Terms of Service

Effective Date: [date of publication]  |  Last Updated: 19 October 2026

This document is a draft prepared for legal review and has not yet been reviewed by counsel. Highlighted items in square brackets are still to be confirmed by Colony.

1. Who we are and what these Terms cover

These Terms are an agreement between eOTP LLC, trading as Colony ("Colony", "we", "us"), a Delaware limited liability company, registered address 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US, and the business that creates a Colony account ("Customer", "you"). By creating an account, ticking the acceptance box at sign-up, or using Colony at colonys.io, you agree to these Terms on behalf of that business, and you confirm that you have authority to bind it. If you cannot bind the business, do not create an account.

These Terms include, and you also agree to: the Privacy Policy, the Data Processing Agreement (DPA), the Acceptable Use and Messaging Policy (AUP), the Sub-processor list, and any order form, plan page or written addendum we both accept. A feature may also come with its own short terms, shown when you switch it on.

Order of precedence. If documents conflict, this is the order that wins: (1) a written addendum or order form signed or accepted by both of us, but only for what it says; (2) the DPA, for personal data; (3) these Terms; (4) the AUP; (5) the Privacy Policy and other documents. The Privacy Policy describes what we do as a controller. It does not change our promises to you as your processor.

2. Definitions

• Account: your Colony workspace and the logins in it.
• Customer Data: everything you or your users put into Colony or collect through it, including data about your own customers, leads, staff and website visitors.
• End User: anyone who deals with you through Colony, such as your customers, leads, signers, bookers, form fillers, or visitors to your public pages.
• Users: the people you let sign in to your Account.
• Third-Party Service: a service run by someone other than Colony that you connect to or use through Colony (Section 10).
• Provider Rules: the terms and policies of a Third-Party Service provider that apply to your use of it.
• Beta Feature: a feature or service we label beta, preview, early access, pilot or similar, or offer free of charge for testing.
• AI Feature: a feature that uses an artificial-intelligence model to produce text, images, pages, summaries, suggestions or calculations.
• Messaging Law: any law, regulation, industry code or network rule about unsolicited or marketing messages and calls in the place where you or the recipient is.
• Including means "including without limitation".

3. Who can use Colony

• Colony is a business service. Whoever signs up must be 18 or older and authorised to act for the business. Colony is not for consumers acting outside a business or professional capacity.
• Using Colony for another business. If you use Colony for a client or another company (for example as an agency, franchisor or consultant), you confirm you have written authority to bind that company to these Terms, and you are responsible for it as if it were your own Account.
• Sanctions and restricted countries. You confirm that you, your owners and your Users are not on a sanctions or denied-party list of the United States, the United Kingdom, the European Union or the United Nations, and are not located in or ordinarily resident in a comprehensively embargoed country or region.
• Your End Users are not our customers. We hold their data for you (Section 8).

4. The service

Colony is business management software for service businesses, with a built-in CRM. Depending on the features you switch on, it covers leads, customers, jobs and projects, tickets, tasks, meetings and public booking pages, products and services, quotes, invoices, credit notes and receipts, recurring invoices, online payment links, forms and electronic signatures, document sharing and scanning, a shared inbox with email, WhatsApp and SMS, newsletters, loyalty cards, vouchers and wallet passes, websites and landing pages, reports and dashboards, workflows, a public API and webhooks, and AI Features. Some features are optional, in beta, switched off until you or we set something up, or available only in some countries. Colony is not an accounting, tax, legal, payroll, stock-control or compliance system, and it does not replace your professional advisers.

We may add, change or retire features. If we remove a material feature that you pay for, we will give you reasonable notice and, if the removal seriously harms your use, a pro-rata refund of what you prepaid for the lost period.

5. Accounts and security

• You are responsible for your login details, your Users, and everything done under your Account. The owner and administrators decide who gets access and what each role can see. Roles limit what menus a User sees and are a convenience, not a substitute for choosing carefully whom you invite.
• Give accurate information and keep it current. Keep your administrators' contact details up to date: we send security and service notices there.
• Keep credentials, API tokens and webhook secrets confidential. Do not share a login between people. Remove Users who leave.
• Turn on two-factor sign-in for your Users where offered.
• Tell us promptly at support@colonys.io if you suspect unauthorised access. You are responsible for losses from unauthorised use that results from your failure to keep credentials safe.
• You are responsible for the settings you choose, including which channels, countries, integrations and AI Features are on, and for the actions of any workflow, automation, webhook or API client you set up, even when it runs without a person clicking.

6. Free trials and Beta Features

• Trials. We may offer a free trial or free plan. A trial lasts for the period shown when you sign up, and we may change or end a trial offer at any time. [Trial length: ___.] Unless we say otherwise, a trial gives you the same features as a paid plan, may have lower limits, and needs no payment details. When a trial ends and you have not chosen a paid plan, we may limit or close the Account after notice. Your data is then handled as in Section 22.
• Beta Features. Beta Features are offered "as is", may change, be withdrawn or stop working without notice, may contain errors, and may not be covered by any support or availability statement. Do not rely on a Beta Feature for anything you cannot afford to lose or redo. We may use your feedback and usage information about a Beta Feature to improve it. If we ask you to keep information about a Beta Feature confidential, you will. Our liability for Beta Features and free services is limited to the extent the law allows, and our total liability for them is USD 100 in total.
• Features that depend on a third party's approval or account (for example WhatsApp message templates, wallet passes, or online payments) may be unavailable or delayed while that third party decides.

7. Fees, taxes and payment

• Paid plans. Colony is currently available [free during a trial period]. When paid plans apply, the plan, price, billing period and any usage charges will be shown before you buy. Before any charge applies to an existing Account, we will give you written notice of the plan, the price and the date, and you may stop using Colony or delete your Account first. Fees are invoiced by eOTP LLC in [currency].
• Billing. Fees are charged in advance for each billing period using the payment method you give us, and are due on the invoice date unless the invoice says otherwise. You authorise us and our payment provider to charge it. Keep your payment method current. Fees you have paid are not refundable, except as these Terms say or the law requires.
• Renewal. Subscriptions renew for the same period unless you cancel before the renewal date. You can cancel in the product or by writing to us, and cancellation takes effect at the end of the paid period.
• Price changes. We may change prices for a renewal by giving you at least [30] days' notice before the renewal date. If you do not accept the new price, cancel before it takes effect. Changes never apply to a period you have already paid for.
• Taxes. Prices exclude VAT, GST, sales tax, use tax, withholding and similar taxes. You pay them, other than tax on Colony's own income. Where we must collect tax, we add it to the invoice, and you give us the tax details we ask for. If the law requires you to withhold tax, you gross up the payment so that we receive the full invoice amount, unless you give us an official receipt for the withheld tax within [90] days.
• Late payment and suspension. If an invoice is unpaid [10] days after we notify you, we may suspend the Account until it is paid, and may charge interest on overdue amounts at the lower of [1]% per month and the legal maximum, plus reasonable collection costs. Suspension for non-payment does not end your duty to pay.
• Disputed charges. Tell us within [60] days of an invoice date if you dispute a charge, and pay the undisputed part.
• Credits and promotions. Promotional credits have no cash value, do not carry over, and cannot be transferred.
• Third-party charges. Third-party services connected to your Account (for example Meta/WhatsApp, LogicSMS, Stripe, PayFast, Ozow, Stitch, Google, Microsoft, AI providers, your email and SMS providers) bill you directly or under their own terms. Colony is not responsible for their charges, availability or decisions. Usage that Colony pays for on your behalf, such as AI usage or messages sent on Colony's own accounts, may be limited or charged as the plan page says.

8. Your content and your data

• You own your data. We do not claim ownership of Customer Data. You give us a limited licence to host, copy, process, transmit and display it only to run the service for you, keep it secure, fix problems, prevent abuse, provide support you ask for, and comply with law.
• Roles. For personal information about your own customers, contacts, staff, signers and the people who use your public pages, you are the controller / responsible party and Colony is your processor / operator. The DPA sets out how we handle it and is part of these Terms. For our own account, billing, security and marketing data about you and your Users, Colony is the controller (see the Privacy Policy).
• You are responsible for having a lawful basis and any consent to put personal information into Colony and to message people through it (see the AUP), for your own privacy notice and cookie notice where you collect data from End Users, for the accuracy and legality of your content, and for responding to requests from the people whose data you hold. Colony provides tools (export, erase, consent ledger, unsubscribe, suppression, audit log) but does not decide for you. Do not upload data you have no right to hold.
• No sale, no training. We do not sell Customer Data. We do not use Customer Data to train AI models, ours or anyone else's, and we use only AI providers whose terms we use do not allow training on it.
• Data from Google and Microsoft accounts. If you connect a Google or Microsoft account, we use the mail, calendar and profile data we get from it only to provide the sync and sign-in features you switched on. We do not use it for advertising or to train AI models, and we do not sell or transfer it except to run the feature, keep it secure, comply with law, or as you direct.
• Aggregate data. We may use anonymised, aggregated usage statistics that do not identify you or any person (for example feature counts) to run, secure and improve Colony.
• Legal requests. If a public authority asks us for Customer Data, we will direct it to you where we lawfully can, and tell you before disclosing unless the law forbids it. We will disclose only what we are legally required to.
• Export and deletion. You can export your data at any time with the tools in the product, and we will help on request. The end-of-contract rules are in Section 22.

9. Your customers, End Users and public pages

• Colony lets you publish pages and links that End Users use: public booking pages, forms, document-signing links, payment links, portals, landing pages, storefront pages, status pages, unsubscribe pages and chat. These are your pages. You are the business the End User deals with, and Colony is not a party to that relationship.
• You are responsible for what you publish and send, for any terms of sale, refund and cancellation policy you offer End Users, for your own privacy and cookie notices (Colony shows a consent banner on public marketing pages and links it to Colony's notice, but that does not replace a policy of your own), for accessibility, and for consumer-protection laws that apply to you.
• You must tell End Users who you are, give them a way to contact you, and not suggest that Colony endorses you or is responsible for your goods or services.
• Search and AI visibility. Public pages may be indexed by search engines and read by AI crawlers according to the visibility settings you choose. Do not publish anything on a public page that you do not want found.
• Cookies and analytics. If you add your own analytics tag or scripts to a page, you are responsible for lawful use of them and for the consent they need.
• Requests from End Users about their data (access, correction, deletion, opt-out) are yours to answer. We will pass on any we receive and help you as the DPA says.
• Copyright and takedown. If you believe content on a Colony page infringes your rights, write to support@colonys.io with the page address, what is infringed and your contact details. We may remove or disable content that is reported or that we reasonably believe is unlawful, and we may end the Accounts of repeat infringers.

10. Third-party services and integrations

Features that connect to other platforms are also governed by those platforms' terms and policies: Meta/WhatsApp Business Platform, LogicSMS (SMS and voice), Stripe, PayFast, Ozow and Stitch (payments), Google and Microsoft (sign-in, mail, calendar), Apple and Google (wallet passes), Cloudflare (email, bot checks), email and SMS providers you connect, and AI providers (Anthropic, OpenAI). By using a connected feature you agree to follow the Provider Rules for it, and you confirm you have the right to accept them for your business.

• What you must pass on. Some providers require us to bind our customers to their rules. Examples: WhatsApp's Business Messaging Policy and Commerce Policy (opt-in, content limits, restricted industries, honouring opt-outs, honest business profile); the payment provider's merchant terms and its list of prohibited and restricted businesses; wallet-pass rules about accurate content and not collecting more data than disclosed; Google's and Microsoft's rules for apps that read user mail, calendar and profile data; and our AI providers' usage policies (Section 14). If a provider changes its rules, the change applies to you from the date it applies to us.
• Provider decisions. We may suspend or remove a connection if we reasonably believe it breaks the Provider Rules or the law, if the provider suspends or restricts it, or if keeping it creates a security, legal or commercial risk for Colony or others. We are not responsible for a provider's decisions, outages, delays or price changes. We will tell you when we can.
• Your accounts with providers. Where you connect your own account (for example your own WhatsApp Business account, Stripe account, email-sending account or Google or Microsoft login), that account is yours, the contract is between you and the provider, and you are responsible for its standing. We are not a party to that contract.
• Access you give. When you connect a service, you authorise us to access and use it, and to pass the data needed, on your instruction.
• No endorsement. A third-party service shown in Colony is not endorsed or guaranteed by us. We make no promise about it beyond these Terms.
• Imports. If you import data from another system, you confirm you are allowed to, and an import is not a live connection to that system.

11. Payments

• Colony is not a bank, payment institution, money transmitter or payment facilitator. Colony does not hold, move or settle your customers' money. Online payments run through the payment provider you connect, and card and bank details go to that provider, not to Colony.
• You are the merchant of record for what you sell. You are responsible for your prices, tax, invoices, receipts, refunds, chargebacks, disputes, fraud checks, delivery and customer support, and for following the payment provider's and card networks' rules. Colony does not process refunds for you. Record and handle them with your provider.
• The payment provider decides whether to approve, hold, reserve, pay out or reverse funds, and may apply its own fees, reserves and fines. You are liable for those, and for any fine or fee charged to Colony because of your transactions.
• You may not use Colony to take payment for goods or services that the provider prohibits or restricts, to split or disguise transactions, or to collect money for someone else without the provider's approval.
• Pay links and payment pages show the balance Colony holds on the invoice. You must check that the invoice is right before you share it. We are not responsible for a payment made against an incorrect invoice.
• Where we show a payment status, it comes from the provider and may be delayed or wrong. The provider's record controls.

12. Messaging, consent and the law

You alone decide whom to message and what to say. You must have valid consent or another lawful basis for every message and call you send through Colony, and you must follow the Messaging Law of every country you message into (for example the TCPA, CAN-SPAM and state laws in the US; POPIA and the WASPA Code in South Africa; PECR and GDPR in the UK/EU; the Spam Act in Australia; the Communications Law in Israel) as well as the rules of the networks and platforms that carry the messages. Colony can enforce suppression, STOP/unsubscribe, quiet hours and per-country consent rules as safeguards, but they do not make a message lawful and they may not cover your case. Details are in the AUP.

• You are the sender. For legal purposes you are the sender of messages you create, schedule, or trigger through Colony, including automated ones. Colony delivers them for you.
• Proof. Keep proof of consent. Colony's consent ledger can hold it, but you must put accurate information in it.
• Fines and claims. You are responsible for penalties, damages, carrier or platform charges, and claims, including class claims, that arise from messages you send or cause to be sent. Section 21 covers this.
• Delivery. Third-party networks, carriers and platforms decide whether and when a message is delivered. We do not guarantee delivery or that a message will not be filtered or blocked.
• Our own contact with you. We may send you service, security and billing messages, and, where the law allows, product news. You can opt out of non-essential messages at any time.

13. Acceptable use

You will not use Colony to: send spam or unconsented marketing; break any law; upload or send unlawful, infringing, deceptive or harmful content; harass people; impersonate others; probe, scrape, overload or bypass the security of Colony or another customer's data; test security without our written permission; reverse engineer, copy or resell Colony without permission; build a competing product from it; use the API beyond published limits or share API keys; or use Colony for high-risk uses we do not support (for example emergency services, safety-critical control, or as your only record where the law requires a specific system). The AUP gives the detail. We may suspend or limit access to stop abuse, protect others, or comply with law, and will tell you when we can.

14. AI features

• Some features send content you choose to AI providers (currently Anthropic, and OpenAI for voice transcription and some features) to produce the output you asked for. Depending on the feature, that may include your records, documents, messages, photos or audio. Only use an AI Feature on content you are allowed to process this way, and do not use one on special-category or sensitive data unless the AUP allows it.
• No training. We do not use Customer Data to train models, and we choose provider terms that do not allow it. Providers may keep inputs for a short period to run the service or prevent abuse, as set out in the sub-processor list and their terms.
• Output may be wrong. AI output can be false, incomplete, out of date or biased, and similar inputs can give different results. It is a draft. A person in your business must review it before you rely on it, send it to a customer, publish it, or use it for money, health, legal, employment, credit, insurance, housing, safety or other regulated decisions. AI document-review and calculation tools are aids, not professional advice and not a compliance check. You remain responsible for results you use.
• No solely automated decisions. Do not use an AI Feature to make a decision with legal or similarly significant effect on a person without human review, and tell people where the law or a provider requires you to tell them they are dealing with AI or that AI helped decide.
• Your ownership. As between you and us, you own the output generated for you from your inputs, subject to the rights of others in the inputs and to the law. Similar output may be generated for others, and we give no promise that output is original or free of third-party rights.
• Acceptable use. The usage policies of our AI providers apply to what you do with AI Features. Do not use them to create deceptive, harmful or unlawful content, to pose as a person, or to build a competing AI model.
• Controls and limits. AI Features may be limited by monthly spend caps, rate limits, kill switches, regional availability and model changes. We may change the AI providers or models behind a feature and will update the sub-processor list as the DPA says.
• Automated actions. An AI Feature that can take an action in your Account (for example the in-app assistant) acts on your instruction and under your Users' permissions, and actions taken that way are your actions. Check what you confirm.

15. Electronic signatures, documents and evidence

• Colony lets you collect electronic signatures and keep signed copies with evidence (such as time, IP address, browser details, and a document fingerprint). Completed documents are sealed with a Colony certificate, which some PDF readers may show as not independently verified. Colony's electronic signature is a simple electronic signature. It is not a qualified or advanced electronic signature, and it is not a digital certificate issued by a trusted authority, unless we say so in writing for a feature.
• Whether a signed document is valid or enforceable depends on the document and on the law where you and the signers are. Examples: ESIGN and UETA in the United States; the Electronic Communications and Transactions Act in South Africa; eIDAS as it applies in the EU and the UK, and the Electronic Communications Act 2000 in the UK; the Electronic Transactions Act 1999 in Australia; the Electronic Signature Law in Israel.
• Documents you must not sign electronically. In many places these cannot be validly signed electronically or need a stronger signature or formality: wills and testamentary documents; most family-law documents (for example adoption, divorce); court orders and filings that must follow court rules; documents that transfer or create certain interests in land or property where the law requires a handwritten, witnessed, notarised or registered form; negotiable instruments; powers of attorney in some places; notices of default, eviction, foreclosure, or termination of utilities, insurance or health benefits; and product-safety or hazardous-material notices. You decide whether Colony is suitable, and if you are unsure, get advice or use a different method.
• Consumer and signer rules. If a signer is a consumer, you are responsible for giving any disclosure or obtaining any consent that the law requires before you ask for an electronic signature or give electronic records, for letting the signer have a paper copy, and for offering another way to sign if the law requires one.
• Signers' identity. Colony does not verify who a signer is beyond what the signing link and any identity step you add can show. You decide how much identity checking your document needs.
• Retention. Keep your own copy. We keep signed documents and their evidence for your Account for as long as your Account is open, and afterwards as Section 22 says. We may keep a limited record where the law requires.
• Colony is a tool, not a law firm. Nothing in Colony is legal advice.

16. Availability, support and security

• Availability. We work to keep Colony available but do not promise uninterrupted or error-free service, and we do maintenance, sometimes without notice. We make no uptime commitment or service credit unless a written addendum says so. We do not guarantee that messages will be delivered by third-party networks.
• Support. Support is by email at support@colonys.io during [support hours]. We aim to respond within [target], but this is a target, not a guarantee.
• Security. We use reasonable technical and organisational measures to protect Customer Data. These include separating customers' data from each other, encrypting stored secrets and credentials, encrypting data in transit, rate limits, role-based access, two-factor sign-in, login history and an audit log, and limiting Colony staff access to what is needed. The DPA, Annex 2, describes them in more detail. We do not hold, and do not claim, any independent security certification, and Colony is not designed to store regulated health information (see the AUP).
• Breach notice. If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any case within [72] hours of becoming aware, with the information we have, so that you can meet your own duties. Our notice is not an admission of fault.
• Backups. We keep backups for our own recovery. They are not a service to you, and we do not promise to restore a particular record you deleted. Back up what you cannot lose; the export tools are there for that.
• Your security duties. Keep your devices, networks and browsers secure, and tell us about any vulnerability you find (Section 13 does not permit testing, but we welcome a report at support@colonys.io).

17. Confidentiality

Each party will protect the other's non-public information that is marked confidential or that a reasonable person would see as confidential (for Colony, this includes pricing, beta features, security details and non-public product plans; for you, Customer Data) with reasonable care, use it only for these Terms, and share it only with its staff, advisers, insurers and service providers who need to know and are bound to protect it. These duties do not cover information that is public through no fault of the receiving party, was already known to it, was independently developed, or was received lawfully from someone else. A party may disclose information if the law or a court requires, after giving the other party notice where it lawfully can. The duty lasts for three years after these Terms end, and for as long as it is a trade secret or personal information.

18. Intellectual property, feedback and publicity

• Colony, its software, design, documentation and brand belong to eOTP LLC and its licensors. We give you a limited, non-exclusive, non-transferable, revocable right to use Colony for your business while these Terms apply. We reserve every right we do not expressly give you.
• You keep all rights in your content. You give us the licence described in Section 8, and you promise you have the right to give it.
• Do not remove proprietary notices, and do not use Colony's name, logo or look without permission, except to say that you use Colony.
• Feedback. If you send us feedback or suggestions, we may use them without payment or duty to you.
• Publicity. We may name you as a Colony customer and show your name and logo in our customer lists, unless you tell us at support@colonys.io not to. We will not publish a case study or quote without your approval.
• Open-source and third-party components are subject to their own licences.

19. Warranties and disclaimers

Each party confirms that it has the power to enter these Terms. Colony is provided "as is" and "as available". To the fullest extent the law allows, we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, quiet enjoyment, title and non-infringement, and any promise that Colony, AI output, calculations, tax or payment figures, or document checks are accurate, complete, secure, uninterrupted or compliant with any law. We do not warrant that a message, payment, signature or webhook will be delivered or recognised. Nothing here limits rights you have by law that cannot be excluded (Section 27).

20. Limitation of liability

To the fullest extent the law allows:

• neither party is liable for indirect, incidental, special, consequential, exemplary or punitive loss, or for lost profit, revenue, goodwill, business or data, even if told it might happen; and
• each party's total liability for all claims relating to Colony in any 12 months is limited to the greater of the amount you paid us in that period and [USD 100].

These limits do not apply to: liability that cannot be limited by law (including fraud, wilful misconduct, and death or personal injury caused by negligence); your duty to pay fees and taxes; your indemnity in Section 21 and your breach of Sections 12 and 13; a party's breach of Section 17 (confidentiality), except that breach of the confidentiality duty about Customer Data that is also a personal data breach is limited to [___] times the cap above; or our indemnity for infringement claims in Section 21, which is limited to [USD ___]. These limits apply to every legal theory, including negligence, and survive if a remedy fails. Each party must take reasonable steps to limit its loss.

21. Indemnity

• By you. You will defend and indemnify Colony and its officers, staff and providers against third-party claims, regulator actions, fines, penalties, carrier and platform charges, and reasonable costs (including legal fees) arising from: your Customer Data and how you collected or used it; messages you send, or cause to be sent, without required consent or in breach of Messaging Law; your content on public pages; your use of an AI Feature or its output; your breach of Sections 3, 8 to 15 or 24 or of the AUP; your breach of a Provider Rule that exposes Colony to a claim, charge or loss; your tax duties; or a dispute between you and your own customers, End Users or payment provider.
• By us. We will defend you against a third-party claim that Colony itself, as we provide it, infringes that third party's intellectual property rights, and pay damages and costs a court finally awards or that we agree in a settlement. We have no duty for claims caused by your content, by use of Colony in breach of these Terms, by changes you made, by combining Colony with something we did not supply, or by a Beta Feature or free service. If a claim is made, we may modify Colony, get a licence, or end the affected feature and refund prepaid fees for it. This is your only remedy for infringement claims.
• Process. The party seeking protection must tell the other promptly, let it control the defence and settlement (but a settlement cannot admit fault by, or put a duty on, the protected party without its consent), and give reasonable help at the other's cost.

22. Term, suspension, termination and what happens to data

• Term. These Terms last while you have an Account. You may stop using Colony and delete your Account at any time. If you pay a subscription, cancellation takes effect at the end of the paid period and you are not refunded for the rest, unless we end the Account without cause or for our breach.
• We may terminate or suspend: (a) for material breach (including Sections 12 and 13 and the AUP) that you do not fix within [14] days after notice; (b) immediately where needed to stop harm, protect Colony or others, comply with law or a Provider Rule, or respond to a security threat; (c) for non-payment (Section 7); (d) if you become insolvent or stop trading; or (e) on [30] days' notice for any reason, with a refund of any prepaid fee for the unused period. We will limit a suspension to what is needed, will tell you why where we lawfully can, and will lift it once the cause is fixed. Suspension does not end your duty to pay.
• You may terminate for our material breach that we do not fix within [30] days after notice, and then we refund any prepaid fee for the unused period.
• Export window. After an Account ends, you can sign in to export for [30] days, unless we ended it for your serious breach or the law stops us. After that we delete Customer Data from production systems. Backups and logs age out on their own schedule (up to 35 days). Some records may be kept longer where the law requires or to protect our legal rights (for example billing records, signed-document evidence, consent and audit logs), and then only as needed. Items in the Recycle Bin are purged after 30 days.
• After ending. Your access stops, you stop using Colony, and sections that by nature continue (including 7 for unpaid fees, 8 on data, 15 on evidence, 17, 18, 19, 20, 21, 22, 24, 26 to 29) continue.

23. Customer duties on data you delete or send

Deleting data in Colony, or sending data to a third party through Colony, may be permanent or beyond our control. Check before you delete, send, merge or import. We are not responsible for loss caused by an action taken by you or your Users.

24. Compliance with laws: export, sanctions and anti-bribery

• Export and sanctions. Each party will follow the export-control and sanctions laws that apply to it. You will not export, re-export or give access to Colony in breach of them, and will not use it for prohibited end uses (such as weapons development) or by sanctioned parties.
• Anti-bribery. Neither party will offer, give, ask for or accept a bribe or improper advantage in connection with these Terms. Each will follow applicable anti-corruption laws, including the US Foreign Corrupt Practices Act and the UK Bribery Act 2010.
• Anti-money-laundering and tax. You will not use Colony to hide the origin of funds, to evade tax, or to issue false or misleading invoices.
• Government use. You may not use Colony for a government agency without our written agreement.

25. Changes to the service and to these Terms

We may update these Terms, the AUP, the DPA and the other documents. We will change the "last updated" date and, for material changes, give notice by email or in the app at least [30] days before they apply (shorter where the law requires, where a provider forces a change, or where the change is needed for security or to stop abuse). A change that is only a correction, a clarification or a new feature takes effect when posted. If you keep using Colony after the change applies, you accept the update. If you do not agree, tell us before it applies and you may stop and delete your Account; if you have prepaid, we will refund the unused part from the date you stop. A change never applies backwards to a dispute already notified.

26. Governing law and disputes

• Governing law and courts. Unless Section 27 says otherwise, these Terms and any dispute about them or Colony are governed by the laws of [the State of ___, USA], without regard to conflict-of-law rules, and the courts in [___] have exclusive jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
• Talk first. Before starting court proceedings, each party will write to the other with a short description of the problem and will try in good faith for [30] days to resolve it. This does not stop either party from asking a court for urgent relief (for example to protect confidential information or intellectual property, or to stop abuse).
• Time limit. To the extent the law allows, a claim must be brought within [two] years after it arose, except claims for unpaid fees.
• Waiver of jury trial. Where the law permits, each party waives its right to a jury trial.

27. Rights that cannot be excluded (local law)

Nothing in these Terms limits any right, remedy or protection that the law gives you and that cannot be excluded or limited by contract. Where the law of your place requires a different rule, that rule applies in place of the part of these Terms that conflicts with it, and the rest stays. In particular:

• South Africa. Colony is offered to businesses. If the Consumer Protection Act applies to you (it does not apply to a business whose asset value or annual turnover is at or above the threshold set under that Act, except for some product-safety and liability provisions), its protections that cannot be waived apply. The Electronic Communications and Transactions Act and the Protection of Personal Information Act apply as the law says. The information about Colony that the Electronic Communications and Transactions Act requires us to give you is in Section 31 and on our website.
• United Kingdom. The Unfair Contract Terms Act 1977 and the Consumer Rights Act 2015 apply where they do. We do not exclude liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else the law does not allow us to exclude. No one who is not a party to these Terms has a right to enforce them under the Contracts (Rights of Third Parties) Act 1999.
• Australia. The Australian Consumer Law gives guarantees that cannot be excluded, and may apply to you even if you are a business, and protects small businesses against unfair terms in standard form contracts. Where a consumer guarantee applies and we fail to meet it, our liability is limited, where the law allows, to resupplying the service or paying the cost of resupply. We intend every term to be fair and will correct a term that a court or regulator finds unfair.
• Israel. Mandatory Israeli law, including the Standard Contracts Law 1982 and the Protection of Privacy Law, applies as it applies to a business customer in Israel, and an Israeli court may review a standard-form term. Nothing here prevents you from asking an Israeli court or the Privacy Protection Authority to apply that law.
• European Union and elsewhere. Where you are a business based in the EU or another place with mandatory local business or data-protection law, that law applies as far as it cannot be excluded.

28. Notices

• To you: by email to the owner and administrator addresses on the Account, or in the app. A notice by email is received one business day after it is sent, unless the sender gets a bounce-back.
• To us: support@colonys.io, with a copy by post to the address in Section 31 for formal legal notices. Security reports go to support@colonys.io and privacy requests to support@colonys.io.
• You must keep your contact details current. We are not responsible for a notice you did not get because they are out of date.

29. General

• Entire agreement. These Terms, with the documents listed in Section 1, are the whole agreement about Colony and replace earlier discussions and terms. Terms in your purchase order or other documents do not apply.
• Severability and waiver. If a part is unenforceable, it is changed to the extent needed to make it enforceable and the rest stays. Neither party gives up a right by not using it.
• Assignment. You may not transfer your rights or duties without our written consent. We may transfer ours to an affiliate, or in a merger, acquisition or sale of the business, on notice, if the other party takes over our duties.
• Subcontracting. We may use sub-processors and other service providers (Section 10 and the sub-processor list) and remain responsible for them to the extent these Terms say.
• Force majeure. Neither party is liable for delay or failure (other than to pay money) caused by events beyond its reasonable control, including natural disaster, war, terrorism, strikes, power, internet, cloud or telecom failure, government action, and the failure of a third-party platform or carrier. It must tell the other party and try to limit the effect.
• Relationship. The parties are independent. There is no partnership, agency, employment or joint venture. Nobody else has a right to enforce these Terms.
• Interpretation. Headings are for convenience. "Including" does not limit. A reference to a law includes later versions. We may enforce these Terms in a way that complies with law.
• Counterparts and electronic signing. An addendum may be signed electronically and in counterparts.

30. Language and electronic acceptance

• Language. These Terms are written in English. If we give you a translation (for example in Hebrew), it is for convenience, and the English version controls if they differ, except where the law of your place requires that the version in your language controls.
• Electronic acceptance. You agree to these Terms electronically by ticking a box, clicking a button, creating an Account or using Colony. We may keep a record of when, how and by whom these Terms (and which version) were accepted, with technical details such as IP address, and that record is evidence of your acceptance. You agree that electronic records and notices are valid and satisfy any requirement that they be in writing.

31. Contact

eOTP LLC trading as Colony, 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US, [registration number]. General: info@colonys.io. Privacy and data requests: support@colonys.io. Security: support@colonys.io. Legal notices: support@colonys.io. Copyright notices: support@colonys.io. Abuse: support@colonys.io.

Appendix A: Acceptable Use and Messaging Policy

This policy is part of the Terms of Service. Words defined there have the same meaning here. It tells you what you must do when you message people, publish pages and use AI or integrations through Colony, what Colony enforces for you, and what it cannot enforce. If this policy and a law, a network rule or a provider's rule conflict, follow the strictest one.

1. You decide; the law applies to you

You choose whom to contact and what to say. Colony is a tool. For legal purposes you are the sender of every message and call that you create, schedule or trigger through Colony, including those sent by a workflow, automation, API call, webhook or AI feature. You must have the right to contact every person, in every country, by every channel you use, and you must keep proof (Colony's consent ledger can hold it). Hiring or relying on Colony does not move your legal responsibility to us, and regulators in many countries treat both the sender and the company that benefits as responsible.

2. What counts as marketing and what counts as service

• Service (transactional) message: a message the person needs or asked for about something they already have with you: an invoice or receipt, a booking confirmation or reminder, a requested document, a signing request, a form link, a job update, a reply to their question, a security notice.
• Marketing (promotional) message: anything that promotes, advertises or sells your business, goods, services, events or brand, or that invites the person to buy or return. Newsletters, offers, vouchers and loyalty promotions, "we miss you" messages, referral requests and feedback requests tied to promotion are marketing.
• Mixed messages. If a service message also contains promotion, it is treated as marketing. A reminder about a payment that also advertises a product is marketing.
• Be honest about the category. Do not label a marketing message as a service message, or use a utility template for promotion, to avoid consent rules or Meta's categories. Abandoned-cart and win-back messages are likely marketing in the United Kingdom, the European Union and the United States, even when a tool labels them as reminders.

3. Consent rules by channel (summary)

What Colony enforces. For SMS and WhatsApp (and other sends that go through Colony's messaging pipeline), Colony will not send a marketing message to a person unless a granted marketing consent is recorded for them. This applies in the United States, United Kingdom, Australia, Israel and South Africa, and in any country Colony has no specific rule for. A person who has withdrawn consent, said STOP, or is on the opt-out list is blocked. Colony records that a send was held or refused. Email newsletters and one-to-one email marketing get an unsubscribe link and use Colony's suppression list, but Colony does not check each email against the consent ledger and the suppression list is filled only from the bounce and complaint events that your email provider reports, so for email you must make sure your lists are lawful and clean.

What Colony does not do. Colony does not decide whether a person is lawfully contactable, does not check national do-not-call or do-not-mail registers for you, does not tell you whether an exception (such as an existing-customer exception) applies, and does not read your message for compliance. Consent records are only as accurate as what you put in.

4. Country notes (for you to follow)

These are summaries, not legal advice, and laws change. Ask a local adviser when you message into a country for the first time.

• United States. Texts and calls with automated technology or an artificial or pre-recorded voice need prior express written consent for marketing (TCPA, 47 CFR 64.1200), and states add their own rules (for example Florida and Oklahoma). A person may revoke consent by any reasonable means. Words such as stop, quit, end, revoke, opt-out, cancel and unsubscribe must be honoured, and you must stop within the legal limit (ten business days at most, and in practice immediately). Check the National Do Not Call Registry and state lists for telemarketing. For email, CAN-SPAM requires accurate sender and subject information, a clear advertisement label where applicable, your valid postal address, a working opt-out for at least 30 days after sending, and honouring opt-outs within ten business days without charge or extra data. SMS to US numbers usually needs carrier registration of your brand and campaign (for example 10DLC or toll-free verification); follow your SMS provider's process. Where a text number cannot accept replies, say so on the message and give another way to opt out.
• United Kingdom. PECR requires consent for marketing texts, WhatsApp and email to individuals, with a narrow "soft opt-in" for existing customers that Colony does not switch on for you. Marketing emails and texts must say who you are and give a free way to opt out. Check the Telephone Preference Service for calls. UK GDPR applies to the data.
• European Union. ePrivacy rules and GDPR require consent for most electronic marketing to individuals; the rules differ by country. Business-to-business rules vary.
• Australia. The Spam Act 2003 requires consent (express, or inferred in narrow cases that Colony does not assume), a clear identification of the sender, and a working unsubscribe that you honour within five working days. Check the Do Not Call Register for calls.
• Israel. Section 30A of the Communications Law requires prior explicit consent for advertising by SMS, email, fax and automated calls, with narrow exceptions that Colony does not assume. Advertising messages must be labelled as advertisements (in Hebrew, the word for "advertisement" at the start), give your identity and contact details, and offer a simple way to refuse. Statutory damages per message can apply.
• South Africa. POPIA section 69 requires opt-in consent for electronic direct marketing, with an existing-customer exception that Colony does not assume. If a person has refused, do not ask again for consent repeatedly: you may approach a person for consent once. Direct marketing must identify you and give an address for opt-out. WASPA and the Consumer Protection Act also apply, including the national opt-out registry. SMS sent through LogicSMS also follow LogicSMS's rules and the WASPA Code.
• Anywhere else. Colony applies its strictest rule (marketing needs a granted consent; quiet hours apply) unless it has a specific rule. You must still follow the local law.

5. Quiet hours, STOP and suppression

• Quiet hours. Colony holds automated marketing messages between 20:00 and 08:00 in the recipient's local time and releases them afterwards. Colony knows the recipient's time zone only where one country has a single time zone (for example the United Kingdom, Israel, South Africa). For other countries, including the United States and Australia, it uses your company's time zone, so check multi-zone cases yourself. Service messages follow the same window unless a separate window has been set for them. Quiet hours are a safeguard, not legal advice: some places allow shorter hours, or ban certain messages on certain days. Do not change times to avoid them.
• STOP and opt-out. A person who replies STOP (or an equivalent word) to a text or WhatsApp that reaches Colony is added to the opt-out list, and may get one final confirmation message with no marketing in it. Where replies do not reach Colony (for example SMS replies that your provider does not forward), you must honour them yourself. A person can also opt out by any other reasonable means (a call, an email, a form, in person). Record it and stop within the legal limit.
• Suppression. People who said STOP, unsubscribed, hard-bounced or complained are suppressed. Do not remove them, re-import them, or message them from another system. A person who says STOP to one kind of message may mean all: do not assume otherwise.
• Re-permission. Do not re-add a person who opted out unless they give new, clear consent.
• One request. In South Africa and wherever the law limits repeated requests, do not repeatedly ask someone who refused to consent.

6. Message content

• Say who you are. Use a real sender name, number, address and reply route.
• Do not hide the sender, forge headers, spoof numbers or use misleading subject lines.
• Include an opt-out in every marketing message, and in service messages where the law requires.
• Put marketing opt-in language where the person sees it, separate from your terms, with a box that is not ticked in advance. Say which channels and what kind of messages.
• Do not buy, rent or scrape contact lists, and do not use a list a third party gives you unless every person consented to hear from you specifically.
• Colony's Join Us links, public contact forms and landing pages can add a person to your lists. Their consent tick-boxes must stay unticked, and your wording must be accurate.
• Imports. Imported contacts have no consent in Colony unless you record it. An import does not make a contact lawful to message.
• AI-found prospects. Leads found by AI web search, enriched by a data vendor, or taken from public sources are not consented for marketing. Treat them as people you have no right to message until they say yes.
• Referrals. Do not offer rewards for forwarding marketing messages unless the law allows it where you operate.

7. WhatsApp, SMS and email provider rules

• WhatsApp (Meta). Follow Meta's Business Terms, WhatsApp Business Messaging Policy and Commerce Policy. In short: message only people who have opted in to the kind of message you send and honour every opt-out; start conversations with approved templates and keep them for their category; free-form replies only inside the 24-hour window; keep your business profile and contact details accurate; offer an easy way to reach a human when a person is dealing with automation; do not share a person's messages with another customer; do not ask for or send full payment card numbers, financial account numbers or government ID numbers over WhatsApp; do not use WhatsApp for health information where the law restricts it; and do not promote goods or services Meta prohibits or restricts (for example firearms, drugs, adult content, gambling without permission, dating, multi-level marketing, payday loans) or any regulated item without the licence and in the countries Meta allows. Template names and content must match what Meta approved. Keep a published privacy policy. Negative feedback, blocks and reports can reduce your sending limits, and Meta can restrict your account.
• Colony's own WhatsApp number. Messages sent from Colony's number are limited to service notices (such as meeting, task, document and request notices) to people who have opted in, and are subject to daily caps. Use your own WhatsApp Business account and approved marketing templates for promotion.
• No AI or data misuse. Do not use WhatsApp data from Colony to build profiles of individual users, to train AI models, or to give to others, except as Meta's terms allow.
• SMS and voice (LogicSMS or your own provider). Follow your provider's rules, carrier rules and registration duties, the WASPA Code of Conduct where it applies, and the CTIA principles (clear consent, clear opt-out, accurate sender, no content that carriers prohibit, such as unlawful or deceptive content). Use only sender IDs and numbers you are allowed to use.
• Email. Follow your email provider's policy (Colony's sender, or your own Mailgun, SendGrid, Postmark, SES, Resend). Keep complaint and bounce rates low. Authenticate your sending domain where you use your own provider.
• Providers may act. Colony or a provider may stop sending, reduce limits, or block a number or domain if rules are broken or quality is poor, and Colony may pass on information to a provider about a complaint.

8. Prohibited uses

You must not use Colony for:

• spam, purchased lists, or messages to people who opted out;
• misleading sender, subject or content; phishing, fraud, scams, pyramid or Ponzi schemes; impersonation of a person, business, authority or Colony;
• unlawful, hateful, threatening, harassing, defamatory or sexually explicit content; any content that sexualises minors; content promoting self-harm or violence; content that infringes copyright, trademark, privacy or other rights;
• promoting regulated goods or services where you lack the licence (for example gambling, firearms, cannabis, unlicensed financial, investment, crypto or medical advice or products);
• debt-collection or credit-offer messages that break the law that applies to them;
• political or election messages, unless you comply with the election law that applies and Colony's providers allow it;
• scraping, credential stuffing, probing, scanning or testing the data or security of Colony or other customers, or trying to see another customer's data;
• malware, bots, denial of service, or anything that harms the service or others;
• abusing the API or webhooks, sharing keys, or ignoring published rate limits;
• evading limits, suppression, consent checks or quiet hours, or setting up several accounts to do so;
• reselling or sub-licensing Colony, or building a competing product from it, without permission;
• creating or using fake signatures, back-dated documents, forged or altered signed documents, or using the e-signature tools to deceive a signer;
• using Colony's AI to make deceptive, harmful or unlawful content, to impersonate a real person, to make decisions about people's credit, employment, housing, insurance, health or legal rights without qualified human review, or to train or distil a competing AI model;
• loyalty, voucher or gift programmes that are unlawful where you operate (including prize or gambling schemes without the licence you need), or that mislead people about value, expiry or terms.

9. Sensitive data and special uses

Do not put in Colony:

• payment card numbers, CVV codes or full bank account details (use a payment provider's hosted payment page);
• government ID numbers or passport scans, except where the law requires, you have a lawful basis, and you protect them. A document collection feature that asks for ID or proof of address is yours to justify and to delete when no longer needed;
• protected health information (HIPAA), or health, genetic, biometric, criminal-record, religious, political, or sexual-orientation data, unless you have a lawful basis, tell people, and Colony has agreed in writing that it is suitable. Colony does not offer a HIPAA business-associate agreement and is not designed to host regulated health records;
• data about children without the consent and notices the law requires;
• any data you have no right to hold.

Do not use Colony for emergency services, safety-critical control, or any use where failure could cause death, injury or serious damage, and do not rely on it as the only record where the law requires a specific system.

10. Public pages and links you publish with Colony

• You are responsible for the content, privacy notice and terms of the pages, forms, booking pages, documents and links you publish, for accessibility, and for cookie and tracking notices beyond the notice Colony provides. Add your own privacy-policy and terms links.
• Say who you are and how to reach you. Do not claim Colony endorses you.
• A contact or join form that adds someone to marketing lists must say so clearly.
• Do not publish another person's personal data, or documents that identify private people, without a lawful reason.
• Colony may remove, disable or set to private any page that breaks this policy or the law.

11. AI features

• AI output is a draft. A person must check it before it is sent or published.
• Do not enter content you have no right to process, or personal data you do not need.
• Tell people when the law or a provider requires you to tell them they are dealing with AI, and give them a way to reach a human.
• Do not use AI features for the prohibited uses in Section 8, for automated decisions with legal or similar effect on a person, or to make professional advice or compliance decisions without a qualified person's review.
• You must follow the usage policies of the AI providers behind Colony, which Colony may change.

12. Integrations and API

• Use only the access you need. Keep tokens secret. Do not share them or put them in public code.
• Respect rate limits. Do not hide the true origin of requests.
• A workflow or webhook that sends messages, charges money or changes records is your automation. Test it, and switch it off if it misbehaves.
• When you connect Google or Microsoft mail or calendar, use it only for your own business and do not use that data for advertising or sell it.
• Payment providers have lists of businesses they will not serve. You must not use Colony to take payment for them.

13. Reports, complaints and enforcement

• Reports. Report abuse to support@colonys.io. Recipients can use the unsubscribe or STOP in the message. Complaints about a Colony customer's message go to that customer first, and to us if they are not resolved.
• Your duty. When a recipient, regulator, provider or carrier complains about your messages, reply within [2] business days, stop the sending in question while it is checked, and give us the proof of consent we ask for. Keep consent records for as long as the law requires, and at least [four] years after the last message.
• Our actions. We may rate-limit, hold, review, suspend or remove content, messages, numbers, pages, integrations or access to stop abuse, comply with law or a provider's rules, or protect others. We may do this immediately in urgent cases. We choose the step that fits: a warning, a limit, a suspension, or ending the account. Repeated or serious breaches may end the account without refund and may be reported to the authorities or providers.
• Telling you. We will tell you why when we lawfully can, and give you a chance to explain or fix the problem, except where we must act at once or may not tell you.
• Appeal. Write to support@colonys.io within [14] days with your reasons and proof. We review it and answer in a reasonable time. Provider decisions (for example Meta restricting a number) are theirs, not ours.
• Changes. We may update this policy as the Terms say, including when laws or provider rules change.

Appendix B: Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between eOTP LLC, trading as Colony ("Colony", "Processor", "Operator", "Service Provider") and the business that holds the Colony account (the "Customer", "Controller", "Responsible Party", "Business"). It applies to personal information that Colony processes for the Customer. It is intended to meet GDPR and UK GDPR article 28, POPIA sections 20 and 21, the service-provider terms of the California Consumer Privacy Act as amended (Cal. Code Regs. tit. 11, section 7051), the processor-contract rules of other US state privacy laws (for example Virginia, Colorado, Connecticut, Texas and Oregon), Israel's Privacy Protection Law and Regulations, and Australia's Privacy Act 1988.

1. Definitions

• Customer Data: personal information that the Customer or its users put into Colony, or collect through Colony (for example through its booking pages, forms or messages), including information about its leads, customers, staff and other contacts.
• Data Protection Law: all laws on personal information that apply to Customer Data, including those named above.
• Personal Data Breach: a breach of security that leads to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Customer Data. This includes a "security compromise" under POPIA section 22.
• Sub-processor: a third party Colony engages that processes Customer Data.
• SCCs: the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0).
• Services: Colony as described in the Terms.
• Terms such as "controller", "processor", "data subject", "personal information", "operator", "responsible party", "business" and "service provider" have the meaning given in Data Protection Law.

2. Roles and scope

1. The Customer is the controller, responsible party and business for Customer Data. Colony is the processor, operator and service provider.
2. Colony is an independent controller for its own account, billing, security, support and marketing data, which are covered by the Colony Privacy Policy, not this DPA.
3. If the Customer is itself a processor for its own clients, it confirms it has authority to give Colony these instructions, and Colony acts as its sub-processor on the same terms (SCC module 3 where it applies).
4. The Customer's instructions are: the Terms and this DPA; use of the Services' settings and features; and further written instructions that are reasonable, lawful and within what the Services can do. Colony will tell the Customer immediately if it believes an instruction breaches Data Protection Law, and may pause that instruction until it is clarified.
5. Annex 1 describes the processing. It is part of this DPA.

3. Colony's obligations

Colony will:

1. process Customer Data only on the Customer's documented instructions, including about transfers to a third country, unless the law requires otherwise, in which case it tells the Customer first unless that law forbids it;
2. process Customer Data only for the business purposes in Annex 1 (providing the Services to the Customer);
3. not sell Customer Data or share it for cross-context behavioural advertising;
4. not retain, use or disclose Customer Data for any purpose, commercial or otherwise, other than the business purposes in Annex 1, or outside its direct business relationship with the Customer, except as Data Protection Law allows;
5. not combine Customer Data with personal information it receives from other sources or collects from its own interactions with individuals, except as Data Protection Law allows for a service provider;
6. not use Customer Data to train or improve AI models, and require its AI sub-processors to do the same;
7. comply with the obligations Data Protection Law places on it, and provide the same level of privacy protection the law requires of the Customer;
8. tell the Customer within [5] business days if it decides it can no longer meet its obligations under Data Protection Law or this DPA;
9. ensure that each person who processes Customer Data is bound by a duty of confidentiality;
10. keep Customer Data secure as set out in Annex 2;
11. help the Customer, taking into account the nature of the processing, with data subject requests (section 8), security, breach notification, data protection impact assessments and consultations with regulators (sections 5 and 9);
12. delete or return Customer Data at the end of the Services (section 10); and
13. make available the information needed to show compliance, and allow audits (section 11).

4. The Customer's obligations

The Customer confirms and agrees that:

1. it has a lawful basis, and gives any notices and obtains any consents, needed to put Customer Data into Colony and to send messages through it, and that its instructions comply with Data Protection Law;
2. it will not put into Colony special categories or sensitive personal information, protected health information (HIPAA), payment card numbers, or information about children, unless it has first agreed safeguards in writing with Colony (and Colony agrees to a separate business associate or similar agreement where the law requires one);
3. it will respond to its own data subjects and use the features Colony provides for access, correction, export and erasure;
4. it will use the security features of the Services (strong passwords, two-factor sign-in, roles, link expiry) and keep its users' credentials safe; and
5. it is responsible for the accuracy and legality of Customer Data and for how its users use it.

5. Security and Personal Data Breaches

1. Colony applies the technical and organisational measures in Annex 2 (GDPR article 32; POPIA section 19; and reasonable security under California Civil Code section 1798.81.5 and similar laws). It may update them, but will not reduce the overall level of protection.
2. Colony will tell the Customer without undue delay, and in any case within [72] hours, after becoming aware of a Personal Data Breach affecting Customer Data. The notice will describe, as far as known: the nature of the breach, the categories and approximate number of people and records involved, likely consequences, the measures taken or proposed, and a contact point. Colony will update the Customer as it learns more, and will take reasonable steps to contain and fix the breach.
3. Colony will help the Customer meet its duties to notify regulators and individuals (for example GDPR articles 33 and 34, POPIA section 22, and US state breach laws). The Customer decides whether, when and what to notify, except where the law requires Colony to notify.
4. Notice of a breach is not an admission of fault or liability.

6. Sub-processors

1. General authorisation. The Customer gives Colony general written authorisation to use the Sub-processors on the sub-processor list, which is Annex 3. This is Option 2 (general written authorisation) of SCC clause 9(a).
2. Notice of changes. Colony will tell the Customer at least [30] days before adding or replacing a Sub-processor that handles Customer Data, by email to the account owner and by updating the list, which the Customer may subscribe to for alerts at [subscription address].
3. Objection. The Customer may object in writing, on reasonable grounds relating to data protection, within that period. The parties will talk in good faith. If Colony cannot reasonably avoid using the Sub-processor for the Customer, the Customer may stop using the affected feature, or end the account and receive a refund of prepaid fees for the unused period. Silence at the end of the period is treated as approval.
4. Emergency replacement. If a Sub-processor must be replaced urgently for security or continuity reasons, Colony will notify the Customer as soon as reasonably possible and the objection right above still applies.
5. Flow-down and liability. Colony binds each Sub-processor by a written contract that imposes data protection obligations at least as protective as this DPA (including the service-provider terms), and remains fully responsible to the Customer for the Sub-processor's performance.
6. Services the Customer connects itself. Where the Customer links its own account with a third party (for example its own payment, email, SMS or WhatsApp account, or Google or Microsoft mail and calendar), that third party is the Customer's own processor or controller, not Colony's Sub-processor, and the Customer is responsible for that relationship. Colony passes data to it only on the Customer's instruction.

7. International transfers

1. The Customer authorises Colony and its Sub-processors to process Customer Data in the countries listed in Annex 3, including the United States.
2. EU and EEA. Where Customer Data from the EU or EEA is transferred to Colony in a country without an adequacy decision, the SCCs apply and are incorporated by reference, as follows: module 2 (controller to processor), and module 3 (processor to processor) where the Customer is itself a processor. Annex 4 completes them. Colony does not rely on the EU-US Data Privacy Framework for transfers to itself.
3. United Kingdom. For transfers from the UK, the UK Addendum applies, completed as set out in Annex 4. The ICO's International Data Transfer Agreement may be used instead if the parties agree in writing.
4. Switzerland. The SCCs apply with these changes: references to the GDPR include the Swiss Federal Act on Data Protection; the Swiss Federal Data Protection and Information Commissioner is the competent authority; and the clauses protect data of legal entities until the law no longer treats them as personal information.
5. South Africa. The Customer, as responsible party, accepts that Colony is bound by this DPA, which gives the protection POPIA section 72(1)(a) requires, including restrictions on onward transfer. This DPA is also the written operator contract required by POPIA section 21.
6. Israel. Colony gives the undertakings required by the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, namely to protect the data to the standard Israeli law requires and to not transfer it onward except on terms at least as protective.
7. Australia. Colony will take reasonable steps to ensure each overseas recipient handles Customer Data consistently with the Australian Privacy Principles.
8. Onward transfers. Colony requires each Sub-processor to have a valid transfer mechanism, such as the SCCs or a Data Privacy Framework certification where the Sub-processor has one.
9. Government access. Colony will, unless the law forbids it, tell the Customer promptly about any legally binding request from a public authority for Customer Data, challenge it if there are reasonable grounds to, and disclose only the minimum required. On request Colony will give the information the Customer reasonably needs for a transfer impact assessment.
10. Alternative mechanism. If a mechanism above is invalidated or replaced, the parties will use the replacement mechanism, and Colony may update this section on notice.

8. Data subject requests

1. Colony provides tools to export, correct and erase a customer's record. Erasure anonymises personal fields and keeps financial and legal records that must be kept so the books reconcile; free-text notes that merely mention a person are not scrubbed automatically.
2. Colony will, within [10] business days of the Customer's request, give reasonable help with a request that the Customer cannot fulfil with those tools.
3. If a data subject contacts Colony about Customer Data, Colony will refer them to the Customer and will not respond itself except to say that, unless the law requires otherwise. Colony will pass on the request to the Customer within [5] business days.
4. Colony helps the Customer honour opt-out, deletion, correction and access requests under US state laws and tells its Sub-processors to do the same where needed.

9. Impact assessments and regulators

Colony will give the Customer reasonable help with data protection impact assessments, prior consultation with a regulator (GDPR articles 35 and 36), and responses to regulators. If a regulator contacts Colony about Customer Data, Colony will tell the Customer unless the law forbids it.

10. Return and deletion

1. When the Customer ends the account, or on its written request, the Customer may export Customer Data using the Services' export tools for 30 days.
2. After that, Colony will delete Customer Data from live systems within a further [30] days, and from backups as they are overwritten within 35 days, and on request will confirm deletion in writing.
3. Records in the Recycle Bin are purged after 30 days. Assistant chats are deleted after 30 days. Anonymous visit counts older than 13 months are deleted.
4. Colony may keep Customer Data only to the extent the law requires, to establish or defend legal claims, or as needed to prevent abuse, and then only for as long as necessary and subject to this DPA. The Customer may instead ask Colony to return rather than delete, in a common machine-readable format.

11. Compliance information and audits

1. Colony will give the Customer, on written request and no more than once in any 12 months (unless there has been a Personal Data Breach or a regulator requires it), a copy of its current security documentation and completed security questionnaires, and will answer reasonable written questions about its compliance with this DPA.
2. Colony does not currently hold an independent security certification or audit report. If it obtains one, it will make the summary available on request. [Replace this sentence if Colony obtains a SOC 2 or ISO 27001 report.]
3. If those materials do not satisfy the Customer, or a regulator or Data Protection Law (including SCC clause 8.9 and 8.6) requires it, the Customer may carry out, or appoint an independent auditor bound by confidentiality to carry out, an audit of Colony's processing of Customer Data, on at least [30] days' written notice, during business hours, no more than once a year, in a way that does not disrupt Colony or expose other customers' data, and at the Customer's cost. Colony will cooperate and contribute.
4. For purposes of the CCPA, the Customer may also take reasonable and appropriate steps to confirm Colony uses Customer Data consistently with its obligations, including ongoing manual reviews, automated scans, and assessments or audits at least once a year, and may, on notice, take reasonable steps to stop and remedy any unauthorised use of Customer Data.
5. Each party will bear its own costs unless the audit finds that Colony has materially breached this DPA, in which case Colony will bear its own costs and the reasonable cost of the audit.

12. California and other US state terms

1. Colony is a service provider and contractor under the CCPA. The Customer discloses Customer Data to Colony only for the limited and specified business purposes in Annex 1.
2. Colony will not sell or share Customer Data; will not retain, use or disclose it for any purpose other than those business purposes or outside the direct relationship with the Customer; and will not combine it with other personal information, as described in section 3.
3. Colony will comply with applicable obligations under the CCPA and its regulations and provide the same level of privacy protection; will tell the Customer if it can no longer meet them; will enable the Customer to respond to consumer requests (section 8); and gives the Customer the rights in section 11.4.
4. Colony certifies that it understands and will comply with these restrictions.
5. To the extent another US state privacy law (including those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others) applies, section 2 and Annex 1 set out the instructions, nature and purpose of processing, type of data and duration of processing; and sections 3, 6, 10 and 11 give the confidentiality, sub-contractor, deletion or return, information and audit terms those laws require.
6. Customer is responsible for its own notices, including notices at collection and opt-outs for its own customers.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in section 16 of the Terms, to the extent the law allows, and nothing limits liability that cannot be limited by law, including a data subject's rights under SCC clause 12 or the Customer's liability to data subjects. [A separate cap for data protection claims, if the lawyer prefers: [amount or multiple].]

14. Term, order of precedence and general

1. This DPA starts when the Customer accepts the Terms and continues until Colony has deleted or returned all Customer Data and the retention in section 10.4 ends.
2. If this DPA, the SCCs, the UK Addendum and the Terms conflict about personal information, the order is: the SCCs and UK Addendum (for transfers they cover), then this DPA, then the Terms.
3. Colony may update this DPA to reflect changes in law or its Services, on [30] days' notice; changes that reduce the protection of Customer Data take effect only if the Customer agrees.
4. Governing law and disputes follow the Terms, except that the SCCs are governed as stated in Annex 4.
5. Notices under this DPA go to the account owner's email address and, for Colony, to support@colonys.io.
6. Signatures: this DPA is accepted when the Customer accepts the Terms. Colony will countersign a copy on request: signed for Colony by [name, title].

Annex 1: Details of processing

This Annex also serves as Annex I.B of the SCCs, and as the description of processing for the UK Addendum, POPIA and US state law.

Annex 2: Technical and organisational security measures

This Annex also serves as Annex II of the SCCs.

Annex 3: Authorised Sub-processors

The Sub-processors authorised at the date of this DPA are those listed on the sub-processor list in section A (Colony's own sub-processors), with the purpose, data and location shown there. This Annex also serves as Annex III of the SCCs (module 2 and 3 options): the subject matter, nature and duration of each Sub-processor's processing is as stated in that list, for as long as the Customer uses the feature concerned. Section B of that list shows services the Customer connects itself, which are not Colony Sub-processors.

Annex 4: Standard Contractual Clauses and UK Addendum details

Part A: SCCs (Decision 2021/914)

Part B: UK Addendum (version B1.0)

Part C: Swiss changes as in section 7.4.

Part D: if the Customer wishes to sign the SCCs separately, Colony will countersign on request at support@colonys.io.