1. Terms of Subscription
Vault reserves the right to update and change the terms of the subscription from time to time. The Subscriber’s will be provided with at least 30 (thirty) days’ notice by email to the Administrator of the company group of any such updates or changes. In the event of material changes to the terms of service / subscription, the Subscriber’s prior written agreement shall be obtained no less than 30 (thirty) days prior to such changes taking effect.
1.1 Support:
Support request and change requests should be logged into the The subscriber group on Basecamp with the following people selected in the message chain: –

Simon Hammerton
Tel: 083 309-8698
email:shammerton@thevault.exchange

James Hammerton
Tel: 073 174-6909
email:jhammerton@thevault.exchange

Vivek Sharma
email: vsharma@thevault.exchange

Support hours:
08h00 – 17h00 Mon-Fri
In after-hours emergencies the support staff will be available via cellphone.

Downtime:
Any errors resulting in unavailability of the service for whatever reason will be attended to immediately on receipt of notification

Admin support:
Any requests by administrators for assistance will be addressed within 15 minutes of such request.

2. Account Terms
You are responsible for maintaining the security of the account and password on its end.
Each set of administrator logins may only be used by one person. Vault will provide The subscriber with separate logins for as many administrators as requested.
The subscriber is responsible for all content posted and its activity that occurs within its account.
The Service may not be used for any illegal purpose or to violate any laws in the jurisdiction (including but not limited to copyright laws) of the subscriber.

3. Cancellation
The subscriber is solely responsible for canceling the account via an email message or other written notification to jhammerton@thevault.exchange or by notifying The subscriber’s main contact at Vault during that time period.
After thirty (30) days of such notice, files uploaded to the subscriber’s Reports tab in the subscriber’s group will be permanently deleted from all backups and logs and are not recoverable by any means, including data recovery software. No copies are made or kept. It is the subscriber’s responsibility to download all content it may require within the thirty (30) day period.
We will also immediately remove any user profiles, on the same basis as above, that The subscriber might request, on receipt of such request via email. However, users have the right, and can, join any group on Vault of their choosing.
Please note that all company groups on Vault can be joined by any registered user (SENS alerts are available to them regardless of whether the company is a “corporate” subscriber), and subscribers are generally members of multiple company groups.
The Vault has the right to suspend or terminate the account and refuse any and all current or future use of the Service, or remove a group member from the system in the instance of a breach proven by an objective third party of the terms of this Agreement. The Vault will however allow the Subscriber to retrieve or provide the company with any of its files or data on the system.
Notice of such suspension or termination will be provided by email to the Administrator who will be provided 5 business days to remedy the breach.

4. Modifications to the Service and Prices
Either party reserves the right at any time and from time to time to upgrade, downgrade or discontinue, temporarily or permanently, any part of the Service. 30 (thirty) days’ notice of such changes will be provided by email or other written notification to the other party.
Any new features that augment or enhance Vault, including the release of new tools and resources, shall be subject to these terms. Continued use of the Vault after any such changes shall constitute The subscriber’s consent to such changes. The addition of new features will be communicated to the Subscriber before being implemented.
An annual calendar year increase is stipulated in this agreement however Vault reserves the right to change prices of all services subject to 30 (thirty) days’ notice, in the eventuality of significant cost increases, equal to or exceeding 10% of the total cost, from third parties, that are beyond our control.
This is applicable to the following:

• Cost of bandwidth and data
• Hosting
• Data feeds

Such notice will be provided by email or other written notification to the administrator of the The subscriber group on Vault. Details will be provided of the significant increases from third parties. The Vault shall not be liable to The subscriber or to any third party for any modification, price change, suspension or discontinuance of the services. The subscriber shall be entitled to terminate this agreement on 5 days’ notice in the event that it does not agree with the extraordinary price increase outside of the annual price increase.

5. Copyright and Content Ownership
All content posted on Vault must comply with copyright law. We claim no intellectual property rights over the material you provide to Vault. All materials uploaded remain the property of The subscriber
The Vault does not pre-screen content, but reserves the right (but not the obligation) in their sole discretion to reasonably refuse or remove any content which is in violation with the terms of this agreement and we shall notify you as such. The subscriber may not duplicate, copy, or reuse any portion of the HTML, CSS, JavaScript, or visual design elements without express written permission from Vault.
The subscriber will not use any manual or automated software, devices, or other processes to “screen scrape” any web pages contained in the Vault website.

6. Confidentiality
“confidential information” means any information of whatsoever nature which has been or may be obtained by one Party to this Agreement (“the Receiving Party”), from the other Party to this Agreement (“the Disclosing Party”), whether in writing or in electronic form or any other form, whether marked or identified as being proprietary or not or pursuant to discussions between the Parties, or which can be obtained by examination, testing, visual inspection or analysis, including without limitation, Personal Information, scientific, business or financial data, know-how, formulae, processes, designs, sketches, photographs, plans, drawings, specifications, sample reports, models, customer lists, price lists, studies, findings, computer software, inventions or ideas, analyses, concepts, compilations, studies and other material prepared by or in possession or control of a Party which contain or otherwise reflect or are generated from any such information as is specified in this definition.
The Parties acknowledge that each Party (“the Disclosing Party”) develops, owns, holds and possesses confidential information which is sensitive in nature and which information, when disclosed, may be damaging to the Disclosing Party.
The Disclosing Party has made and will from time to time, in carrying out its obligations in terms of this Agreement, make the confidential information available to the other Party (“the Receiving Party”) to enable the Receiving Party to carry out its obligations in terms of this Agreement.
The Receiving Party acknowledges that although the Parties have given an indication of the type of information which will be confidential information for the purposes of this Agreement, this indication does not limit the definition of confidential information and the Parties’ intention is that all data and information relating to the Disclosing Party’s businesses which the Receiving Party receives or may receive, acquires or may acquire, is included in Confidential information for the purposes of this Agreement.
The Receiving Party shall not, in any manner whatsoever, disclose all or part of the confidential Information to any entity or person which is not a party to this Agreement without the prior written consent of the Disclosing Party, that consent will be in the sole discretion of the Disclosing Party.
Unless otherwise authorised thereto in writing, the Receiving Party shall use the confidential information only for the purposes of carrying its obligations in terms of this Agreement.
The Receiving Party may disclose the confidential information to its employees, shareholders, officers, directors, agents, advisors and sub-contractors (collectively “Representatives”) only to the extent required in terms of this Agreement and then only to the extent that they need to know. The Receiving Party undertakes, prior to disclosing any part of the confidential information to any of its Representatives, to inform such Representatives of the confidential nature of the confidential information and to procure their written agreement to act in accordance with the terms and conditions of this Confidentiality clause.
The Receiving Party shall have and shall procure that its Representatives to whom the confidential information is disclosed shall have, the necessary technical and organisational security safeguards to prevent the unauthorised or inadvertent disclosure of the confidential information.
The Receiving Party shall procure that all of the Representatives to whom disclosure is made in terms of this Confidentiality Clause will act in accordance with the terms hereof as if each of them were a party to this Agreement and the Receiving Party shall be responsible for any breach of any of the terms of this clause by any of the Representatives.
The Receiving Party shall, when requested to do so by the Disclosing Party, promptly destroy all originals and copies of all information, documents, disks and records of whatever nature relating to the confidential information, and will destroy all memoranda, notes, and other materials prepared by the Receiving Party or the Receiving Party’s officers, employees, agents or advisors based on the confidential information, which information shall, at all times, remain the sole and absolute property of the Disclosing Party.
The Receiving Party acknowledges that failure to comply with any provision of this clause shall constitute breach of this Agreement, which shall entitle the Disclosing Party to take any action it deems necessary in the circumstances and to pursue any remedy that may be available to it at law, including applying for an interdict to protect its rights in terms of this clause.
The confidentiality obligations contained in this clause will not apply to any of the confidential information which:
is or becomes part of the public domain through no fault of the Receiving Party;
properly becomes available to the Receiving Party from a third party source having a lawful right to disclose same to the Receiving Party as can be demonstrated by competent written evidence by the Receiving Party;
was known to the Receiving Party (and not subject to any obligations on the Receiving Party to keep it confidential) prior to disclosure thereof to it as can be demonstrated by competent written evidence in the possession of the Receiving Party; or is required by law to be disclosed.
If the Receiving Party becomes compelled in terms of any law or regulation, which law or regulation it is required to comply with, to disclose any part of the confidential information, the Receiving Party shall promptly notify the Disclosing Party in writing of such law or regulation and of the actions which the Receiving Party proposes to take in response. In such event, Receiving Party shall, –
prior to any such disclosure, to the extent legally permitted, give the Disclosing Party reasonable prior notice of such required disclosure; and
at the request and cost of the Disclosing Party, to the extent legally permitted, provide the Disclosing Party with reasonable assistance in contesting the required disclosure; and
to the maximum extent possible in the circumstances, keep the confidential information confidential.
The Receiving Party agrees that, due to the nature of the confidential information, in the event of any breach by the Receiving Party of this Agreement, damages may not be an appropriate remedy and that the Disclosing Party shall be entitled to apply for an interdict to protect its rights in terms of this clause.
The provisions of this clause shall endure until 5 (five) years following the date of last disclosure of confidential information by the Disclosing Party to the Receiving Party, notwithstanding the date of expiry or termination of this Agreement.

6.1 Roles of the parties under Data Protection Law
Depending on the particular activity, the Vault acts as both a Processor and a Controller, as defined in European Union (EU) General Data Protection Regulation (Regulation (EU) 2016/679).
We act as the Controller of The subscriber’s documents, notes and subscribers data when you sign-up to use our Services. We collect and store this data for specific purposes as per The subscriber Group’s modules.
We act as the Processor and you are the Controller of the data that we process on The subscriber’s behalf when we provide Services to you in terms of the Agreement. You are solely responsible for determining the purpose for which, and the manner in which client-controlled Personal Data is processed.

6.2 Our obligations as The subscriber’s Processor
We warrant that at all times during the term of our Agreement, we will comply with all applicable requirements of the Protection of Personal Information Act (POPIA), also known as the POPI Act, of South Africa’s Data Protection Law , aimed at safeguarding individuals’ privacy by regulating how their personal information is processed by both public and private bodies when processing Personal Data. If you become aware that we are not complying with the Data Protection Law (POPIA), then you must give us written notice, and 7 calendar days to comply.
We will not access or use The subscriber’s data, except as necessary to provide the Services (which shall be the purpose for the application of Data Protection Law) to you under our Agreement.
In respect of the Personal Data that we process on the subscriber’s behalf, we will act in accordance with the Data Protection Laws, our Agreement, and on The subscriber’s written instructions that we may receive from time to time.
We will not disclose Personal Data to any of our employees, directors, agents, contractors or affiliates, or any third party, except as necessary to:
provide the Services to you, comply with applicable laws, or with The subscriber’s prior written consent.
We will, and will ensure any of our third party providers, implement and maintain appropriate technical and organisational measures:
to protect the security and confidentiality of Personal Data that we process in providing the Services;
to protect Personal Data at all times against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure, access, or processing; and
as required under the relevant Data Protection Laws.

6.3 Roles of the parties under Data Protection Law
We will cooperate with you to the extent that is reasonably necessary to enable you to adequately discharge The subscriber’s responsibility as a Controller. We will cooperate and provide you with such reasonable assistance as you require to prepare data protection impact assessments to the extent required by Data Protection Laws.
Where necessary, we will give you reasonable access to audit any relevant records or materials we hold regarding the data that we process on The subscriber’s behalf that are necessary to demonstrate our compliance with our obligations under this clause.
You can edit, delete or remove any data that has been uploaded to The subscriber’s Vault group at The subscriber’s own discretion.

7. Our personnel
We will provide training as necessary from time to time to our personnel to ensure that our personnel comply with Data Protection Laws.
Our personnel are bound by confidentiality obligations in respect of access, use or processing of Personal Data.

8. Data privacy
The subscriber ensures that:
The database subscribers, as supplied to Vault for uploading, have given the subscriber positive permission to send email alerts to them.
Positive permission is understood to be a request by the subscriber via personal interaction, telephone call, email, website form or social media channel.
Any new subscribers added to the subscriber group, by the subscriber group administrator, at any time, have given the subscriber positive permission to send them email alerts.
The subscriber group users’ profile and profile details are not visible to any other Vault alerts subscribers.
The subscriber’s alerts subscribers can join any other company groups on Vault. In terms of the Vault’s privacy statement they are made aware that, by joining another Vault company group, their profile details can be viewed by the relevant Vault group administrators of the groups they join, and that group administrators can edit these profile details in the interests of accurate communications.
Vault will never sell the subscriber’s data, or personal information of the alerts subscribers to third parties and will not distribute this information to any third party whether for consideration or otherwise.
Data is transmitted using the secure HTTPS protocol.
The Vault Privacy policy updated and available on registration and in the footer of the website.
Either party warrants that the alerts subscriber database as supplied to Vault for uploading to the Vault group, and any subsequent alert subscriber uploads undertaken by the subscriber, will not:

• breach the provisions of any law, statute or regulation;
• infringe the Intellectual Property Rights or other legal rights of any person; or
• give rise to any cause of action against Vault
• conflict with the spirit of POPIA.

Vault complies with all relevant Data Protection Laws that apply to it, including all the requirements of POPIA. Vault complies with the POPIA openness condition; alerts subscribers are told exactly what information Vault is collecting, the reasons for collection, the name and address of the responsible party, the right of the data subject to correct their data and object to processing.
SSL is used, passwords are encrypted and good password reset mechanisms and other security measures are in place.
Company group unsubscribe and Vault unsubscribe options listed in every email issued. Also available in Privacy Policy and site footer.
New users asked to confirm, at the time of registration, that they have read and accepted the site’s Privacy Policy. This also includes instructions on how to unsubscribe.
Company group administrators are asked to confirm that they have the subscriber’s permission to add them to their group. For existing Vault subscribers they will need to have the subscriber’s email address to add them to their group. Company group administrators can update and expand profile details in the interests of accurate communications with the subscriber. These aspects are addressed in the Privacy Policy available at https://thevault.exchange/privacy-policy/ that subscribers agree to.
Database supplied must have been emailed by the client informing the database members that the client will be using the Vault platform. (Vault will assist with this process.) The email will contain a link and reference to the Vault’s Privacy Policy with the message that this policy will apply when they are uploaded to the company group.
Vault subscribers can update, edit and delete their profile details at any time. They can leave all, or some, of the company groups they have been joined to. They can request to be completely removed from the database, without having to login.
Details relating to the above appear in every alert email, in the Privacy Statement, and in the footer links of the Vault website.
Only group administrators as created by the client have access to the group members profiles, and have edit, add member and download rights. These rights can be restricted to a single group administrator. Strong passwords are suggested and should be maintained by the client.
The Vault database is monitored on a weekly basis. Subscribers who are not members of any company group are removed from the database as are users who are marked as “sploggers” (linking to a blog site set up for the sole purpose of increasing page ranking in Google), if any.
All automatic email replies to email alerts sent from groups are copied to the Vault site administrator and monitored as necessary.
Only three members of the Vault team have password protected access to the live database; CEO, deputy CEO and lead developer.
All database access activity and usage patterns are monitored in real time to detect data leakage, unauthorized SQL transactions, and protocol and system attacks, by installed security software. Emails alerts are issued to the site admin for each instance of an attack and further steps are taken to block rogue IP addresses and emails.
Email alerts are issued to the site admin for every subscriber login and every admin login, and these are monitored for any suspicious activity.
All software, including security, is updated to the latest version.
Users’ passwords and logins are protected via the use of WordPress Security Keys, a set of random variables that improve encryption of information stored in the user’s cookies.
There are a total of four security keys: AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY
These are changed on a monthly basis.
User and admin logins are protected by Google captcha that require a unique key to implement. Machine generated account creation is blocked by a hidden “Honeypot” and a numerical sum captcha.
All data and processing of data takes place within South Africa

9.POPI
In terms of POPI, the service provider needs to take appropriate reasonable technical and organisational measures to prevent-
The loss of, damage to or unauthorised destruction of personal information; and
Unlawful access to or processing of personal information.
The service provider also needs to take reasonable measures to-
Identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control;
Establish and maintain appropriate safeguards against the risks identified;
Regularly verify that the safeguards are effectively implemented; and
Ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.
The service provider must have due regard to generally accepted information security practices and procedures which may apply to it generally or be required in terms of specific industry or professional rules and regulations.
Preventing a Data Breach and disclosure of such;
The following security measures are taken to prevent a breach:

• Firewalls, anti-virus applications and malware protection to protect hardware, devices and networks are in place;
• Using up to date software and operating systems;
• Installing patches and updates without delay.

9.1Notification:
The Vault will immediately notify The subscriber via email following discovery of any suspected breach or compromise of the security, confidentiality, or integrity of any Company Data or User Data.
Notification provided by email will include a brief summary of the available facts, the status of our investigation, and if known and applicable, the potential number of persons affected by release of data relating to such persons (“Affected Persons”). If applicable, The Vault agrees to notify the Affected Persons regarding any security breach by email, at our expense. These notices will be delivered within two hours of such breach. The Vault agrees that it will not communicate with any third party, including, but not limited to the media, consumers and Affected Persons regarding any security breach without the express written consent and direction of the Subscriber except as required by applicable law. Each Party will notify the other Party promptly of any actual or attempted use or possession of any confidential information or developed intellectual property by any unauthorized person or entity which may become known to it and will cooperate with the other Party in any investigation or action against any such persons or entities. If an investigation, carried out by an impartial third party, indicates negligence (defined as the service provider’s failure to comply with the data security requirements set forth in the contract) on the part of Vault or its representatives then Vault will be liable for losses incurred by The subscriber. Vault indemnifies and holds The subscriber harmless from any claims arising from loss, damages, injuries claimed against The subscriber as a result of an act or omission by Vault in rendering the services under applicable law and the Agreement. Such liability excludes consequential damages stemming from a data breach such as lost profits or reputational damages.

10.General Conditions
The subscriber’s use of the Services provided by Vault is at The subscriber’s sole risk.
Save for the uptime guarantee, the Vault does not warrant that the service will be uninterrupted or error-free beyond its control.
Vault shall not be considered in breach of this Agreement provided that downtime is Excusable Downtime that arises after the Effective Date. Excusable Downtime means the time the subscription is not available as a result of maintenance of which the Subscriber is given prior written notice, or which is determined after troubleshooting, to be due to an Event of Force Majeure. An Event of Force Majeure means an event or circumstance that prevents either party to this agreement from complying with its obligations under this agreement that was not caused by or did not result from the negligence or fault of a Party or persons acting on its behalf. An Event of Force Majeure does not include a failure to perform that could have been prevented by Vault taking reasonable precautions, including by having implemented business continuity and disaster recovery measures and ensuring third party providers do the same.
Technical support is only provided via email.
The subscriber must not modify, adapt or hack Vault.
The subscriber must not modify another website so as to falsely imply that it is associated with Vault.
The subscriber agrees not to reproduce, duplicate, copy, sell, resell or exploit any portion of Vault, use of Vault or access to Vault without the express written permission by Vault.
We may, but have no obligation to, remove content and accounts that we determine in our sole discretion are unlawful or that violates any party’s intellectual property or these terms.
Neither Party will be liable to the other for any indirect, incidental, special, consequential or exemplary damages, including but not limited to, damages for loss of profits and goodwill.
The failure of a Party to exercise or enforce any right or provision of the terms shall not constitute a waiver of such right or provision. These terms constitute the entire agreement between the Parties and governs The subscriber’s use of the Vault, superseding any prior agreements between the Parties (including, but not limited to, any prior versions of these terms).
No indulgences or extensions of time or latitude which one of the Parties may allow to the other Party shall constitute a waiver by that Party of any of its rights, and it shall not thereby be prevented from exercising any of its rights which may have arisen in the past or may arise in the future.

No variation of this Agreement shall be accepted unless in writing and agreed between the parties.

11.Server
Vault is hosted in the Amazon cloud in the Ireland node.
Technical details relating to the security of the hosting environment:
Isolated Virtual Private Cloud with public & private subnets
Backend services i.e. server, RDS are deployed in private subnets
HTTP/HTTPS ports are exposed via Application Load Balancer and CloudFront
EC2 encryption at rest with AWS KMS
Scheduled snapshot of the data volume of EC2
RDS MySQL encryption at rest with AWS KMS
Scheduled snapshot of the RDS instance with point-in-time recovery
OpenVPN to access backend services from the internet
CloudFront is setup with basic DDoS protection and caching functionality

12. NOTICES AND DOMICILIA
The Subscriber nominates its registered address as its domicilium address for service upon it of all processes in connection with any claim arising out of this Agreement.
The Vault nominates its physical address as stipulated in the Agreement, as its domicilium address for service upon it of all processes in connection with any claim arising out of this Agreement.
Either Party shall be entitled to change its chosen domicilium address, on written notice to the Company.
All notices and communications under the Agreement shall be given in English and in writing.

13. Contact us
James Hammerton
CEO
jhammerton@theVault.exchange
+27 (0) 73 174-6909

Simon Hammerton
Chairman
shammerton@theVault.exchange
+27 (0) 83 309-8698

Websites
https://theVault.exchange