Terms of Service

1. Acceptance of Terms

By accessing or using the Aatrex platform ("Service"), clicking "I agree," or checking the acceptance box during account registration, you ("Customer," "you," or "your") agree to be legally bound by these Terms of Service ("Terms") on behalf of yourself and the organization you represent. If you do not have authority to bind your organization, or if you do not agree to these Terms, you must not use the Service.

These Terms constitute a binding legal agreement between you and Aatrex ("Aatrex," "we," "us," or "our"). Use of the Service by minors under 18 years of age is strictly prohibited. By registering, you represent that you are at least 18 years of age and have full legal capacity to enter into this agreement.

2. Definitions

"Service" means the Aatrex web platform, APIs, and related software for orchestrating Microsoft 365 and Google Workspace tenant-to-tenant data migrations. "Customer Data" means all email, files, calendar entries, contacts, and other data belonging to or controlled by the Customer that is processed through the Service. "Migration" means the transfer of Customer Data from a source tenant to a destination tenant. "Organization" means the legal entity on whose behalf the Customer registers an account. "User" means any individual authorized by the Customer to access the Service under the Customer's account. "Confidential Information" means non-public information disclosed by either party that is designated as confidential or that reasonably should be understood to be confidential. "Subprocessor" means any third party engaged by Aatrex to process Customer Data.

3. Service Description and Scope

Aatrex provides a software platform that facilitates the orchestration and execution of data migrations between cloud tenants. The Service acts solely as a data processor and migration orchestrator — it does not generate, modify, or retain Customer Data beyond what is strictly necessary to perform the Migration.

Aatrex is not a backup service. The Service is not designed or warranted as a means of data archival, disaster recovery, or long-term data storage. Email and file content processed through the Service is not intentionally persisted to Aatrex storage. Migration metadata, logs, and credentials are retained as described in Section 9.

4. Account Registration and Security

You must provide accurate, complete, and current registration information. You are prohibited from: (a) creating an account using false identity or misleading organization information; (b) registering on behalf of an organization without proper authority; (c) sharing account credentials with unauthorized parties.

You are solely responsible for maintaining the confidentiality of your account credentials and for all activities occurring under your account. You must notify Aatrex immediately at support@aatrex.in upon becoming aware of any unauthorized access to your account. Aatrex reserves the right to terminate accounts found to use false registration information without notice or refund.

5. Customer Responsibilities — Data Authorization (Critical)

This section represents your most significant obligation under these Terms.

5.1 Legal Authority to Migrate.

You represent and warrant that you have obtained all necessary legal rights, licenses, consents, and authorizations to migrate all Customer Data processed through the Service. This includes, without limitation: (a) administrative consent from both the source and destination Microsoft 365 or Google Workspace tenants; (b) compliance with your organization's internal data governance and IT policies; (c) authorization from all individuals whose data will be migrated, where required by applicable law.

5.2 No Unauthorized Migration.

You must not use the Service to migrate data: (a) belonging to a third party without that party's explicit consent; (b) in violation of any court order, regulatory directive, or contractual obligation; (c) subject to a data hold, litigation hold, or preservation order without compliance with such hold.

5.3 Pre-Migration Backup Obligation.

You acknowledge that data migration carries inherent risks, including partial data loss, formatting changes, and metadata alterations. You are solely responsible for maintaining complete, independent backups of all Customer Data before initiating any Migration. Aatrex explicitly disclaims all liability for data loss, corruption, or incompleteness arising from or in connection with any Migration.

5.4 Regulatory Compliance.

You are solely responsible for ensuring that your use of the Service complies with all laws, regulations, and standards applicable to your organization and industry, including without limitation data protection laws, sector-specific regulations (healthcare, finance, legal), and any data residency or sovereignty requirements applicable to your organization.

5.5 Tenant Administrator Consent.

Migrations that require Azure Active Directory application consent or Google OAuth authorization must be granted only by persons with appropriate administrative authority. Granting such consent on behalf of a tenant you do not administer without authorization is strictly prohibited and constitutes a material breach of these Terms.

6. Acceptable Use Policy

You must not use the Service to:

(a) Migrate, transfer, or process data in violation of any applicable law, regulation, or third-party rights;

(b) Circumvent, disable, or interfere with any security or access control mechanism of any cloud tenant or platform;

(c) Attempt to access, probe, or exploit systems, accounts, or data belonging to other Aatrex customers;

(d) Reverse engineer, decompile, or disassemble any portion of the Service;

(e) Resell, sublicense, or commercially exploit the Service without Aatrex's prior written consent;

(f) Introduce malware, viruses, or harmful code into the Service or connected systems;

(g) Conduct load testing, stress testing, or automated scraping of the Service without prior written approval;

(h) Use the Service in connection with cryptocurrency mining, spam distribution, or any fraudulent purpose;

(i) Impersonate Aatrex, its employees, or any other person or entity;

(j) Violate the terms of service of Microsoft, Google, or any other third-party platform connected through the Service.

Violations of this Acceptable Use Policy may result in immediate suspension or termination of your account without notice or refund, and Aatrex reserves the right to report violations to appropriate law enforcement authorities.

7. Data Ownership and Processing

7.1 Customer Ownership.

Customer Data remains the sole and exclusive property of the Customer. Aatrex acquires no ownership interest in Customer Data by virtue of providing the Service.

7.2 Limited License.

Customer grants Aatrex a limited, non-exclusive, non-transferable license to access, process, transmit, and store Customer Data solely to the extent necessary to provide the Service as described in these Terms and the Privacy Policy.

7.3 No Secondary Use.

Aatrex will not use Customer Data for any purpose other than providing the Service. Aatrex will not sell, rent, lease, or otherwise commercially exploit Customer Data. Aatrex will not share Customer Data with any third party except as set forth in these Terms or as required by law.

7.4 Data Processing Agreement.

For Customers subject to the General Data Protection Regulation (GDPR) or the Digital Personal Data Protection Act 2023 (DPDPA), Aatrex acts as a data processor and the Customer acts as the data controller with respect to personal data processed through the Service. These Terms, together with Aatrex's Privacy Policy, are intended to constitute a Data Processing Agreement as required under applicable data protection law, incorporating the following processor obligations: (a) processing Customer Data only on documented instructions from Customer; (b) ensuring persons authorised to process Customer Data have committed to confidentiality; (c) implementing appropriate technical and organisational security measures as described in Section 8; (d) engaging Subprocessors only in accordance with Section 8A; (e) assisting Customer in fulfilling data subject rights requests; (f) assisting Customer in meeting its obligations under Articles 32–36 GDPR; (g) deleting or returning Customer Data at Customer's choice upon termination; and (h) making available information necessary to demonstrate compliance and allowing audits as set forth in Section 7.5. Customers that require a separately executed DPA instrument may request one from support@aatrex.in.

7.5 Audit Rights.

To the extent required by applicable data protection law, including GDPR Article 28(3)(h), Aatrex shall make available to Customer all information reasonably necessary to demonstrate compliance with this Section 7, and shall allow for and contribute to audits and inspections conducted by Customer or an auditor mandated by Customer, provided that: (a) Customer provides at least 30 days' prior written notice; (b) audits are conducted during normal business hours; (c) Customer bears the cost of any third-party auditor; and (d) audits do not unreasonably disrupt Aatrex's operations. Aatrex may satisfy this obligation in part through provision of current third-party security certifications (e.g., SOC 2, ISO 27001) where available.

8. Data Protection and Security

Aatrex implements the following security measures to protect Customer Data:

(a) AES-256-GCM encryption for all credentials and secrets stored at rest;

(b) TLS encryption for all data transmitted between Customer systems and Aatrex servers and between Aatrex and third-party cloud providers;

(c) Per-operation audit logs recording the identity of the initiating user, timestamp, action type, and outcome;

(d) Role-based access controls limiting Aatrex employee access to Customer Data to authorized personnel on a need-to-know basis;

(e) Compliance with CERT-In (Computer Emergency Response Team - India) security guidelines, including mandatory incident reporting obligations.

Notwithstanding the foregoing, no security measure is perfect or impenetrable. Aatrex does not warrant that the Service is free from vulnerabilities or that Customer Data will never be compromised. In the event of a security incident affecting Customer Data, Aatrex will notify affected Customers within 72 hours of becoming aware of the incident, consistent with applicable legal obligations.

8A. Subprocessors

8A.1 Current Subprocessors.

Aatrex engages third-party subprocessors to support delivery of the Service. A current list of subprocessors is available at support@aatrex.in upon written request.

8A.2 Change Notification.

Aatrex will notify Customers of any intended addition or replacement of a subprocessor at least 30 days in advance by email to the Customer's registered email address. Customer may object to the proposed change in writing to support@aatrex.in within 14 days of notification. If Customer's objection is based on reasonable data protection grounds and the parties cannot resolve the objection, Customer may terminate the affected Service without penalty upon 30 days' written notice.

8A.3 Subprocessor Obligations.

All subprocessors are bound by written agreements imposing data protection obligations no less protective than those set forth in these Terms.

9. Data Retention and Deletion

9.1 Migration Data.

Email content, file content, and other Customer Data processed during a Migration is handled in-memory and is not persisted to Aatrex storage systems after Migration completion.

9.2 Audit and Migration Logs.

Migration metadata, audit logs, and operational records are retained for a minimum of 180 days from the date of creation, consistent with CERT-In requirements. Logs for active or ongoing projects are retained for the duration of the project plus 180 days after the project's last recorded activity.

9.3 GDPR and DPDPA Erasure Rights.

Customers may request deletion of migration logs and project metadata by submitting a written request to support@aatrex.in or by using the data erasure endpoint available within the Service. Aatrex will fulfill erasure requests within 30 days, subject to legal obligations requiring retention.

9.4 Post-Termination Deletion.

Upon termination of your account, Aatrex will retain Customer Data for 30 days to allow Customer to export it in machine-readable formats (JSON and CSV where applicable). After this period, Customer Data will be permanently deleted from Aatrex systems. Aatrex is not liable for any loss of data that is deleted in accordance with this policy.

9.5 Immutable Audit Records.

Notwithstanding the foregoing, Aatrex may retain immutable audit records of data deletion and purge events for compliance and evidentiary purposes. Such records do not contain personal data beyond what is minimally necessary to establish the fact of deletion.

10. Payment Terms

10.1 Fees.

Customer agrees to pay all fees as set forth in the applicable pricing plan selected at the time of purchase. All fees are non-refundable except as expressly provided in these Terms or required by applicable law.

10.2 Taxes.

All fees are exclusive of applicable taxes, including Goods and Services Tax (GST), Value Added Tax (VAT), withholding tax, or other taxes. Customer is responsible for all applicable taxes arising from the use of the Service, other than taxes based on Aatrex's net income.

10.3 Price Changes.

Aatrex reserves the right to modify pricing at any time, with at least 30 days' prior written notice to Customer. Continued use of the Service after the effective date of a price change constitutes acceptance of the new pricing. For Customers on annual or multi-year subscription plans, price changes will not take effect until the next renewal date.

10.4 Suspension for Non-Payment.

Aatrex may suspend access to the Service without notice in the event of overdue payment. Suspension does not relieve Customer of the obligation to pay outstanding fees. Accounts suspended for more than 60 days may be terminated.

10.5 Dispute of Charges.

Customer must notify Aatrex of any disputed charges within 30 days of the charge date. Failure to dispute a charge within this period constitutes acceptance of the charge. Chargebacks initiated without prior notice to Aatrex constitute a breach of these Terms and may result in immediate account termination.

10.6 No Refunds for Consumed Services.

Fees paid for completed Migrations or consumed service units are non-refundable, regardless of the outcome of the Migration. Aatrex may, in its sole discretion, issue service credits for documented service failures.

11. Intellectual Property

11.1 Aatrex Ownership.

Aatrex retains all right, title, and interest in and to the Service, including all software, algorithms, interfaces, documentation, trademarks, and underlying technology. No rights in the Service are granted to Customer except as expressly set forth in these Terms.

11.2 Feedback.

If Customer provides feedback, suggestions, or ideas regarding the Service ("Feedback"), Customer grants Aatrex a perpetual, irrevocable, royalty-free license to use such Feedback for any purpose without compensation or attribution. Customer hereby waives, to the maximum extent permitted by applicable law, any moral rights in such Feedback.

11.3 No Reverse Engineering.

Customer may not attempt to derive the source code, algorithms, or underlying structure of the Service by any means.

12. Confidentiality

12.1 Mutual Obligation.

Each party agrees to hold the other party's Confidential Information in strict confidence and not to disclose it to any third party without the other party's prior written consent. Each party agrees to use Confidential Information solely for the purpose of performing its obligations under these Terms.

12.2 Exclusions.

The confidentiality obligation does not apply to information that: (a) is or becomes publicly available through no fault of the receiving party; (b) is rightfully received from a third party without restriction; (c) is independently developed without use of the Confidential Information; or (d) is required to be disclosed by law, court order, or regulatory authority, provided that the receiving party gives prompt written notice to the disclosing party before such disclosure, unless applicable law prohibits such advance notice.

12.3 Employee Access.

Each party shall limit access to Confidential Information to employees and contractors who have a need to know and who are bound by confidentiality obligations at least as protective as those set forth herein.

13. Service Availability

13.1 Target Uptime.

Aatrex targets 99.5% monthly uptime for the Service as an operational goal. This target is aspirational and does not constitute a Service Level Agreement or create any right to a remedy, credit, or refund. Scheduled maintenance windows communicated at least 48 hours in advance are excluded from uptime calculations.

13.2 Excluded Downtime.

Aatrex's uptime commitment expressly excludes outages caused by: (a) third-party cloud provider failures (Microsoft Azure, Google Cloud, or other infrastructure providers); (b) Customer's own network, systems, or configurations; (c) Force Majeure events; (d) denial-of-service attacks or other external security attacks; (e) Customer's suspension for non-payment.

13.3 No SLA Guarantee.

Aatrex does not guarantee that the Service will be uninterrupted, error-free, or that any specific Migration will complete successfully within a specified timeframe. Migration performance depends on factors outside Aatrex's control, including source and destination tenant API rate limits, network conditions, and data volume.

14. Representations, Warranties, and Disclaimers

14.1 Customer Representations.

Customer represents and warrants that: (a) it has full legal authority to enter into these Terms; (b) its use of the Service will comply with all applicable laws; (c) it holds all rights necessary to migrate the Customer Data through the Service; (d) the migration will not violate any third-party intellectual property rights or privacy rights.

14.2 Disclaimer of Warranties.

15. Limitation of Liability

15.4 Third-Party Services.

Aatrex has no control over and assumes no liability for the availability, security, or conduct of Microsoft Azure, Microsoft 365, Google Workspace, or any other third-party platform connected to the Service. Any disruption, rate limiting, or policy change by such third-party platforms is outside Aatrex's liability.

15.5 Data Loss.

Aatrex expressly excludes all liability for loss, corruption, incompleteness, or alteration of Customer Data arising from or in connection with any Migration. Customer's obligation to maintain pre-migration backups is a material condition of the Service.

15.6 Carve-Outs.

Notwithstanding Sections 15.1 and 15.2, the limitations of liability set forth in this Section 15 shall not apply to: (a) Aatrex's gross negligence, fraud, or willful misconduct; (b) Aatrex's indemnification obligations under Section 16; or (c) liability that cannot be excluded or limited under applicable law, including liability for death or personal injury caused by negligence.

16. Indemnification

Customer shall defend, indemnify, and hold harmless Aatrex, its officers, directors, employees, agents, licensors, and service providers from and against any claims, liabilities, damages, judgments, awards, losses, costs, or expenses (including reasonable legal fees) arising out of or relating to:

(a) Customer's violation of these Terms or any applicable law;

(b) Customer's migration of data without legal authorization, including violation of any third party's intellectual property, privacy, or data protection rights;

(c) Customer's breach of any warranty set forth in these Terms;

(d) Any claim by a User, employee, or data subject arising from Customer's direction of the Migration;

(e) Customer's infringement of any third-party intellectual property rights;

(f) Customer's provision of false or misleading registration information.

Aatrex reserves the right to assume exclusive control of the defense of any matter subject to indemnification by Customer, at Customer's expense.

17. Suspension and Termination

17.1 Termination by Customer.

Customer may terminate its account at any time. Termination does not entitle Customer to a refund of prepaid fees for unused service periods except as expressly required by law.

17.2 Termination by Aatrex.

Aatrex may suspend or terminate Customer's access to the Service immediately and without notice upon: (a) material breach of these Terms, including the Acceptable Use Policy; (b) reasonable belief that Customer is using the Service for an illegal purpose; (c) non-payment of fees; (d) insolvency or bankruptcy proceedings; (e) conduct that threatens the security, integrity, or availability of the Service for other customers.

17.3 Effect of Termination.

Upon termination: (a) all licenses granted hereunder immediately terminate; (b) Customer's access to the Service will be revoked; (c) Customer Data will be retained for 30 days for export purposes, then permanently deleted; (d) any outstanding fees become immediately due and payable.

17.4 Survival.

The following sections survive termination: Definitions, Data Ownership, Intellectual Property, Confidentiality, Limitation of Liability, Indemnification, Governing Law, and General Provisions.

18. Governing Law and Dispute Resolution

18.1 Governing Law.

These Terms and all disputes arising out of or in connection with them shall be governed by and construed in accordance with the laws of India, without regard to its conflict of law principles.

18.2 Mandatory Arbitration.

Any dispute, controversy, or claim arising out of or relating to these Terms, or the breach, termination, or invalidity thereof, shall be finally settled by binding arbitration administered by the International Centre for Alternative Dispute Resolution (ICADR), New Delhi, under the ICADR Arbitration Rules and the Arbitration and Conciliation Act, 1996 (India), as amended. The arbitration shall be completed within 12 months of the notice of arbitration unless the parties agree otherwise. The seat of arbitration shall be Bangalore, Karnataka, India. The arbitration shall be conducted in English. The arbitral award shall be final and binding on both parties.

18.3 Injunctive Relief.

Notwithstanding Section 18.2, either party may seek interim or injunctive relief from courts of competent jurisdiction in Bangalore, India to prevent irreparable harm pending arbitration.

18.4 Class Action Waiver.

This waiver applies only to business entities. It does not apply to natural persons acting in their capacity as consumers where prohibited by applicable consumer protection law.

18.5 Limitation Period.

Any claim arising out of or related to these Terms must be brought within one (1) year after the cause of action accrues. Claims not brought within this period are forever waived and barred. The limitation period begins to run from the later of: (a) the date the cause of action accrued; or (b) the date the claiming party knew or reasonably should have known of the facts giving rise to the claim.

19. General Provisions

19.1 Entire Agreement.

These Terms, together with the Privacy Policy and any order forms or purchase agreements, constitute the entire agreement between the parties with respect to the subject matter hereof and supersede all prior and contemporaneous understandings, negotiations, representations, and agreements, whether written or oral.

19.2 Modifications.

Aatrex reserves the right to modify these Terms at any time. Material changes will be communicated to Customer via email or prominent in-Service notice at least 30 days before the effective date. Continued use of the Service after the effective date constitutes acceptance of the modified Terms. Material changes to these Terms shall not apply to Migrations that are already in active progress at the time the change takes effect.

19.3 Severability.

If any provision of these Terms is found to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect. The invalid provision shall be modified to the minimum extent necessary to make it enforceable.

19.4 No Waiver.

Aatrex's failure to enforce any right or provision of these Terms shall not constitute a waiver of that right or provision. Any waiver must be in writing and signed by an authorized representative of Aatrex.

19.5 Assignment.

Customer may not assign or transfer these Terms or any rights hereunder without Aatrex's prior written consent. Aatrex may assign these Terms in connection with a merger, acquisition, or sale of substantially all of its assets without Customer's consent.

19.6 No Third-Party Beneficiaries.

These Terms are for the sole benefit of the parties and their respective permitted successors and assigns. Nothing herein shall create any rights in any third party.

19.7 Force Majeure.

Neither party shall be liable for failure or delay in performance due to causes beyond their reasonable control, including acts of God, government actions, war, terrorism, natural disasters, pandemic, or third-party infrastructure failures (including Microsoft or Google cloud outages). The party claiming Force Majeure must: (a) give prompt written notice to the other party; (b) use commercially reasonable efforts to overcome or work around the Force Majeure event; and (c) resume performance as soon as reasonably practicable. Force Majeure does not excuse payment obligations.

19.8 Anti-Bribery.

Each party represents that it will comply with all applicable anti-bribery and anti-corruption laws, including the Prevention of Corruption Act (India) and, where applicable, the U.S. Foreign Corrupt Practices Act and the UK Bribery Act.

19.9 Export Control.

Customer agrees to comply with all applicable export control laws and regulations in connection with its use of the Service.

19.10 Notices.

Legal notices to Aatrex must be sent to support@aatrex.in. Notices to Customer will be sent to the email address provided during registration.

19.11 Sanctions Compliance.

Customer represents and warrants that neither Customer nor any of its principals, officers, or directors is: (a) designated on any applicable sanctions list, including those maintained by the United Nations Security Council, the European Union, the United Kingdom Office of Financial Sanctions Implementation, the U.S. Office of Foreign Assets Control (OFAC), or any comparable Indian authority; or (b) located in a country or territory subject to comprehensive sanctions. Customer agrees to immediately notify Aatrex if this representation becomes false.

19.12 Beta and Preview Features.

From time to time, Aatrex may offer features designated as "Beta," "Preview," or "Early Access." Such features are excluded from the uptime target in Section 13, are provided AS IS without any warranty, and may be modified or discontinued at any time without notice. Beta features are not subject to the service credits or remedies, if any, that may apply to generally available features.

21. Jurisdiction-Specific Provisions

These Terms are governed by Indian law as stated in Section 18. The following provisions apply additionally to Customers located in the specified jurisdictions. In case of conflict between a jurisdiction-specific provision and the general Terms, the jurisdiction-specific provision prevails for Customers in that jurisdiction.

21.1 United States.

Governing law (US Customers): For disputes arising from use of the Service by US-based Customers, either party may elect to have the dispute resolved under New York law and submitted to JAMS arbitration (www.jamsadr.com) in lieu of Section 18.2, provided such election is made in writing within 30 days of the dispute arising.

California Consumers: Notwithstanding Section 18.4, the class action waiver does not apply to natural persons acting in a personal (non-commercial) capacity who are residents of California. Such persons retain the right to bring individual claims in small claims court for disputes within that court's jurisdictional limit.

No sale of personal information: Aatrex does not sell or share personal information as defined under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA). Aatrex does not use Customer Data for cross-context behavioural advertising.

21.2 Canada.

Aatrex processes personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec's Law 25 (Law modernizing legislative provisions as regards the protection of personal information). Canadian Customers may direct privacy requests to support@aatrex.in. Where Quebec Law 25 applies, Aatrex will conduct and document a Privacy Impact Assessment (PIA) prior to any new processing of Quebec residents' personal information that presents a risk of privacy harm.

21.3 Australia.

Aatrex handles personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Australian Customers may lodge complaints with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au if they are not satisfied with Aatrex's response to a privacy complaint. Nothing in these Terms excludes, restricts, or modifies any consumer guarantee, right, or remedy under the Australian Consumer Law (ACL) to the extent it cannot be excluded.

21.4 Singapore.

Aatrex processes personal data in accordance with Singapore's Personal Data Protection Act 2012 (PDPA). Singapore Customers may direct data access or correction requests to support@aatrex.in. Aatrex will notify the Personal Data Protection Commission (PDPC) and affected individuals of a data breach affecting Singapore residents' personal data within 3 calendar days of assessing that the breach is notifiable under the PDPA.

21.5 Brazil.

Aatrex processes personal data in accordance with Brazil's Lei Geral de Proteção de Dados (LGPD) (Law No. 13,709/2018). Brazilian data subjects may exercise their rights under Art. 18 LGPD (access, correction, deletion, portability, revocation of consent, and information about sharing) by contacting support@aatrex.in. Aatrex will notify Brazil's Autoridade Nacional de Proteção de Dados (ANPD) of a data incident affecting Brazilian data subjects within 2 business days of confirming the incident, as required by ANPD Resolution CD/ANPD No. 2/2022.

21.6 Japan.

Aatrex handles personal information in accordance with Japan's Act on the Protection of Personal Information (APPI), as amended in 2022. Japanese data subjects may request disclosure, correction, or deletion of their personal information by contacting support@aatrex.in. Aatrex will not provide Japanese data subjects' personal information to third parties without their consent except where permitted by APPI. Prior to any overseas transfer of Japanese data subjects' personal information, Aatrex will implement measures to ensure the recipient provides a level of protection equivalent to APPI requirements.

21.7 United Arab Emirates.

Aatrex processes personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations. UAE data subjects may exercise their rights (access, correction, deletion, and withdrawal of consent) by contacting support@aatrex.in. Aatrex will cooperate with the UAE Data Office in the event of a supervisory investigation.

21.8 General International.

For Customers located in jurisdictions not specifically addressed above: (a) Customer, as data controller, is solely responsible for ensuring its use of the Service complies with applicable local data protection and privacy laws; (b) Aatrex, as data processor, will provide reasonable cooperation to assist Customer in meeting its local compliance obligations upon written request; (c) all Customer Data is processed in India unless a separate written data residency agreement is executed; (d) by using the Service, Customer acknowledges and consents to the cross-border transfer of data to India for processing purposes.

21.9 Prohibited and Restricted Jurisdictions.

Prohibited Jurisdictions: The Service is not available to any person or entity located in, organised under the laws of, or ordinarily resident in: (a) the Democratic People's Republic of Korea (North Korea); (b) the Islamic Republic of Iran; (c) the Syrian Arab Republic; or (d) the Republic of Cuba (collectively, "Prohibited Jurisdictions"). These restrictions reflect India's obligations under applicable United Nations Security Council resolutions and Indian law. Any attempt to access the Service from a Prohibited Jurisdiction is a material breach of these Terms and will result in immediate account termination without refund.

Restricted Jurisdictions: Customers located in the following jurisdictions are subject to enhanced due diligence and must obtain written approval from Aatrex before activating a paid subscription: (a) the Islamic Republic of Pakistan; (b) the People's Republic of China; (c) the Republic of Belarus; (d) the Republic of the Union of Myanmar; (e) the Islamic Republic of Afghanistan; (f) the Republic of the Sudan; (g) the State of Libya; (h) the Republic of Yemen; (i) the Federal Republic of Somalia; (j) the Republic of South Sudan (collectively, "Restricted Jurisdictions"). Access from Restricted Jurisdictions on a free trial basis does not imply eligibility for a paid subscription. Aatrex reserves the right to decline or terminate service to any Restricted Jurisdiction customer at its sole discretion to comply with Indian government directives, FEMA restrictions, or applicable sanctions.

Compliance with Indian Government Directives: Aatrex may, without notice, suspend or terminate access to the Service for any user or jurisdiction in response to a directive issued by the Government of India, the Ministry of Electronics and Information Technology (MeitY), the Reserve Bank of India (RBI), or any other competent Indian governmental authority under the Information Technology Act, 2000, the Foreign Exchange Management Act, 1999, or any other applicable Indian law. No liability shall attach to Aatrex for any such suspension or termination.

Sanctions Monitoring: Aatrex reserves the right to update the list of Prohibited and Restricted Jurisdictions at any time to reflect changes in Indian law, UNSC resolutions, or Indian government policy. Updated lists will take effect upon posting to these Terms. Continued use of the Service after such update constitutes acceptance of the revised jurisdiction restrictions.

20. Contact

For legal notices, security incidents and data protection requests: support@aatrex.in. Put the topic (for example "Legal notice", "Security incident" or "GDPR Request") in the subject line.