TERMS OF USE (“Terms of Use”)

1. SERVICES AND SUPPORT TERMS AND CONDITIONS

1.1 Subject to the terms of this Agreement, Company will use commercially reasonable efforts to provide Customer the Services. The Services are delivered partially through a software application provided by the Company (the “Platform”). As part of the registration, Customer will identify an administrative user name and password for Customer’s Company account. Company reserves the right to refuse registration of, or cancel passwords it deems inappropriate.

1.2 Subject to the terms hereof, Company will provide Customer with reasonable technical support services, including without limitation in accordance with the terms set forth in the SOW.

2. RESTRICTIONS AND RESPONSIBILITIES

2.1 Customer will not, directly or indirectly: reverse engineer, decompile, disassemble or otherwise attempt to discover the source code, object code or underlying structure, ideas, know-how or algorithms provided as part of the Services or any software, documentation or data related to the Services (“Software”); modify, translate, or create derivative works based on the Services or any Software (except to the extent expressly permitted by Company or authorized within the Services); use the Services or any Software for timesharing or service bureau purposes or otherwise for the benefit of a third; or remove any proprietary notices or labels.

2.2 Further, Customer may not remove or export from the United States or allow the export or re-export of the Services, Software or anything related thereto, or any direct product thereof in violation of any restrictions, laws or regulations of the United States Department of Commerce, the United States Department of Treasury Office of Foreign Assets Control, or any other United States or foreign agency or authority. As defined in FAR section 2.101, the Software and documentation are “commercial items” and according to DFAR section 252.2277014(a)(1) and (5) are deemed to be “commercial computer software” and “commercial computer software documentation.” Consistent with DFAR section 227.7202 and FAR section 12.212, any use modification, reproduction, release, performance, display, or disclosure of such commercial software or commercial software documentation by the U.S. Government will be governed solely by the terms of this Agreement and will be prohibited except to the extent expressly permitted by the terms of this Agreement.

2.3 (i) Customer represents, covenants, and warrants that customer will use the Services only in compliance with Company’s standard published policies then in effect, publicly available online at the Company’s website (the “Policy”) and all applicable laws and regulations. Customer hereby agrees to indemnify and hold harmless Company against any damages, losses, liabilities, settlements and expenses (including without limitation, reasonable costs and reasonable outside attorneys’ fees) in connection with any claim or action that arises from a violation of the foregoing or otherwise from Customer ’s use of Services, except to the extent the same arise out of the negligence or intentional misconduct of Company. Although Company has no obligation to monitor Customer’s use of the Services, Company may do so to the extent legally permissible and may prohibit and use of the Services it believes may be (or alleged to be) in violation of the foregoing.

(ii) Company represents, covenants, and warrants that Company will provide the Services only in compliance with and all applicable law and regulations and the terms of this Agreement. Company hereby agrees to indemnify and hold harmless Customer against arising from claims by a third party that Customer’s lawful and contractual use of the Company’s intellectual property directly infringes or misappropriates a third party’s Berne Convention signatory country intellectual property rights due to the Company’s gross negligence or willful misconduct

or intentional misconduct of Customer.

2.4 Customer shall be responsible for maintaining ancillary services needed to connect to, access or otherwise use the Services, including, without limitation, servers, software, operating systems, networking, web servers and the like (collectively, “Equipment”). Customer is responsible for issuing and managing their mobile device management system, and providing written instructions of the installation, enrollment, and/or data handling processes. Customer shall also be responsible for maintaining the security of the Equipment, Customer account, passwords (including but not limited to administrative and user passwords) and files, and for all uses of Customer account or the Equipment with or without Customer ’s knowledge or consent. The responsibility for such solutions described above shall under no circumstances pass on to the Company, unless agreed otherwise in writing.

2.5 Customer shall be responsible for ensuring the materials intermediated by the Company (and supplied by third parties) are taken care of when in its workers’ possession.

2.6 Subject to a separate subscription agreement, agreed in writing, the Company will retain materials to be supplied to, returned by or held for Customer in a secure location with proper security/surveillance and in compliance with applicable law.

2.7 Customer shall be responsible for submitting the correct information to the Platform in order for Company to perform the services. Any additional expenses incurred due to incorrect, incomplete, or insufficient information shall be covered by Customer.

3. CONFIDENTIALITY (NON-DISCLOSURE AGREEMENT, NDA); PROPRIETARY RIGHTS

3.1 Each party (the “Receiving Party”) understands that the other party (the “Disclosing Party”) has disclosed or may disclose business, technical or financial information relating to the Disclosing Party’s business (hereinafter referred to as “Proprietary Information” of the Disclosing Party). Proprietary Information of Company includes non-public information regarding features, functionality and performance of the Service. Proprietary Information of Customer includes non-public data provided by Customer to Company to enable the provision of the Services, or any other non-public business or technical information, including personnel information,

regarding the Customer that is disclosed or otherwise made accessible to Company. The Receiving Party agrees: (i) to take reasonable precautions to protect such Proprietary Information, and (ii) not to use (except in performance of the Services) or divulge to any third person any such Proprietary Information. The Disclosing Party agrees that the foregoing shall not apply with respect to any information that the Receiving Party can document (a) is or becomes generally available to the public, or (b) was in its possession or known by

it prior to receipt from the Disclosing Party, or (c) was rightfully disclosed to it without restriction by a third party, or (d) was independently developed without use of any Proprietary Information of the Disclosing Party or (e) is required to be disclosed by law.

3.2 Customer shall own all right, title and interest in and to the Customer’s Data. Company shall own and retain all right, title and interest in and to (a) the Services, Software (i.e. web platform and inventory management systems), all improvements, enhancements or modifications thereto, (b) any software, applications, inventions or other technology developed in connection with Implementation Services or support, and (c) all intellectual property rights related to any of the foregoing.

3.3 Notwithstanding anything to the contrary, Company shall have the right to collect and analyze data and other information relating to the provision, use and performance of various aspects of the Services and related systems and technologies, and Company will be free (during and after the term hereof) to (i) use such information and data to improve and enhance the Services and for other development, diagnostic and corrective purposes in connection with the Services and other Company offerings, and (ii) disclose such data solely in aggregate or other de-identified form in connection with its business. No rights or licenses are granted except as expressly set forth herein.

4. PAYMENT OF FEES

4.1 Customer will pay Company the then applicable fees described in the relevant Order Form for the Services in accordance with the terms therein (the “Fees”). Company reserves the right to change the Fees or applicable charges and to institute new charges and Fees at the end of the Initial Service Term or then current renewal term, upon thirty (30) days’ prior notice to Customer (which may be sent by email). If Customer believes that Company has billed Customer incorrectly, Customer must contact Company no later than 120 days after receipt of the first billing statement in which the error or problem appeared to receive an adjustment or credit. Inquiries should be directed to Company’s Customer Support. Customer will pay the Company upfront for purchase of goods on the day an order is placed on the Platform, plus the first month’s subscription at the same time. Each following monthly subscription will be charged on the first day of each month thereafter, in advance.

4.2 Company may choose to bill through an invoice, in which case, full payment for invoices issued in any given month must be received by Company thirty (30) days after the date of receipt of the invoice by Customer. Unpaid amounts may, following notice, be subject to a late-interest charge of 0.05% per day on any outstanding balance, or the maximum permitted by law, whichever is lower, plus all expenses of collection, and may result in immediate suspension or termination of Service. Customer shall be responsible for all taxes associated with the Services other than taxes based on Company’s net income.

4.3 Details of the available subscription tiers, included OPS amounts, and related features are described in the Company’s current Pricing Schedule available on the Platform or the Company’s website.

4.4 Customer may configure a preferred payment method within the Platform, selecting from the available options published in the Pricing Schedule. The default method is Pay at Order Placement. The selected payment option applies account-wide and cannot be changed retroactively for orders already placed

5. OPS-Based Pricing and Subscription

5.1 Definition of OPS.

“OPS” means the Operational Points System — virtual credits representing the right to use specific Raal.io features or Services, including but not limited to logistics operations, integrations, and platform functionality. OPS may be obtained through a subscription plan or purchased separately as additional “top-up” packages. OPS are automatically deducted as the Customer uses eligible Services.

5.2 OPS Allocation and Rollover.

Each subscription tier includes a fixed number of OPS per billing period, as described on the Company’s website or the relevant Order Form.

Unused OPS automatically roll over to the next billing period, provided the cumulative balance does not exceed two (2) times the monthly OPS allocation included in the Customer’s active subscription.

For annual subscriptions, rollover may not exceed two (2) years of OPS allocation.

If the Customer does not consume OPS for two consecutive billing periods, no additional OPS will be added until the balance drops below the permitted maximum.

5.3 Top-Up OPS Purchases.

OPS purchased separately from the subscription (“Top-Up OPS”) may be acquired in any quantity without limitation.

Top-Up OPS do not expire as long as the Customer maintains an active subscription and will always be consumed first before the OPS included in the Customer’s subscription plan.

Upon expiration, cancellation, or termination of the Customer's subscription for any reason, all unused Top-Up OPS shall be automatically forfeited without refund or compensation.

5.4 OPS Consumption.

OPS are deducted automatically whenever an eligible feature or operation is performed.

The list of OPS-eligible features and their corresponding OPS consumption values are published in the Company’s current Pricing Schedule or OPS Feature List available through the Platform.

5.5 Insufficient Balance.

If the Customer’s OPS balance is insufficient to complete a requested operation, the Platform will notify the Customer and present available top-up options.

The Company has no obligation to perform or continue any operation when the OPS balance is insufficient.

5.6 OPS Pricing.

OPS pricing corresponds to the Customer’s subscription tier, as published on the Company’s website or the relevant Order Form.

Additional OPS purchased as Top-Ups are billed at the per-OPS Top-Up rate applicable to the Customer's current subscription tier at the time of purchase. The applicable Top-Up rate is displayed on raal.io/pricing and within the Customer Portal prior to purchase.

5.7 Pass-Through Logistics Costs. All third-party logistics, courier, customs, and import-related costs (including duties and taxes) incurred on behalf of the Customer are invoiced at actual cost (“Pass-Through Costs”), without any margin added by the Company. Pass-Through Costs relating to taxable services (e.g., transport or customs clearance) are invoiced with VAT added. Customs duties, import VAT, or other official charges imposed by authorities are invoiced without VAT. The Company issues such invoices in its own name but on the Customer’s behalf, acting as a disbursement agent.

5.8 OPS Accounting and Reporting.

OPS balances and usage data are displayed in real time within the Customer Portal.

The Company maintains auditable OPS usage records for accounting and transparency.

The Customer shall review monthly OPS reports and may dispute OPS consumption within fourteen (14) days of report issuance. If no dispute is raised within that period, the report is deemed accepted.

OPS are non-refundable except in the case of verified system errors acknowledged by the Company.

5.9 Renewal and Expiry.

Unless otherwise stated in the relevant Order Form, monthly and annual subscriptions automatically renew for successive terms equal to the initial subscription period unless cancelled before renewal.

OPS remaining at termination shall expire unless otherwise agreed in writing.

Top-Up OPS remain valid only for the duration of an active subscription and shall be forfeited upon its expiration, cancellation, or termination, without refund or compensation.

5.10 OPS Data and Audit.

OPS usage data (including shipment counts, API calls, and other service actions) may be retained and used by the Company for audit, compliance, and service-improvement purposes in accordance with the Data Processing Agreement. Such records constitute conclusive evidence of OPS usage unless proven otherwise by the Customer.

5.11 Pay-As-You-Go Tier (Non-Subscription Access). Customers without an active paid subscription are automatically placed on the Pay-As-You-Go Tier. Pay-As-You-Go Customers do not participate in the OPS system and are instead billed in monetary currency on a pay-per-use basis for each eligible operation. Applicable rates are calculated in real time and made available through the Company's estimation tool at raal.io/estimate, which Customers may use free of charge to review and compare prices before placing an order. Pay-As-You-Go pricing is the highest rate offered by the Company and reflects the absence of subscription commitments. Pay-As-You-Go access is subject to feature restrictions as described on the Company's pricing page, and the Company reserves the right to modify, limit, or suspend Pay-As-You-Go access at its sole discretion. Payment for Pay-As-You-Go usage is due upfront at the time of each order or operation, and no credit, rollover, or refund shall apply.

6. TERM AND TERMINATION

6.1 SUBJECT TO EARLIER TERMINATION AS PROVIDED BELOW, THIS AGREEMENT IS FOR THE INITIAL SERVICE TERM AS SPECIFIED IN THE RELEVANT ORDER FORM. AT THE END OF EACH TERM, THIS AGREEMENT WILL AUTOMATICALLY RENEW FOR ADDITIONAL ONE YEAR TERMS THEREAFTER, UNLESS ONE PARTY GIVES THE OTHER PARTY AT LEAST 30 DAYS PRIOR WRITTEN NOTICE OF NON-RENEWAL OR OTHERWISE TERMINATES THIS AGREEMENT OR ANY SOW AS SET FORTH HEREIN.

6.2 In the event Customer desires to terminate any given Subscription prior to the conclusion of the applicable Customer Subscription Term, Customer shall be entitled to terminate such Subscription only upon (a) written notice to Company of its intent to so terminate with a 30 day notice and (b) payment in full to Company in an amount equal to the sum of one (1) monthly subscription payments at the applicable Customer Subscription Price plus any applicable shipping fees for returning the equipment to the Customer. If fees aren’t paid, or necessary information isn’t provided for Company to return equipment being held in storage, subscription management fee will be charged monthly until all pending invoices are settled and all equipment has been shipped back to the Customer.

6.3 Should the Customer terminate the Subscription, not make prepayments for the shipping or any costs or Fees, the Company shall not have the obligation to ship the equipment nor store it for more than 90 days. Upon lapse of that 90 days period, the Company shall have the right to return the equipment to the Customer or dispose of it in a manner that does not involve selling or otherwise transferring ownership of the equipment, at the expense of the Customer

7. WARRANTY AND DISCLAIMER

7.1 Company shall maintain the Services in a manner which minimizes errors and interruptions in the Services and shall perform the Implementation Services in a professional and workmanlike manner. Services may be temporarily unavailable for scheduled maintenance or for unscheduled emergency maintenance, either by Company or by third-party providers, or because of other causes beyond Company’s reasonable control, but Company shall use reasonable efforts to minimize the occurrence of such disruptions, promptly resolve the same and restore Services, and provide advance notice in writing or by e-mail of any scheduled service disruption. HOWEVER, COMPANY DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR FREE; NOR DOES IT MAKE ANY WARRANTY AS TO THE RESULTS THAT MAY BE OBTAINED FROM USE OF THE SERVICES. EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE SERVICES AND IMPLEMENTATION

SERVICES ARE PROVIDED “AS IS” AND COMPANY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. Company represents that it carries sufficient insurance (including, without limitation, worker's compensation, public liability and property damage insurance) to protect against related liability, which may arise in the performance of services specified herein or performed in connection herewith.

7.2 UNDER NO CIRCUMSTANCES, (INCLUDING, BUT NOT LIMITED TO: UPON ENTRY INTO A CONTRACT WITH A THIRD PARTY PROPOSED, ENDORSED OR REFERRED OR INTEGRATED THROUGH THE COMPANY) SHALL THE COMPANY BE LIABLE FOR ANY OBLIGATIONS, DAMAGES, STATEMENTS, OR COMMUNICATION OF THE THIRD PARTY RELATED DIRECTLY OR INDIRECTLY TO THE DELIVERY OF THE SERVICES BY THE COMPANY TO THE CUSTOMER.

7.3 THE COMPANY DOES NOT SUPPLY EQUIPMENT NOR ACT AS AN AGENT, DISTRIBUTOR, AFFILIATE, RESELLER, FACILITATOR, REPRESENTATIVE ETC. OF ANY EQUIPMENT SUPPLIERS IN THE RELATION TO THE CUSTOMER AND THE AGREEMENT. NOR SHALL THE COMPANY ASSUME ANY RESPONSIBILITY FOR THE EQUIPMENT PROVIDED BY ANY PROVIDERS OF THE EQUIPMENT OR FOR ANY OTHER OBLIGATIONS OF ANY EQUIPMENT PROVIDERS.

8. LIMITATION OF LIABILITY

NOTWITHSTANDING ANYTHING TO THE CONTRARY, EXCEPT FOR COMPANY'S LIABILITY FOR LOSS OF OR DAMAGE TO CUSTOMER'S EQUIPMENT WHILE IN COMPANY'S POSSESSION OR CONTROL DURING SHIPPING AND LOGISTICS (WHICH SHALL BE LIMITED TO THE REPLACEMENT VALUE AS SET FORTH IN SECTION 8.D), THE INDEMNITY OBLIGATIONS OF COMPANY UNDER SECTION 2.3 (ii), OR A BREACH OF CONFIDENTIALITY BY EITHER PARTY UNDER SECTION 3, NEITHER, COMPANY NOR CUSTOMER, NOR THEIR RESPECTIVE OFFICERS, AFFILIATES, REPRESENTATIVES, CONTRACTORS AND

EMPLOYEES (COLLECTIVELY, “COMPANY PARTIES”) SHALL BE RESPONSIBLE OR LIABLE WITH RESPECT TO ANY SUBJECT MATTER OF THIS AGREEMENT OR TERMS AND CONDITIONS RELATED THERETO UNDER ANY CONTRACT, NEGLIGENCE, STRICT LIABILITY OR OTHER THEORY: (A) WITH RESPECT TO COMPANY AND THE

COMPANY PARTIES FOR ERROR OR INTERRUPTION OF USE OR FOR LOSS OR INACCURACY OR CORRUPTION OF DATA OR COST OF PROCUREMENT OF SUBSTITUTE GOODS, SERVICES OR TECHNOLOGY OR LOSS OF BUSINESS;

(B) FOR ANY INDIRECT, EXEMPLARY, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES; (C) FOR ANY MATTER BEYOND SUCH PERSON'S REASONABLE CONTROL; OR (D) FOR ANY AMOUNTS THAT, TOGETHER WITH AMOUNTS ASSOCIATED WITH ALL OTHER CLAIMS, EXCEED THE GREATER OF (i) THE FEES PAID BY CUSTOMER TO COMPANY FOR THE SERVICES UNDER THIS AGREEMENT IN THE 6 MONTHS PRIOR TO THE ACT THAT GAVE RISE TO THE LIABILITY OR (ii) THE REPLACEMENT VALUE OF THE LOST OR DAMAGED LAPTOPS, IN EACH CASE, WHETHER OR NOT SUCH PERSON HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. EXCEPT AS SPECIFICALLY STATED HEREIN, THE DOCUMENTATION, DELIVERABLES AND SERVICES ARE PROVIDED

"AS IS" WITHOUT WARRANTY OF ANY KIND. COMPANY DOES NOT WARRANT THAT: THE DOCUMENTATION OR DELIVERABLES WILL MEET CUSTOMER’S REQUIREMENTS; OPERATION OF THE DELIVERABLES WILL BE UNINTERRUPTED OR ERROR-FREE; OR ANY ERRORS WHICH MAY BE CONTAINED IN THE DELIVERABLES CAN OR WILL BE FIXED. TO THE FULLEST EXTENT PERMITTED BY LAW, RAAL.IO HEREBY DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, WITH RESPECT TO THE DOCUMENTATION, DELIVERABLES AND SERVICES INCLUDING, WITHOUT LIMITATION, ALL IMPLIED WARRANTIES OF ACCURACY, INTEGRATION, MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE AND ALL WARRANTIES ARISING FROM ANY COURSE OF DEALING, COURSE OF PERFORMANCE OR USAGE OF TRADE, EXCEPT AS SPECIFICALLY STATED HEREIN.

9. SEPARATE AGREEMENTS WITH OTHER SERVICE PROVIDERS

9.1 For the purpose of equipping, financing, servicing, insuring etc. it’s equipment necessary for the workers, the Customer will have to subscribe to services of third parties such as sellers of equipment, etc. The Customer shall enter into direct contractual relationships with such third parties, will have the obligation to commercially assess the suitability of these suppliers and duly legally assess all the contractual documents and obligations arising from such agreements. The Company shall not assume any responsibility for such agreements, will not act as a contractual intermediary, endorser etc.

10. MISCELLANEOUS

If any provision of this Agreement is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that this Agreement will otherwise remain in full force and effect and enforceable. This Agreement is not assignable, transferable or sublicensable by Customer except with Company’s prior written consent, which consent will not be unreasonably withheld, conditioned or delayed; provided, however, either party may transfer or assign any of its rights and obligations under this Agreement without consent of the other party in the event of the sale of all or a majority of its stock or assets to a third-party acquiror provided that the acquiror shall be bound by such party’s obligations hereunder. This

Agreement (including, for the avoidance of doubt, all related statements of work) is the complete and exclusive statement of the mutual understanding of the parties and supersedes and cancels all previous written and oral agreements, communications and other understandings relating to the subject matter of this Agreement, and that all waivers and modifications must be in a writing signed by both parties, except as otherwise provided herein. No agency, partnership, joint venture, or employment is created as a result of this Agreement and neither party has any authority of any kind to bind the other party in any respect whatsoever. All notices under this Agreement will be in writing and will be deemed to have been duly given when received, if personally delivered; when receipt is electronically confirmed, if transmitted by facsimile or e-mail; the day after it is sent, if sent for next day delivery by recognized overnight delivery service; and upon receipt, if sent by certified or registered mail, return receipt requested.

11. APPLICABLE LAW AND SETTLEMENT OF DISPUTES

11.1 The Agreement is governed by the laws of the Republic of Estonia.

11.2 If the Customer is not satisfied with the activities of the Company, it has the right to file a complaint in writing to the Company. The Company shall make efforts to settle the disputes by means of negotiations. Other contractual disputes between the Customer and the Company shall also be sought to be settled by negotiations.

11.3 The Harju County Court in Tallinn, Estonia as the court of the first instance shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with the Agreement or its subject matter or formation (including non-contractual disputes or claims). No Party will claim lack of personal jurisdiction or forum non conveniens in this court.

Exhibit A - Statement of Work

EXHIBIT B - DATA PROCESSING AGREEMENT

1. BACKGROUND

1.1 This data processing agreement (hereinafter the “DPA”) forms an inseparable part of a contract between the Customer and the Company for the access to and use of the Platform and use of the Services. Capitalized terms not otherwise defined shall have the meaning given to them in the Agreement (for sake of clarity: the master subscription agreement).

1.2 The Company and the Customer wish to duly observe all their respective obligations under the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and any other relevant applicable data protection regulations (together Data Protection Laws).

1.3 For the purposes of this DPA, the terms “controller”, “processor”, “personal data”, “data subject”, “personal data breach” shall have the meaning given in the GDPR. “Sub-processor” shall mean another processor engaged by the Company to process the personal data in the Platform or with respect to the Services.

2.PURPOSE

2.1 The Company provides a equipment management service to the Customer. As such, the Company processes any personal data on behalf of the Customer solely for the purpose of providing the Platform and the Services and acts as a data processor as regards such personal data, whereas the Customer acts as a data controller.

3. PROCESSING OF PERSONAL DATA

3.1 The categories of data subjects and the types of personal data the Company processes on behalf of the Customer:

3.1.1 Users of the Platform. The types of personal data are as follows:

• contact data (personal email, personal address, personal phone number, work address, work phone number, work email address);
• employment data (company name, position / role, management and subordination relations in the company department or any other organizational structure, place of work)
• communications data (emails, messages sent to the Company);

any personal data related to the use of the Platform and the Services.

3.1.2 Data subjects whose personal data the Customer processes as a controller, except the Users of the Platform. The types of personal data: anything that related to the particular data subject, including but not limited to name, contact details and other identifiers based on which that data subject can be either directly or indirectly identified.

3.2 The Customer as a data controller is fully responsible for any personal data it processes using the Platform and the Services. The Customer confirms that personal data processing practices are fully compliant with the Data Protection Laws, including that it has a legal basis to process the personal data as stipulated herein and that it has properly informed the data subjects thereof. If a User adds Contents to the Platform, it shall ensure its accuracy, correctness, completeness, relevance and its compliance with the Contract, good practice, and Legal Acts.

3.3 The Company shall:

3.3.1 process the personal data only on lawful documented instructions from the Customer and for the purposes of providing the Platform and the Services, unless required to do so by the Data Protection Laws. In such a case, the Company shall inform the Customer of such requirement in advance, unless that law prohibits providing such information;

3.3.2 ensure that persons authorized to process the personal data have committed themselves to confidentiality;

3.3.3 taking into account the nature of processing and the information available to the Company, assist the Customer in ensuring compliance with the Customer’s obligations under Articles 32 to 36 of the GDPR;

3.3.4 inform the Customer if, in the Company’s opinion, the Customer’s instruction infringes the Data Protection Laws.

3.4 The Company takes appropriate technical and organizational security measures taking into account (i) the state of the art, (ii) costs of implementation, (iii) nature, scope, context and purposes of the processing, and (iv) risks posed to data subjects. Such security measures include, but are not limited to, encrypted storage and access controls.  In deciding on those measures, the Company assumes that the Platform and Services are used for its intended purposes (business management, project management, time management, work scheduling and tracking, financial management, reporting, etc.). The description of technical and organizational measures can be found on the Company’s Web Site (see the Security Overview).

3.5 The Company shall promptly notify the Customer if it receives a request from a data subject in relation to its personal data processed in the Platform or with respect to the Services and allows the Customer to respond to it. The Company shall not respond to a data subject’s request without the Customer’s prior written consent. Taking into account the nature of the processing, the Company shall assist the Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Customer’s obligation to respond to a data subject request under the Data Protection Laws.

3.6 The Company shall notify the Customer without undue delay by email after it has become aware of a personal data breach and cooperate reasonably with the Customer as regards the data breach. In such a case, the Customer may use the information received from the Company about the data breach only to ensure and/or demonstrate its compliance with the Data Protection Laws. The Customer shall keep this information confidential unless it is the Customer’s confidential information or unless such information must be disclosed under any Legal Acts.

4. USE OF SUB-PROCESSORS

4.1 The Customer hereby authorizes the Company to appoint sub-processors in accordance with this section 4 of the DPA. The Company shall ensure that Sub-processors are bound by written agreements that require them to provide at least the level of data protection required from the Company by this DPA. The Company shall inform the Customer of any intended changes concerning the addition or replacement of sub-processors. The Customer may object to the Company’s use of a sub-processor by notifying the Company promptly in writing within 10 working days after receipt of the Company’s notice. In the event the Customer objects to the new sub-processor, the Company will use reasonable efforts to offer the Platform and Services to the Customer without such a sub-processor. If this is not possible, the Customer may terminate the Contract. The Company shall impose the same data protection obligations as set out herein on the sub-processors.

4.2 The Company and its sub-processors may transfer personal data outside the EU only where they have a lawful basis to do so, including to a recipient who is: (i) in a country which provides an adequate level of protection for personal data; or (ii) under appropriate safeguards that cover the EU requirements for the transfer of personal data to data processors outside the EU. More specific information about transferring personal data outside the EU is available upon request.

4.3 Sub-processors may include courier and logistics providers engaged for delivery and return of equipment.”

5. AUDIT RIGHTS

5.1 Upon the Customer’s written request, the Company shall make available to the Customer at the Customer’s expense the information necessary to demonstrate its compliance with the obligations laid down in this DPA and in Article 28 of the GDPR, provided the requested information is in the Company’s possession or control. Should that prove to be insufficient for the Customer, the Company shall cooperate with the Customer, including allow for and contribute to reasonable audits, including inspections, conducted by the Customer or another auditor mandated by the Customer and accepted by the Company, at the Customer’s expense. The details of such audits and inspections shall be agreed between the Parties, however, the following applies:

5.1.1 the Company will only be required to provide to the Customer information, records and documents reasonably required to demonstrate its compliance with its obligations under this DPA and Article 28 of the GDPR regarding the personal data in processed on behalf of the Customer;

5.1.2 the Company will not disclose any information, records or other documents that are subject to its business secrets;

5.1.3 the Company will not disclose any information, records or other documents that would place it in breach of its confidentiality obligations under applicable laws or agreements with other Customers or persons;

5.1.4 the Company will not disclose any information, records or other documents relating to a matter that is subject to a current, pending or threatened litigation or other dispute resolution mechanism between the Customer and the Company;

5.1.5 any information, records or other documents provided to the Customer pursuant to this section 5 of the DPA shall be treated as confidential by the Customer;

5.1.6 the Customer may exercise its right to perform an audit under this section of the DPA 5 not more often than once in any calendar year unless it has a reasonable doubt as to the compliance of the Company.

5.2 The Customer shall be responsible for the costs of the audit. However, should the audit reveal any violation or breach of this DPA by the Company or its sub-processor, the Company shall compensate the Customer for the costs arising from the audit and remedy the breach.

6. LIABILITY

6.1 To the extent due to the Company’s or its sub-processor’s fault, the Company shall be liable for damage caused to the Customer as a consequence of processing contrary to the provisions of this DPA and in respect of which the Customer has had to pay compensation to the data subject or pay administrate fines awarded by relevant authorities. The liability of the Company is limited pursuant to sections 6 and 7 of the Agreement (for sake of clarity, the master subscription agreement’s sections Warranty and Disclaimer; and Limitation of Liability) between the Client and the Company.

7. TERM AND TERMINATION

7.1 This DPA shall apply during such time period as the Company processes personal data on behalf of the Customer. The termination of personal data processing takes place on the first of the following events taking place:

7.1.1 the Customer requests the Company to delete or return the personal data and stop processing thereof;

7.1.2 the Company’s obligation to provide the Platform and the Services to the Customer ceases permanently due to termination or expiration of the Contract;

7.2 Upon termination of the personal data processing, the personal data shall, at the Customer’s discretion, either be returned to the Customer, to the extent possible, or be deleted unless any applicable law (including EU law or national law) to which the Company is subject requires retention of the personal data. The Customer hereby instructs the Company to keep the Contents added to the Platform for up to 75 days after the termination or expiry of the Contract, including a trial version of the Platform.

7.3 Personal data of Customer employees (name, personal email, phone, address) will be deleted within 90 days after the successful offboarding event, unless such data is legally required to be retained (e.g., if appearing on invoices).

7.4 Obligations which by their nature (e.g. duty of confidentiality) should survive termination or expiration of this DPA, shall so survive.

8. MISCELLANEOUS

8.1 The governing law and dispute resolution are regulated in the Terms of Use.

8.2 Any modifications made in this DPA will be agreed upon by the Customer.

8.3 Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability while preserving the Parties’ intentions as closely as possible or – should this not be possible – (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein. The foregoing shall also apply if this DPA contains any omission.

8.4 In case of any conflict between the terms of this DPA and the Terms of Use, the provisions of this DPA shall prevail.