Last Updated: November 3, 2026

Enterprise Terms

These Enterprise Terms, effective as of the effective date of a signed order form (each, an “Order Form”) or the date on which you otherwise begin using the Services (such date, the “Effective Date”) is by and between Collaborative Intelligence, Inc. dba Brade AI (“Company”), and the customer set forth on the Order Form or the customer that otherwise begins using the Services (“Customer”). In the event of any conflict between these Enterprise Terms and the terms of any Order Form (if any), the terms of the Order Form shall control.

1. Trial Services

If you are accessing the Services on a trial, beta, pilot or similar basis (“Trial Services”), then unless otherwise indicated on an applicable Order Form, certain of Company’s obligations under this Agreement will not apply, as further described below.

2. Order Forms; Access to Services

Upon mutual execution, each Order Form shall be incorporated into and form a part of the Agreement. For each Order Form, subject to Customer’s compliance with the terms and conditions of this Agreement (including any limitations and restrictions set forth on the applicable Order Form), Company grants Customer a nonexclusive, limited, nonsublicensable, nontransferable right and license to provide access and use of the Company product(s) and/or service(s) specified in such Order Form (collectively, the “Services”) during the applicable Order Form Term (as defined below) for the internal business purposes of Customer, only as provided herein and only in accordance with Company’s applicable official user documentation for such Services (the “Documentation”).

3. Implementation

Upon payment of any applicable fees set forth in each Order Form, Company agrees to use reasonable commercial efforts to provide standard implementation assistance for the Services only if and to the extent such assistance is set forth on such Order Form (“Implementation Assistance”). If Company provides Implementation Assistance in excess of any agreed-upon hours estimate, or if Company otherwise provides additional services beyond those agreed in an Order Form, Customer will pay Company at its then-current hourly rates for consultation. The foregoing support services and Company’s obligations under this section do not apply to Trial Services.

4. Support Services

Company will use commercially reasonable efforts to make the Services available and will provide email support for defects in the Services during Company’s normal business hours. Company does not commit to any level of availability or to any response or resolution time, and no service credits apply. Any assistance outside the scope of this support will be provided by Company on a time and materials basis.

5. Updates; Pre-Release Products

From time to time, Company may provide upgrades, patches, enhancements, or fixes for the Services to its customers generally without additional charge (“Updates”), and such Updates will become part of the Services and subject to this Agreement; provided that Company shall have no obligation under this Agreement or otherwise to provide any such Updates. Customer understands that Company may make improvements and modifications to the Services at any time in its sole discretion; provided that Company shall use commercially reasonable efforts to give Customer reasonable prior notice of any major change that might adversely impact Customer’s use of the Services.

6. Fees; Payment

Customer shall pay Company the fees as set forth in each Order Form (“Fees”). Unless otherwise specified in an Order Form, all fees shall be invoiced annually in advance and all invoices issued under this Agreement are payable in U.S. dollars within thirty (30) days from date of invoice. Support and maintenance fees shall be invoiced monthly as incurred or as otherwise set forth in an Order Form. Past due invoices are subject to interest on any outstanding balance of the lesser of 1.5% per month or the maximum amount permitted by law. Customer shall be responsible for all taxes associated with the Services (excluding taxes based on Company’s net income). All Fees paid are non-refundable and are not subject to set-off.

7. Ownership; Feedback

As between the parties, Company retains all right, title, and interest in and to the Services, and all software, products, works, and other intellectual property and moral rights related thereto or created, used, or provided by Company for the purposes of this Agreement, including any copies and derivative works of the foregoing. Any software which is distributed or otherwise provided to Customer hereunder (including without limitation any software identified on an Order Form) shall be deemed a part of the “Services” and subject to all of the terms and conditions of this Agreement. No rights or licenses are granted except as expressly and unambiguously set forth in this Agreement. Customer may (but is not obligated to) provide suggestions, comments or other feedback to Company with respect to the Services (“Feedback”). Company acknowledges and agrees that all Feedback is provided “AS IS” and without warranty of any kind. Notwithstanding anything else, Customer shall, and hereby does, grant to Company a nonexclusive, worldwide, perpetual, irrevocable, transferable, sublicensable, royalty-free, fully paid-up license to use and exploit the Feedback for any purpose. Nothing in this Agreement will impair Company’s right to develop, acquire, license, market, promote or distribute products, software or technologies that perform the same or similar functions as, or otherwise compete with any products, software or technologies that Customer may develop, produce, market, or distribute.

8. Restrictions

Except as expressly set forth in this Agreement, Customer shall not (and shall not permit any third party to), directly or indirectly: (a) reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, or algorithms of the Services (except to the extent applicable laws specifically prohibit such restriction); (b) modify, translate, or create derivative works based on the Services; (c) copy, rent, lease, distribute, pledge, assign, or otherwise transfer or encumber rights to the Services; (d) use the Services for the benefit of a third party; (e) remove or otherwise alter any proprietary notices or labels from the Services or any portion thereof; (f) use the Services to build an application or product that is competitive with any Company product or service (including the Services); (g) interfere or attempt to interfere with the proper working of the Services or any activities conducted on the Services; or (h) bypass any measures Company may use to prevent or restrict access to the Services (or other accounts, computer systems or networks connected to the Services). Customer is responsible for all of Customer’s activity in connection with the Services, including but not limited to uploading Customer Data (as defined below) onto the Services. Customer is responsible for the use of the Services by any person to whom Customer has given access to the Services. Customer (i) shall use the Services in compliance with all applicable local, state, national and foreign laws, treaties and regulations in connection with Customer’s use of the Services (including those related to data privacy, international communications, export laws and the transmission of technical or personal data laws), and (ii) shall not use the Services in a manner that violates any third-party intellectual property, contractual or other proprietary rights.

9. Customer Data

For purposes of this Agreement, “Customer Data” shall mean any data, information or other material provided, uploaded, or submitted by Customer to the Services in the course of using the Services. Customer shall retain all right, title and interest in and to the Customer Data, including all intellectual property rights therein. Customer, not Company, shall have sole responsibility for the accuracy, quality, integrity, legality, reliability, appropriateness, and intellectual property ownership or right to use of all Customer Data. Customer represents and warrants that it has all rights necessary to provide the Customer Data to Company as contemplated hereunder, in each case without any infringement, violation or misappropriation of any third-party rights (including, without limitation, intellectual property rights and rights of privacy) and in compliance with all applicable laws. Notwithstanding anything to the contrary, Customer acknowledges and agrees that Company may (a) internally use and modify (but not disclose) Customer Data for the purposes of (i) providing the Services to Customer and (ii) generating Aggregated De-Identified Data (as defined below), and (b) freely use, retain and make available Aggregated De-Identified Data for Company’s business purposes (including without limitation, for purposes of improving, testing, operating, promoting and marketing Company’s products and services). “Aggregated De-Identified Data” means data submitted to, collected by, or generated by Company in connection with Customer’s use of the Services, but only in aggregate, de-identified form which can in no way be linked specifically to Customer. Company owns all right, title and interest in and to Aggregated De-Identified Data. Customer agrees and acknowledges that Customer Data may be irretrievably deleted if Customer’s account is ninety (90) days or more delinquent.

10. Privacy; Data Security

Company shall use commercially reasonable efforts to comply with the terms of the U.S. Privacy Law Addendum attached hereto as Exhibit B. If Customer believes Customer Data may include the personal information of natural persons that is subject to (a) the General Data Protection Regulation (Regulation (EU) 2016/679), (b) the Swiss Federal Act on Data Protection, (c) the EU GDPR as it forms part of the law of England and Wales by virtue of section 3 of the European Union (Withdrawal) Act 2018; (d) the UK Data Protection Act 2018; or (e) the Privacy and Electronic Communications (EC Directive) Regulations 2003, Customer may execute a Data Processing Addendum (“DPA”) provided upon request. Promptly following Company’s receipt of Customer’s request, Company will send Customer a DPA ready for execution.

11. Artificial Intelligence

Customer acknowledges and agrees that: (a) that certain output from the Services will be generated by artificial intelligence or machine learning; (b) due to the nature of artificial intelligence and machine learning are rapidly evolving fields of study, and use of the Services may in some situations result in incorrect or inaccurate output; (c) Customer must verify the accuracy and appropriateness of any output from the Services before relying on any such output; (d) relying upon any output from the Services without first verifying accuracy with a qualified human could cause harm, including but not limited to legal, financial, and physical harm; and (e) Customer has no rights to any information generated through the Services by or for other customers of Company, regardless of any level of similarity to information provided to Customer. Company cannot control, and has no duty to take any action, regarding how Customer may interpret, rely on, or use any output from the Services or what actions Customer may take as a result of having been exposed to output, and Customer hereby releases Company from all liability for Customer having acquired or not acquired output through the Services.

12. Confidentiality

For purposes of this Agreement, “Confidential Information” shall mean to the extent previously, presently or subsequently disclosed by or for either party (the “Disclosing Party”) to the other party (the “Receiving Party”) all financial, business, legal and technical information of the Disclosing Party or any of its affiliates, suppliers, customers and employees (including information about research, development, operations, marketing, transactions, regulatory affairs, discoveries, inventions, methods, processes, articles, materials, algorithms, software, specifications, designs, drawings, data, strategies, plans, prospects, know-how and ideas, whether tangible or intangible, and including all copies, abstracts, summaries, analyses and other derivatives thereof), that is marked or otherwise identified as proprietary or confidential at the time of disclosure, or that by its nature would be understood by a reasonable person to be proprietary or confidential. Confidential Information shall not include any information that (a) was rightfully known to the Receiving Party without restriction before receipt from the Disclosing Party, (b) is rightfully disclosed to the Receiving Party without restriction by a third party, (c) is or becomes generally known to the public without violation of this Agreement by the Receiving Party, or (d) is independently developed by the Receiving Party or its employees without access to or reliance on such information. The pricing information set forth in an applicable Order Form, Documentation and Feedback are Company’s Confidential Information, and the Customer Data is Customer’s Confidential Information. Each party shall treat as confidential all Confidential Information of the other party, shall not use such Confidential Information except as set forth in this Agreement, and shall not disclose such Confidential Information to any third party except as expressly permitted herein without the Disclosing Party’s written consent. The Receiving Party shall use at least the same degree of care which it uses to prevent the disclosure of its own confidential information of like importance to prevent the disclosure of the Disclosing Party’s Confidential Information, but in no event less than reasonable care. The Receiving Party shall promptly notify the Disclosing Party of any actual or suspected misuse or unauthorized disclosure of any of the Confidential Information. In the event of any termination or expiration of this Agreement, the Receiving Party will either return or, at the Disclosing Party’s request, destroy the Confidential Information of the Disclosing Party; provided however, that the Receiving Party may retain copies of the Disclosing Party’s Confidential Information for routine backup and archival purposes subject to the confidentiality obligations set forth herein. The Receiving Party may make disclosures required by law or court order provided that, if permissible pursuant to applicable law, the Receiving Party shall promptly notify the Disclosing Party of any disclosure requirement and provide reasonable assistance to the Disclosing Party in the Disclosing Party’s efforts to prevent and/or limit the disclosure.

13. Third-Party Services

Customer acknowledges and agrees that the Services may operate on, with or using application programming interfaces (APIs) and/or other services operated or provided by third parties (“Third-Party Services”), including without limitation through integrations or connectors to such Third-Party Services that are provided by Company. Company is not responsible for the operation of any Third-Party Services nor the availability or operation of the Services to the extent such availability and operation is dependent upon Third-Party Services. Customer is solely responsible for procuring any and all rights necessary for it to access Third-Party Services (including any Customer Data or other information relating thereto) and for complying with any applicable terms or conditions thereof. Company does not make any representations or warranties with respect to Third-Party Services or any third-party providers. Any exchange of data or other interaction between Customer and a third-party provider is solely between Customer and such third-party provider and is governed by such third-party provider’s terms and conditions.

14. Term; Termination

This Agreement shall commence upon the date of the first Order Form, and, unless earlier terminated in accordance herewith, shall last until the expiration of all Order Form Terms. Each Order Form shall specify the Initial Term, Renewal Term (if any), and terms applicable to each. The Initial Term and each Renewal Term (if any) are collectively referred to herein as the “Term.” In the event of a material breach of this Agreement by either party, the non-breaching party may terminate this Agreement by providing written notice to the breaching party, provided that the breaching party does not materially cure such breach within thirty (30) days of receipt of such notice. Without limiting the foregoing, Company may suspend or limit Customer’s access to or use of the Services if (a) Customer’s account is more than fifteen (15) days past due, or (b) Customer’s use of the Services results in (or is reasonably likely to result in) damage to or material degradation of the Services, which interferes with Company’s ability to provide access to the Services to other customers; provided that in the case of subsection (b): (i) Company shall use reasonable good faith efforts to work with Customer to resolve or mitigate the damage or degradation in order to resolve the issue without resorting to suspension or limitation; (ii) prior to any such suspension or limitation, Company shall use commercially reasonable efforts to provide notice to Customer describing the nature of the damage or degradation; and (iii) Company shall reinstate Customer’s use of or access to the Services, as applicable, if Customer remediates the issue within thirty (30) days of receipt of such notice. All provisions of this Agreement which by their nature should survive termination shall survive termination, including, without limitation, accrued payment obligations, ownership provisions, warranty disclaimers, confidentiality, indemnity and limitations of liability. For clarity, any termination or transition assistance services provided by Company to Customer, including any assistance in exporting the Customer Data, shall be billable at Company’s standard rates then in effect.

15. Indemnification

a. Company will indemnify, defend and hold Customer, its officers, directors, consultants, employees, agents, successors and assigns harmless from any and all amounts actually paid to any third party in connection with claims, liabilities, damages, costs and expenses (including, but not limited to, reasonable attorneys’ fees) (collectively, “Losses”) relating to any claim that the Services, as provided by Company to Customer under this Agreement and used within the scope of this Agreement, infringe or misappropriate any intellectual property right of such third party (each, an “Infringement Claim”). In the event of any such Infringement Claim, Company may, at its option: (i) obtain a license to permit Customer the ability to continue using the Services; (ii) modify or replace the relevant portion(s) of the Services with a non-infringing alternative having substantially equivalent performance within a reasonable period of time; or (iii) terminate this Agreement by providing notice to Customer, and provide Customer with a refund of any prepaid, unearned Fees (prorated on a daily basis for the then-current billing period), if any. Notwithstanding the foregoing, Company will have no liability for any Infringement Claim to the extent that it results from: (1) modifications to the Services made by a party other than Company or its agents, or otherwise not approved by Company or its agents or allowed under this Agreement; (2) the combination, operation or use of the Services with equipment, devices, data (including Customer Data) or software not provided or approved by Company; (3) Customer’s failure to use updated or modified versions of the Services provided by Company to avoid a claim; or (4) Customer’s use of the Services other than in accordance with this Agreement ((1) through (4), collectively, the “Excluded Claims”). The indemnification obligations set forth in this Section 15(a) are Company’s sole and exclusive obligations (and Customer’s sole and exclusive remedies) with respect to infringement or misappropriation of intellectual property rights of any kind. Company’s aggregate liability under this Section 15(a) shall not exceed the Fees paid or payable by Customer to Company in the twelve (12) months prior to the event giving rise to the Infringement Claim. Notwithstanding anything to the contrary herein, Company shall have no obligation under this Section 15 with respect to Trial Services.

b. Customer will indemnify and hold Company, its officers, directors, consultants, employees, agents, successors and assigns harmless from any and all Losses relating to any claim cause by (i) any of the Excluded Claims, (ii) Customer’s breach of any representation, warranty or obligation under this Agreement, and (iii) any claim that Customer Data or the use of Customer Data in connection with the Services may violate any law, rule, or regulation or infringe or violate the rights of a third party. If Company receives any notice or claim that Customer Data may violate any law, rule, or regulation or infringe or violate the rights of a third party, Company may (but is not required to) suspend the Services hereunder with respect to such Customer Data.

c. Any claim for indemnification hereunder is contingent upon the indemnified party providing (i) prompt written notice of the liability, (ii) reasonable cooperation, information, and assistance in connection therewith, and (iii) the indemnifying party with the sole control and authority to defend, settle or compromise such liability, provided that the indemnified party may participate in such defense at its sole cost. The indemnifying party will not make any settlement that requires a materially adverse act or admission by the indemnified party without the indemnified party’s written consent (such consent not to be unreasonably delayed, conditioned or withheld). The indemnifying party will not be liable for any settlement made without its prior written consent.

16. Warranties and Disclaimers

a. Mutual. Each party represents and warrants that (i) it is duly organized and validly existing under the laws of the jurisdiction in which it is organized, (ii) it has full power and authority, and has obtained all approvals, permissions and consents necessary, to enter into this Agreement and to perform its obligations hereunder, (iii) this Agreement is legally binding upon it, and (iv) the execution, delivery and performance of this Agreement does not and will not conflict with any agreement to which it is a party.

b. Disclaimers. EXCEPT AS EXPRESSLY SET FORTH HEREIN, THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE” AND ARE WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, AND ANY WARRANTIES IMPLIED BY ANY COURSE OF PERFORMANCE, USAGE OF TRADE, OR COURSE OF DEALING, ALL OF WHICH ARE EXPRESSLY DISCLAIMED.

c. Trial Services. In the event that Company provides Customer with access to any Trial Services or free trial, demonstration, pre-release or similar versions of the Services (as may be indicated on the Services or otherwise by Company), then (i) Customer acknowledges that such Services are experimental in nature, are provided “AS IS”, and may not be functional on any machine or in any environment, and (ii) Company’s obligations pursuant to Section 3 (Implementation), 4 (Support Services) and 15 (Indemnification) shall not apply to such services.

17. Limitation of Liability

IN NO EVENT SHALL EITHER PARTY, OR ITS OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, PARTNERS, SUPPLIERS OR LICENSORS, BE LIABLE UNDER CONTRACT, TORT, STRICT LIABILITY, NEGLIGENCE OR ANY OTHER LEGAL OR EQUITABLE THEORY WITH RESPECT TO THE SUBJECT MATTER OF THIS AGREEMENT (A) FOR ANY LOST PROFITS, DATA LOSS, COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR SPECIAL, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES OF ANY KIND WHATSOEVER, SUBSTITUTE GOODS OR SERVICES (HOWEVER ARISING), (B) FOR ANY BUGS, VIRUSES, TROJAN HORSES, OR THE LIKE (REGARDLESS OF THE SOURCE OF ORIGINATION), OR (C) FOR ANY DIRECT DAMAGES IN EXCESS OF (IN THE AGGREGATE) THE FEES PAID (OR PAYABLE) BY CUSTOMER TO COMPANY HEREUNDER IN THE TWELVE (12) MONTHS PRIOR TO THE EVENT GIVING RISE TO A CLAIM HEREUNDER (EXCEPT IF COMPANY PROVIDES CUSTOMER WITH TRIAL SERVICES, IN NO EVENT WILL ANY DIRECT DAMAGES EXCEED $100).

18. Publicity

Customer hereby consents to inclusion of its name and logo in Company’s public-facing client lists and marketing materials that may be published as part of its marketing and promotional efforts, including on Company’s website. Customer also agrees that Company may (but is under no obligation to) issue press releases and publish testimonials and case studies with statements attributed to a named employee of Customer. Customer may withdraw this consent at any time by written notice to Company, after which Company will make no new use of Customer’s name, logo or statements and will remove them from its website within thirty (30) days.

19. Force Majeure

In no event shall either party be liable to the other party, or be deemed to have breached this Agreement, for any failure or delay in performing its obligations under this Agreement (except for any obligations to make payments), if and to the extent such failure or delay is caused by any circumstances beyond such party’s reasonable control, including but not limited to acts of God, flood, fire, earthquake, explosion, war, terrorism, invasion, riot or other civil unrest, strikes, labor stoppages or slowdowns or other industrial disturbances, or passage of law or any action taken by a governmental or public authority, embargoes or blockades occurring after the date of this Agreement, or national or regional emergency, in each case, which effects could not have been avoided through reasonable business continuity planning (each of the foregoing, a “Force Majeure Event”). In the event of such Force Majeure Event, the affected party shall provide a prompt notice to the other party, stating the period of time the occurrence is expected to continue, and the affected party uses diligent efforts to end the failure or delay and minimize the effects of such Force Majeure Event. Notwithstanding the foregoing, Customer shall not be excused from its payment obligations as a result of the occurrence or persistence of such Force Majeure Event.

20. Miscellaneous

This Agreement (including all Order Forms) represents the entire agreement between Customer and Company with respect to the subject matter hereof, and supersedes all prior or contemporaneous communications and proposals (whether oral, written or electronic) between Customer and Company with respect thereto. In the event of any conflict between these Terms and an Order Form, the Order Form shall control. The Agreement shall be governed by and construed in accordance with the laws of the state of Delaware, excluding its conflicts of law rules, and the parties consent to exclusive jurisdiction and venue in the state and federal courts located in New Castle County, Delaware. All notices under this Agreement shall be in writing and shall be deemed to have been duly given when received, if personally delivered or sent by certified or registered mail, return receipt requested; when receipt is electronically confirmed, if transmitted by facsimile or e-mail; or the day after it is sent, if sent for next day delivery by recognized overnight delivery service. Notices must be sent to the contacts for each party set forth on the Order Form. Either party may update its address set forth above by giving notice in accordance with this section. Except as otherwise provided herein, any provision of this Agreement may be amended or waived only by a writing executed by both parties. Neither party may assign any of its rights or obligations hereunder without the other party’s consent; provided that (a) either party may assign all of its rights and obligations hereunder without such consent to a successor-in-interest in connection with a sale of all or substantially all of such party’s assets or stock, and (b) Company may utilize subcontractors in the performance of its obligations hereunder. No agency, partnership, joint venture, or employment relationship is created as a result of this Agreement and neither party has any authority of any kind to bind the other in any respect. In any action or proceeding to enforce rights under this Agreement, the prevailing party shall be entitled to recover costs and attorneys’ fees. If any provision of this Agreement is held to be unenforceable for any reason, such provision shall be reformed only to the extent necessary to make it enforceable. The failure of either party to act with respect to a breach of this Agreement by the other party shall not constitute a waiver and shall not limit such party’s rights with respect to such breach or any subsequent breaches.

Exhibit A - [Reserved]

Exhibit B - United States Privacy Law Addendum

This United States Privacy Law Addendum (the “Addendum”) supplements the Agreement and includes the terms of the Agreement. Any capitalized terms that are used but not defined herein shall have the definitions set forth in the Agreement. Where there is a conflict between the Agreement and this Addendum, this Addendum will control.

1. Definitions

(a) “Authorized Subprocessor” means a third-party party entity engaged by Company to process Personal Data in order to provide the Services and that has been approved by Customer in accordance with Section 6.

(b) “Company Account Data” means personal data that relates to Company’s relationship with Customer, including the names or contact information of individuals authorized by Customer to access Customer’s account and billing information of individuals that Customer has associated with its account.

(c) “Company Usage Data” means usage data collected and processed by Company in connection with the provision of the Services, including without limitation data used to identify the source and destination of a communication, activity logs, and similar data.

(d) “Consumer” means a natural person whose Personal Data is protected by Privacy Laws.

(e) “Consumer Request” means a request from a Consumer to exercise their rights over Personal data afforded pursuant to Privacy Laws.

(f) “Controller” means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing Personal Data. “Controller” includes the term “Business” or equivalent term under Privacy laws.

(g) “Personal Data” means any information provided to Company by or on behalf of Customer in connection with the Services that relates to an identified or identifiable Consumer and constitutes “personal data,” “personal information,” or equivalent term under Privacy Laws.

(h) “Privacy Laws” means any applicable laws and regulations in any relevant jurisdiction relating to the processing of Personal Data. Privacy Laws includes but are not limited to, U.S. state comprehensive privacy laws, such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (the “CCPA”), in each case as updated, amended or replaced from time to time. The terms “affiliates,” “business purpose,” “Controller,” “Personal Data Breach,” “Processor,” “process” or “processing,” “sell,” or “share,” shall have the meaning set forth for that or any equivalent term under Privacy Laws. For the avoidance of doubt, the terms “Controller” and “Processor” include “Business” and “Service Provider,” respectively, as defined in the CCPA.

2. Description of Processing

(a) Nature and Purpose of Processing: Except with respect to Company Account Data and Company Usage Data, Company shall process Personal Data provided by Customer under the Agreement as necessary to provide the Services under the Agreement, for the purposes specified in the Agreement and this Addendum, and in accordance with Customer’s instructions as set forth in this Addendum. Such purposes shall include the provision of an AI-enabled software platform designed for industrial distributors and manufacturers.

(b) Duration of Processing: Company shall process Personal Data provided by Customer as long as required (i) to provide the Services to Customer under the Agreement, or (ii) by applicable law or regulation.

(c) Categories of Consumers: Company may process Personal Data relating to the following categories of Consumers: Customer’s users, and Customer’s customers, suppliers, vendors and other business contacts whose information appears in Customer Data (for example, in emails and attachments processed through a connected mailbox).

(d) Categories of Personal Data: Company may process the following categories of Personal Data: Customer’s user name and business contact information (such as name, email address, physical address, phone number, company name, title, role, IP address, and device information); and personal data contained in Customer Data, including the names, email addresses, phone numbers, titles and other contact details of senders, recipients and contacts, the content of emails and attachments, and contact details in customer, order and quote records.

3. Customer’s Obligations

Customer shall, in its use of the Services, at all times process Personal Data, and provide instructions for the processing of Personal Data, in compliance with Privacy Laws. Customer shall ensure that the processing of Personal Data in accordance with Customer’s instructions will not cause Company to be in breach of the Privacy Laws. Customer is solely responsible for the accuracy, quality, and legality of (a) the Personal Data provided to Company by or on behalf of Customer, (b) the means by which Customer acquired any such Personal Data, and (b) the instructions it provides to Company regarding the processing of such Personal Data. Customer shall not provide or make available to Company any Personal Data in violation of the Agreement or otherwise inappropriate for the nature of the Services, and shall indemnify Company from all claims and losses in connection therewith.

4. Use of Personal Data

Company shall not: (a) sell or share Personal Data; (b) retain, use, or disclose Personal Data outside of Company’s direct business relationship with Customer or for any purpose other than to perform the Services and other obligations under the Agreement, which constitutes a business purpose under the Privacy Laws, except as otherwise permitted in Agreement or by Privacy Laws; and (c) combine Personal Data received from, or on behalf of, Customer with Personal Data that it receives from, or on behalf of, another party or person, except as necessary to provide the Services or as otherwise instructed by Customer.

5. Audit

To the extent required by applicable Privacy Laws, and upon Customer’s written request at reasonable intervals, and subject to reasonable confidentiality controls, Company shall either (a) make available for Customer’s review copies of certifications or reports demonstrating Company’s compliance with prevailing data security standards applicable to the processing of Personal Data provided by Customer under the Agreement, or (b) if the provision of reports or certifications pursuant to (a) is not reasonably sufficient under the applicable Privacy Laws, allow Customer or Customer’s independent third party representative to conduct an audit or assessment of Company’s policies and technical and organizational measures using an appropriate and accepted control standard or framework and assessment procedure for such assessments, that (i) Customer provides reasonable prior written notice of any such request for an audit and such inspection shall not be unreasonably disruptive to Company’s business; (ii) such audit shall only be performed during business hours and occur no more than once per calendar year; and (iii) such audit shall be restricted to data relevant to Customer. Customer shall be responsible for the costs of any such audits or inspections, including without limitation a reimbursement to Company for any time expended for on-site audits. To the extent permitted under Privacy Laws, if Customer determines that Company is processing Personal Data in an unauthorized manner, Customer may, taking into account nature of Company’s processing and the nature of the Personal Data processed by Company on behalf of Customer, and upon providing prior written notice, take commercially reasonable and appropriate steps to stop and remediate such unauthorized processing.

6. Authorized Subprocessors

(a) A list of Company’s current Authorized Subprocessors (the “List”) is attached hereto as Table A. Such List may be updated by Company from time to time. Company may provide a mechanism to subscribe to notifications of new subprocessors and Customer agrees to subscribe to such notifications where available. At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, Company will add such third party to the List and notify Customer via email. Customer may object to such an engagement by informing Company within ten (10) days of receipt of the aforementioned notice to Customer, provided such objection is in writing and based on reasonable grounds relating to data protection. If Customer does not object during this period, that third party will be deemed an Authorized Subprocessor. Customer acknowledges that certain subprocessors are essential to providing the Services and that objecting to the use of a subprocessor may prevent Company from offering the Services to Customer.

(b) If Customer reasonably objects to an engagement in accordance with Section 6(a), and Company cannot provide a commercially reasonable alternative within a reasonable period of time, Customer may discontinue the use of the affected Service by providing written notice to Company. Discontinuation shall not relieve Customer of any fees owed to Company under the Agreement.

(c) Company will enter into a written agreement with the Authorized Subprocessor imposing on the Authorized Subprocessor data protection obligations comparable to those imposed on Company under this Addendum with respect to the protection of Personal Data. In case an Authorized Subprocessor fails to fulfill its data protection obligations under such written agreement with Company, Company will remain liable to Customer for the performance of the Authorized Subprocessor’s obligations under such agreement.

7. Confidentiality and Security of Personal Data

(a) Company shall ensure that any person it authorizes to process Personal Data has agreed to protect Personal Data in accordance with Company’s confidentiality obligations in the Agreement. Customer agrees that Company may disclose Personal Data to its advisers, auditors or other third parties as reasonably required in connection with the performance of its obligations under this Addendum, the Agreement, or the provision of Services to Customer.

(b) Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Company shall maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing Personal Data.

8. Personal Data Breach

(a) In the event of a Personal Data Breach, Company shall, without undue delay, inform Customer of the Personal Data Breach and take such steps as Company in its sole discretion deems necessary and reasonable to remediate such Personal Data Breach, to the extent that remediation is within Company’s reasonable control.

(b) In the event of a Personal Data Breach, Company shall, taking into account the nature of the processing and the information available to Company, provide Customer with reasonable cooperation and assistance necessary for Customer to comply with its obligations under Privacy Laws with respect to notifying (i) the relevant regulatory agency and (ii) Consumers affected by such Personal Data Breach without undue delay.

(c) The obligations described in Sections 8(a) and 8(b) shall not apply in the event that a Personal Data Breach results from the actions or omissions of Customer. Company’s obligation to report or respond to a Personal Data Breach under Sections 8(a) and 8(b) will not be construed as an acknowledgement by Company of any fault or liability with respect to the Personal Data Breach.

9. Data Protection Assessments

Taking into account the nature of Company’s processing and the information available to Company, Company shall reasonably cooperate with Customer to conduct any data protection or privacy impact assessments as required by Privacy Laws, including by providing Customer with information and documents necessary for such assessments that Customer cannot otherwise obtain without Company’s assistance. Notwithstanding the foregoing, Customer and Company each remain responsible only for the measures respectively allocated to them under Privacy Laws pertaining to any such assessment.

10. Consumer Request

Company shall, to the extent permitted by Privacy Laws, notify Customer upon receipt of a Consumer Request. If Company receives a Consumer Request in relation to Personal Data, Company will advise the Consumer to submit their request to Customer and Customer will be responsible for responding to such request, including, where necessary, by using the functionality of the Services. Customer is solely responsible for ensuring that Consumer Requests communicated to Company, and, if applicable, for ensuring that a record of consent to processing is maintained with respect to each Consumer.

11. Return or Destruction of Personal Data

Upon the termination or expiration of the Agreement, at Customer’s choice, Company shall return or delete Personal Data, unless further storage of such Personal Data is required or authorized by applicable law. If return or destruction is impracticable or prohibited by law, rule or regulation, Company shall take measures to block such Personal Data from any further processing (except to the extent necessary for its continued hosting or processing required by law, rule or regulation) and shall continue to appropriately protect the Personal Data remaining in its possession, custody, or control.

12. Company’s Role as a Controller

The parties acknowledge and agree that with respect to Company Account Data and Company Usage Data, Company is an independent controller, not a joint controller with Customer. Company will process Company Account Data and Company Usage Data as a controller (a) to manage the relationship with Customer; (b) to carry out Company’s core business operations, such as accounting, audits, tax preparation and filing and compliance purposes; (c) to monitor, investigate, prevent and detect fraud, security incidents and other misuse of the Services, and to prevent harm to Customer; (d) for identity verification purposes; (e) to comply with legal or regulatory obligations applicable to the processing and retention of Personal Data to which Company is subject; and (f) as otherwise permitted under Privacy Laws and in accordance with this DPA and the Agreement. Company may also process Company Usage Data as a controller to provide, optimize, and maintain the Services, to the extent permitted by Privacy Laws. Any processing by Company as a controller shall be in accordance with Company’s privacy policy.

Table A - Authorized Subprocessors