Terms of Service The agreement between your organisation and TotulDigital for Cloud Office, VPS compute and the Cyber Security Compliance module. Updated 8 October 2026 · TD-TOS-2026-10 1. Parties, acceptance and definitions These Terms of Service (the Terms) are an agreement between: VDR Tech Limited VDR Tech Limited, trading as TotulDigital — a limited liability company incorporated in Masdar City Free Zone under the Masdar City Companies Registration Regulations 2009 Licence and registration no. MC 14332, issued by the Registrar of Companies of Masdar City Free Zone Registered address: Smart Station SS 548, First Floor, Incubator Building, Masdar City, Abu Dhabi, United Arab Emirates · VAT: not registered for UAE VAT Contact: contact@totuldigital.com · Security: security@totuldigital.com · Data protection: privacy@totuldigital.com and the organisation or person that creates an account, places an order or uses the Services (the Customer, you). If you accept these Terms on behalf of an organisation, you confirm that you are authorised to bind it. You accept these Terms by creating an account, signing an order, or using the Services. The Services are intended for businesses and professionals. If you are a consumer, mandatory consumer law of your country of residence applies in addition and prevails where it gives you more protection. Definitions. In these Terms: - Services — Cloud Office, VPS compute, the Cyber Security Compliance module and any other service we provide under an order, as described at totuldigital.com when you subscribe. - Cloud Office — hosted mail, files, calendar, contacts and notes at totuldigital.com/portal, inside the client portal, including access over IMAP, SMTP, CalDAV, CardDAV and WebDAV. - VPS — virtual servers we provision for you on our infrastructure. - Compliance module — monitoring of your servers and Cloud Office with our security monitoring engine, and the compliance reports built on it. - Customer Data — all content and data you or your users put into the Services, including mail, files, calendars, contacts, notes, server contents and monitoring data. - Users — the people you allow to use the Services under your account. - Order — the plan, quantities and price you select or agree with us in writing. - Early access — a feature we have marked as in development, early access, preview or beta. 2. The Services We provide the Services with the features described on the relevant product page at the time of your Order. We may improve or change features; we will not materially reduce the core functionality of a paid Service during a paid period. Service | What it is today | Where it runs Cloud Office | Mail, files, calendar, contacts and notes for one organisation; two-factor sign-in, device passwords for sync clients, mail rules and out-of-office | Strasbourg, France VPS compute | Virtual servers, on the plans listed at totuldigital.com/vps | Strasbourg, France Cyber Security Compliance | Security monitoring; framework reports in development (early access) | Strasbourg, France Infrastructure. The Services run on one dedicated server operated for us by OVHcloud in its Strasbourg datacentre (SBG3), France, divided into virtual machines on a private network. There is currently no second site. No backups today: We do not currently operate backups or a second copy of Customer Data. A hardware failure could cause permanent loss of data. Until we tell you otherwise in writing, you are responsible for keeping your own copies (for example over IMAP and WebDAV) of anything you cannot afford to lose. 3. Early-access features Features marked in development or early access — including the framework reports of the Compliance module — are provided as they are, may change or be withdrawn, and are not part of what you buy until the product page says they are generally available. Reports, mappings and findings produced by the Compliance module are tools to help you. They are not legal advice, an audit opinion or a certification, and they do not transfer to us any obligation you have under NIS2, GDPR, DORA or any other law, including the obligation to notify an authority of an incident. 4. Availability and support We aim to keep the Services available and to fix faults promptly, but we do not commit to a service level and we do not offer service credits. Maintenance may interrupt the Services; where we can, we announce planned work in advance. Support is provided by email at support@totuldigital.com during business days. Security incidents go to security@totuldigital.com. We do not offer telephone support or round-the-clock cover. 5. Accounts and security - You are responsible for your Users and for everything done under your account. - Keep credentials confidential. Use two-factor sign-in, and give each calendar, contacts or files sync client its own device password rather than your account password. - Tell us at security@totuldigital.com without delay if you suspect unauthorised access. - We may require reasonable security measures, such as a password change, where an account appears to be compromised. 6. Acceptable use You must use the Services lawfully and in line with our Acceptable Use Policy, which forms part of these Terms. In particular you must not send spam, host malware or phishing, attack other systems, or infringe others' rights. 7. Customer Data Customer Data belongs to you. You grant us only the rights needed to host, process, transmit and display it to provide the Services, and to monitor and secure them. We do not sell Customer Data, use it for advertising, or use it to train models. You can take a complete copy of your mail over IMAP and of your files over WebDAV at any time, and calendars and contacts over CalDAV and CardDAV, without asking us. Where we process personal data on your behalf, our Data Processing Agreement applies and forms part of these Terms. 8. Fees, invoicing and taxes - Fees are as stated in your Order. Subscriptions are monthly and renew until cancelled. - Fees are payable in advance for each month, in the currency stated in the Order. - We are not registered for UAE VAT, so our fees do not include UAE VAT. If we register, VAT will be added to fees as the law requires, with notice. Customers outside the UAE remain responsible for any taxes due where they are, including under reverse-charge rules. - We may change prices with at least 30 days' notice. A change never applies to a month you have already paid for. - If an invoice is overdue by more than 14 days we may suspend the Services after giving you notice; we do not delete Customer Data for non-payment without the notice described under Termination. - Early-access features are not billed unless an Order says otherwise. 9. Term, suspension and termination These Terms apply from acceptance until all Orders have ended. - You may cancel at any time with effect from the end of the current billing month. Part-months are not refunded. - We may terminate for convenience with 60 days' notice, refunding any prepaid fees for the period after termination. - Either party may terminate immediately if the other materially breaches these Terms and does not remedy the breach within 15 days of notice. - We may suspend the Services immediately where necessary to stop serious harm to the Services, other customers or third parties, or where required by law; we will tell you why and restore the Services when the cause is resolved. On termination you have at least 30 days to retrieve Customer Data before it is deleted. After that period we delete it from the live systems. 10. Intellectual property We, and our licensors, keep all rights in the Services, the software and the documentation. The Services include open-source software, which is licensed under its own terms. You may not resell the Services, or reverse-engineer them except where the law allows. If you send us feedback, we may use it without obligation to you. 11. Confidentiality Each party keeps the other's non-public information confidential, uses it only for this agreement, and shares it only with people who need it and are bound by similar duties. This does not apply to information that is public, already known, independently developed or required to be disclosed by law — in which case the disclosing party gives notice where legally allowed. 12. Warranties and disclaimers We will provide the Services with reasonable skill and care. Apart from that, and to the extent the law allows, the Services are provided as they are, without other warranties, express or implied, including fitness for a particular purpose and uninterrupted or error-free operation. We hold no certifications (such as ISO/IEC 27001 or SOC 2) and make no claim that the Services alone make you compliant with any law or framework. 13. Limitation of liability - Nothing in these Terms limits liability that cannot lawfully be limited, including for death or personal injury caused by negligence, or for fraud. - Neither party is liable for indirect or consequential loss, or for loss of profit, revenue, goodwill or anticipated savings. - Subject to the above, each party's total liability in any 12-month period is limited to the fees paid by you for the Services in that period. - Because there are no backups, our liability for loss of Customer Data is limited as above; please keep your own copies. 14. Indemnities You will defend and indemnify us against third-party claims arising from Customer Data or from your breach of the Acceptable Use Policy. We will defend and indemnify you against third-party claims that the Services, used as permitted, infringe their intellectual property rights. The indemnified party must notify promptly and allow the other to control the defence. 15. Data protection Our Privacy Policy explains how we handle personal data for which we are the controller. Our Data Processing Agreement governs personal data we process for you. The subprocessors we use are listed below; we give 30 days' notice before adding one. Subprocessor | Service | Location of processing | Data involved OVHcloud SAS (2 rue Kellermann, 59100 Roubaix, France) | Dedicated server and datacentre (Strasbourg, SBG3) | France (EU) | All customer data, at rest and in processing Cloudflare, Inc. | Authoritative DNS for our domains (DNS only; traffic is not proxied) | Cloudflare's global network | Domain names and DNS queries; no customer content Internet Security Research Group (Let's Encrypt) | TLS certificates | United States | Host names in certificates; no customer content 16. Export control and sanctions You confirm that you are not subject to sanctions that would prohibit us from providing the Services to you, and that you will not use them in breach of applicable export-control or sanctions laws, including those of the UAE, the European Union and the United Nations. 17. Force majeure Neither party is liable for delay or failure caused by events beyond its reasonable control, such as natural disasters, war, failures of public networks or power, or acts of authorities. Payment obligations are not excused. 18. Changes to these Terms We may update these Terms. We will give at least 30 days' notice of material changes by email or in the Services. If you do not agree, you may terminate before the change takes effect; continued use after that date is acceptance. 19. Notices Notices to us go to contact@totuldigital.com. Notices to you go to the email address of your account owner. Notices are received when sent, unless a bounce is returned. 20. Governing law and disputes These Terms are governed by the laws of the Emirate of Abu Dhabi and the federal laws of the United Arab Emirates applicable there. Any dispute will be resolved by the courts of Abu Dhabi, which have exclusive jurisdiction, after the parties have tried in good faith to settle it within 30 days of written notice. This clause does not remove a consumer's right to the protection of the mandatory law of their country of residence or to bring proceedings there. 21. General - Entire agreement. These Terms, the Order, the Acceptable Use Policy and the Data Processing Agreement are the whole agreement and replace prior discussions. - Order of precedence. Data Processing Agreement for personal data; then the Order; then these Terms. - Severability. If a provision is unenforceable, the rest remains in force. - Assignment. You may not assign without our consent; we may assign to an affiliate or a successor with notice. - No waiver. Not enforcing a right is not a waiver of it. - Language. The English version governs if a translation differs.