RemoteGymp Terms of Service

Version: 2026-08-28

Effective date: 28 August 2026

These Terms of Service ("Terms") are a binding agreement between RemoteGymp Ltd, registered in Northern Ireland under company number NI742463, whose registered office is at B1 Portview Trade Centre, BT4 1HE, United Kingdom ("RemoteGymp", "we", "us" or "our"), and the person or organisation using the Services ("you" or "Customer").

The "Services" are the RemoteGymp websites, hosted and self-hosted remote-support software, technician dashboard, endpoint agents, remote-control, file-transfer, command, diagnostic, licensing, trial, billing, support, APIs and related features and documentation.

1. Eligibility, authority and acceptance

1.1 You must be at least 18 and legally able to enter into a contract.

1.2 If you use the Services for an organisation, you confirm that you have authority to bind it. If you use the Services wholly or mainly outside your trade, business, craft or profession, you are a "Consumer". Otherwise, you are a "Business Customer".

1.3 These Terms apply when you click or otherwise actively indicate that you accept them. If you do not accept them, you must not create or use an account or use the Services.

1.4 Acceptance is required for each initial account sign-up and each new user added to an existing account. RemoteGymp may keep an audit record of the accepted version, date and time, user and organisation identifiers, and relevant technical evidence such as the sign-in or network address. Where an organisation provisions users centrally, an authorised administrator may accept these Terms on the organisation's behalf, and each provisioned user must accept them at first sign-in before using the Services.

1.5 You must provide accurate account information, keep it current, protect credentials, recovery codes, API keys, enrolment credentials and access links, and promptly report suspected compromise. You are responsible for activity performed through your account except to the extent caused by RemoteGymp's breach of these Terms or failure to use reasonable care.

2. Licence and ownership

2.1 Subject to these Terms and payment of applicable charges, RemoteGymp grants you a limited, non-exclusive, non-transferable, non-sublicensable and revocable right to use the Services during your subscription or authorised trial for your own lawful remote-support purposes.

2.2 RemoteGymp and its licensors retain all rights in the Services, software, documentation, branding and related intellectual property. No rights are granted except those expressly stated.

2.3 You may not copy, sell, rent, sublicense or commercially exploit the Services; circumvent licensing, security, usage or access controls; reverse engineer them except where applicable law cannot exclude that right; interfere with their operation; or use them to build or benchmark a competing product for publication without our written consent.

2.4 We may provide updates, patches or replacements. Some updates may be required for security, compatibility or continued access.

3. Customer systems, users and data

3.1 You retain ownership of data, files, screen content, commands, device information and other material that you or your authorised users submit, display, transmit or make available through the Services ("Customer Data").

3.2 You grant RemoteGymp a limited right to host, transmit, process, copy and otherwise use Customer Data only as needed to provide, secure and support the Services, comply with law, and exercise our rights under these Terms.

RemoteGymp may generate and use aggregated or de-identified data derived from operation of the Services for analytics, security and service improvement, provided such data is not reasonably capable of being associated with you, any user, or any identifiable individual, and is not disclosed in any form that identifies you.

3.3 You are responsible for your devices, networks, backups, configurations, authorised users, technicians, permissions and the legality, accuracy and integrity of Customer Data. You must maintain appropriate independent backups; the Services are not an archival or backup service.

3.4 When RemoteGymp processes personal data on a Business Customer's documented instructions, the Data Processing Agreement forms part of these Terms. Our handling of personal data is described in the Privacy Notice.

4. Remote access, consent and acceptable use

4.1 Remote access can display private information and permit powerful actions on another device. Before connecting, monitoring, recording, transferring files, executing commands or installing an agent, you must have all permissions, notices and consents required by the device owner, user, employer, customer and applicable law.

4.2 You decide which devices and people are accessed, who is authorised, what actions are taken and whether a session should continue. RemoteGymp does not supervise individual sessions.

4.3 You must not use the Services to:

• access a device, account or data without authorisation;
• stalk, harass, deceive, exploit or invade another person's privacy;
• distribute malware, ransomware or harmful code;
• steal credentials, payment data, confidential information or identity information;
• commit fraud or violate intellectual-property, computer-misuse, surveillance, employment,

privacy, export-control, sanctions or other applicable law;

• disrupt, overload, probe or compromise the Services or third-party systems; or
• conceal or misrepresent your identity or authority in connection with remote access.

4.4 You are responsible for technicians, administrators, invited users and anyone using access links or credentials that you issue. You must promptly revoke access that is no longer required.

4.5 You represent that you are not, and are not owned or controlled by, a person subject to trade sanctions administered by the UK, EU, US or UN, and that you will not make the Services available in or to any territory subject to comprehensive sanctions. We may suspend or terminate access immediately where we reasonably believe continued provision would breach export control or sanctions law.

4.6 Our AI resolution feature is optional and is initiated by the person requesting support. Where it is used, the text entered, user-selected screenshots and related system, configuration, diagnostic and performance data are processed to generate a suggested resolution. Terminal output is sent only where a user enters it or deliberately includes it in the information submitted to the feature. Users are told when they are interacting with AI. An organisation's owner may disable the feature for all of that organisation's users. Suggested resolutions are advisory and you remain responsible for actions taken during a session.

4.7 You must not use the Services to process protected health information subject to HIPAA, cardholder data subject to PCI DSS, or data subject to sector-specific regulation, unless we have entered into a separate written agreement covering that use.

5. Subscriptions, charges and cancellation

5.1 Prices, included usage, billing frequency and plan limits are shown at checkout or in an order form. Usage-based subscription charges are billed in arrears by calendar month. Any other charges are payable as stated at checkout or in the order form. Charges exclude taxes unless stated otherwise.

5.2 Subscriptions renew for successive calendar months until cancelled. You authorise our payment provider to collect renewal charges using the saved payment method. We may change prices on at least 30 days' notice, effective from the next renewal.

5.3 You may cancel at any time through your billing settings, without contacting us and by the same means you used to subscribe. Cancellation takes effect at the end of the calendar month in which you cancel, and you retain access until that date. Charges already paid are non-refundable except where these Terms, the checkout terms or applicable law require otherwise.

5.4 We may suspend access for overdue charges after reasonable notice. You remain responsible for amounts accrued before suspension or cancellation.

5.5 Trials and promotional access may be limited, changed or withdrawn. We may use proportionate technical and account signals to prevent repeated or abusive trials, as explained in the Privacy Notice.

6. Additional Consumer terms

6.1 This section applies if you are a Consumer. Nothing in these Terms excludes or limits any right or remedy available to you under the mandatory law of your country of residence, and where those laws give you greater protection than these Terms, those laws prevail.

6.2 We will supply the Services with reasonable care and skill, as described, and fit for any purpose you made known to us before purchase.

6.3 If the Services are not in conformity, you may require us to bring them into conformity free of charge and within a reasonable time. If we fail to do so, or the lack of conformity is serious, you may obtain a proportionate price reduction or terminate this agreement and receive a refund of amounts paid for the affected period. These remedies are in addition to any other rights you have in law.

6.4 If you contract online you may have a statutory right to cancel within 14 days. Details applicable to your purchase are provided before checkout and in a durable confirmation. If you expressly ask us to begin providing a paid service during that period and then cancel, we may charge a proportionate amount for the service supplied, where the law permits. Any loss of the withdrawal right for supplied digital content applies only after the express request and acknowledgement the law requires.

6.5 You may cancel at any time in your billing settings. Cancellation takes effect at the end of the calendar month in which you cancel.

6.6 Please contact [email protected] with any complaint; we aim to respond within three calendar months. We are willing, but not obliged, to consider using RetailADR, at https://www.retailadr.org.uk/, where its rules permit it to consider the dispute.

6.7 If you are a Consumer in Australia, our goods and services come with guarantees that cannot be excluded under the Australian Consumer Law. Nothing in these Terms excludes, restricts or modifies those guarantees. Where permitted, our liability for breach of a guarantee in respect of services is limited to resupplying the services or paying the cost of resupply.

6.8 Provisions concerning governing law, liability, refunds, suspension, changes and termination apply to Consumers only to the extent permitted by applicable consumer law.

7. Service operation and changes

7.1 We aim to provide a reliable service but do not promise that it will be uninterrupted, error-free, secure against every threat, compatible with every device or network, or able to recover every session or item of data.

7.2 Internet, cloud, identity, payment, operating-system, network and device providers are outside our control. Their failures or changes may affect the Services.

7.3 We may maintain, patch, change or discontinue features. Where reasonably practicable, we will give advance notice of a material reduction to paid functionality.

7.4 Support, availability or service-level commitments apply only if stated in your plan or a separate written agreement.

8. Security

8.1 We will use reasonable technical and organisational measures appropriate to the nature and risk of the Services.

8.2 No system is completely secure. You are responsible for appropriate access controls, multi- factor authentication where offered, least-privilege permissions, endpoint security, network security, patching, staff training, backups and incident procedures.

8.3 You must promptly notify [email protected] of a suspected vulnerability, unauthorised access or security incident involving the Services and must not publicly disclose a vulnerability before we have had a reasonable opportunity to investigate and remediate it.

9. Confidentiality

Each party will protect the other's non-public confidential information using reasonable care and use it only to perform or receive the Services. This obligation does not cover information that is public without breach, already lawfully known, independently developed or lawfully received without restriction. A party may disclose information when legally required after giving notice where permitted.

10. Feedback

If you provide suggestions or feedback, you grant RemoteGymp a worldwide, perpetual, irrevocable, royalty-free right to use it without restriction or payment, provided we do not identify you publicly without permission.

11. Disclaimers

11.1 To the maximum extent permitted by law, the Services are supplied on an "as available" basis. RemoteGymp excludes implied terms, warranties and conditions that may lawfully be excluded.

11.2 RemoteGymp does not warrant that remote access will always be available or successful, that all threats or errors will be detected or prevented, or that use of the Services will satisfy every legal, regulatory or sector-specific requirement applicable to you.

11.3 You remain responsible for deciding whether the Services are suitable for your purpose and for the consequences of actions performed during remote sessions. Nothing in this Section excludes the statutory rights stated in Section 6.

12. Limitation of liability

12.1 Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or wilful misconduct.

12.2 Subject to Sections 6 and 12.1, RemoteGymp is not liable for indirect, incidental, special, punitive or consequential loss, or for loss of profits, revenue, business, opportunity, goodwill, anticipated savings or data, even if the possibility was known.

12.3 Subject to Sections 6 and 12.1, RemoteGymp's total aggregate liability arising out of or in connection with the Services and these Terms, whether in contract, tort (including negligence), misrepresentation, restitution, breach of statutory duty or otherwise, will not exceed the subscription fees paid or payable in the six months immediately preceding the event giving rise to the claim. For a free or trial service, the cap is £0.

12.3A For RemoteGymp's liability for breach of the Data Processing Agreement, breach of its confidentiality obligations under Section 9, or a Personal Data Breach caused by RemoteGymp's breach of these Terms, the limitation in Section 12.3 is replaced by a cap of the subscription fees paid or payable for the twelve months immediately preceding the event giving rise to the claim.

12.4 The limitations in this Section apply to the maximum extent permitted by law and reflect the allocation of risk and charges for the Services. Nothing in this Section reduces a Consumer's mandatory statutory remedies.

13. Business Customer indemnity

13.1 If you are a Business Customer, you will indemnify RemoteGymp against third-party claims, damages and reasonable costs arising from your unlawful or unauthorised remote access, your Customer Data, your failure to obtain required consent, or your material breach of Section 4. This does not apply to the extent the claim was caused by RemoteGymp's breach, negligence or wilful misconduct. This Section does not apply to Consumers.

13.2 RemoteGymp will indemnify you against third-party claims that the Services, as supplied by RemoteGymp and used in accordance with these Terms, infringe that third party's intellectual property rights, and against damages and reasonable costs finally awarded. This does not apply to the extent the claim arises from Customer Data, from use in combination with anything not supplied by RemoteGymp, or from use in breach of these Terms. If the Services become, or RemoteGymp reasonably believes they may become, the subject of such a claim, RemoteGymp may at its option procure the right to continue use, modify or replace the affected part, or terminate the affected subscription and refund fees paid for the period after termination.

14. Suspension and termination

14.1 You may terminate these Terms by cancelling paid subscriptions and ceasing use.

14.2 We may suspend or terminate access where reasonably necessary because of material breach, non-payment, a security threat, suspected fraud or unlawful use, risk to the Services or others, or a legal requirement. Where appropriate, we will give notice and an opportunity to remedy.

14.3 On termination, licence rights cease and you must stop using and uninstall the relevant software. You are responsible for exporting data before access ends. We may delete Customer Data after a reasonable wind-down period, subject to law and the DPA.

14.4 Sections intended by their nature to survive termination do so, including Sections 2.2, 3, 9, 10, 11, 12, 13, 16 and 17.

15. Changes to these Terms

15.1 We may update these Terms to reflect changes to the Services, law, security or our business. We will give existing paid subscribers at least 30 days' notice of material changes by email or through the Services unless an urgent legal or security reason requires earlier effect. Where you cancel in response to a notified change, cancellation takes effect no later than the date the change takes effect, and the change will not apply to you.

15.2 An updated version applies from the effective date stated in the notice. If you do not agree, you must stop using the Services and cancel before the new version takes effect. Changes do not retrospectively reduce rights or increase charges already accrued.

16. Governing law and disputes

16.1 These Terms and non-contractual disputes are governed by the laws of England and Wales.

16.2 If you are a Business Customer, the courts of England and Wales have exclusive jurisdiction. If you are a Consumer, this choice does not deprive you of mandatory protections of the country in which you live, and you may bring proceedings in any court available to you under applicable law.

16.3 Before starting formal proceedings, each party should give the other written notice and a reasonable opportunity to resolve the dispute, except where urgent relief is required.

17. General

17.1 Neither party is liable for delay or failure caused by events outside its reasonable control, except that this does not excuse payment obligations already due.

17.2 You may not assign these Terms without our written consent. We may assign them as part of a reorganisation, financing, merger or sale, provided this does not reduce a Consumer's mandatory rights.

17.3 If a provision is unenforceable, it will be modified only as much as necessary and the rest will remain effective. Failure to enforce a provision is not a waiver.

17.4 These Terms, the Privacy Notice, applicable DPA, checkout or order details and any expressly incorporated written terms form the entire agreement about the Services. In the event of conflict the following order of precedence applies: (1) the DPA, in respect of the processing of Personal Data only; (2) an order form signed by RemoteGymp; (3) these Terms; (4) the Privacy Notice.

17.5 Notices to RemoteGymp may be sent to [email protected] or RemoteGymp Ltd, B1 Portview Trade Centre, BT4 1HE, United Kingdom. We may send notices to the account email address or through the Services.

RemoteGymp Privacy Notice

Version: 2026-10-12

Effective date: 12 October 2026

1. Who we are

RemoteGymp Ltd, registered in Northern Ireland under company number NI742463, of B1 Portview Trade Centre, BT4 1HE, United Kingdom ("RemoteGymp", "we", "us" or "our"), provides remote-support software and related websites and services.

For personal data used to run our business, websites, accounts, billing and support, RemoteGymp is normally the controller. When we process screen content, files, device data or other personal data on a business customer's instructions to provide the service, that customer is normally the controller and RemoteGymp is its processor.

Contact us at [email protected] or by post at the address above.

2. Personal data we collect

Depending on how you use RemoteGymp, we may collect:

• account and contact data, such as name, email address, organisation, role and preferences;
• authentication and security data, such as password hashes, sign-in events, multi-factor and

recovery status, identity-provider details, IP address, device/browser information and security alerts;

• subscription and transaction data, such as plan, invoices, payment status and limited payment

identifiers supplied by our payment provider; we do not need to store full card details;

• service and device data, such as device name, operating-system and agent version, enrolment and

licence status, connection/session metadata, settings, diagnostic logs and audit events;

• support communications, attachments and troubleshooting information;
• website data, such as pages requested, essential cookie or local-storage values and technical

logs;

• trial-abuse prevention signals, which may include normalised or hashed device, network and

account identifiers; and

• Customer Data handled during remote support, which may include screen content, filenames,

transferred files, commands, terminal output and other content chosen by the customer.

We may receive data directly from you, an organisation that manages your account, a person who invites or supports you, your device, identity and payment providers, and infrastructure or security providers.

3. Why we use personal data

We use personal data as follows:

Our lawful bases are performance of a contract, steps requested before entering a contract, compliance with legal obligations, and our legitimate interests in operating, securing, supporting and improving RemoteGymp and preventing abuse. We rely on consent where the law specifically requires it, including for non-essential cookies or particular marketing.

Where we rely on legitimate interests, we have carried out a balancing assessment and will provide a summary on request.

Where data is required to create or secure an account, take payment or deliver the Services, failure to provide it may mean we cannot provide the relevant feature.

4. Remote-session content

Customers decide which devices and people may be accessed and what data is displayed or transferred. A customer using RemoteGymp must provide its own privacy information and obtain any consent or other legal authority required for monitoring, recording, remote access or data transfer.

RemoteGymp processes Customer Data to provide the requested service, maintain security and comply with documented lawful instructions. Customers should avoid exposing personal data that is not needed for the support task and should maintain their own backups.

5. Sharing

Android managed-device location

On enrolled Android devices, RemoteGymp can collect approximate location, accuracy and capture time for the managing organisation's device-management purposes. Reporting requires organisation policy, an in-app disclosure and Android permission. With background permission, reporting can occur while the app is closed. Successful reports are limited to once every six hours; RemoteGymp does not continuously track GPS location. You can revoke permission in Android settings. Revoking permission stops further collection but does not automatically delete existing records.

Android support notifications

RemoteGymp uses Google Firebase Cloud Messaging to deliver attended-support notifications. Firebase processes installation identifiers and technical app/device information to provide this service. RemoteGymp sends a support-request event and session identifier through Firebase, not screen content, support-chat messages or transferred documents. Receiving a notification does not start screen sharing; you must separately approve the support session and Android screen sharing.

Service providers and other recipients

We may share personal data with:

• hosting, networking, security, monitoring, email, support and software providers;
• payment processors, banks and accounting providers;
• identity providers selected by a customer;
• professional advisers, auditors and insurers;
• a buyer, investor or successor involved in a genuine corporate transaction; and
• courts, regulators, law-enforcement bodies or others where required or permitted by law.

Providers may use personal data only for the contracted purpose and must protect it appropriately. We do not sell personal data.

6. International transfers

Some providers or customers may process personal data outside the United Kingdom. Where restricted transfers occur, we use an adequacy regulation, recognised contractual safeguards or another lawful transfer mechanism and apply supplementary measures where appropriate. Contact us for information about the safeguard relevant to your data.

7. Retention

We keep personal data only as long as reasonably needed for the purpose collected, including providing the Services, security, dispute resolution and legal, tax, accounting and audit requirements. Retention depends on the data and account status. We generally retain account, contract, payment and acceptance evidence for the applicable legal and claims period; operational logs and session metadata for a shorter security and troubleshooting period; support records while useful to resolve and evidence the issue; and trial-abuse signals only while proportionate to prevent repeated misuse. Backups are deleted or overwritten on their normal protected cycle.

Customers control retention of data held in their own self-hosted installation. A business customer’s DPA or order may specify different return or deletion arrangements for Customer Data.

Indicative retention criteria

8. Security

We use technical and organisational measures designed for the nature and risk of the data, including access controls, authentication controls, encryption in transit, logging, patching, backup and incident-management practices. No internet service can guarantee absolute security.

9. Your rights

Subject to applicable law, you may ask us to:

• provide access to your personal data;
• correct inaccurate or incomplete data;
• erase data;
• restrict processing;
• provide portable data;
• stop processing based on legitimate interests;
• stop direct marketing; or
• review certain solely automated decisions with legal or similarly significant effects.

Where processing relies on consent, you may withdraw it without affecting earlier lawful use. We may need to verify your identity and may be unable to fulfil a request where a legal exemption applies. If RemoteGymp processes data only for a business customer, we may refer the request to that customer.

You may complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. If you are in the EEA you may instead complain to the supervisory authority of your country of residence, work, or the place of the alleged infringement. We would welcome the opportunity to address your concern first.

10. Cookies and local storage

Our sites and Services use essential cookies or local storage for functions such as sign-in, security, preferences and language selection. If we introduce non-essential analytics, advertising or similar technologies, we will provide relevant information and obtain consent where required.

We also use limited device and network characteristics to detect repeated or abusive free trials, as described in section 2. We do not use cookies or similar technologies for advertising or cross-site tracking.

11. Children

RemoteGymp is not directed to people under 18, and people under 18 must not create an account.

12. Automated processing

We use rules and risk signals to detect suspected fraud, security threats and repeated trial abuse. These may result in a restriction on account access. You may request human review of any such restriction by contacting [email protected], and we will provide a decision by a member of staff. We do not use these measures for profiling unrelated to security and abuse prevention.

13. AI-assisted resolution

Where you choose to use our AI resolution feature, the text you enter, user-selected screenshots and related system, configuration, diagnostic and performance data are processed to generate a suggested resolution. Terminal output is sent only where you enter it or deliberately include it in the information submitted to the feature. You are told when you are interacting with AI. An organisation's owner may disable the feature for all of that organisation's users. Suggested resolutions are advisory and are not solely automated decisions producing legal or similarly significant effects.

14. Changes

We may update this Notice when our practices, providers or legal duties change. We will publish the new version and bring material changes to the attention of affected users where appropriate.

RemoteGymp Data Processing Agreement

Version: 2026-08-28

Effective date: 28 August 2026

This Data Processing Agreement ("DPA") forms part of the RemoteGymp Terms of Service, an order form or another agreement for the Services (the "Agreement") between the customer ("Customer") and RemoteGymp Ltd, company number NI742463, of B1 Portview Trade Centre, BT4 1HE, United Kingdom ("RemoteGymp").

1. Scope and roles

1.1 This DPA applies where RemoteGymp processes Personal Data on Customer's behalf in providing the Services. Customer is the Controller and RemoteGymp is the Processor, except where applicable law assigns different roles.

1.2 Customer instructs RemoteGymp to process Personal Data as necessary to provide, secure and support the Services, comply with the Agreement and Customer's documented lawful instructions, and as described in Schedule 1.

1.3 Customer is responsible for the lawfulness, fairness and transparency of the processing; the accuracy and minimisation of Personal Data; all required notices, consents and other legal bases; and the lawfulness of its instructions and remote access.

1.4 Where Customer deploys the Services in its own environment, Customer alone determines the means and purposes of processing within that environment and RemoteGymp is not a Processor of Personal Data held there. RemoteGymp acts as Processor only in respect of licensing and entitlement data transmitted to RemoteGymp. Sections 6, 7 and 8 apply only to data RemoteGymp processes.

1.5 Applicable Data Protection Law means all laws relating to data protection, privacy and the processing of Personal Data applicable to a party's processing under this DPA, including (a) the UK GDPR and the Data Protection Act 2018; (b) Regulation (EU) 2016/679 and Member State implementing legislation; (c) the Swiss Federal Act on Data Protection; and (d) the US State Privacy Laws identified in Schedule 3.

Controller, Processor, Data Subject, Personal Data, Personal Data Breach and processing have the meanings given in Regulation (EU) 2016/679, and equivalent terms under any other Applicable Data Protection Law shall be construed accordingly.

2. Processor obligations

RemoteGymp will:

• process Personal Data only on documented instructions, including for international transfers,

unless required by law, in which case it will notify Customer before processing unless legally prohibited;

• promptly tell Customer if, in RemoteGymp's opinion, an instruction infringes applicable

data-protection law;

• ensure that authorised personnel are bound by confidentiality;
• implement and maintain measures appropriate to the risk as described in Schedule 2;
• taking account of the nature of processing, reasonably assist Customer with data-subject

requests, security, breach notifications, data-protection impact assessments and prior consultation duties;

• notify Customer without undue delay after becoming aware of a Personal Data Breach affecting

Customer Personal Data and provide available information reasonably needed for Customer's obligations; and

• make available information reasonably necessary to demonstrate compliance with this DPA.

RemoteGymp's assistance may be charged at reasonable rates where the request is unusually burdensome or arises from Customer's acts or instructions, unless the assistance is required because of RemoteGymp's breach.

3. Subprocessors

3.1 Customer gives RemoteGymp general written authorisation to use subprocessors to provide the Services. RemoteGymp will impose data protection obligations on each subprocessor by written contract that are no less protective than those in this DPA, and shall remain fully liable to Customer for the performance of each subprocessor's data protection obligations.

3.2 RemoteGymp will give the account contact at least 30 days' advance notice by email of an intended new subprocessor that will process Customer Personal Data.

3.3 Customer may object on reasonable data-protection grounds within 30 days of notice. The parties will work in good faith on a reasonable solution. If none is available, Customer may terminate the affected Service before the new subprocessor begins processing; this is Customer's sole remedy for the objection, without affecting mandatory rights.

4. International transfers

RemoteGymp will not make a restricted transfer of Customer Personal Data unless it uses a lawful transfer mechanism recognised by Applicable Data Protection Law. The parties will reasonably cooperate on necessary transfer documentation and supplementary measures.

5. Data-subject requests

If RemoteGymp receives a request relating to Customer Personal Data, it will not respond on Customer's behalf unless authorised or legally required. Where practicable, RemoteGymp will forward the request to Customer. Customer is responsible for responding, and RemoteGymp will provide reasonable assistance appropriate to the nature of processing.

6. Security and breaches

6.1 RemoteGymp will assess processing risks and maintain appropriate technical and organisational measures. Customer acknowledges that security changes over time and that Schedule 2 describes categories of controls rather than a guarantee against every incident.

6.2 A breach notification is not an admission of fault or liability. Customer is responsible for notifications to individuals and regulators unless law expressly requires RemoteGymp to notify them directly.

7. Return and deletion

At the end of the affected Services, and at Customer's choice where reasonably technically available, RemoteGymp will return or delete Customer Personal Data and existing copies, unless law requires retention. Data in protected backups may remain until overwritten through the normal backup cycle and will remain protected and unavailable for ordinary use. Customer must export required data before account access ends.

8. Audit

8.1 RemoteGymp will first satisfy audit requests using current independent reports, certifications, policies, questionnaires or other relevant evidence where available.

8.2 If that evidence is insufficient, Customer may conduct one audit in any 12-month period, and additional audits following a relevant Personal Data Breach or regulator request. Audits require reasonable advance notice, must occur during business hours, must minimise disruption and risk, must protect other customers and confidential information, and may not include vulnerability or penetration testing without written agreement.

8.3 Customer bears reasonable audit costs unless the audit identifies a material breach by RemoteGymp.

9. Liability and priority

The exclusions and limitations of liability in the Agreement apply to this DPA to the fullest extent permitted by law. If this DPA conflicts with the Agreement on processing Personal Data, this DPA controls for that conflict.

10. Term

This DPA starts when Customer accepts the Agreement or the parties otherwise enter it and continues while RemoteGymp processes Customer Personal Data. Governing law and jurisdiction are those in the Agreement.

Schedule 1 — Processing details

Subject matter and duration: Provision, security, maintenance and support of the Services for the term of the Agreement and the limited deletion, backup and legal-retention period afterwards.

Nature and purpose: Collection, recording, organisation, transmission, hosting, retrieval, consultation, troubleshooting, protection, deletion and other processing needed for remote support, account administration and Customer's documented instructions.

Data subjects: Customer's users, administrators, technicians, staff, contractors, clients, end users, device users, support contacts and other people whose data Customer makes available.

Personal Data: Names, usernames, business contact details, identifiers, IP and device details, authentication and permission data, audit and session metadata, support information, screen content, filenames, files, commands, terminal output and other content selected by Customer.

Special-category and high-risk data: The Services are not designed to require special-category or criminal-offence data, but such data may incidentally appear on a remotely accessed device, in content selected by Customer, or in free-text descriptions entered by a person requesting support. Customer must minimise it and have all additional legal conditions and safeguards required for its processing.

Frequency: As initiated by Customer and its authorised users, with continuous supporting security and operational processing where needed.

Schedule 2 — Security measures

RemoteGymp's measures, appropriate to the relevant deployment and risk, include:

• logical access controls, unique accounts, role-based permissions and least privilege;
• authentication protections and multi-factor authentication where supported;
• encryption of supported communications in transit and appropriate protection of secrets;
• segregation between customers and controlled administrative access;
• security, operational and acceptance logging with access restrictions;
• secure development, change control, dependency review, patching and vulnerability handling;
• availability monitoring, backup and recovery arrangements appropriate to hosted components;
• malware, abuse, network and infrastructure protections;
• incident detection, escalation, response and post-incident review;
• personnel confidentiality, access review and security awareness;
• due diligence and contracts for subprocessors; and
• periodic review and improvement of controls in light of risk and technology.

Customer remains responsible for security of its endpoints, networks, self-hosted environment, credentials, user permissions, backups and configuration.

Schedule 3 — US State Privacy Laws

1. Scope. This Schedule applies where RemoteGymp processes Personal Information subject to US State Privacy Laws, and prevails over the body of this DPA for that processing.

2. Roles. Customer is a Business or Controller; RemoteGymp is a Service Provider or Processor.

3. Restrictions. RemoteGymp shall not: (a) sell or share Personal Information; (b) retain, use or disclose Personal Information for any purpose other than performing the Services specified in the Agreement, or as otherwise permitted by the CCPA; (c) retain, use or disclose Personal Information outside the direct business relationship between the parties; or (d) combine Personal Information with information received from another source, except as permitted by the CCPA.

4. Certification. RemoteGymp certifies that it understands the restrictions in paragraph 3 and will comply with them.

5. Assistance. RemoteGymp shall assist Customer in responding to consumer rights requests and, where required, honour opt-out preference signals including Global Privacy Control.

6. Notice. RemoteGymp shall notify Customer if it determines it can no longer meet its obligations under US State Privacy Laws.