Terms of Service

1.1 Software Subscription.

(a) Software License. (a) Software License. Patch My PC grants Customer and its wholly or majority-owned affiliates a non-exclusive, limited license to use its Software for either a trial period or for the Subscription Term as set forth in the applicable Quotation. This license is non-transferrable as set forth in Section 2.4, below.

(b) Not For Resale License. Patch My PC may provide access to the Software under a Not for Resale License which Customer may not use for production or use with its own customers. A Not for Resale License is a non-exclusive, limited, nontransferable license to use its Software for the pre-determined trial period in a lab environment. Patch My PC reserves the right to immediately revoke the Not for Resale License upon Notice to Customer.

(c) Software and License Delivery. For licenses to on-premises Software, Patch My PC will make all software, installs, and updates available via digital download; Customer may retain backup copies when applicable. Patch My PC may immediately revoke trial licenses upon Notice to Customer.

2.1 General License Restrictions and Audits. Customer may not use the Software for more Devices than licensed Device count purchased, as set forth on the applicable Quotation, except as provided in Section 2.2. Patch My PC may audit the number of Devices on which Customer has used the Software. If an audit concludes that the Software has been used on more Devices than permitted under Section 2.2, Patch My PC may proportionally increase its charges, both prospectively and in arrears, to Customer for the use of the software on the excess Devices.

2.2 License Increase Exception. Customers who purchase a Software Subscription may use the Software for 10% more Devices than originally purchased to allow for normal growth within the Subscription Term. Customer agrees to provide Notice to Patch My PC if it needs to exceed 110% of its licensed device count to determine if a modification to the license count and payment is required for the current Subscription Term.

2.3 Reverse Engineering. Customer will not reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, underlying ideas, underlying user interface techniques, or algorithms of the Software or the associated documentation by any means whatsoever, whether directly or indirectly. Customer will use its best efforts to prevent its employees and contractors and any third parties from attempting to do any of the foregoing. Patch My PC may immediately terminate Customer’s license for any failure to comply with this section.

2.4 Assignments and Transfers. Customer will not transfer, assign, or sublicense their license to any other person or organization, except for Customer’s wholly or majority owned affiliates and successors. Any other attempted transfer, assignment, sublicense, or use will void Customer’s license. Patch My PC may transfer, assign, or sublicense its obligations to any affiliate or successor upon Notice to Customer. Customer will reasonably cooperate with Patch My PC, its affiliates, or successors as requested in a Notice to enable an affiliate or successor to continue providing Services to Customer.

3.1 Software Licensed, not Sold. The Software is provided exclusively under a license. Patch My PC reserves all rights not expressly granted in these Terms. All intellectual property rights such as, but not limited to copyrights, database rights, patents, trademarks, trade names, logos, domain names, and derivative rights relating to the Services, including new developments (hereafter also the “Intellectual Property Rights”) are and will remain the exclusive property of Patch My PC. Notwithstanding any contrary language in any Customer-issued purchase orders or other documents, all right, title, and interest in and to the Software, documentation, and corresponding intellectual property (other than any license to the Software) remains the property of Patch My PC.

3.2 Ownership of Third-Party Content. All rights, title, and interest in and to third-party patches which may be accessed through or installed by the Software (“Third Party Patches”) are the property of the respective owners and are protected by applicable laws and treaties, including intellectual property laws. These Terms do not grant Customer any ownership rights to such content.

3.3 Open-Source Software. Certain components of the Software contain open-source software that is provided under the terms of an open-source license. The terms of open-source licenses supplement and, in the event of a conflict with these Terms, shall supersede these Terms. A list of the open-source software used in the Software and their respective licenses is available in the trust center at Trust.PatchMyPC.com (“PMPC Trust Center”). The list includes any open-source software planned for incorporation in the Software within the next 30 days. Customer may receive notifications by subscribing to updates in the PMPC Trust Center. If Customer reasonably objects to the incorporation of new open-source software or to the licenses for such software it may terminate these Terms by providing fourteen days’ advance Notice to Patch My PC; in such event, Patch My PC will refund any prepaid and unused fees.

3.4 Customer Ideas. If Customer (or its affiliates or successors) provide Patch My PC with any ideas, suggestions, feature requests, recommendations, or other feedback (collectively, “Ideas”) relating to the Software, Patch My PC shall have a royalty-free, worldwide, transferable, sub-licensable, irrevocable, non-exclusive, perpetual license to use such and implement such Ideas in the Software.

3.5 Access to the Software. To use the Software, Customer must provide Devices, operating systems, and licenses necessary to use the Software, including the licenses for applications and software downloaded or installed through the Software. Customer will use commercially reasonable steps to ensure that it does not disturb or interfere with the operation of the Software. If any Software update requires changes in Customer’s Device or software, the Customer must implement these changes at their own expense.

3.6 Software Delivery. Patch My PC will deliver the license key through email. The license key can be activated in the on-premise version of the Software and the SaaS offering.

3.7 Availability. For Customers who purchase a license to the SaaS, Patch My PC commits to using commercially reasonable efforts to make the SaaS available 24 hours per day and 365 days per year.

3.8 Appropriate Use. Customer shall not edit, alter, abridge, or otherwise change in any manner the content of the Service, including, without limitation, all copyright and proprietary rights notices. Customer may not, and may not permit others to: (i) modify, translate, adapt, alter, or create derivative works from the Software; copy, distribute, publicly display, transmit, sell, rent, lease, or otherwise exploit the Software; (ii) distribute, sublicense, rent, lease, or loan the Software to any third party; (iii) harvest, collect, gather, or assemble information or data regarding other users of the Software, except to the extent that such information or data is publicly available; (iv) transmit or process through the Software any unlawful, immoral, libelous, tortuous, infringing, defamatory, threatening, vulgar, or obscene material or material harmful to minors; (v) transmit material containing malware; (vi) attempt to gain unauthorized access to the Software, computer systems, or networks related to the Software; or (vii) harass or interfere with any other user’s use and enjoyment of the Software. Any violation of this section shall excuse Patch My PC from all responsibilities, financial or otherwise, related to such violation.

4.1 Confidential Information. Both Patch My PC and Customer will keep confidential and not disclose to any third party any Confidential Information which may be provided in connection with these Terms. Both parties shall employ reasonable technical, administrative, and physical information security controls to safeguard Confidential Information embodied in electronic form from unauthorized disclosure, alteration, loss, or other compromise.

4.2 Compelled Disclosure. Both the Patch My PC and Customer may disclose Confidential Information pursuant to applicable court order or other legal requirement if they are compelled by law to do so. The disclosing party will promptly provide the other party Notice before such mandatory disclosure to the extent legally permitted.
Patch My PC shall not disclose or otherwise provide access to any Customer Data to any public authority, including law enforcement or national security agencies, on a voluntary basis or in response to any non‑binding, informal, or non‑compulsory request. Patch My PC shall: (i) only disclose Customer Data where it is legally required to do so pursuant to a valid, binding, and enforceable order issued by a competent authority, and (ii) limit any disclosure strictly to what is required under the binding order and shall document the assessment and response. Where legally permitted, Patch My PC shall promptly notify the Customer of any such request, including the legal basis relied upon, the scope of the requested data, and any steps taken to challenge or limit the request.

5.1 Software Subscription Fees, Invoicing, and Payment. Customer will pay all undisputed charges specified in each invoice. All charges are quoted and payable only in United States Dollars unless designated otherwise on the invoice. If Customer pays by credit card, Patch My PC may add a surcharge to Customer’s invoice to cover the costs of accepting Customer’s credit card payment. All payment obligations are non-cancelable, except as provided below. Payment shall be due within 30 days from receipt of Patch My PC’s invoice unless stated otherwise in the invoice. Patch My PC does not provide any discounts for early payment. Customer’s failure to timely pay all undisputed charges when due shall be considered a material breach of these Terms. Customer will pay interest at annualized rate of up to 8% on any undisputed balance that is more than 30 days overdue. Any terms and conditions accompanying or incorporated into any purchase order are not a part of these Terms, shall have no legal effect, and shall not be binding on Patch My PC. Customer is responsible for providing complete and correct billing information. Customer agrees to reimburse Patch My PC for any fees or costs associated with returned payments. In the event Customer remits a payment in excess of the invoiced amount due, Customer agrees that Patch My PC may retain such overpayments up to $50, may deduct the administrative costs of issuing a credit from such overpayments, and need not issue any credit if the administrative costs would be greater than the value of the credit.

5.2 Taxes. Customer will be responsible for, and will promptly pay or reimburse Patch My PC for, the payment of all sales, use, excise, value-added, or similar taxes, assessments, or duties (or other similar charges) imposed by any governmental agency (including any interest and penalty imposed thereon as a result of any act or omission of Customer that is in accordance with the direction or request of Customer) that are based on, or with respect to, any Software or services provided by Patch My PC to Customer. Patch My PC will collect and remit sales tax where applicable in the United States. Customers claiming tax exempt status must provide appropriate documentation to Patch My PC from each applicable jurisdiction.

5.3 Refund. Patch My PC wants you to be 100% satisfied. If Customer is less than satisfied or believe there has been an error in billing, please contact our customer service department by emailing us at [email protected] or calling us at (866) 343-3083. When contacting us, please include all details relating to your Software licenses. Patch My PC, at its discretion, will seek to solve the issue, provide a refund, or offer a credit that can be used for future Software. All full refund requests must be made within the earlier of 180 days of purchase or 30 days of receipt of the relevant invoice.

5.4 Refunds for Reseller Customers. If Customer has purchased its license through an authorized reseller or other authorized third party and is less than satisfied with the Software, Customer may still seek a refund as set forth in Section 5.3. Patch My PC will reasonably cooperate with the Customer and its reseller to resolve Customer’s dissatisfaction; however, any refund or other resolution of the situation may be subject to any legal agreement between Customer and its reseller or to reseller’s approval.

5.5 Software Suspension. Patch My PC may, in its sole discretion, suspend the Customer’s access to the Software for any unpaid balance that is more than 14 days overdue, after providing 14-day advance notice, without limiting its other rights and remedies. Patch My PC will restore Customer’s access to Software upon full payment of all overdue payments and interest.

6.1 Limitation of Liability. In no event will Patch My PC be held liable to Customer or any third party for any special, incidental, indirect, punitive, exemplary, or consequential damages, or damages for loss of business, loss of profits, business interruption, or loss of business information arising out of the use or inability to use the program, or for any claim by any other party, even if Patch My PC has been advised of the possibility of such damages.
Except for its obligations under the Data Processing Addendum and the indemnification obligations below, Patch My PC’s entire liability with respect to its obligations under these Terms or otherwise with respect to the Software will not exceed the amount paid by the Customer to Patch My PC within the 12-month period preceding the incident or omission giving rise to the liability. With respect to violations of the Data Processing Addendum and the indemnification obligations set forth below, Patch My PC’s entire liability with respect to its obligations under these Terms or otherwise with respect to the Software or Services will not exceed twice the amount paid by the Customer to Patch My PC within the 12-month period preceding the incident or omission giving rise to the liability.

6.2 Indemnification. Customer and Patch My PC agree to indemnify, defend, and hold harmless the other party, its officers, directors, employees, and agents for any third-party demands, claims, actions, damages, losses, costs, liabilities, and expenses (including reasonable attorney’s fees) relating to or arising from the indemnifying party’s violation of any applicable laws, rules, or regulations. Further, Patch My PC agrees to indemnify, defend, and hold Customer harmless from third-party demands, claims, actions, damages, losses, costs, liabilities, and expenses (including reasonable attorney’s fees) incurred by or asserted directly against Customer alleging that the Software violates or infringes upon the intellectual property rights of a third party. The indemnified party reserves the right, at its own cost, to assume the exclusive defense and control of any matter otherwise subject to indemnification by the other party, in which event the other party will fully cooperate in asserting any available defenses. Such indemnification is subject to the indemnified party seeking indemnification in a timely manner and before any communications on the merit of the claim are made to the third party. Such indemnification is subject to the indemnified party seeking indemnification in a timely manner and before any communications on the merits of the claim are made to the third party.

6.3 Remedy for Infringement. In the event a court or other tribunal of competent jurisdiction determines that the Software infringes on or otherwise violates any third-party registered patent, trade secret, copyright, or trademark, or if Patch My PC determines that the Software likely infringes or violates a third party’s intellectual property rights, Patch My PC, at its sole option and expense, will: (a) modify the allegedly infringing or violating portion of the Software so as to make it non-infringing and non-violating; (b) replace the allegedly infringing or violating software, or any portion thereof, with a non-infringing and/or non-violating product having reasonably equivalent functionality; (c) obtain the right for Customer to continue using the allegedly infringing or violating portion of the Software; or (d) revoke the license to the allegedly infringing or violating Software and provide a pro-rata refund to Customer for all fees prepaid but unearned fees for the Software. Patch My PC will have no obligation under these Terms relating to any indemnification if a claim results from any of the following: (i) Customer’s continued use of the infringing or violating Software after Patch My PC makes one of the foregoing remedies available to Customer; (ii) Customer’s modification of the Software; or (iii) Customer’s use of the Software in any manner other than as permitted under these Terms.

6.4 Force Majeure. Any failure or delay by either party in the performance of its obligations pursuant to these Terms, except for Customer’s payment obligations, will not be deemed a default or breach of these Terms or a ground for termination to the extent such failure or delay is due to computer, Internet or telecommunications breakdowns, denial of service attacks, fire, flood, earthquake, elements of nature or acts of God, acts of war, terrorism, riots, civil unrest, rebellions or revolutions, strikes, supplier and third-party failure, lockouts, labor difficulties, quarantines, health related orders, or other similar actions taken by governmental authorities, or any similar cause beyond the reasonable control of the non-performing party.

7.1 Termination for Convenience. Either party may terminate these Terms at any time without cause by providing sixty days prior written Notice to the other party. If Patch My PC terminates pursuant to this section it will, within 30 business days of the termination, repay a pro-rata refund for unused fees which were prepaid by Customer. No refund is due if Customer terminates pursuant to this section, except as provided in Section 5.3.

7.2 Changes to Terms. Patch My PC reserves the right to change these Terms. Patch My PC may change these Terms with respect to users of Patch My PC’s SaaS offering by posting the updated Terms in a conspicuous location within the SaaS. For other versions of the Software, Patch My PC may change these terms by providing Customer with notice of the changes. The most current version of these Terms will supersede all previous versions.

7.3 Termination for Cause. Either party may terminate these Terms due to the other party’s material breach of these Terms by providing Notice and a 30 business day window to cure the material breach. If Patch My PC does not cure its material breach, then Customer may terminate these Terms and Patch My PC will, within 30 business days, repay a pro-rata refund for unused fees which were prepaid by Customer. If Customer does not cure its material breach, then Patch My PC may suspend its license, terminate these Terms, and pursue any other remedy at law.

7.4 Customer’s Obligation Upon Termination. Upon termination of these Terms, Customer’s licenses to Patch My PC’s Software shall automatically terminate. If Customer uses the Software on an on-premises basis, Customer will destroy any copies of the Software, and upon request by Patch My PC, certify that all copies have been destroyed, except as retained in Customer’s offline backup system. If Customer retains copies of the on-premises version of the Software in an offline backup program, Customer shall promptly destroy or delete such copies once they are no longer required to be retained under such program.

7.5 Surviving Provisions. All provisions relating to confidentiality, proprietary rights, non-disclosure, indemnification, payment, and limitation of liability will survive any termination of these Terms. All provisions relating to Data Protection will survive as set forth in Addendum 1.

8.1 Warranty. Patch My PC represents and warrants that the Software will operate materially as it is designed and represents that it uses commercially reasonable efforts to develop the Software. Customer’s sole remedy under this warranty is for Patch My PC to correct any defect within a commercially reasonable time. However, it does not represent or warrant that its Software is error-free. Except as provided herein, the Software, including any open-source components incorporated within the Software, is provided “AS IS” without any warranty of any kind, including any implied warranties such as the warranties of merchantability and fitness for a particular purpose.
Patch My PC will perform commercially reasonable virus checks on Third Party Patches. However, Patch My PC does not warrant that Third Party Patches will be free of viruses or malware. Moreover, Patch My PC makes no warranties or representations regarding the Third Party Patches and Customer agrees that any installation or download of Third Party Patches is otherwise the sole responsibility of the Customer.
Customer is responsible for determining the appropriate use of the Software and assumes all of the risks associated with the use of it, including but not limited to the risks of program errors, damage to or loss of data, programs or equipment, and unavailability or interruption of operations. Customer agrees that it is solely responsible for complying with the terms and conditions governing Third Party Patches.

8.2. Disclaimer of Recommendations. Patch My PC does not endorse or sponsor any commercial product, service, or activity of any third-party vendor. Customer agrees that nothing in these Terms will be construed to imply that Patch My PC is in any way liable for the products or services of a third-party vendor regardless of whether such product or service employs technology developed by Patch My PC or is recommended by Patch My PC employees.

9.1 Governing Law and Dispute Resolution. Unless Customer selects New York as an alternative using the procedures set forth below, these Terms will be construed and enforced in accordance with, and governed by, the laws of the State of Colorado without giving effect to principles of conflicts of law. Customer and Patch My PC also agree that the venue of any litigation arising out of or related to these Terms or the Software shall be the state or federal courts in Denver, Colorado. The parties waive any objection to such venue including on the basis of forum non conveniens or related doctrines. In no event shall the United Nations Convention on Contracts for the International Sale of Goods or the Uniform Computer Information Transaction Act apply to any dispute between the parties arising out of or related to these Terms or the Software. However, notwithstanding the foregoing, within 14 days of accepting these Terms, Customer may select the law of the state of New York as the governing law by providing Notice to Patch My PC specifying such state; in such event, the laws of the State of New York shall be deemed to replace the laws of the State of Colorado in the foregoing text in this paragraph.

Customer also agrees (1) that any dispute shall be resolved only on an individual basis before a single arbitrator under the Commercial Arbitration Rules of the American Arbitration Association; (2) that Customer and Patch My PC waive any right to bring a claim on a class-action or representative basis or to have a claim brought in such a way by any other person or party and (3) that any arbitration between Customer and Patch My PC regarding the Services must be initiated with the requirements of this section within one year of accrual or be permanently barred; and (4) to the maximum extent permitted by law, neither Customer nor Patch My PC shall be entitled to recover any punitive or exemplary damages, regardless of the nature of the dispute. You and we also agree that an arbitration initiated under this section will be confidential, except as necessary to enforce or vacate any arbitration award. Customer, Patch My PC, the arbitrator, and witnesses in the arbitration proceeding shall have the right to attend such proceedings in person or remotely via video conference or other technological means.

9.2 Integration Clause. These Terms, the applicable Quotation, and any variation agreement supersede all previous and contemporaneous oral and written agreements including any terms and conditions included in Customer’s purchase order. These documents constitute the complete and entire agreement of the parties. The terms set forth in the Quotation shall supersede any contrary provisions in these Terms but such terms shall be effective only during the Subscription Term stated in the Quotation. The parties may also revise these Terms in a variation agreement or other document signed by both parties.

9.3 Headings and Other Materials. Section headings and any overview or summary of these Terms are only for convenience and are not to be considered a part of these Terms or be used to define, limit, or construe the scope of any term or provision of these Terms.

Confidential Information: Any non-public information disclosed by one party to this contract to the other party, either directly or indirectly, (including, without limitation, pricing, trade secrets, product roadmaps, services, customers, Software, inventions, engineering, hardware information, marketing or financial information), which is designated as “Confidential,” “Proprietary” or an alike designation, or should reasonably be understood to be confidential or proprietary information given the nature of the information and the circumstances of the disclosure.

Customer: Every person or company that is granted licenses to the Software, uses any of Patch My PC’s Software, or agrees to these Terms.

Customer Data: Any data sent from Customer’s systems solely in connection with the operation and support of the Software. This includes applicable information about Customer’s devices, software configurations, update status, usage metadata, licensed products, and authorized administrators or contracts for the Software. Customer Data does not include data that Customer stores, processes or manages in its own IT environment or within third-party or internal business applications that do not relate to the operation and support of the Software. For example, a banking customer may send Customer Data related to a database program installed on their systems, but will not provide the contents of data files for that database program. Customer Data does not include Personal Data relating to the Customer and its personnel that the Customer provides to Patch My PC in connection with the operation and support of the Software (e.g., an authorized user’s email address) for which Patch My PC determines the purposes and means of processing.

Data Incident: Any unauthorized Processing of Customer Data.

Data Protection Laws: All applicable foreign, state, or federal laws, statutes, regulations, rules, executive orders, directives, or other official guidance relating to data protection, privacy, data security, electronic communications, or Data Incidents that are applicable to a party or Customer Data processed under these Terms.

Data Subject: A natural person to whom, or household to which, Personal Data relates.

Devices: Every Customer device that can be updated by Patch My PC’s Software.

File Hosting Service: Patch My PC’s update catalog of third-party software. The File Hosting Service shall be considered a component of the Software.

Notice: A formal, written notice from one party to the other. Notice to Patch My PC can be provided via email to [email protected] or by certified mail to this address: Attn: Legal Department, Patch My PC, LLC, PO Box 1436, Castle Rock, CO 80104. Patch My PC may provide formal written notice to Customer at the postal address or email address on the Customer’s Quotation or invoices.

Personal Data: Any Customer Data that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Data Subject, including without limitation, all information defined as “Personal Information” or analogous definitions in Data Protection Laws. This definition excludes Telemetry Data collected to provide the services specified in these Terms.

Processing: (and related forms of “process”), when used in relation to data, refers to any operation or set of operations which is performed on data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processing (and its related forms) shall have the meaning set forth in this paragraph when used in relation to data, regardless of whether they are capitalized when used throughout the Terms.

Quotation: A document from Patch My PC (that details (a) the nature of the license to Software that Patch My PC offers to Customer, and, in particular, whether that license is to Patch My PC’s SaaS or on-premises Software; (b) the duration of the license; (c) the cost, if any, for such license; (d) any legal terms that shall apply during the Subscription Term. If Customer uses the Software in a situation where Patch My PC has not issued such a document, the Customer shall be offered a thirty (30) day “trial period” license as set forth in Section 1.1(a) without cost. A Quotation shall expire on its expiration date if an expiration date is set forth therein. A Customer may accept the offer set forth in a Quotation by paying the applicable cost or using the license. Customer may not add, remove, or change terms to the offer set forth in a Quotation. For purposes of this paragraph, Patch My PC includes any resellers authorized by Patch My PC.

SaaS: Patch My PC’s Software, provided and licensed under a Software-as-a-Service (rather than on-premises) model.

Software: Any Patch My PC software including all Patch My PC cloud-based services.

Software Subscription: Any Software licensed to Customer by Patch My PC on a periodic licensing model that allows the Customer to pay a per-Device fee. The Customer will pay the initial subscription fee specified in the Customer’s Quotation upfront and is entitled to use the Software specified in the Customer’s Quotation for the Subscription Term.

Standard Contractual Clauses or SCCs shall refer to the “Annex to the COMMISSION IMPLEMENTING DECISION on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679.” The SCCs are presently available at https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_en.

Subscription Term: The duration of the license to the Software as set forth in the applicable Quotation. The Subscription Term shall begin when Customer begins to use the license.

Telemetry Data: Data such as usage statistics, error logs, and system configuration details collected from the Customer’s use of Patch My PC’s Software, which is used to provide Customer support, identify software issues, optimize performance, and enhance future updates.

UK Addendum: means version B1.0 of the “International Data Transfer Addendum to the EU Commission Standard Contractual Clauses” which entered into force on March 21, 2022. The UK Addendum is presently available at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/.

This Data Processing Addendum (“DPA”) is an integral part of the Terms between Patch My PC and Customer. Capitalized words or phrases defined in the Terms shall have the same definitions in this Addendum.

1. Data Protection Law Compliance. Patch My PC will comply with Data Protection Laws applicable to Patch My PC’s Processing of Customer Data. Customer has the right to take reasonable and appropriate steps to ensure that Patch My PC Processes Customer Data in a manner consistent with Customer’s obligations under Data Protection Laws, and, following Notice to Patch My PC, to stop and remedy unauthorized use of Customer Data. Patch My PC shall reasonably cooperate with such steps. Patch My PC shall promptly provide Notice to Customer if it concludes it cannot satisfy the obligations set forth in this paragraph. If Customer is subject to the California Consumer Privacy Act (“CCPA”), as amended, Patch My PC shall also comply with the prohibitions on Service Providers set forth in Cal. Civ. Code § 1798.140(ag)(1) and the other contract requirements for Service Providers set forth in CCPA’s implementing regulations at 11 Cal. Code Regs. § 7051 as if such requirements were set forth, mutatis mutandis, herein.

2. Processing Purpose/Limitation. Customer authorizes Patch My PC to Process Customer Data only: (a) as necessary to provide the Software, (b) as otherwise mutually agreed in advance and in writing. Patch My PC agrees that it will not Process any Customer Data for any other purpose except: (a) as necessary to fulfill Patch My PC’s authorized business purposes as provided in the Terms or other written direction from Customer; or (b) as otherwise required by applicable law, provided Patch My PC notifies Customer of such legal requirement before Processing (unless the law prohibits such disclosure on public interest grounds). Patch My PC shall Process Customer Data within the United States and within such other jurisdictions as may be specified on the applicable Quotation or in a Notice provided to Customer. Customer and Patch My PC agree that the Customer Data Processing Description in the PMPC Trust Center properly describes the categories of Personal Data to be Processed, the duration of Processing, and the purposes of such Processing.

3. Prohibition on Selling and Sharing. Patch My PC will not sell (as defined in applicable Data Protection Laws) or share (for behavioral advertising or other marketing purposes) any Customer Data Processed hereunder. Patch My PC may not combine Customer Data with data it receives from or on behalf of other parties unless expressly authorized in writing to do so.

4. Authorized Persons. Patch My PC will ensure that the personnel it authorizes to Process Customer Data are under appropriate obligations of confidentiality and security with respect to the Customer Data.

5. Subprocessors. Patch My PC may appoint third parties to Process Customer Data on Patch My PC’s behalf or perform its obligations with respect to Customer Data under the Terms (each, a “Subprocessor”). Customer may view a list of all Subprocessors in the PMPC Trust Center as well as subscribe to receive notifications of changes to the Subprocessor list. Customer hereby approves all Subprocessors listed in the PMPC Trust Center at the beginning of Customer’s first Subscription Term. Patch My PC will give Customer 14 days’ notice before engaging with new Subprocessors. The Customer may object in this timeframe for reasonable cause; if no response is received, the new Subprocessor is assumed accepted. In the event Patch My PC decides to use such Subprocessor notwithstanding Customer’s reasonable objection, Customer shall have the right to terminate the Terms as set forth in Section 7.2. Patch My PC will perform reasonable due diligence to ensure that any Subprocessors are able to, and are obligated by written contract to comply with, Patch My PC’s obligations under this DPA. Patch My PC shall authorize Subprocessors to Process Customer Data only to the extent necessary to perform the Subprocessor’s obligations. Patch My PC accepts liability for, and shall remain liable to Customer, with respect to third parties’ processing of Customer Data.

6. Termination of Processing. Patch My PC and Customer agree that Patch My PC will securely delete the Customer Data upon (a) the termination or expiration of these Terms or (b) on the expiration of all of Customer’s licenses to the Software. Patch My PC’s obligations under this DPA shall survive any termination of these Terms for so long as Patch My PC remains in possession or control of, has access to, or otherwise Processes Customer Data.

7. Security. Taking into account the state of the art, the costs of implementation, the nature of Patch My PC’s business, the sensitivity of Customer Data, and purposes for which such Customer Data will be Processed, Patch My PC shall implement a security program of appropriate technical, administrative, and physical security measures to protect Customer Data from unauthorized access, use, modification, disclosure, or other Processing. Patch My PC’s security program shall, in any event, include the security controls set forth in the PMPC Trust Center.

8. Data Incidents. Patch My PC shall promptly take all appropriate steps, at its sole cost and expense, to investigate, contain, remediate the cause, and mitigate any effects or potential harms to Data Subjects arising from any Data Incident involving Patch My PC’s Services or personnel. Patch My PC shall provide Notice to Customer without undue delay, and in any event within 72 hours if Patch My PC becomes aware of such a Data Incident. Such notice shall include all information reasonably available regarding the scope, nature and effects of the Data Incident, and affected Data Subjects, and Patch My PC shall promptly provide material updates to Customer as available. If the Data Incident resulted from Patch My PC’s breach of these Terms or violation of Data Protection Laws and Data Protection Laws require notice to authorities or individuals, or other remedial action, then Patch My PC shall reimburse Customer for the reasonable costs of providing such notice or remedial action. Such reimbursement shall be subject to the limits of liability stated in Section 6.1.

9. Assistance with Data Subject Rights, Regulator Requests, and Consultations. Patch My PC will provide Notice to Customer without undue delay of (a) any communication from a Data Subject exercising any rights in Personal Data under Data Protection Laws (a “Rights Request”), and (b) any inquiry or notice from any official or governmental authority regarding a party’s Processing of Personal Data under these Terms or compliance with applicable Data Protection Laws (a “Regulator Request”). Patch My PC will cooperate as reasonably necessary, at Customer’s expense, to assist Customer in the fulfilment of a Rights Request or in connection with any response to a Regulator Request. To the extent Patch My PC receives a Rights Request directly from a Data Subject regarding data Processed under these Terms, then Patch My PC shall direct the Data Subject to contact Customer in relation to the Rights Request. Patch My PC shall not alter or delete any Personal Data unless authorized in writing by Customer, unless in Patch My PC’s good faith belief, Patch My PC is prohibited from seeking such authorization or is obligated to delete such Personal Data without or before any such authorization is granted.

Where necessary in relation to Patch My PC’s Processing of Customer Data hereunder, Patch My PC will provide reasonable assistance to Customer, at Customer’s expense, with any data protection impact assessments, request for information about Patch My PC’s Processing of Personal Data, or any prior consultations with official or governmental authorities which may be required under applicable Data Protection Laws.

10. Oversight and Audit. Patch My PC shall reasonably cooperate with Customer, at Customer’s expense, in the event of any questions about the design or efficacy of Patch My PC’s security program. In addition, no more than once annually with 90 days written notice, Patch My PC will allow and reasonably cooperate, at Customer’s expense, with an assessment by Customer or a mutually acceptable assessor designated by Customer relating to Patch My PC’s processing of Personal Data.

11. Transfers of Personal Data from the European Economic Area, United Kingdom, or Switzerland. To the extent Customer’s use of Patch My PC’s Services requires the transfer of Personal Data from a member state within the European Economic Area to the United States, such transfers shall be subject to Module 2 of the SCCs, which are hereby incorporated, mutatis mutandis, as if set forth herein. With respect to such incorporation: (a) optional clause 7 of the SCCs shall not apply; (b) in situations where clause 9 applies, “Option 2” and the time period of seven days shall apply in clause 9(a); (c) the optional component of clause 11 shall not apply; (d) in clause 17, “Option 1” and the law of the Republic of Ireland shall apply; (e) clause 18(b) shall refer to “Ireland”; (f) the appendix shall be deemed to be incorporated with the information from the PMPC Trust Center, other information in this DPA, and with respect to Customer, such contact information for Customer as Customer shall maintain in Customer’s account with Patch My PC.

To the extent Customer’s use of Patch My PC’s Services requires the transfer of Personal Data from the United Kingdom to the United States, such transfers shall be subject to the UK Addendum, which is hereby incorporated, mutatis mutandis, as if set forth herein. The tables of the UK Addendum shall be deemed to incorporate the information set forth in and referenced by this DPA. For purposes of Table 4, the “neither Party” option shall apply.