not amend this Packet. Public badges on the Trust Center are summaries only. Consumer privacy requests (California, Colorado, and other US state laws) go to support@relayto.com as stated in the US State Privacy Addendum. The live vendor list on the Trust Center must match Annex III; if they differ, Annex III controls until the Trust Center is updated. The SOC 2 Type II report is an attestation for a stated period. It is not a warranty that an incident cannot occur. Vendor infrastructure reports (for example AWS SOC 1 / SOC 2 / SOC 3 or ISO 27001) belong to those vendors. This Packet is not a HIPAA Business Associate Agreement. If Customer requires a BAA because it will introduce PHI into the Services, RELAYTO Limited will provide its standard BAA on written request. Customer must not upload PHI until that BAA is signed. 2. Customer Obligations a. Compliance. Customer is responsible for use of the Services by its End Users. Customer and its End Users must use the Services in compliance with the Acceptable Use Policy. Customer will obtain from End Users any consents necessary to allow Administrators to engage in the activities described in this Agreement and to allow RELAYTO to provide the Services. Customer will comply with laws and regulations applicable to Customer's use of the Services, if any. b. Customer Administration of the Services. Customer may specify End Users as "Administrators" through the administrative console. Administrators may have the ability to access, disclose, restrict or remove Customer Data in or from Services accounts. Administrators may also have the ability to monitor, restrict, or terminate access to Services accounts. RELAYTO's responsibilities do not extend to the internal management or administration of the Services. Customer is responsible for: (i) maintaining the confidentiality of passwords and Administrator accounts; (ii) managing access to Administrator accounts; and (iii) ensuring that Administrators' use of the Services complies with this Agreement. Customer acknowledges that if Customer purchases the Services through a reseller and delegates any of such reseller's personnel as Administrators of Customer's Services account, such reseller may be able to control account information, including Customer Data, and access Customer's Services account as further described above. c. Unauthorized Use & Access. Customer will prevent unauthorized use of the Services by its End Users and terminate any unauthorized use of or access to the Services. The Services are not intended for End Users under the age of 13. Customer will ensure that it does not allow any person under 13 to use the Services. Customer will promptly notify RELAYTO of any unauthorized use of or access to the Services. d. Restricted Uses. Customer will not (i) sell, resell, or lease the Services; (ii) use the Services for activities where use or failure of the Services could lead to physical damage, death, or personal injury; or (iii) reverse engineer the Services, nor attempt nor assist anyone else to do so, unless this restriction is prohibited by law. 3. Third Party Requests i. "Third Party Request" means a request from a third party for records relating to an End User's use of the Services including information in or from an End User or 4 of 53