Terms of Service

1. Welcome

Welcome! Orcus Technologies, Inc., which does business as TimeForge, SurveyConnect, and Lineup (“we,” “us,” “our,” or the “Company”), offers online business tools, applications, APIs, and data integrations that help our customers manage their workforce.

These Terms of Service (the “Agreement”) are a binding contract between you and us. Please read them carefully. The Agreement takes effect when you sign up for or use any of our Services, or access any content or material we make available through the Services (“Content”).

This Agreement includes our Privacy Policy. By using the Services, you confirm that you’ve read and understood this Agreement and agree to follow it. If you don’t agree, or can’t comply, you may not use the Services or any Content.

What “Services” means. “Services” means all of the software, applications, widgets, tools, and features we make available, including our platforms, help desk, APIs, and related support. It also includes new features and products we release, even ones that cost extra.

What’s not included. “Services” doesn’t include Professional Services. Professional Services are work we do at your request to build features, modifications, or customizations for you, and any other work outside our standard Services. If you need Professional Services, we’ll sign a separate written agreement with you that covers them.

If you have a signed agreement with us. If you have a signed agreement with us, such as a Master Service Agreement or order form, it controls wherever it conflicts with this Agreement. The rules in this Agreement are the defaults that apply when your signed agreement doesn’t say otherwise. The one exception is Section 28 (Privacy): it applies to every customer and controls over a signed agreement, and the Standard Contractual Clauses in Section 28 control over everything else.

2. Your data and information

Third-Party Data. The Services may give you access to data that comes from third parties or other users (“Third-Party Data”). Your license includes access to it, but we make no promises about whether it’s accurate, timely, or complete. It’s your responsibility to make sure any Third-Party Data you use is accurate, timely, and complete.

Your Data. Using the Services may involve information about you or your business, such as information about your employees, customers, clients, services, and finances (“Your Data”). You exclusively own Your Data, subject to our Privacy Policy.

User Content. Some parts of the Services let you upload or post information, such as employee names and photos, payment information, reviews, and organizational roles. This information may or may not be meant for others to see (“User Content”). For any User Content you post, you promise that:

1. you have the right to post it; and
2. neither the content nor our use of it under this Agreement violates this Agreement, the law, or anyone else’s rights (including copyright and other intellectual property, publicity, and personality rights), and it doesn’t suggest that we or anyone else is affiliated with or endorses you without their written consent.

Our license to your information. You give us a non-exclusive, transferable, assignable, royalty-free, worldwide license to use User Content and Your Data to provide the Services to you, within the limits of our Privacy Policy. Providing the Services includes testing, maintaining, and improving them.

Aggregated and de-identified data. We may create aggregated or de-identified data from Your Data and from how the Services are used (“Aggregated Data”). We may use Aggregated Data for any lawful purpose, including improving and developing our products, forecasting, and benchmarking. Aggregated Data can’t reasonably be used to identify you, your employees, any other individual, or any household, including when combined with other information. We’ll take reasonable measures to keep it that way, we won’t try to re-identify it, and we’ll require by contract anyone we share it with to meet these same obligations. We own Aggregated Data, and it isn’t Your Data or your Confidential Information.

3. Feedback and other materials you send us

If you send us questions, feedback, comments, suggestions, criticism, or other materials (“Received Materials”), we may treat them as non-confidential and free of any ownership or personal claims. We have no obligations regarding Received Materials. We may copy, use, share, display, edit, adapt, and distribute them without limits.

We may also use any ideas, concepts, know-how, or techniques in anything you send us for any purpose, including developing and marketing products, without paying or owing anything to anyone, including you.

The one exception: if we ever want to use your name or likeness, we’ll get your written permission first.

4. Changes to this Agreement

We may revise this Agreement from time to time. If we do, we’ll let you know by posting a notice on our website or emailing you, as appropriate.

If you keep using the Services after the changes take effect, you accept them. If you don’t agree, you can end this Agreement by emailing support@timeforge.com. Changes apply going forward and don’t affect disputes that arose before they took effect.

Changes to a signed agreement between us must be in writing and signed by both of us.

5. Payment and term

When you sign up with a credit card or other payment method, you authorize us to make the charges we disclose to you at sign-up, including recurring charges where they apply.

Unless your signed agreement says otherwise, your subscription renews automatically at the end of each billing period (monthly or annual, as you chose at sign-up) until you cancel. You can cancel at any time, as described in Section 16. Either of us may also choose not to renew by giving the other notice before the end of the current billing period.

6. Trials and beta testing

From time to time, we (or others on our behalf) may offer access to beta versions of the Services, or trials of paid subscriptions for a set period for free or at a reduced price (each a “Trial”). We decide who’s eligible for a Trial. To the extent the law allows, we may withdraw or change a Trial at any time, without notice and without liability.

Automatic charges after a Trial. Some Trials require your payment details to start.

• At the end of those Trials, we may automatically start charging you the applicable fees, beginning the day after the Trial ends, on a recurring monthly basis. By giving us your payment details for the Trial, you agree to these charges.
• To avoid being charged, you must cancel the paid subscription on your account’s subscription page, or close your account, before the Trial ends.
• To stop recurring monthly charges later, you must cancel on your account’s subscription page, or close your account, before the end of the current monthly period.
• You can’t end a paid subscription before the end of a period you’ve already paid for. Except as this Agreement specifically provides, we don’t refund fees you’ve already paid.

Beta versions. If your Trial is for a beta version, you understand that the beta hasn’t been fully developed and may have defects that wouldn’t be acceptable in a finished product. Beta versions are provided without any warranty, including the implied warranties of fitness for a particular purpose, merchantability, and non-infringement. Beta users have no claim against us for any reason related to their use of the Services during a beta Trial.

7. License and acceptable use

Your license. Subject to this Agreement, we give you a limited, non-exclusive, non-transferable license to use the Services for your internal business purposes. You can’t sublicense it. You have no rights in the Services beyond what this Agreement expressly gives you.

General limits.

• You may not download any part of our websites, or use any Services, except for your own business use.
• You may not use data mining, robots, or similar data-gathering tools, or otherwise exploit your access to the Services commercially.
• You may not use our trademarks, logos, or other graphics without our written permission, which we may refuse for any reason. Our logos and product and service names are our trademarks.
• Other trademarks on our websites or in the Services belong to their owners. Mentioning them doesn’t mean their owners approve of or endorse us, unless they’ve expressly said so.

Things you must not do or try to do. Beyond anything else that would be misuse of the Services, you must not:

• modify, tamper with, repair, or create derivative works of any of the Services;
• reverse engineer, disassemble, or decompile the software behind the Services, or try to discover or recreate its source code, except where the law expressly allows it;
• use the Services for research or benchmarking aimed at creating a competing or similar product;
• use the Services in any way not allowed by this Agreement, our Privacy Policy, or any other policy, instructions, or terms that apply to the Services;
• sell, lend, rent, resell, lease, sublicense, or transfer your rights in the Services to anyone else;
• remove, hide, or change any proprietary notices in the Services;
• use the Services in a way meant to avoid fees or exceed usage limits;
• use the Services to:
  • commit fraud or other illegal acts, run hoaxes or phishing schemes, or falsify or manipulate data;
  • send spam, junk mail, chain letters, pyramid schemes, or other unsolicited messages;
  • advertise or promote a product or service we don’t offer;
  • store or send content that is illegal, defamatory, threatening, pornographic, abusive, or otherwise objectionable; that encourages criminal behavior; or that violates anyone’s intellectual property, publicity, or privacy rights;
  • store or send viruses, malware, or other harmful code, or launch denial-of-service attacks; or
  • abuse, harass, or stalk anyone, or otherwise violate their legal rights;
• interfere with or disrupt the servers or networks we use to provide the Services or that other users rely on, break the rules of those networks, or interfere with anyone else’s use of the Services;
• access or try to access our other accounts, systems, or networks not covered by this Agreement, through password mining or any other means;
• place an unreasonable burden on the Services or our systems, as we determine; or
• share passwords or other access information or devices, or otherwise authorize any third party to access or use the Services.

8. Third-party applications

The Services may connect with third-party applications, websites, and services (“Third-Party Applications”). They may have their own terms and privacy policies, and those govern your use of them. We don’t endorse, and aren’t responsible for, how any Third-Party Application works, what it contains, or any transaction you make with its provider.

9. Your account and collaborators

Your account. You’re responsible for keeping your login, password, and other account information confidential, and for restricting access to your computer. You accept responsibility for everything that happens under your account or password.

We may refuse service, close accounts, or remove or edit content at our discretion.

You’re solely responsible for the accuracy and currency of the data entered under your account. You agree to indemnify us and hold us harmless against any claim related to the content, accuracy, or currency of the information you provide through the Services.

Collaborators. The Services may let you invite employees, contractors, attorneys, and other service providers (“Collaborators”) to access Your Data and User Content. If you do, you’re solely responsible for what your Collaborators do. At our discretion, we may limit how many accounts a Collaborator can work with, and we may require a Collaborator to get a paid license at any time. Collaborators aren’t third-party beneficiaries of this Agreement and have no rights or remedies under it.

10. Confidentiality

10.1 Confidential information. While this Agreement is in effect, each of us (including our employees, consultants, and agents) may receive the other’s proprietary or confidential information (“Confidential Information”). Each of us agrees to:

• keep the other’s Confidential Information confidential;
• not share it with third parties, except as this Agreement allows;
• not use it for purposes outside this Agreement;
• share it only with employees, consultants, and agents who need it for this Agreement and who have confidentiality obligations at least as protective as these;
• tell those people about their obligations under this Agreement; and
• be responsible if any of them breach this section.

Confidential Information doesn’t include information that:

• (a) is or becomes public, unless the receiving party made it public in violation of this Agreement;
• (b) the receiving party already knew, without a duty of confidentiality;
• (c) the receiving party developed independently, outside this Agreement;
• (d) the receiving party lawfully got from a third party, without a duty of confidentiality; or
• (e) is otherwise addressed in this Agreement.

10.2 Legally required disclosures. Either of us may disclose the other’s Confidential Information when the law, a government or regulatory agency, or a court requires it. The disclosing party must:

• (a) limit the disclosure as much as the law allows;
• (b) notify the owner of the information as soon as practicable; and
• (c) continue to treat the disclosed information as confidential under this Agreement in every other respect.

10.3 Remedies. We both acknowledge that Confidential Information is unique and valuable, and that a breach of this section could cause harm that money alone can’t fix. If this section is breached, or a breach is threatened, the affected party may seek a court order (an injunction) or other equitable relief without posting a bond. This is in addition to, not instead of, any money damages.

11. Links to other websites

We may link to other websites or resources. We don’t control them, so we aren’t responsible for their availability or content.

12. Ownership

We are, and will remain, the sole owner of the Services and all copyrights, trade secrets, and other proprietary rights in them, including any derivative works, regardless of how you use them. The Services are protected by U.S. and international copyright and trademark laws. The Services are licensed to you, not sold. This Agreement doesn’t give you ownership of the Services or any rights in them, including intellectual property rights.

13. Disclaimer of warranty

EXCEPT AS THIS AGREEMENT EXPRESSLY STATES, THE SERVICES AND EVERY PART OF THEM, INCLUDING THIRD-PARTY CONTENT, ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT ANY WARRANTY OF ANY KIND — ORAL, WRITTEN, STATUTORY, EXPRESS, OR IMPLIED — INCLUDING WARRANTIES OF PERFORMANCE, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE.

WE DON’T GUARANTEE THE AVAILABILITY, CURRENCY, COMPLETENESS, ACCURACY, OR TRUTHFULNESS OF ANY INFORMATION PROVIDED BY OR ABOUT THE SERVICES. WE ALSO DON’T GUARANTEE THAT ALL ERRORS CAN BE CORRECTED, OR THAT OUR WEBSITES OR SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE.

Some jurisdictions don’t allow implied warranties to be excluded, so parts of this section may not apply to you. Any warranties in this Agreement are for your benefit only.

14. Limitation of liability

WE — INCLUDING OUR SUPPLIERS, SHAREHOLDERS, OFFICERS, EMPLOYEES, AND AGENTS — WILL NEVER BE LIABLE FOR LOST PROFITS OR FOR ANY INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES, INCLUDING DAMAGES ARISING FROM THIS AGREEMENT OR FROM USING OR RELYING ON THE SERVICES, EVEN IF WE WERE TOLD SUCH DAMAGES WERE POSSIBLE.

OUR TOTAL LIABILITY OF ANY KIND ARISING FROM OR RELATED TO THIS AGREEMENT AND THE SERVICES (INCLUDING WARRANTY CLAIMS) WILL NEVER EXCEED THE AMOUNT YOU PAID US IN THE 1 MONTH BEFORE THE CLAIM AROSE. THIS APPLIES REGARDLESS OF THE FORUM, AND WHETHER THE CLAIM IS BASED ON CONTRACT, TORT, OR ANYTHING ELSE.

THIS SECTION CONTINUES TO APPLY EVEN IF THERE IS A FAILURE OF CONSIDERATION OR AN EXCLUSIVE REMEDY FAILS. WE BOTH AGREE THAT OUR PRICES AND THIS AGREEMENT ARE BASED ON THESE LIMITS, AND THAT THEY ARE AN ESSENTIAL PART OF OUR BARGAIN.

SOME JURISDICTIONS DON’T ALLOW LIMITS ON CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THESE LIMITS MAY NOT APPLY TO YOU.

15. Service limits and changes

We’ll make reasonable efforts to keep the Services running, but technical problems or maintenance may cause temporary interruptions from time to time.

To the extent the law allows, we may change or discontinue any part of the Services, temporarily or permanently, at any time, with or without notice. We won’t be liable to you for any interruption, change, or discontinuation, except where the law says otherwise.

We have no obligation to maintain, support, upgrade, or update the Services, or to provide any particular content through them. To the extent the law allows, we or the owners of any Content may remove it at any time without notice.

16. Termination and survival

Either of us may end this Agreement if the other breaches a material term and doesn’t fix it within 30 days after being notified of the breach.

We may end this Agreement or suspend your access at any time, with or without notice, if we know or suspect you are using the Services or Content without authorization.

Unless your signed agreement says otherwise, you may end this Agreement at any time. Your access continues through the end of the period you’ve already paid for, and you won’t receive a refund of any fees you’ve already paid.

Any terms that, by their wording or nature, need to continue after this Agreement ends in order to have effect will survive.

17. After termination

For 30 days after this Agreement ends for any reason, we’ll provide Your Data to you in a reasonable, approved format. If you want other help moving to a new provider, we may provide it at our discretion, once you’ve paid our standard hourly rates for that work.

After that, we’ll delete Your Data, unless the law requires us to keep it. If you want us to keep it longer, we can do so for an agreed period and fee. Aggregated Data (see Section 2) isn’t deleted, because it doesn’t identify you or any individual.

18. Governing law and jurisdiction

We operate the Services from our offices in Texas, in the United States. Texas law governs this Agreement, without regard to conflict-of-law rules.

You agree that any claim or dispute with us, about this Agreement, or related in any way to your use of the Services, must be brought only in the federal or state courts located in Texas. You consent to the jurisdiction and venue of those courts and waive any objection to jurisdiction or venue.

If a court or tribunal finds any part of this Agreement unlawful, the rest remains in full effect.

19. Attorney’s fees

In any lawsuit or appeal to enforce this Agreement, the losing party will pay the winning party’s reasonable attorney’s fees and costs.

20. Entire agreement

This Agreement, together with any signed agreement between us, is a binding contract and the entire agreement between us on its subject. It replaces all earlier or simultaneous statements and understandings, whether written or oral, but it doesn’t replace a signed agreement. We may update this Agreement as described in Section 4. A signed agreement can be changed only in a writing signed by both of us.

21. No waiver

Waiving one term of this Agreement doesn’t waive any other term, and a one-time waiver isn’t a permanent one. Not enforcing a term isn’t a waiver of that term or any other, or of the right to enforce it later.

22. Severability and binding effect

If any part of this Agreement is invalid or unenforceable in any way, the rest of it — and that part, in every other respect — remains valid and enforceable. This Agreement binds and benefits both of us and our heirs, personal representatives, successors, and assigns.

23. Force majeure

We aren’t liable for, or in breach of this Agreement because of, any delay or failure to perform caused by something beyond our reasonable control.

24. Our warranty and indemnification

Except for beta Trials, we warrant that the Services and every part of them don’t infringe anyone else’s intellectual property rights. If a third party wins a final judgment against you on a claim that the Services infringe its intellectual property rights, we’ll indemnify you and hold you harmless for that judgment.

25. Your defense and indemnification

In addition to your other obligations under this Agreement, you agree to defend us against any actual or threatened third-party claim that arises from:

1. your or your Collaborators’ use of the Services, including claims by your clients or customers about inaccurate, late, or incomplete Third-Party Data;
2. your failure to comply with the law; or
3. your breach of this Agreement.

You’ll also indemnify, defend, and hold us harmless against:

• (a) all damages, costs, and attorney’s fees finally awarded against us in any such proceeding;
• (b) all reasonable out-of-pocket costs, including reasonable attorney’s fees, we incur defending any such proceeding (unless you’ve taken over the defense); and
• (c) any amount you agree to pay a third party to settle any such claim.

26. Electronic communications

When you visit our websites or email us, you’re communicating with us electronically, and you agree to receive communications from us electronically. We’ll communicate with you by email or by posting notices on our websites. You agree that any agreements, notices, disclosures, and other communications we send you electronically meet any legal requirement that they be in writing.

27. Independent contractors

We’re independent contractors. This Agreement doesn’t create an agency, partnership, joint venture, employment, or franchise relationship between us. Neither of us is the other’s agent, and neither of us can bind the other or take on obligations on the other’s behalf.

28. Privacy

Using the Services may involve personal information about many people, including your employees, administrators, officers, vendors, and contractors. We comply with all applicable privacy laws, and you agree to comply with them too.

Europe, the UK, and Switzerland (GDPR). When we process personal information in Your Data that is covered by the EU General Data Protection Regulation, the UK GDPR, or the Swiss Federal Act on Data Protection, you’re the controller and we’re your processor. (If you process that information for someone else, you’re the processor and we’re your subprocessor.) In addition to our commitments below, we will:

• process it only on your documented instructions, which are this Agreement and your use of the Services, including for any international transfers, unless the law requires otherwise (in which case we’ll tell you first, unless the law prohibits that), and tell you if we believe an instruction violates the law;
• make sure everyone who handles it is bound to keep it confidential;
• protect it with appropriate technical and organizational security measures;
• use other processors (“subprocessors”) only under written contracts with the same data-protection obligations as these, remain responsible for them, give you our current list on request, and tell you at least 30 days before adding or replacing one so you can object;
• help you respond to individuals exercising their rights, and help you meet your obligations for security, breach notification, data protection impact assessments, and consultations with regulators;
• notify you without undue delay after we become aware of a personal data breach;
• delete or return it when the Services end, as described in Section 17, unless the law requires us to keep it; and
• give you the information you reasonably need to show we’re meeting these obligations, and allow reasonable audits, including inspections, by you or an independent auditor you choose. Audits require at least 30 days’ notice, happen no more than once a year (unless a regulator requires one or after a personal data breach), are at your expense, and are subject to confidentiality.

Details of the processing (all regions). This applies to all personal information in Your Data, wherever it comes from.

• Purposes: scheduling, time and attendance, labor forecasting, HR record-keeping, surveys, integrations with your point-of-sale, payroll, and HR systems, customer support, and testing, maintaining, securing, and improving the Services.
• Duration and frequency: processing is continuous for as long as this Agreement lasts, and until the data is deleted under Section 17.
• People: may include your employees, job applicants, contractors, and survey participants.
• Data: may include contact details, employment records, schedules, time and attendance records, pay information, tax and employment-eligibility records, and survey responses. It may also include any demographic information you choose to collect, such as gender, date of birth, race, ethnicity, national origin, and marital status.
• Sensitive data: biometric templates, where you use fingerprint time clocks. We store only a non-reversible template, never a fingerprint image, limit access to it, and delete it on the schedule in our Privacy Policy. It may also include sensitive information you choose to collect, such as race or ethnicity. We process sensitive information only on your instructions and protect it with the security measures below.
• Parties and contacts: you are the data exporter, reachable at the contacts on your account. Orcus Technologies, Inc. is the data importer, reachable at support@timeforge.com.

International transfers. We’re based in the United States, so personal information is transferred there. For transfers from the European Economic Area, the European Commission’s Standard Contractual Clauses (Decision 2021/914) are part of this Agreement: Module 2 applies when you’re a controller, and Module 3 applies when you’re a processor. For those clauses:

• the optional clause in Clause 7 doesn’t apply;
• Option 2 in Clause 9 (general authorization for subprocessors) applies, with the notice described above;
• the optional language in Clause 11 doesn’t apply;
• the competent supervisory authority is the one determined under Clause 13;
• Irish law governs them, and disputes go to the Irish courts; and
• Annex I is completed by “Details of the processing” above, Annex II by “Security measures” below, and Annex III by our subprocessor list.

Security measures.

• Hosting: our servers are in data centers run by SSAE 16 SOC 1 Type II audited operators, with physical access controls, video surveillance, and 24/7 security.
• Network: connections pass through network and web application firewalls, and only required ports are open.
• Encryption: data sent over the internet is encrypted in transit. Certain sensitive fields, such as Social Security numbers and passwords, are encrypted at rest, and passwords are salted and hashed.
• Testing and monitoring: we run regular vulnerability scans, internally and through third-party vendors, and monitor our systems around the clock.
• Backups: we keep real-time replicated and nightly backups, including offsite, and test restores weekly.
• Access: access to personal information is limited to personnel who need it.

UK transfers. For transfers from the UK, the UK International Data Transfer Addendum to the Standard Contractual Clauses (version B1.0) also applies. Tables 1 to 3 of the Addendum are completed by the information in this section. For Table 4, we, as importer, may end the Addendum as its Section 19 allows.

Swiss transfers. For transfers from Switzerland:

• the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority;
• references to the GDPR mean the Swiss Federal Act on Data Protection; and
• “Member State” in Clause 18(c) doesn’t prevent individuals in Switzerland from suing where they habitually reside.

If these terms and the Standard Contractual Clauses conflict, the clauses control.

Canada. When we process personal information in Your Data that is covered by Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) or by a provincial private-sector privacy law (such as those in Quebec, Alberta, and British Columbia), you remain responsible for that information, and we process it on your behalf. In addition to our commitments below, we will:

• use it only for the purposes listed in “Details of the processing” above and to create Aggregated Data under Section 2, and for no other purpose;
• protect it with security safeguards appropriate to its sensitivity, at least as protective as those laws require of you;
• limit access to people who need it, and bind them to keep it confidential;
• notify you promptly of any breach of security safeguards, confidentiality incident, or attempted violation of these obligations involving it, and give you the information you need to assess it and meet your own reporting obligations;
• help you respond to individuals’ requests to access or correct their information;
• delete or return it when the Services end, as described in Section 17, unless the law requires us to keep it; and
• let you verify that we’re meeting these obligations, on the same terms as the audits described above, and give you the information you need for any privacy impact assessment you must complete.

Personal information in Your Data may be stored and processed in the United States, where U.S. courts and authorities may be able to access it under U.S. law. You’re responsible for any notice those Canadian laws require you to give your employees or other individuals about this.

California (CCPA). We also comply with the California Consumer Privacy Act (CCPA), as described in our Privacy Policy.

How we handle personal information in Your Data. When we process personal information in Your Data, we act as your service provider (also called a processor). We will:

• process it only for the purposes listed in “Details of the processing” above and to create Aggregated Data under Section 2, on your instructions;
• not sell it or share it, including for cross-context behavioral advertising;
• not keep, use, or disclose it for any other purpose, or outside our direct business relationship with you, except as the law allows;
• not combine it with personal information we get from other sources or collect ourselves, except as the law allows;
• comply with applicable privacy laws and give it the level of privacy protection they require;
• tell you if we can no longer meet our obligations under those laws;
• let you take reasonable steps to make sure we use it in line with your obligations under those laws, such as reasonable requests for information about our practices; and
• let you take reasonable steps to stop and fix any unauthorized use of it.

You’ll tell us about any privacy request from an individual that we need to act on, and we’ll help you respond. We may use our own service providers to help provide the Services. When we do, we’ll bind them by written contract to terms at least as protective as these.

This section is our data processing agreement (DPA).

Other laws. As new privacy laws are adopted around the world, we try to comply with them, and you must also comply with them.

29. Security breach

If we, or our employees, contractors, or agents acting in those roles, have a security breach (as the applicable laws and regulations define it), then when we discover it we will:

• (a) take steps to fix it that comply with the law and are consistent with industry standards; and
• (b) promptly notify you of the breach, its nature and scope, and the steps we’ll take.

You’re responsible for meeting your own legal obligations.