Terms of Service for the Privexus Platform

1.1 These Terms of Service ("Terms") are entered into by and between Privexus ("Privexus," "we," "us," or "our") and the individual or entity accessing or using the Privexus platform ("Customer," "you," or "your").

1.2 Privexus operates the Privexus platform, a compliance management software service designed to help organizations manage their data protection, data governance, cybersecurity, and AI governance obligations under Cambodian law and applicable international standards.

1.3 By creating an account, accessing, or using the Privexus platform, you acknowledge that you have read, understood, and agree to be bound by these Terms. If you are accepting these Terms on behalf of an organization, you represent that you have the authority to bind that organization to these Terms.

1.4 These Terms constitute a legally binding agreement between you and Privexus. If you do not agree to these Terms, you may not access or use the platform.

2.1 "Authorized Users" means individuals authorized by the Customer to access and use the platform under the Customer's account.

2.2 "Customer Data" means all data, content, and information uploaded or submitted by the Customer or Authorized Users to the platform.

2.3 "Data Processing Agreement" or "DPA" means the agreement governing the processing of personal data, as referenced in these Terms.

2.4 "Effective Date" means the date you first access or use the platform.

2.5 "Personal Data" has the meaning given under the Personal Data Protection Law of the Kingdom of Cambodia (PDPL 2026), being any information relating to an identified or identifiable natural person.

2.6 "Services" means the Privexus platform, including all features, functionalities, and support services provided by Privexus.

2.7 "Service Level Agreement" or "SLA" means the service level commitments described in these Terms or your order form.

3.1 To access the platform, you must register for an account and provide accurate, current, and complete information. You are responsible for maintaining the accuracy and completeness of your account information.

3.2 You must use a valid business email address for registration. Personal email addresses associated with free email services may not be accepted.

3.3 You are responsible for maintaining the confidentiality of your account credentials, including passwords and API keys. You must immediately notify us of any unauthorized access or security breach.

3.4 Account administrators may invite Authorized Users and assign access levels. The Customer is responsible for all activities that occur under its account, whether authorized or not.

3.5 We reserve the right to suspend or terminate accounts that violate these Terms, engage in prohibited activities, or pose security risks.

3.6 Multi-factor authentication (MFA) is required for administrator accounts. Single sign-on (SSO) via SAML 2.0 or OpenID Connect is available for organizations with compatible identity providers.

4.1 Subject to these Terms and payment of applicable fees, Privexus grants you a limited, non-exclusive, non-transferable, revocable license to access and use the Services solely for your internal business purposes during the subscription period.

4.2 This license is restricted to the number of Authorized Users and service modules specified in your order form or subscription plan.

4.3 You may not sublicense, resell, transfer, assign, or otherwise make available the platform or any content to third parties without our prior written consent.

4.4 You may not reverse engineer, decompile, disassemble, or attempt to derive the source code, algorithms, or underlying technology of the platform.

4.5 You may not bypass, disable, or interfere with security-related features or usage rules built into the platform.

4.6 All rights not expressly granted herein are reserved by Privexus.

5.1 You agree not to use the platform in any manner that violates applicable law, including the Personal Data Protection Law of the Kingdom of Cambodia (PDPL 2026), or any other relevant Cambodian or international law.

5.2 Prohibited activities include but are not limited to: uploading or processing unlawful, defamatory, obscene, or fraudulent content; attempting unauthorized access to any account, system, or network; transmitting malware, viruses, or other harmful code; engaging in activities that interfere with or disrupt the platform or its underlying infrastructure.

5.3 You shall not use the platform to process personal data without a valid legal basis as required under PDPL 2026. You are responsible for determining and maintaining appropriate legal bases for all personal data processing activities conducted through the platform.

5.4 Security testing, vulnerability scanning, or penetration testing of the platform requires prior written authorization from Privexus.

5.5 If we reasonably believe your use violates these Terms or applicable law, we may investigate and take appropriate action, including suspending access, removing content, or terminating the agreement.

6.1 You retain all rights, title, and interest in and to all Customer Data. Privexus does not claim any ownership rights over your data.

6.2 You represent and warrant that you have all necessary rights, permissions, and legal bases to upload, process, and share Customer Data through the platform, and that such processing complies with applicable law, including PDPL 2026.

6.3 You are responsible for implementing appropriate technical and organizational measures to ensure the security and confidentiality of Customer Data, including proper access controls and encryption where necessary.

6.4 You shall implement data minimization principles, collecting and processing only the minimum personal data necessary for your stated purposes.

6.5 Upon termination of your subscription, you may export your Customer Data within the period specified in your order form. After this period, we may delete Customer Data in accordance with our data retention policy.

6.6 Privexus may use anonymized, aggregated data derived from Customer Data for service improvement, analytics, and benchmarking purposes, provided such data does not identify you or any individual.

7.1 Privexus acts as a data processor under PDPL 2026, processing Customer Data on your behalf as the data controller. Your use of the platform constitutes your acknowledgment of this data processing relationship.

7.2 The Data Processing Agreement ("DPA") incorporated into these Terms governs our processing of personal data. In case of conflict, the DPA shall prevail with respect to personal data processing matters.

7.3 We process personal data only in accordance with your documented instructions, unless required to do otherwise by applicable Cambodian or international law.

7.4 We implement appropriate technical and organizational security measures to protect personal data, including: encryption at rest (AES-256) and in transit (TLS 1.2+); access controls and authentication mechanisms; regular security assessments and vulnerability testing; incident detection and response procedures.

7.5 You acknowledge that compliance with PDPL 2026 requires ongoing effort, and Privexus provides tools and workflows to support your compliance program. However, Privexus does not guarantee that your use of the platform ensures legal compliance.

7.6 Cross-border transfers of personal data outside the Kingdom of Cambodia are conducted in compliance with Chapter [X] of PDPL 2026 on international data transfers.

7.7 We maintain records of processing activities as required under PDPL 2026 Article 30 and make such records available to you upon request.

8.1 Subscription fees and any applicable taxes are specified in your order form or subscription plan. Fees are based on the number of Authorized Users, service modules, and subscription period selected.

8.2 Unless otherwise specified, fees are billed in advance on a monthly or annual basis according to your selected billing cycle.

8.3 All fees are non-refundable except as expressly stated in these Terms or required by applicable law.

8.4 We reserve the right to modify subscription fees with at least thirty (30) days' prior written notice. Fee changes take effect at the next renewal date.

8.5 Payment is due within thirty (30) days of invoice date. Late payments accrue interest at the rate of 1.5% per month or the maximum rate permitted by Cambodian law, whichever is lower.

8.6 If payment is overdue by more than fifteen (15) days, we may suspend your access to the platform after providing written notice. Access will be restored upon payment of all outstanding fees.

8.7 You are responsible for all taxes, duties, and other governmental charges related to your use of the Services, excluding taxes based on our net income.

9.1 We aim to maintain platform availability of 99.9% measured monthly, excluding scheduled maintenance and circumstances beyond our reasonable control.

9.2 Scheduled maintenance will be communicated in advance through the Trust Center and status.privexus.io. We will provide at least forty-eight (48) hours' notice for planned downtime.

9.3 In the event of unscheduled downtime, we will use reasonable efforts to restore service as quickly as possible and communicate status updates.

9.4 Support requests may be submitted through the platform or by email. We aim to respond to standard support requests within one (1) business day during normal business hours (Monday to Friday, 8:00 AM to 6:00 PM Phnom Penh time, excluding public holidays).

9.5 Critical incidents affecting production systems are addressed with priority. Response times for critical incidents are specified in your order form or SLA.

9.6 These service levels apply to core platform functionality. Third-party integrations and external services are subject to their respective availability commitments.

10.1 Privexus and its licensors retain all rights, title, and interest in and to the platform, including all software, technology, documentation, and other materials provided in connection with the Services.

10.2 The Privexus name, logo, and all related trademarks, service marks, and trade names are the exclusive property of Privexus. You may not use our trademarks without prior written permission.

10.3 You retain all rights to your Customer Data. You grant Privexus a limited license to use Customer Data solely to provide and improve the Services.

10.4 If you provide feedback, suggestions, or recommendations regarding the platform, we may use such input without obligation to you.

10.5 You shall not remove, alter, or obscure any proprietary notices, including copyright and trademark notices, on or in the platform.

11.1 "Confidential Information" means all non-public information disclosed by one party to the other that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information.

11.2 Each party agrees to: protect Confidential Information using the same degree of care it uses to protect its own confidential information, but no less than reasonable care; not disclose Confidential Information to any third party without prior written consent; and use Confidential Information only for purposes of performing or receiving the Services.

11.3 Confidentiality obligations do not apply to information that: is or becomes publicly available through no fault of the receiving party; was rightfully known before disclosure; is independently developed without use of Confidential Information; or is disclosed pursuant to a valid legal requirement or court order.

11.4 The confidentiality obligations in these Terms survive termination or expiration of the agreement for a period of three (3) years.

12.1 Each party represents and warrants that: it has the full power and authority to enter into these Terms; its performance under these Terms does not conflict with any other agreement to which it is a party; and it will comply with all applicable laws in performing its obligations.

12.2 Privexus represents and warrants that: the platform will perform substantially in accordance with its documentation; we will provide the Services in a professional and workmanlike manner; and we maintain appropriate security measures as described in these Terms.

12.3 THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE PLATFORM WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE.

12.4 You acknowledge that the platform is not designed or guaranteed to ensure legal compliance. Using the platform does not guarantee compliance with PDPL 2026 or any other law. You are responsible for determining your compliance obligations.

13.1 TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE CAMBODIAN LAW, NEITHER PARTY SHALL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, REVENUE, DATA, OR USE, INCURRED BY THE OTHER PARTY OR ANY THIRD PARTY, WHETHER IN AN ACTION IN CONTRACT OR TORT, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

13.2 EXCEPT FOR CLAIMS ARISING FROM BREACH OF CONFIDENTIALITY, INTELLECTUAL PROPERTY INFRINGEMENT, OR GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, EACH PARTY'S TOTAL CUMULATIVE LIABILITY UNDER THESE TERMS SHALL NOT EXCEED THE TOTAL FEES PAID BY YOU TO PRIvexUS DURING THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

13.3 The limitations in this section apply regardless of the form of action, whether in contract, tort (including negligence), strict liability, or otherwise, and even if a remedy fails of its essential purpose.

14.1 You shall indemnify, defend, and hold harmless Privexus and its officers, directors, employees, and agents from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising from: your breach of these Terms; your processing of Customer Data without a valid legal basis; your violation of applicable law; or your unauthorized use of the platform.

14.2 We shall indemnify you against third-party claims that the platform, as provided by us, infringes any patent, copyright, trademark, or trade secret of such third party, provided you: promptly notify us of the claim; give us sole control of the defense and settlement; and provide reasonable cooperation.

14.3 If the platform is, or in our reasonable opinion is likely to become, the subject of an infringement claim, we may at our option: procure the right to continue using the platform; modify or replace it with a non-infringing equivalent; or terminate these Terms and refund prepaid fees.

15.1 These Terms commence on the Effective Date and continue for the subscription period specified in your order form, unless earlier terminated in accordance with these Terms.

15.2 Either party may terminate these Terms: for material breach if the other party fails to cure within thirty (30) days of written notice; or immediately if the other party becomes insolvent, files for bankruptcy, or ceases to operate.

15.3 You may terminate your subscription at any time through the platform settings or by contacting support. Termination takes effect at the end of the current billing period.

15.4 We may terminate or suspend your access immediately, without prior notice, if we reasonably believe you have violated these Terms or pose a security risk.

15.5 Upon termination: your right to access the platform immediately ceases; we will make Customer Data available for export for thirty (30) days, unless otherwise agreed; we will delete Customer Data within sixty (60) days of the retention period, unless legally required to retain longer; and all fees owed become immediately due and payable.

16.1 We may modify these Terms from time to time. Material modifications will be communicated by posting an updated version in the Trust Center and, where practical, by email notification to the account administrator.

16.2 For material modifications, we will provide at least thirty (30) days' notice before the modified terms take effect, unless such changes are required by applicable law or necessary to address security concerns.

16.3 If you do not agree to the modified Terms, you may terminate your subscription before the effective date. Your continued use of the platform after the effective date constitutes your acceptance of the modified Terms.

16.4 Non-material modifications take effect immediately upon posting. We encourage you to review the Terms periodically.

17.1 These Terms and any dispute arising from them shall be governed by and construed in accordance with the laws of the Kingdom of Cambodia.

17.2 Any dispute, controversy, or claim arising out of or relating to these Terms, including their existence, interpretation, performance, or termination, shall first be attempted to be resolved through good-faith negotiations between the parties.

17.3 If the dispute is not resolved through negotiation within thirty (30) days, either party may submit the dispute to arbitration in accordance with the Arbitration Rules of the National Commercial Arbitration Center of Cambodia.

17.4 The seat of arbitration shall be Phnom Penh, Cambodia. The language of arbitration shall be English.

17.5 Notwithstanding the foregoing, either party may seek injunctive relief or other equitable remedies in the courts of the Kingdom of Cambodia to protect its intellectual property rights or confidential information.

18.1 Entire Agreement: These Terms, together with the Data Processing Agreement, Order Forms, and any referenced policies, constitute the entire agreement between the parties and supersede all prior agreements and understandings.

18.2 Amendments: Any amendment or modification of these Terms must be in writing and signed by both parties.

18.3 Waiver: The failure of either party to enforce any right or provision shall not constitute a waiver of such right or provision.

18.4 Severability: If any provision of these Terms is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

18.5 Assignment: You may not assign these Terms without our prior written consent. We may assign these Terms to an affiliate or in connection with a merger, acquisition, or sale of assets.

18.6 Independent Contractors: The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, or employment relationship.

18.7 Third-Party Beneficiaries: These Terms are for the sole benefit of the parties and their permitted successors. There are no third-party beneficiaries.

18.8 Force Majeure: Neither party shall be liable for any failure or delay due to matters beyond its reasonable control, including natural disasters, war, terrorism, government actions, or infrastructure failures.

19.1 If you have questions about these Terms or need to exercise any rights under these Terms, please contact us:

19.2 Privexus

19.3 Address: Phnom Penh, Kingdom of Cambodia

19.4 Email: trust@privexus.io

19.5 For data protection inquiries: dpo@privexus.io

19.6 For legal and contractual matters: legal@privexus.io