performance of the Services related to consequences – including but not limited – to inadequate configurations, devices, IT network, internet connection, version upgrade of any system or software of the Client and in any case only for fraud or unless otherwise provided by the law.

Liability Cap. Without prejudice to the previous clause, in any case whatsoever, the total aggregate liability of Provider for the Services shall be limited to the net costs for the specific Services provided.

To the extent permitted by applicable law the Client disclaim Google’s liability for any damages (whether direct, indirect, incidental, consequential, or otherwise) arising from Amagis’ resale and/or supply of the Services and liability for all warranties with respect to the Product, including, warranties of merchantability, satisfactory quality, fitness for a particular purpose, and non-infringement.

9. Amendments and Waivers

Unilateral amendments. These ToB shall remain into force until the date in which such other terms of business as amended by the Provider at its own sole discretion from time to time are published on the website of AmagisTech (the “Amended ToB”). Where the Amended ToB are published during the course of the provision of the Services, AmagisTech shall use its reasonable efforts to draw all such amendments to the Client’s attention as soon as practicable. Nonetheless, publication on the website of AmagisTech at http://www.amagistech.com of the Amended ToB shall be deemed to constitute sufficient notice to the Client for of the amendment and reissuance made on the Amended ToB and, therefore, the Client shall be bound by the Amended ToB starting from the day after their publication on the website of AmagisTech or notification via email.

Waivers. Unless expressly stated otherwise, all rights and remedies hereunder are cumulative and are not exclusive of any other rights or remedies provided hereunder or by law. The waiver of one breach or default or any delay in exercising any rights will not constitute a waiver of any subsequent breach or default.

10. Data Protection

Data processing. Acting as autonomous data controller, each Party shall be responsible to comply with the relevant rules applicable in terms of DPR bearing any damages or liabilities that shall arise from the breach of the DPR and indemnify the other Party from any damages, costs or expenses suffered as a result of a breach of this clause. The Client must have data protection policies and practices in place at the time of the placement of the Order Form, and must maintain them, at a minimum, in compliance with all applicable DPR and agrees that its activities under these ToB, including without limitation, any collection or processing of special categories of data (including data related to crimes and criminal offences) will be at all times be conducted in accordance with applicable DPR. The Client must have obtained all necessary consents to provide any personal data it may provide to AmagisTech for the purposes outlined in, and contemplated by, this Agreement.

Relationship Client-Provider. In the case of Controller-Processor relationship between the Client and the Provider, with reference to the processing of Client Data, the Client, acting as controller, will appoint the Provider as data processor with a separate Data Processing Addendum.

11. Notices and Communications

Notices. All notices and communications (“Notice”) relating to an Order Form shall be considered valid only if carried out in pursuant to this clause. All notices shall be written in English, unless for the Clients that have their registered office in Italy, San Marino or the Vatican which can use Italian for any communication.

Ways to notify. A notice given to a party under or in connection with any Agreement shall be in writing and shall be delivered (i) by registered letter to the registered address of the recipient Party or (ii) notified by a Party to the email address indicated below:

  • For PROVIDER: legals@amagistech.com;
  • For CLIENT: any email address indicated by the Client and/or any official registered email address

Delivery. A notice sent according to this Clause: (A) case (i), is deemed to have been received at the time indicated on the return receipt and (B) case (ii), it shall be deemed to have been received on the first business day after the date on which the email is sent.

12. Governing Law and Jurisdiction

Section applicable to Clients in Malta or established in any state other than the Republic of Italy.

Governing Law. These ToB and any dispute or claim arising out of or relating to these ToB or any related Agreement shall be governed and construed in accordance with the laws and regulations of Malta with express exclusion of the conflict of laws principles.

Venue. Any dispute, controversy or claim arising out of or relating to these ToB or related Agreement, or the breach, termination or invalidity thereof, shall be settled by the Courts of Malta.

Section applicable to Clients established in Italy

Governing Law. These ToB and any dispute or claim arising out of or relating to these ToB or related Agreement shall be governed and construed in accordance with the laws and regulations of Italy with express exclusion of the conflict of laws principles

Venue. All disputes – including those of non contractual nature – arising out of, related or connected to these ToB or related Agreement shall be settled by the exclusive competence of the Court of Milan.

13. Miscellaneous

Non circumvention. Both Parties hereby undertake not to, either directly or indirectly, circumvent these ToB by the use of any form of structure or the interposition of another person, legal or natural, in any transaction. In the event that a Party circumvents these ToB and is in breach of any of the provisions of these ToB, whether directly or indirectly, such Party shall be liable for all expenses, costs and disbursements, including but not limited to, all legal costs and expenses, suffered by the non-breaching Party, including those costs and expenses incurred to enforce such provision.

Outsourcing. The Provider may outsource entirely or partially the Services to third parties

Force Majeure. With the express exclusion of the Client’s obligation of paying the Fees for the Products or Services, neither Party will be liable for failure or delay in its performance of an Agreement to the extent caused by circumstances beyond its reasonable control.

Assignment. Neither the Agreements, nor any right or duty under these ToB may be transferred, assigned or delegated by a Party, by operation of law or otherwise, without the prior written consent of the other Party. Any attempted transfer, assignment or delegation without such consent will be void and without effect. This section shall not apply to a successor of a all of a Party business or assets, whether by merger, sale of assets, sale of stock, sale of control, reorganisation or otherwise, with written notice to the other Party, provided that such successor in interest agrees in writing to assume all of the assigning Party’s obligations under these ToB and Agreements. Subject to the foregoing, any existing Agreement will be binding upon and will insure to the benefit of the Parties and their respective representatives, heirs, administrators, successors and permitted assigns.

Severability. Any part or provision of these ToB which is entirely or partially prohibited or which is held to be void or unenforceable shall be ineffective to the extent of such prohibition or unenforceability without invalidating the remaining provisions hereof. If the invalidity of any part or provision – either entire or partial – of these ToB shall deprive any party of the economic benefit intended to be conferred by these ToB, the parties shall negotiate, in good-faith, to develop a structure the economic effect of which is as close as possible to the economic effect of these ToB without regard to such invalidity

Rights of Third Parties. Except as expressly stated otherwise, nothing in these ToB or in the Order Forms shall create or confer any rights or other benefits in favour of any person other than the parties to these ToB or any Agreement.

Publicity, Marketing. The Client agrees that the Provider may reference and use Client’s name and trademarks in the Provider marketing and promotional materials, including, but not limited to its website, solely for purposes of identifying the Client as a client of the Provider. Otherwise, and except as expressly permitted under these ToB, neither Party may use the trade names, trademarks, service marks, or logos of the other Party without the express written consent of the other Party. The Provider expressly retains all other rights not expressly waived to under these ToB, including, without limitations, the right to market and sell its Services.

Non-solicitation. In order to protect the legitimate business interests of the Provider, the Client shall expressly refrain from directly or indirectly attempting to employ or engage or solicit or entice away, or employing or engaging or soliciting or entice away, from the employment or service of the AmagisTech the services of any employee of Amagis, even if the initial approach is made by the employee. This obligation will survive a 24-month period after the termination of the last existing Agreement.

Counterparts. Each Order Form/Agreement may be executed in one or more counterparts all of which, taken together, shall be deemed to constitute one and the same instrument. In case the Parties opt for digital signatures, including DocuSign, the original is the copy digitally signed by both Parties.

14. DORA Compliance

This section is exclusively applicable in the event the Client is subject to the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554 – ‘DORA’).

The Client acknowledge to have read and understood, and – as applicable – agree that:

  • The service level agreement of the Services are indicated in the Agreement. The Client decides which Services to use, how to use them and for what purpose. Therefore, the Client decides the scope of the arrangement.
  • Subcontractors: Amagis might engage with subcontractors for the provision of the Services and in such cases Amagis will (i) provide information about the subcontractors and (ii) provide advance notice of changes to subcontractors.
  • Locations of Services: Amagis provides its Services from Italy or Malta availing of the following for the provision of the Services:
  • Authenticity, integrity, recovery and confidentiality: Information on our security measures are available:
  • The Client agrees that the Services and the security measures implemented and maintained by Amagis provide a level of security appropriate to the risk to Client Data. If the Client believes that the Services and/or security measures implemented no longer provide an appropriate level of security for Client Data, the Client shall immediately notify Amagis.
  • Incident Assistance: Without prejudice to Clause 8 Amagis will provide assistance to the Client at additional charges when an ICT incident that is related to the Services occurs. Amagis’ notification of or response to any ICT-related incident under this Section will not be construed as an acknowledgement by Amagis of any fault or liability with respect to the ICT-related incident.
  • Termination: Please refer to Clause 3. In addition, the Client can terminate for convenience with a month advance notice if necessary to comply with law, including the grounds in DORA Article 28(7); and if directed by a supervisory authority.
  • Amagis will cooperate with the competent authorities and the resolution authorities of the Client, including persons appointed by them.
  • Training: Where requested by Client, Amagis (through its officers or relevant employees, at the Provider’s discretion) shall participate in Client’s security awareness programs and digital operational resilience training. Client’s training shall be scheduled at Client’s reasonable discretion, subject to proper notification in writing of Amagis. In case Amagis incurs costs for participating in such training, such reasonable costs may be charged by Amagis to the Client.

Critical and Important Functions: The Client shall inform Amagis if the Services are supporting its critical or important functions. With respect to the Services that support a critical and important functions, Amagis agrees to:

  • notify within two weeks the Client in the event of development of material impact that can affect Amagis ability to provide Services;
  • Where the Client is required to perform a TLPT (threat-led penetration testing, under DORA Art. 3(17).) and the TLPT’s precise scope, as validated by the Client’s applicable national competent authority, includes the Services or the Products, Amagis will, using commercially reasonable efforts and at additional costs, participate in the TLPT as set forth below, as and to the extent required under DORA Art. 26 and 27; provided, that: (a) the Client shall furnish Amagis with a copy, at least 60 days in advance of any requested participation or cooperation, of the identifications and assessments called for under DORA Art. 26(2); and (b) prior to each instance of any requested participation or cooperation, the Client shall have demonstrated to Amagis’ satisfaction that the Client (i) has taken, as required by DORA Art. 26(3), all necessary measures and safeguards in connection with any participation by Amagis; and (ii) shall retain at all times full responsibility for ensuring compliance with DORA;
  • use reasonable commercial efforts to implement and test business contingency plans and to have in place ICT security measures, tools and policies that provide an appropriate level of security, in accordance with the Client’s regulatory framework PROVIDED THAT the Client must promptly inform Amagis of such request and the Client agrees that the Services and the security measures implemented and maintained by Amagis provide a level of security appropriate to the risk to Client Data and the Client’s regulatory framework;
  • to the extent required by DORA to enable the Client to monitor the Services and to ensure compliance with DORA, Amagis provides (1) unrestricted access to the relevant information at the relevant business premise, (2) copies of relevant documentation on-site if critical to the operations of the Services. Copies of documentation taken in accordance with this section may not be taken or transmitted off-site unless: (a) the Client has, and has demonstrated to Amagis’ reasonable satisfaction, a necessity under applicable law to take such copies; (b) the Client has entered into additional undertakings of confidentiality in connection with such documentation (and its content); and (c) the Client has had a prior opportunity to review and redact copies of such documentation for confidential, personal or otherwise commercially-sensitive information.
  • In the event of audit and onsite inspection:
    • The Client shall provide Amagis information about the scope and purpose of the onsite inspection or audit and other relevant information, including a complete description of the critical or important functions supported by the use of the Services, in order for Amagis to prepare for the onsite inspection or audit and a minimum of sixty (60) calendar days’ notice;
    • The Client shall pay Amagis a reimbursement fee of 125EUR/hr + VAT unless otherwise agreed in writing;
    • The persons conducting the audit shall observe all of the Amagis’ security policies, procedures and measures in place at the concerned premises at the time of the inspection or audit (such as those relating to health and safety, those relating to access to and use of Amagis’ facilities, those relating to confidentiality, etc.);
    • Shall take place in the presence of staff members, advisors or contractors designated by Amagis for this purpose;
    • Shall take place during business hours of Amagis, in the shortest period of time possible, to be defined by the Parties in a proportional manner, taking into account the complexity of the Services, the risks attendant to the critical or important functions in connection with which the Client uses such services, and the potential impact of the Services on the continuity of the Client’s activities;
    • Any third party appointed by the Client to exercise the Client’s monitoring right shall possess appropriate skills and knowledge to effectively perform the contracted Services. In addition, Amagis shall have the right to object to any third-party auditor if the third party is manifestly unsuitable or is a competitor of Amagis. In the event of any such objection by Amagis, the Client shall select a different third-party auditor (subject to the same qualification and objection terms herein) or perform the audit itself;
    • Audit Confidentiality. The results of any performance monitoring under this Section shall be deemed the Confidential Information of Amagis and shall not be used for any purpose except to verify the compliance with the obligations under this T&C and except that such results may be disclosed to the authorities to the extent required by law. The Client shall ensure necessary confidentiality protections are in place with any designated third-party auditor;
    • The Client has the right to request alternative assurance levels if rights of the Client are materially affected by the current levels;
  • cooperate during the onsite inspections and audits performed by any competent authorities;
  • shall use reasonable commercial efforts to assist the Client following the termination of the ToB and in the transition of services relating to the Services and shall provide the Services until the completion of such transition period.

Annex 1 – Data Processing Addendum

The Client shall be referred as “Controller” and the Provider as “Processor” or each party as “Party” and collectively referred to as the “Parties”.

1. Interpretation

Interpretation. All the terms used in this DPA shall have the meaning ascribed in the GDPR and in the ToB.

2. Duration

This DPA shall apply to any existing Agreement between the Controller and Processor.

3. Processor Duties

The Processor warrants and undertakes in respect of all Personal Data that it processes on behalf of the Controller that at all times:

  • it shall only process such personal data on written instructions by the Controller, unless the Processor is obliged to process the personal data according to the DPR. If so, the Processor shall notify the Controller of such legal obligation before commencing the processing and shall only process the personal data once the Processor and Controller have agreed in each case that such processing is in compliance with the DPR;
  • it shall process Personal Data only in carrying out the Services. In case the processing required by the Controller is outside of the scope of this DPA, the Parties shall agree in writing how to manage such processing and under which terms and conditions, provided that a legal basis for processing exists;
  • upon termination of this DPA for any cause, and upon written request of the Controller, all Personal Data shall be destroyed or returned to the Controller, unless otherwise prohibited by any applicable law;
  • it shall participate in discussions with the Controller and the data protection authority and implement any recommendation from the Controller or the data protection authority regarding the processing of personal data;
  • it shall promptly inform the Controller if: (a) any data protection authority contacts the Processor regarding the Services or the processing activities covered by this DPA; (b) there is a request for the transfer or disclosure of Personal Data to the data protection authority or any other public authority, unless notification to the Controller is prohibited by law; (c) there is a request for access, correction, blocking or deletion of Personal Data directly from the data subject or from a third party.
  • it shall cooperate with – and promptly assist – the Controller, if there is a request from a data subject to exercise his/her rights related to the personal data processed by the Processor according to this DPA.
  • If the Processor deems an instruction to be in breach of DPR, the Processor shall promptly inform the Controller. Should the Processor and the Controller be unable to come to an agreement on the duties as described above related to processing of personal data, the Parties shall jointly choose and appoint an outside counsel to opine on the matter. Such counsel’s opinion shall be final. The payment of such outside counsel shall be split between the Parties.

If the Processor deems an instruction to be in breach of DPR, the Processor shall promptly inform the Controller. Should the Processor and the Controller be unable to come to an agreement on the duties as described above related to processing of personal data, the Parties shall jointly choose and appoint an outside counsel to opine on the matter. Such counsel’s opinion shall be final. The payment of such outside counsel shall be split between the Parties.

4. Security Measures

Security measures. The Processor shall undertake to implement and maintain appropriate and sufficient technical and organisational measures to protect such personal data against unauthorised, accidental or unlawful destruction or loss, damage, alteration, unauthorised disclosure or access to data stored or otherwise processed, to ensure compliance with the DPR.

Special categories of data or data relating to criminal convictions and offences (collectively “Special Data”). The Client shall not provide any Special Data to the Provider. However, in case the processing of Special Data is necessary to execute an Agreement, the Controller (i) must previously inform the Processor if it has the intention of processing Special Data, (ii) shall await from the Processor or Google authorisation to process accordingly, and (iii) shall be the only subject liable to evaluate whether the technical and organisational measures provided by the Products are sufficient to protect the Special Data.

5. Subprocessors

The Processor may subcontract its processing of personal data under this DPA to any other person or entity (the “Sub-Processor”) at the following conditions: (i) appointing the Sub-Processor in writing in accordance with art. 28 of GDPR, (ii) all the costs and expenses related to the Sub-Processor appointment is borne by the Processor, (iii) complying with the cross border data transfer regulations, in the case of a Sub-Processor established outside of the European Economic Area.

6. Data Breaches

Data breach notification. The Processor shall notify the Controller not later than seventy two (72) hours after having become aware of any data breach related to the data processed in accordance with this DPA. The notification shall include any necessary documentation or information enabling the Controller, where necessary, to notify the breach to the competent supervisory authority.

Cooperation. The Processor shall cooperate with the Controller and take all reasonable commercial steps, as directed by the Controller, to assist in the investigation, mitigation and remediation of each such personaI data breach.

7. Cross Border Transfer of Data

The Processor in case of transfer of Personal Data to countries outside the EEA shall comply with paragraphs 44 and subsequent of the GDPR. In case of international data transfers, the Standard Contractual Clauses shall apply for the applicable modules and the relevant data supervisory authority would be the Italian Data Protection Supervisory Authority for Italian Client and the Maltese IDCP for all the other Clients.

8. Personal Data Details

Personal data processed. Personal Data processed: personal information, email address, IP address.