# Master Services Agreement (MSA) — Interlegal × Cyprus Delivery Partner — Template | Field | Value | |---|---| | Document type | Master Services Agreement (umbrella sub-contracting framework) between Interlegal and a Cyprus delivery partner (ICPAC firm, corporate-services provider, director-services firm, valuer, Bar firm, etc.) | | When used | Signed **once** with a given Partner before the first matter-specific SOW (or simultaneously with the first SOW where Partner accepts both at the same signing). Governs all subsequent SOWs with that Partner. Counterpart-of: [[09-cyprus-partner-sow]]. | | Owner role | Engagement Partner (AS, signatory); operations manager (drafter); compliance officer (KYC + AML on Partner); insurance officer (PII evidence) | | Pre-condition | Verification CLOSED — POSITIVE on `/staff` "Cyprus Partner Verification" panel per [[process/partner-verification]]; outreach via [[17-partner-verification-request]]; partner-selection criteria (11 items) confirmed; AS sign-off recorded. | | Drives | Every subsequent [[09-cyprus-partner-sow]] with the same Partner references this MSA at §2.2 (MSA_DATE field). Affiliate-firm MSAs (Variant B constellation) are separate instruments executed on the same template — one MSA per legal entity that signs an SOW. | | Office 365 mirror | `/Interlegal — Cyprus IP Box/Partners/{{partner-slug}}/msa-{{partner-slug}}-{{MSA_DATE_ISO}}.docx` | --- **Master Services Agreement** Our ref: MSA / {{PARTNER_SHORT_NAME}} / {{MSA_DATE_ISO}} MSA number: {{MSA_NUMBER}} Effective date: {{MSA_DATE_ISO}} Initial term: {{INITIAL_TERM_YEARS}} years from effective date; auto-renewing per §13. --- ## 1. Parties **(1) Interlegal Limited**, a Cyprus advocates' firm with offices at {{INTERLEGAL_CY_ADDRESS}} ("**Interlegal**"); and **(2) {{PARTNER_LEGAL_NAME}}**, a {{PARTNER_ENTITY_TYPE}} incorporated in {{PARTNER_JURISDICTION}} under reg. no. {{PARTNER_REG_NO}}, with offices at {{PARTNER_ADDRESS}}, regulated by {{PARTNER_REGULATOR}} (member no. {{PARTNER_REG_MEMBER_NO}}) ("**Partner**"). (each a "**Party**" and together the "**Parties**"). ## 2. Purpose and structure 2.1 Interlegal operates a turn-key Cyprus IP Box delivery service ("**Service**") for international clients. Interlegal wishes to sub-contract specified Cyprus-side workstreams (corporate filings, banking introductions, ICPAC audit, advance-ruling submission, Bar representation, registered office, secretary services, S0 diagnostic, G5 sign-offs) to Partner on a recurring matter-by-matter basis. 2.2 This MSA sets out the **umbrella terms** that apply to every such matter. The **matter-specific scope, deliverables, fees and SLAs** are set out in a Statement of Work ("**SOW**") executed on the [[09-cyprus-partner-sow]] template, one SOW per matter. 2.3 **Order of precedence.** If there is a conflict between this MSA and a SOW, the SOW prevails **for the matter to which that SOW relates**; this MSA prevails for all other matters and for any term not addressed in the SOW. 2.4 **No volume commitment.** Nothing in this MSA obliges Interlegal to refer any minimum number of matters; nothing obliges Partner to accept any specific matter (subject to §6 exclusivity). ## 3. Partner warranties — selection criteria 3.1 Partner warrants on the effective date and on each SOW signing that the following 11 criteria, as set by [[ADR-006]] §"Cyprus partner selection criteria", are met and will be maintained throughout the term: | # | Warranty | Evidence held by Interlegal at signing | |---|---|---| | W-1 | ICPAC-licensed (audit + accounting) — either Partner directly or named affiliate under separate SOW | ICPAC member number + audit-firm registration certificate | | W-2 | At least one Bar member on staff or named affiliate Bar firm under separate SOW (legal sign-off for ruling submission + court representation) | Cyprus Bar Association practising-certificate number | | W-3 | IP Box specialism — minimum 3 closed IP Box matters in last 5 years OR published IP Box thought leadership | Matter list (anonymised) or publication list | | W-4 | Tax-ruling experience — minimum 2 successful advance rulings obtained in last 3 years | Ruling reference numbers (anonymised) or representation letter | | W-5 | Real office in Cyprus (Limassol / Nicosia / Larnaca preferred) | Site visit memo or attested lease | | W-6 | English working language; UA/RU bonus | Confirmed in verification interview | | W-7 | EU GDPR compliance; willing to sign DPA | Signed DPA at Annex 3 | | W-8 | Boutique 5–25 staff sweet spot; Big-4 independence (no Big-4 affiliate revenue dependency) | Staff list + affiliate disclosure | | W-9 | Secure file exchange (SFTP / Tresorit / managed PGP); email-PDF as default is a disqualifier | Channel attested in verification + tested at MSA signing | | W-10 | References — minimum 2 satisfied client cases (UA-origin preferred; cross-border SaaS preferred) | Reference letters or call notes | | W-11 | Willing to take G5 professional ownership — passes the "rubber-stamping" framing test per [[ADR-006]] §"Pre-engagement test" 4 questions | Verification interview transcript with the 4 verbatim answers | 3.2 **Notification of degradation.** Partner shall notify Interlegal in writing within ten (10) business days of any event that materially degrades any warranty above (e.g. loss of ICPAC member status, departure of the named Bar member, regulatory censure, ownership change, Big-4 affiliation, GDPR breach, IT-security incident, partner economic distress). 3.3 **Cure period.** Partner has thirty (30) days from notification (or from Interlegal becoming aware) to cure a material degradation. Failure to cure entitles Interlegal to terminate this MSA per §13.2(b) without liability. 3.4 **Annual re-attestation.** On each anniversary of the effective date Partner re-attests the 11 warranties by countersigning Annex 5 (Annual Re-attestation Schedule). ## 4. SOW process 4.1 **Instantiation.** For each matter Interlegal sends Partner a SOW on the [[09-cyprus-partner-sow]] template, pre-populated with matter reference, scope, deliverables, fees, SLAs, and applicable Constellation (Variant A — single-firm; Variant B — split G5a/G5b). 4.2 **Acceptance.** Partner accepts a SOW by countersignature within five (5) business days, or proposes redlines within the same window. Silence after five business days is treated as a decline. 4.3 **Decline grounds.** Partner may decline a SOW for (a) conflict per §7, (b) capacity (with reasonable explanation), (c) scope falling materially outside the SOW template (e.g. asset class Partner has no expertise in). Habitual decline without grounds is itself a degradation event under §3.2. 4.4 **No oral variations.** Variations to a SOW are valid only in writing signed by both Parties. 4.5 **SOW ↔ MSA versioning rule (per [[ADR-006]]).** A material change to ADR-006 ownership matrix, partner economics, or selection criteria triggers an **MSA amendment proposal** within thirty (30) days, accompanied by **SOW amendment proposals** for every then-live SOW with Partner. Partner has thirty (30) days to sign each amendment. Refusal to sign an MSA amendment entitles Interlegal to terminate per §13.2(c); refusal to sign a SOW amendment entitles Interlegal to wind down the affected SOW only (no general termination right). ## 5. Fees framework 5.1 Per-matter fees are set in each SOW. The MSA does not itself impose any fee. Reference fee bands set by [[ADR-006]] §"Partner economics" are reproduced at Annex 6 for the avoidance of doubt. 5.2 **No retainer.** No retainer is payable under this MSA except as separately agreed in a SOW. 5.3 **No discount for batching.** Each matter is billed separately. Partner shall not offer (and Interlegal shall not request) volume discounts that would create incentive to compress per-matter quality scope. 5.4 **Quarterly partner economics review.** Per [[ADR-006]] §"Partner economics" Parties hold a quarterly review of fee-to-scope mapping. Either Party may propose re-banding for **future** SOWs (live SOWs remain on their original fee terms unless amended per §4.5). Disagreement is resolved by good-faith negotiation; if irreconcilable for two consecutive reviews, either Party may terminate per §13.2(d). 5.5 **No share of upside.** Partner is paid fixed-fee or capped T&M per SOW. Partner does not receive (and shall not seek) any share of Interlegal's overall margin on the Service, any client success fee, or any equity / phantom equity. ## 6. Exclusivity 6.1 **Bidirectional opt-in exclusivity (first 18 months).** Per [[ADR-006]] §"Anti-conflict / partner exclusivity": (a) Partner shall not accept UA-origin clients for any Cyprus IP Box turn-key engagement materially equivalent to the Service **without Interlegal's prior written knowledge** during the first eighteen (18) months from the effective date. (b) Interlegal shall not engage a second Cyprus delivery partner for UA-origin Cyprus IP Box clients during the same eighteen (18) months, save for (i) the backup-partner relationship under §8, (ii) affiliate firms named in a Variant B SOW, or (iii) Partner-initiated decline of a specific matter per §4.3. 6.2 **Pre-existing pipeline carve-out.** Partner-side pre-existing matters as listed in Annex 7 are not subject to §6.1(a). Annex 7 is locked at MSA signing and not amendable. 6.3 **Post-18-months.** After the initial 18-month period §6.1 falls away by default; either Party may propose written renewal of the exclusivity regime as part of the next quarterly economics review. 6.4 **Client off-boarding (good faith).** If a client elects to migrate to another Cyprus provider after completing S2, Interlegal shall release the documentation pack without upcharge per [[ADR-006]] §"Anti-conflict". Partner shall not solicit the client for follow-on engagements for twelve (12) months after such migration. ## 7. Conflicts of interest 7.1 Partner warrants that, as at the effective date, it acts for no party adverse to a current or pipeline matter disclosed by Interlegal at Annex 8 (conflict-screen disclosure list). 7.2 **Ongoing register.** Partner maintains a conflicts register and notifies Interlegal in writing within five (5) business days of any newly identified conflict, real or potential, in relation to any live or proposed SOW. 7.3 **Escalation window.** Per [[ADR-006]] §"Anti-conflict" any conflict in which a Partner-matter counterparty is also a Partner client shall be escalated to Interlegal within forty-eight (48) hours of Partner becoming aware. 7.4 **Resolution options.** On an unresolvable conflict Partner shall, at Interlegal's election, either (a) withdraw from the conflicting engagement, (b) implement an ethical wall acceptable to Interlegal, or (c) terminate the affected SOW(s) without penalty (this MSA continues unless terminated per §13). ## 8. Backup-partner regime 8.1 Per [[ADR-006]] §"Risk: partner becomes single point of failure" Interlegal shall maintain a **warm second-partner relationship** ("**Backup Partner**") during the term of this MSA. The Backup Partner is identified by Interlegal in writing within ninety (90) days of MSA signing and refreshed annually. 8.2 The Backup Partner is engaged on (a) a signed DPA + NDA only and (b) no live SOWs except as activated under §8.4. 8.3 Partner acknowledges that the existence of a Backup Partner is **not** a breach of exclusivity under §6 and is a risk-mitigation requirement. 8.4 **Backup activation triggers.** Interlegal may activate the Backup Partner (open one or more SOWs with the Backup Partner) on any of the following: (a) Partner enters insolvency, administration, or analogous proceeding; (b) Partner loses any regulatory licence underlying a warranty in §3.1 and fails to cure within thirty (30) days; (c) Partner suffers a confidentiality, GDPR, AML, or sanctions incident affecting matter information and Interlegal reasonably determines that continued sole-source engagement creates unacceptable client risk; (d) Partner has missed material milestones on two (2) or more live SOWs in any rolling six-month window; (e) the quarterly partner-review SLA / quality / G5-turnaround metrics breach thresholds set at Annex 9 for two consecutive quarters; (f) Partner exercises termination-for-convenience under §13.3. 8.5 **No double-engagement on the same matter.** Activation under §8.4 results in **new matters** going to the Backup Partner. Live SOWs with Partner continue to completion unless terminated per their own terms or under §13. ## 9. Confidentiality and data protection 9.1 Each Party shall keep confidential all information received from the other in connection with the Service and use it solely for performance of this MSA and the SOWs. 9.2 The data-processing addendum at **Annex 3** forms part of this MSA and applies to every SOW unless a SOW-level DPA expressly varies it for that matter. 9.3 Partner shall use the secure portal designated by Interlegal for transfer and storage of matter information. Transmission by personal email, public file-share services, or unencrypted media is prohibited. Breach of this clause is a material breach under §13.2(a). 9.4 **Audit right.** Interlegal may, on thirty (30) days' notice and not more than once per twelve (12) months, audit Partner's compliance with §9 and Annex 3 (Interlegal bears its own costs; remediation costs are borne by Partner where non-compliance is found). ## 10. AML / CFT and sanctions 10.1 Partner shall maintain AML/CFT and sanctions-screening procedures consistent with Cyprus Law N.188(I)/2007 as amended [VERIFY:current AML law citation] and shall promptly notify Interlegal of any matter giving rise to suspicion. 10.2 Where Partner is itself a regulated obliged entity, Partner shall not rely on Interlegal's CDD without express written agreement per the relevant SOW. 10.3 Partner shall notify Interlegal within five (5) business days of any sanctions designation affecting Partner, its principals, or its ultimate beneficial owners. ## 11. Independence and professional standards 11.1 Where Partner is appointed as ICPAC member firm, auditor, director-services provider, Bar member, or other regulated capacity in respect of any matter, Partner shall comply with the independence and ethical standards of its regulator at all times, irrespective of any instruction received from Interlegal. 11.2 **Professional override.** Nothing in this MSA or any SOW requires Partner to act contrary to the rules of its regulator. Where a regulator rule conflicts with an Interlegal instruction, the regulator rule prevails and Partner shall notify Interlegal in writing within two (2) business days of identifying the conflict. ## 12. Liability and insurance 12.1 **Umbrella cap.** Partner's aggregate liability under this MSA and all SOWs in any rolling twelve-month period is capped at the greater of (a) EUR {{UMBRELLA_LIAB_CAP}} or (b) three (3) times the total fees paid to Partner across all SOWs in that period, save for liability for fraud, wilful misconduct, breach of confidentiality, breach of data-protection law, sanctions breach, or any sum that cannot be limited by law. 12.2 **Per-matter cap.** Individual SOW liability caps in [[09-cyprus-partner-sow]] §10 operate **within** the umbrella cap above (umbrella cap is the ceiling, not additive). 12.3 **PII.** Partner shall maintain professional indemnity insurance with a Cyprus-authorised insurer with cover of not less than EUR {{PARTNER_PII_LIMIT}} per claim and EUR {{PARTNER_PII_AGGREGATE}} in aggregate per year, and shall provide evidence of renewal annually at Annex 4. 12.4 **Cross-indemnity.** Each Party shall indemnify the other against losses arising from its own gross negligence, wilful misconduct, breach of regulatory requirements, or breach of confidentiality. 12.5 **Notification.** Per [[ADR-006]] §"Insurance" each Party shall notify the other within ten (10) business days of any claim, circumstance likely to give rise to a claim, or regulatory enquiry that may engage joint matters under this MSA, so that the other Party may notify its insurer. ## 13. Term and termination 13.1 **Initial term and renewal.** Initial term {{INITIAL_TERM_YEARS}} years; auto-renews for successive one-year periods unless either Party serves written notice of non-renewal at least one hundred and eighty (180) days before expiry. 13.2 **Termination for cause.** Either Party may terminate this MSA on written notice for: (a) material breach not cured within thirty (30) days of written notice (including breach of §9.3 secure-channel obligation, §10 AML/sanctions, §11 independence, or §3.2 failure-to-notify warranty degradation); (b) failure to cure a warranty degradation under §3.3 within the thirty-day cure window; (c) refusal to sign an MSA amendment proposed under §4.5 within thirty (30) days of the proposal; (d) failure of two consecutive quarterly economics reviews per §5.4; (e) loss of regulatory licence underlying any warranty in §3.1; (f) insolvency, administration, liquidation, or analogous proceeding of the other Party; (g) conflict of interest that cannot be cured per §7.4. 13.3 **Termination for convenience.** After the first twelve (12) months of the initial term either Party may terminate on one hundred and eighty (180) days' written notice. Termination for convenience triggers Backup-Partner activation per §8.4(f). 13.4 **Off-boarding protocol.** On termination by either side: (a) live SOWs continue to completion unless terminated per their own §11, with reasonable extension of any expiring milestone where termination disrupts delivery (max thirty (30) days extension); (b) Partner returns or destroys all matter information per Interlegal's written direction within fourteen (14) days of last live SOW completing, with certificate of destruction at Annex 10; (c) Partner cooperates in good faith with Backup-Partner handover including, at Interlegal's cost, one (1) handover call per active matter and reasonable email follow-up for thirty (30) days; (d) §6 exclusivity falls away on termination notice (not on termination effective date) so neither Party is restricted from arranging successor relationships; (e) §9 confidentiality and §12.4 cross-indemnity survive termination indefinitely. 13.5 **No penalty for cause termination.** Termination for cause under §13.2 does not entitle the breaching Party to any payment beyond fees earned on completed deliverables up to the effective date of termination. ## 14. Notices 14.1 Notices under this MSA shall be in writing and delivered: - to Interlegal: {{INTERLEGAL_NOTICE_ADDRESS}}; cc {{INTERLEGAL_NOTICE_EMAIL}}; AS personal copy {{AS_NOTICE_EMAIL}}. - to Partner: {{PARTNER_NOTICE_ADDRESS}}; cc {{PARTNER_NOTICE_EMAIL}}. 14.2 Notices are effective on delivery (couriered + email) or, where served by registered post, five (5) business days after posting. ## 15. Miscellaneous 15.1 **Entire agreement.** This MSA together with its Annexes and any executed SOW constitutes the entire agreement of the Parties for the Service and supersedes all prior discussions. 15.2 **Assignment.** Neither Party may assign or novate this MSA without the other's prior written consent (not unreasonably withheld). A change of control of Partner is a deemed assignment requiring consent. 15.3 **No partnership.** Nothing in this MSA creates a partnership, joint venture, or employment relationship between the Parties. 15.4 **Counterparts.** This MSA may be executed in counterparts (including by qualified electronic signature) each of which is an original and which together constitute one instrument. ## 16. Governing law and jurisdiction This MSA is governed by Cyprus law. The Cyprus courts (Limassol District Court) have exclusive jurisdiction, subject to either Party's right to seek interim relief in any court of competent jurisdiction. --- **For Interlegal Limited:** ______________________ Name: {{ENGAGEMENT_PARTNER_NAME}} Title: Partner Date: ______________________ **For {{PARTNER_LEGAL_NAME}}:** ______________________ Name: {{PARTNER_SIGNATORY_NAME}} Title: {{PARTNER_SIGNATORY_TITLE}} Date: ______________________ --- ## Annexes - **Annex 1** — Service description (high-level — Sprint 1.6+ scope; details per SOW). - **Annex 2** — Approved direct communications channels with Ultimate Clients (per SOW §3.3 default-deny). - **Annex 3** — Data-processing addendum (Controller-to-Processor or Joint Controller as applicable). - **Annex 4** — Partner PII certificate(s) + renewal log. - **Annex 5** — Annual Re-attestation Schedule (11 warranties; countersigned each anniversary per §3.4). - **Annex 6** — Reference fee bands per [[ADR-006]] §"Partner economics" (informational; not binding pricing). - **Annex 7** — Partner pre-existing pipeline carve-out (locked at signing per §6.2). - **Annex 8** — Conflict-screen disclosure list (Interlegal's then-live and pipeline matters disclosed for §7.1 screen). - **Annex 9** — Quarterly partner-review metric thresholds (SLA hit rate, G5 turnaround, ruling success rate, client satisfaction) per [[ADR-006]] §"Risk: partner becomes single point of failure". - **Annex 10** — Certificate of destruction template (used under §13.4(b)). --- ## Annex 3 — Data-Processing Addendum (DPA) This Annex 3 (the **DPA**) forms part of the MSA per §9.2 and applies to all Personal Data Processed by either Party in connection with the Service. ### 1. Defined terms Capitalised terms used and not otherwise defined have the meanings given in Regulation (EU) 2016/679 (the **GDPR**) and Cyprus Law N.125(I)/2018 as amended. - **Controller**, **Processor**, **Personal Data**, **Processing**, **Data Subject**, **Personal Data Breach** — as defined in GDPR Article 4. - **Ultimate Client** has the meaning given in the MSA. - **Sub-Processor** means any third party engaged by either Party to Process Personal Data in performance of the MSA or any SOW. - **Interlegal Stack** means the cloud-hosted portal operated by Interlegal for matter management, document storage, calculation engine, and ancillary cloud services in support of Cyprus IP Box delivery. ### 2. Roles 2.1 In respect of each Ultimate Client's Personal Data Processed under the MSA: (a) the **Ultimate Client** is the Controller (or, where the Ultimate Client is itself a corporate structure, the relevant individuals are Data Subjects and the Ultimate Client's directing entity is the Controller); (b) **Interlegal** is the Processor of record vis-à-vis the Ultimate Client and a Joint Controller with Partner where the matter requires joint professional judgement (e.g. GAAR / Principal Purpose memo per [[ADR-006]] ownership matrix); (c) **Partner** is a Sub-Processor of Interlegal in respect of Personal Data flowing through the Interlegal Stack to Partner; Partner is independently a Controller where Cyprus statutory / regulatory obligations require Partner to Process Personal Data on its own account (e.g. CySEC / ICPAC / Bar professional record-keeping). 2.2 In respect of Partner-originated Personal Data shared with Interlegal for matter-team operations (Partner staff contact data, Partner UBO data), Partner is the Controller and Interlegal is the Processor. ### 3. Partner obligations as Sub-Processor Partner shall: (a) Process Personal Data only on Interlegal's documented instructions (as set out in the MSA, the relevant SOW, or written variations thereto), save where Cyprus law or a regulator rule mandates otherwise (in which case Partner shall notify Interlegal of the mandate before Processing begins, unless the law itself prohibits notification); (b) ensure that persons authorised to Process Personal Data are bound by confidentiality (statutory professional duty satisfies this requirement); (c) implement technical and organisational measures appropriate to the risk (Cyprus Tax Department / ICPAC / Cyprus Bar professional-confidentiality regimes plus the measures at §6 below are deemed to satisfy baseline appropriateness); (d) not engage any further Sub-Processor without Interlegal's prior written consent (consent not unreasonably withheld; consent deemed given for the Sub-Processors listed at §5 below); (e) assist Interlegal with Data Subject requests, Personal Data Breach notification, Data Protection Impact Assessments, and regulator queries, to the extent reasonably necessary; (f) on termination, return or destroy Personal Data per MSA §13.4(b) with the destruction certificate at Annex 10. ### 4. Cross-border transfer 4.1 **Cyprus → Ukraine.** Personal Data flowing from Partner (Cyprus, EU) to Interlegal (Ukraine, non-EU) is transferred under Standard Contractual Clauses (Module 2 — Controller to Processor, where Partner is Controller of Partner-originated data; Module 3 — Processor to Processor, where data originates with the Ultimate Client and Partner has received it as a Sub-Processor of Interlegal) incorporated by reference into the MSA at Annex 3-A. 4.2 **Interlegal Stack hosting.** Personal Data persisted on the Interlegal Stack is hosted on Cloudflare Inc. infrastructure with the EU configured as the primary processing region. Cloudflare's published Data Processing Addendum and the Standard Contractual Clauses incorporated therein apply. 4.3 Either Party shall promptly notify the other if the legal basis for cross-border transfer changes (including, without limitation, issuance of an adequacy decision for Ukraine, withdrawal of an existing decision affecting either Party's jurisdiction, or amendment of the Standard Contractual Clauses by the European Commission). ### 5. Sub-Processors 5.1 The following Sub-Processors are engaged by Interlegal in connection with the Interlegal Stack and are deemed approved Sub-Processors for purposes of §3(d): | Sub-Processor | Role | Location of Processing | Safeguards | | --- | --- | --- | --- | | **Cloudflare Inc.** | Hosting, edge compute, storage, and ancillary cloud services for the Interlegal Stack | EU (configured primary region; Cloudflare's global edge for caching only, no Personal Data persisted at edge) | Cloudflare DPA + Standard Contractual Clauses | 5.2 **Sub-Processor change rule.** Interlegal may add, replace, or remove a Sub-Processor on thirty (30) days' prior written notice to Partner. Partner may object in writing within fifteen (15) business days where the change creates a material adverse effect on Personal Data protection. An unresolved objection that cannot be resolved in good faith within a further fifteen (15) business days entitles either Party to terminate the affected matter(s) without penalty under MSA §13.5. 5.3 **Material change.** Any of: (a) addition of a new Sub-Processor not covered by the existing Cloudflare Data Processing Addendum (i.e. a vendor other than Cloudflare Inc.); (b) change of Sub-Processor primary processing region outside the EU / UK / European Economic Area / adequate-country list under GDPR Article 45; (c) any other material change to the Sub-Processor table at §5.1, ...is a **material change** for purposes of MSA §13.2(c) and triggers an Annex 3 amendment within thirty (30) days. Partner's unreasonable refusal to sign an amendment within that window is termination grounds per MSA §13.2(c). ### 6. Security measures Without limitation, the Parties operate the following security measures: - secure portal access per MSA §9.3 with role-based access control; - encryption at rest at the storage layer and in transit (TLS 1.2+ minimum); - audit logging of access to matter records, retained for the period set out in MSA §13.4 / Cyprus statutory minimum, whichever is longer; - periodic access review (quarterly, per [[joint-cadence]]); - annual penetration test of the Interlegal Stack (Interlegal-borne cost; summary report shared with Partner on request). ### 7. Personal Data Breach notification 7.1 Each Party shall notify the other without undue delay and in any event within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting data Processed under this DPA. 7.2 Notification shall include the nature of the breach, the categories and approximate number of Data Subjects affected, likely consequences, and mitigation steps taken or proposed. 7.3 The Parties shall cooperate in good faith on Data Subject and regulator notifications, with the Controller leading external communications and the Joint Controllers / Processors providing reasonable assistance. ### 8. Audit (cross-reference) MSA §9.4 audit right applies to this DPA. No separate audit framework operates at the DPA level. ### 9. Liability (cross-reference) MSA §12 liability framework applies to this DPA. Breach of this DPA is a material breach for purposes of MSA §13.2(a). ### 10. Annex 3 versioning This Annex 3 is at version {{ANNEX3_VERSION}} as of {{EFFECTIVE_DATE}}. Material changes follow §5.3 above. Non-material updates (typographical corrections, contact-detail updates, clarifications that do not affect either Party's substantive obligations) are recorded in the Annex 3 changelog below. ### Annex 3 changelog | Version | Effective | Change | | --- | --- | --- | | 1.0 | {{EFFECTIVE_DATE}} | Initial issue at MSA signing. | ### Annex 3-A — Standard Contractual Clauses schedule The Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference. Module 2 (Controller-to-Processor) and Module 3 (Processor-to-Processor) apply as set out in §4.1 above. The completed Annexes I, II, and III of the SCCs are appended at execution; Annex IB (Description of Transfer) is updated per matter via the SOW intake at [[18-project-intake-questionnaire]] §6. --- ## Quality gates - **G1 — Author self-check.** All placeholders filled; all 11 warranties evidenced at Annex 5; PII evidence at Annex 4; DPA at Annex 3; conflict screen complete at Annex 8; KYC pack on Partner UBOs collected; Backup-Partner identification scheduled (§8.1 90-day window); selection-criteria verification CLOSED — POSITIVE on `/staff` panel. - **G2 — Peer review.** A second partner has reviewed: precedence (§2.3), exclusivity (§6), backup regime (§8), liability caps (§12), termination + off-boarding (§13). Redlines resolved. - **G3 — Compliance / risk.** AML re-check on Partner; sanctions screen on Partner principals + UBOs; data-processing addendum in place; regulator membership verified at source (ICPAC + Bar register lookup); PII insurer is Cyprus-authorised. - **G4 — Portal + O365 + ADR cross-ref.** Signed MSA filed in `/Interlegal — Cyprus IP Box/Partners/{{partner-slug}}/`; mirrored locally; `/staff` partner record advanced to `MSA_SIGNED`; [[ADR-006]] §"Engaged partner" snapshot table refreshed with `MSA: signed YYYY-MM-DD`; [[process/partner-verification]] §"Open MSA dependency" item closed; ADR amendment-log entry appended. --- ## Related - [[ADR-006]] — Cyprus Contractor Strategy (ownership matrix + selection criteria + exclusivity + backup-partner + versioning rule — this MSA is the contractual instrument that operationalises ADR-006). - [[ADR-005]] — Quality Gates G0-G6 (G5 ownership boundary that drives SOW deliverable W-2 + W-11). - [[ADR-009]] — Language and filing protocol (English working language, drives W-6). - [[09-cyprus-partner-sow]] — Per-matter SOW that references this MSA at §2.2. - [[17-partner-verification-request]] — Pre-engagement outreach template; verification PASS is the pre-condition for MSA execution. - [[process/partner-verification]] — Verification methodology + state machine + close criteria; tracks "Open MSA dependency" closure on MSA signing. - [[joint-cadence]] — Weekly G4/G5 + monthly cross-firm + quarterly retro + annual economics review — operational rhythms that this MSA assumes.