3.1. Service Description: The description of the Service is provided as part of the Service Documentation.

3.2. Location of Data: Zapier provides the Service from AWS servers in the United States, and certain data may be processed by our Subprocessors (defined below), unless otherwise agreed by the parties from time to time. Zapier processes Customer Content in accordance with the Data Processing Addendum (“DPA”). Each Zapier subprocessor (the “Subprocessors”), and the locations where Zapier and each such subprocessor processes data, can be found on the Subprocessors page on Zapier’s website. Zapier shall not change the country or region for provision of the Services or processing of Customer Content without providing reasonable prior notice to Customer. Customer may receive notifications of any change to the list of Zapier subprocessors by signing up at the Zapier Trust Center.

3.3. Data Protection and Security: Zapier will implement and maintain appropriate technical and organizational measures to ensure the availability, authenticity, integrity, and confidentiality of Customer Content as described in, including recovery and secure deletion of data upon termination, all in accordance with the DPA.

3.4. Data Access, Recovery, and Return: In the event of Zapier’s insolvency or discontinuation of business operations, Zapier provides Customer with access and technology to download, transfer, or delete its Customer Content during the term of the Agreement, as described in Zapier’s data retention policies.

3.5. Service Level Agreement: The provisions of Section 8 of the Agreement shall apply to the Service provided by Zapier to Customer and shall constitute the service level agreements as required under DORA (the “Service Levels”).

3.6. ICT Incidents: Zapier will cooperate with Customer relating to an ICT Incident resulting in unauthorized access or disclosure of Customer Content stored on the Service. Zapier reserves the right to charge reasonable fees (including personnel cost as determined by Zapier in accordance with its then-current rates) for support provided.

3.7. Cooperation with Competent Authorities: If requested by a Competent Authority under DORA, Zapier will cooperate with Competent Authorities in relation to Customer’s compliance as required under DORA.

3.8. Termination Rights: The Customer may terminate the Agreement in accordance with the termination provisions of the Agreement. To the extent that DORA requires that Customer have any termination rights under the Terms of Service that are not already included in the Agreement, Customer shall have those additional termination rights as required by DORA. Termination, however effected, shall not relieve Customer of any payment obligations for Services rendered prior to termination.

3.9. Security Awareness Training: Zapier will provide its personnel with security awareness program and digital operational resilience training program. To the extent required by DORA and subject to mutual agreement between the parties (including as to reasonable costs), Customer can engage Zapier support personnel to participate in Customer’s ICT risk management training, provided that such training is reasonable and directly relevant to the Zapier Services, can be attended virtually, and provides for input from Zapier to adapt the training for relevance and reasonableness.

3.10. Subcontracting: Customer agrees that Zapier may engage Subcontractors in respect of the Service and the provisions of this clause shall apply to any such Subcontracting. Zapier will remain fully responsible under the Agreement for the provision of the Service to Customer. Subcontractors that process data can be found on the Subprocessors page on Zapier’s website and Customer may receive notifications of any change to the list of Zapier subprocessors by signing up at the Zapier Trust Center.