ANNEX No. 5 to the Terms of Use: Data Act Addendum

This Data Act Addendum ("Data Act Addendum") forms a part of the Terms. If You are an entitled entity under Regulation (EU) 2023/2854 ("Data Act") and your use of an ESET Service under the Terms qualifies as a "data processing service" under the Data Act, then this Data Act Addendum applies to You.  Capitalized terms not defined in this Data Act Addendum shall have the meanings given to them in the Terms or, if not defined there, the meaning given to them in the Data Act. Rights and obligations not governed by the specific provisions of this Data Act Addendum shall be governed by the relevant provisions of the Terms of Use. In the event of any conflict between this Addendum and the Terms, the specific provisions of this Data Act Addendum shall prevail.

The Data Act Addendum does not apply to Trial Subscriptions, Pre-release Services, NFRs, or Services provided for testing and evaluation purposes for a limited period.

A. Definitions

For the purposes of this Data Act Addendum, the following definitions apply:

1. "Destination Provider" means a different provider of services of the same type that is other than ESET, or your own on-premises ICT infrastructure.
2. "Exportable Data" means Cloud Data that ESET processes as a data processor and that ESET can lawfully retrieve and make available to You where technically feasible without disproportionate effort beyond simple operations and that remains available within the applicable data retention period for the relevant ESET Service.
    
   Exportable Data excludes:

1. 1. 1. data processed by ESET as a data controller;
      2. statistical, aggregated or anonymized data;
      3. ESET's or a third party's Intellectual Property, Confidential Information or trade secrets, including proprietary algorithms, source code, detection technologies, threat intelligence reports and insights;
      4. data whose export would compromise the security, integrity and functionality of the relevant ESET Service;
      5. data that ESET is not legally permitted to disclose or export; and
      6. any Exportable Data that has been deleted in accordance with the applicable data retention period.

3. "Switching Process" means the process whereby You change from using the relevant ESET Service to using services of a Destination Provider, including the export and transfer of Exportable Data.

B. Switching Notice and Switching Process

1. You shall initiate the Switching Process by submitting a written request ("Switching Notice") to ESET through the contact details specified in Section J of the Terms or through the applicable ESET support channel, observing a two month prior written notice ("Notice Period") in which You shall inform us about (a) Switching Process start date, (b) whether the Switching Process shall relate to all or only some of our Applications, Products and Services and (c) whether You intend to switch to another data processing service or your own on-premise ICT infrastructure.
2. During the Notice Period, the Parties will coordinate regarding the Switching Process, including identification of available Exportable Data and technical requirements.
3. You acknowledge that the availability of Exportable Data is subject to the applicable data retention period for the relevant ESET Service as defined in documentation. ESET has no obligation to retain or provide access to Exportable Data beyond such retention period.
4. Switching process can be initiated no later than three months before the termination of the Subscription Term or the respective ESET Service.
5. Following the Notice Period, ESET will provide reasonable assistance to You and third parties authorized by You to facilitate the Switching Process during a transitional period of up to thirty (30) calendar days (the "Transitional Period").
6. You may request extending the Transitional Period once, which ESET and You shall discuss in good faith.
7. Throughout the Transitional Period, ESET will:
   1. maintain business continuity and continue to provide the relevant ESET Service under the Terms;
   2. provide clear information about known risks to continuity of the relevant ESET Service; and
   3. maintain the technical and organizational measures applicable under the Terms and relevant documentation.
8. If the mandatory maximum Transitional Period of thirty (30) calendar days is technically unfeasible for reasons on the side of ESET, ESET shall notify You within fourteen (14) working days after receiving the Switching Notice, duly justify the technical unfeasibility, and indicate an alternative Transitional Period. The alternative Transitional Period shall not exceed seven (7) months. ESET shall ensure continuity of the relevant ESET Service throughout the alternative Transitional Period.

C. Data Retrieval

1. After the Transitional Period, You will have up to thirty (30) calendar days to retrieve Exportable Data ("Retrieval Period").
2. ESET will provide Exportable Data for your download in a structured and machine-readable format supported by the relevant ESET Service.
3. You are solely responsible for importing and implementing Exportable Data into new systems or infrastructure.
4. At the end of the Retrieval Period, ESET will erase Exportable Data in accordance with the Terms, the applicable data retention practices and applicable law, except where retention is required by applicable law. Any Exportable Data We retain during the Retrieval Period shall remain subject to the Terms until the end of the Retrieval Period.  Upon your request, ESET will provide You with written confirmation of deletion in compliance with this provision.

D. Your Obligations in relation to the Switching Process

1. To effectuate the Switching Process You shall (a) where available use self-service export capabilities, (b) provide reasonable cooperation and technical information necessary for an effective Switching Process, (c) notify ESET promptly upon completion of the Switching Process.  
2. You are obliged to comply with all confidentiality obligations under the Terms;
3. The Switching Process and this Data Act Addendum do not affect your obligation to pay all applicable fees for the relevant ESET Service(s). You must comply with the applicable purchase or payment terms agreed between You and ESET or the ESET partner from whom You purchased the relevant ESET Service, and remain obliged for payment until the later of: (i) expiry of the Subscription period to the relevant ESET Service as originally agreed or (ii) finalization of the Transitional Period.
4. If the Transitional Period extends beyond the expiry of the Subscription Period as originally agreed, You shall also pay the applicable fees for each commenced month during which the relevant ESET Service continues to be provided during the Transitional Period, in accordance with our or the applicable ESET Partner’s standard price list.
5. If, at the time You submit a Switching Notice, the Subscription or the relevant ESET Services have already been terminated, You are not entitled to the switching of the Exportable Data.  

E. ESET Obligations

1. ESET shall provide (a) clear information about known risks to continuity of the relevant ESET Service, (b) maintain the technical and organizational measures set out in the Terms and relevant documentation during the Switching Process, (c) continue providing the relevant ESET Service under the Terms during the Notice Period and Transitional Period; and (d) make available documentation regarding Exportable Data and formats supported by the relevant ESET Service for export.

F. Switching Charges

1. No additional charges will apply for your use of available standard self-service export capabilities, beyond the fees You have agreed to pay for the current committed Subscription period.
2. Until 12 January 2027, We may charge reduced switching charges for manual assistance beyond standard export capabilities, provided that such charges do not exceed the costs incurred by Us that are directly linked to the Switching Process.
3. From 12 January 2027, We will not impose switching charges for the Switching Process.
4. Agreed fees for the provision of the relevant ESET Service and any applicable early termination penalties are not switching charges and remain payable pursuant to Section D.3 above and/or Terms.

G. Payment Obligations and Termination

1. The relevant ESET Service will terminate upon the earlier of:
   1. expiration of the Transitional Period; or
   2. your written request to terminate  the relevant ESET Service without transferring Exportable Data.
2. Notwithstanding termination under this Data Act Addendum, your obligation to pay for ESET Service(s) remains unaffected as detailed in Section D.3 of this Data Act Addendum. There shall be no refund of any prepaid fees or relief from fees for ESET Service(s) that have been ordered but not yet invoiced or paid in full, except where otherwise expressly provided in the Terms or required by applicable law.
3. If You have not paid the total fees under the applicable Order or Subscription, all remaining amounts become immediately due and payable upon termination, to the extent permitted by applicable law.

H. Disclaimer

1. ESET's obligations under this Data Act Addendum are subject to:
   1. technical feasibility and security requirements;
   2. the applicable data retention period;
   3. applicable laws and regulations; and
   4. the protection of ESET's and third parties Intellectual Property, Confidential Information and trade secrets.
2. ESET expressly disclaims any and all kinds of liability or warranty, whether express, implied, statutory or otherwise, regarding the compatibility or functionality of Exportable Data with Destination Provider systems, except to the extent such exclusion is prohibited by the Data Act or other applicable law.

I. Order of Precedence

1. This Data Act Addendum shall govern and prevail solely with respect to the subject matter herein. In all other respects, the Terms, including the applicable Data Processing Agreement, documentation, Logs Retention Policy, Privacy Policy and Security Policy, shall continue to apply.