“Adequacy Decision” means a decision, determination, or finding issued by a competent supervisory authority or governmental body under the Data Protection Laws, recognizing that a third country or jurisdiction ensures an adequate level of data protection.

“Controller” has the meaning given to it in the GDPR.

“Data Protection Laws” means all privacy, data protection, and data security laws, rules, and regulations applicable to the Processing of Personal Data under the Agreement.

“Data Subject” means an identified or identifiable natural person to whom Personal Data relates.

“Documented Instructions” means Customer’s complete and documented instructions to CRScube regarding the Processing of Personal Data.

“Personal Data” means any information defined as personal data, personally identifiable information, or an equivalent term under the Data Protection Laws, to the extent such information is provided to or Processed by CRScube (or its Sub-Processors) by or on behalf of Customer under the Agreement. For the avoidance of doubt, Personal Data does not include System Data or data that has been Anonymized.

“Personal Data Breach” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data Processed by CRScube (or its Sub-Processors) on behalf of Customer.

“Process” has the meaning given to it in the GDPR and “Process”, “Processes”, “Processing”, and “Processed” will be interpreted accordingly.

“Processor” has the meaning given to it in the GDPR.

“Sub-Processor” means any third party (including any Affiliate of CRScube) engaged by CRScube to Process Personal Data in relation to the Services.

1. Scope. This DPA applies to the Processing of Personal Data in connection with the Services.

2. Roles. The Parties’ respective roles for the Processing of Personal Data are as follows:

   1. Controller and Processor. If Customer determines the purposes and means of Processing, Customer is a Controller and CRScube is a Processor.

   2. Processor and Sub-Processor. If Customer Processes Personal Data for a third party, Customer is a Processor and CRScube is a Sub-Processor.

3. Support Services. To the extent CRScube provides support services to Customer (including technical, administrative, or operational support, whether escalated by Reseller), Customer agrees that CRScube’s access to Personal Data for such support or troubleshooting purposes constitutes a Documented Instruction. CRScube will Process Personal Data as a Processor (or Sub-Processor) in accordance with this DPA.

4. Details of Data Processing. The specific details of the Processing of Personal Data are set forth in Appendix 1.

5. Compliance with Laws. Each Party is responsible for complying with the Data Protection Laws applicable to it and binding on it under this DPA.

1. Documented Instructions. CRScube Processes Personal Data in accordance with the Documented Instructions (which, if Customer is a Processor, may be based on the instructions of the relevant Controller).

2. Additional Instructions. Any instructions outside the scope of the Documented Instructions require prior written agreement between CRScube and Customer, including agreement on any additional fees payable by Customer to CRScube. If CRScube declines or is unable to follow additional or amended instructions requested by Customer that are outside the scope of, or changed from, those given or agreed to be given in this DPA, Customer is entitled to terminate the affected Agreement upon written notice.

3. Infringement of Laws. Customer agrees that CRScube has no general obligation to monitor or verify the legality or accuracy of any Documented Instructions or Personal Data provided by Customer. If CRScube forms a reasonable opinion that the Documented Instructions infringe the Data Protection Laws, CRScube will promptly inform Customer, and CRScube will have the right to suspend performance of the affected Processing without liability until Customer confirms, amends, or withdraws such Documented Instructions.

1. Compliance and Authority. Customer will comply with the Data Protection Laws applicable to it in its role (whether as a Controller or a Processor) under the Agreement and represents and warrants that (a) it has all necessary legal bases, notices, and authorizations to provide Personal Data to CRScube (or its Sub-Processors); (b) the Documented Instructions comply with the Data Protection Laws; (c) if Customer is a Processor, it has obtained all required approvals from its Controller for CRScube’s engagement; and (d) Personal Data does not exceed the scope set forth in Section 2.

2. Security Responsibility. Customer is solely responsible for its internal security environment in connection with the Services, including (a) maintaining the confidentiality and security of user account credentials and access rights within Customer’s control; (b) implementing appropriate security measures on systems, networks, and devices used to access or use the Services; and (c) ensuring the secure transmission and minimum necessary disclosure of Personal Data provided to CRScube in connection with the Professional Services.

1. Processing Limitations. CRScube will Process Personal Data in accordance with the Documented Instructions and solely to provide, maintain, and support the Services. CRScube will not sell, share, retain, or Process Personal Data for any other purpose, except as required by the Data Protection Laws.

2. Compliance with Laws. CRScube will comply with the Data Protection Laws applicable to it in its role under the Agreement.

3. Personnel Confidentiality and Security. CRScube will limit access to Personal Data to personnel with a need-to-know, and ensure such personnel are bound by confidentiality obligations and appropriately trained on data protection.

4. Legal Requests. If CRScube receives a binding legal request to disclose Personal Data, it will, unless prohibited by law, promptly notify Customer in writing before disclosure and limit disclosure to the minimum scope legally required.

5. Inability to Comply. CRScube will promptly notify Customer in writing if it determines that it can no longer meet its obligations under the Agreement or the Data Protection Laws.

1. Technical and Organizational Measures. CRScube will implement and maintain appropriate organizational, administrative, physical, and technical security measures designed to protect Personal Data against Personal Data Breaches and to ensure a level of security appropriate to the risk posed by the Processing of Personal Data. CRScube’s specific technical and organizational security measures are set forth in Appendix 2.

2. Review and Modification. CRScube regularly reviews and modifies its security measures to reflect changing technology, legal and regulatory requirements, operational risks, and industry best practices. CRScube may update or modify its security measures from time to time, provided that such updates or modifications do not result in a material degradation or reduction of the overall level of security provided for Personal Data.

3. Security Standards and Certifications. CRScube will maintain relevant third-party security certifications or audit attestations to demonstrate the ongoing effectiveness and operational reliability of its technical and organizational measures.

1. Authorized Sub-Processors. Customer provides a general authorization for CRScube to engage Sub-Processors. The current list of Sub-Processors is available at https://www.crscube.io/legal.

2. Notice and Objection. CRScube will provide at least thirty (30) days’ prior written notice of any new Sub-Processors by updating the list of Sub-Processors available at https://www.crscube.io/legal or by sending an email notification to Customer’s registered administrative contact. Customer may object in writing on reasonable, documented data protection grounds within thirty (30) days of notice (“Objection”). Otherwise, the engagement of new Sub-Processors is deemed authorized by Customer.

3. Resolution and Termination. Upon receipt of an Objection by CRScube, the Parties will negotiate in good faith for thirty (30) days to reach a mutually agreeable resolution. If unresolved within such period, Customer may terminate the affected Agreement or Services relying on the proposed Sub-Processors upon written notice within fifteen (15) days thereafter.

4. Sub-Processor Obligations and Responsibility. CRScube will bind Sub-Processors to data protection terms no less protective than this DPA and remains fully responsible for their acts and omissions relating to the Processing of Personal Data.

1. Customer Responsibility. Customer is solely responsible for receiving, evaluating, and responding to requests from Data Subjects exercising their rights under the Data Protection Laws (“Data Subject Requests”).

2. Redirection. If CRScube (or Sub-Processors) receive a Data Subject Request directly, CRScube will promptly forward it to Customer without responding, except to acknowledge receipt without taking substantive action or position, or as required by the Data Protection Laws.

3. Assistance. Customer will first attempt to fulfill Data Subject Requests directly. To the extent Customer is unable to fulfill Data Subject Requests directly, CRScube will, upon Customer’s written request and considering the nature of the Processing, provide reasonable assistance to the extent required by the Data Protection Laws applicable to CRScube in its role as Processor or Sub-Processor.

4. Fees. To the extent permitted by the Data Protection Laws, CRScube may charge reasonable fees for assistance requiring CRScube’s significant resources, subject to prior mutual agreement.

1. Breach Notification. CRScube will notify Customer without undue delay after becoming aware of Personal Data Breach. To the extent known at the time, the notification will include (a) the nature, timing, and scope of Personal Data Breach (including affected records and Data Subjects); (b) the likely consequences; and (c) measures taken or planned to mitigate and remedy Personal Data Breach. Information may be provided in phases as it becomes available.

2. No Admission and Excluded Incidents. The notification will not be construed as an admission of fault or liability by CRScube. The unsuccessful security incidents or routine security events that do not compromise Personal Data do not constitute Personal Data Breach or trigger notification obligations.

3. Indemnification.

   1. Scope. To the extent Personal Data Breach is directly caused by CRScube’s breach of the Agreement, CRScube will indemnify, defend, and hold harmless Customer against reasonable, direct third-party damages, and necessary expenses (such as notification costs) arising from Personal Data Breach.

   2. Exclusions. CRScube will have no liability or indemnification obligation to the extent Personal Data Breach results from (a) Customer’s breach of the Agreement or Data Protection Laws; (b) CRScube’s adherence to the Documented Instructions; or (c) Customer’s (or End Users’) negligence, misconfiguration, credential compromise, or unauthorized access enabled by Customer.

   3. Sole Remedy and Liability Cap. This Section states Customer’s sole remedy and CRScube’s entire liability for Personal Data Breach. CRScube’s aggregate liability under this Section is subject to the liability caps and limitations set forth in the Agreement.

1. Processing Regions. CRScube will Process Personal Data only in the designated regions specified in Appendix 1 (“Processing Regions”). CRScube will not transfer or Process Personal Data outside the Processing Regions except as necessary to provide the Services or to comply with the Data Protection Laws or binding legal orders.

2. Transfer Mechanisms. To the extent Personal Data is transferred across borders, CRScube will ensure such transfers comply with the Data Protection Laws through recognized transfer mechanisms, including Standard Contractual Clauses (“SCCs”), Adequacy Decisions, or other statutory legal transfer frameworks. SCCs or other transfer mechanisms will not apply where an Adequacy Decision or statutory exception applies.

1. Term and Survival. This DPA will become effective on the effective date of the Agreement and will remain in effect until the termination or expiration of the Agreement and the complete deletion or return of Personal Data under this DPA.

1. Return or Deletion. Except as set forth in Sections 12.2 and 12.3 or as required by applicable laws, upon termination or expiration of the applicable Order Form, CRScube will, within ninety (90) days from receipt of Customer’s written return or deletion request, return or delete Personal Data held in production and sandbox environments.

2. Legal Retention Obligations. Notwithstanding Section 12.1, CRScube may retain Personal Data to the extent required by applicable statutory, regulatory, or legal obligations, or to the extent necessary to preserve the integrity of system audit trails, user access logs, or compliance records required for regulatory compliance. Any Personal Data retained pursuant to this Section 12 will remain strictly subject to the confidentiality and security obligations under the Agreement and this DPA, and will be Processed solely to comply with such obligations.

3. Backup Archives. Notwithstanding Section 12.1, if immediate deletion of Personal Data residing on encrypted backup archives or disaster recovery systems is technically infeasible, CRScube is not required to manually purge such data immediately, provided that CRScube (a) securely isolates such backups from active Processing; and (b) overwrites or destroys such backup data in accordance with CRScube’s standard backup deletion process.

1. Demonstration of Compliance. CRScube will make available to Customer all information reasonably necessary to demonstrate compliance with the obligations set forth in this DPA. Customer agrees that its audit and information rights under the Data Protection Laws or this DPA will be satisfied in the first instance by CRScube providing, no more than once per twelve (12) month period, any of the following: (a) CRScube’s then-current third-party security certifications and audit reports; (b) executive summaries of recent penetration tests or vulnerability assessments; or (c) responses to a reasonable, standard information security questionnaire provided by Customer.

2. On-Site Audits. If the information made available under Section 13.1 is not reasonably sufficient to confirm CRScube’s compliance with this DPA, and Customer has a reasonable, documented belief that CRScube is in material breach of its obligations under this DPA, or if an audit is required by the Data Protection Laws or a competent supervisory authority, Customer (or its designated independent third-party auditor) may conduct an audit of CRScube’s relevant Processing facilities and records, subject to the following conditions:

   1. Notice and Frequency. Customer must provide CRScube with at least thirty (30) days’ prior written notice of its intention to conduct an audit. An audit will be conducted no more than once per twelve (12) month period, except as required by a binding order of a supervisory authority or following Personal Data Breach.

   2. Scope and Limitations. An audit will be conducted during CRScube’s normal business hours, will not exceed three (3) business days, and will be designed to minimize disruption to CRScube’s business operations. Audit will be strictly limited to systems, facilities, and documentation directly used to Process Personal Data. Under no circumstances will Customer or its auditor be entitled to access CRScube’s source code, trade secrets, confidential information, or any data belonging to CRScube’s other customers.

   3. Auditor Requirements. Any third-party auditor designated by Customer must be an independent, qualified professional, will not be a competitor of CRScube, and will execute a non-disclosure agreement in a form reasonably acceptable to CRScube prior to commencement of the audit.

   4. Costs. Customer will bear all costs and expenses incurred by Customer and its auditors in connection with any audit conducted under this Section 13.2.

3. Sub-Processor Audits. Customer acknowledges and agrees that CRScube may not have the right to grant physical or direct access to the facilities and systems of Sub-Processors. To the extent Customer requests audits of Sub-Processors, CRScube will fulfill such request by providing available Sub-Processor audit reports or certifications and using commercially reasonable efforts to obtain any additional information reasonably requested by Customer. Direct audits of Sub-Processor’s facilities will be permitted only to the extent permitted under CRScube’s agreement with such Sub-Processor.

1. Limitation of Liability. Each Party’s total aggregate liability arising from or in connection with this DPA, any breach hereof, or the Processing of Personal Data (whether in contract, tort, indemnification, or otherwise) will be strictly subject to the exclusions, disclaimers, and aggregate liability caps set forth in the Agreement. Nothing in this DPA will be construed as expanding, increasing, or creating an independent cap on CRScube’s liability beyond the limits specified in the Agreement.

2. Data Legality and Compliance Assessment. Customer assumes sole responsibility for the accuracy, quality, integrity, and lawful acquisition of Personal Data provided to CRScube. CRScube has no obligation to evaluate the content or nature of Personal Data to identify specific legal, industry, or regulatory requirements applicable to Customer. Customer is solely responsible for evaluating CRScube’s security measures and independently determining whether the Services satisfy Customer’s legal and compliance obligations under the Data Protection Laws.

3. Processing Instructions. Customer acknowledges that CRScube Processes Personal Data strictly based on the Documented Instructions. CRScube will not be liable for any claims, losses, damages, or regulatory fines resulting from (a) CRScube’s adherence to the Documented Instructions; or (b) Customer’s failure to comply with its obligations under the Data Protection Laws.

4. No Legal Advice. CRScube does not provide legal, privacy, or regulatory advice. Any opinions, documentation, template forms, or recommendations provided by CRScube regarding compliance with the Data Protection Laws will not be deemed or relied upon as legal advice. Customer acknowledges and agrees that the Services may be used in ways that do or do not comply with the Data Protection Laws, and Customer is solely responsible for configuring and using the Services in a manner that complies with all laws applicable to Customer’s specific operational environment and jurisdiction.

1. Subject matter and purpose

   1. The purpose of the Processing of Personal Data by CRScube is the provision of the Services to support life science research, clinical operations, and related research or operational activities.

2. Nature

   1. The nature of the Processing of Personal Data includes (a) computation, storage, transmission, and structuring of Personal Data as necessary to provide the Software, and (b) access, review, configuration, data migration, and troubleshooting of Personal Data as necessary to perform the Professional Services and provide technical, administrative, or operational support as requested by Customer, in each case as described in the Documented Instructions and initiated by Customer.

3. Duration

   1. As between CRScube and Customer, the duration of the Processing of Personal Data is determined by Customer. The Processing of Personal Data will continue for the period during which CRScube provides the Services, plus the time required until CRScube securely deletes or returns Personal Data.

4. Categories of data subjects

   1. The Data Subjects could include the following:

      1. for clinical trial subjects, individuals participating in clinical trials or research managed by Customer;

      2. for healthcare professionals and site staff, principal investigators, coordinators, nurses, or other site personnel; or

      3. for customer personnel, employees, contractors, or agents of Customer or its authorized partners using the Services.

5. Categories of personal data

   1. The general categories of Personal Data Processed are determined by Customer, which could include:

      1. for clinical trial subjects, key-coded/pseudonymized subject identifier, demographic data (e.g., age, gender), and clinical observations; or

      2. for professional staff and personnel, name, business contact information (e.g., email address, phone number), role/title, professional qualifications, system credentials (e.g., usernames, audit trail logs), and electronic signatures.

6. Special categories of personal data (sensitive data)

   1. The special categories of Personal Data Processed are determined by Customer, which could include:

      1. data concerning health or medical conditions (e.g., medical history, clinical assessments, adverse events, lab results);

      2. data revealing racial or ethnic origin (commonly collected for trial demographics); or

      3. biometric or genetic data (if applicable to the specific clinical trial).

7. Processing regions

   1. CRScube Processes Personal Data only in South Korea, Japan, the United States, Germany, or Ireland (including Processing for the purposes of operation, maintenance, and technical support in connection with the Services). Any transfer or Processing of Personal Data outside these regions will be conducted strictly in accordance with Sections 7 and 10 of this DPA.

This Appendix 2 forms part of this DPA and describes the core technical and organizational security measures implemented and maintained by CRScube pursuant to Section 6 of this DPA.

1. Access Control and Authentication

   1. Logical Access. Enforces Role-Based Access Control (RBAC) based on the principle of least privilege and need-to-know access.

   2. Authentication. Requires Multi-Factor Authentication (MFA) for administrative and operational interactive user access to production environments, where technically applicable, together with strong authentication requirements.

   3. Session Control. Enforces automatic session timeouts and account lockouts after repeated failed login attempts.

2. Data Protection and Encryption

   1. Encryption in Transit. Encrypts Personal Data transmitted over public networks using TLS 1.2 or higher.

   2. Encryption at Rest. Encrypts Personal Data and backups stored in production databases and storage repositories using industry-standard algorithms (AES-256).

   3. Environment Isolation. Logically isolates Personal Data and maintains strict segregation between production, staging, and development environments.

3. System Availability and Business Continuity

   1. Data Backups. Performs automated, encrypted backups of production databases on a daily basis with multi-zone redundancy.

   2. Disaster Recovery. Maintains formal Disaster Recovery (DR) and Business Continuity plans, testing system recovery capabilities at least annually. 

   3. Infrastructure Resilience. Hosts production environments for the Services on tier-1 cloud providers offering high availability, physical facility security, and redundant power/networking.

4. Incident Management and Security Monitoring

   1. Logging and Audit Trails. Collects and retains security, access, and audit trail logs for monitoring and forensic investigations.

   2. Incident Response. Maintains a documented security incident response plan outlining detection, containment, investigation, and escalation procedures.

   3. Breach Notification. Notifies Customer without undue delay after becoming aware of Personal Data Breach in accordance with Section 9 of this DPA.

5. Operational Assurance and Vendor Management

   1. Security Assessments. Maintains third-party security certifications or attestations (e.g., ISO/IEC 27001) and conducts annual third-party penetration testing.

   2. Sub-Processor Diligence. Performs security assessments on all Sub-Processors prior to engagement and executes data protection agreements with equivalent protections.

   3. Personnel Confidentiality. Binds all employees and contractors to written confidentiality obligations and requires annual data security training.