Terms and Policies

This Data Processing Addendum ("DPA") forms part of the agreement between Infera Health, Inc. ("Infera") and its customer ("Customer") for Infera's Services, whether that agreement is the Infera Terms of Service or a signed Infera Cloud Service Agreement (in each case, the "Agreement"). This DPA applies whenever Infera processes Customer Personal Data in providing the Services.

For Customers under the Infera Terms of Service, this DPA applies automatically when Customer accepts the Terms of Service. For Customers under a Cloud Service Agreement, this DPA applies when the Cloud Service Agreement or an Order Form references it or when the parties sign it. Customers who want a countersigned copy may complete the signature page at the end of this DPA and email it to privacy@infera.com. Capitalized terms not defined in this DPA have the meanings given in the Agreement.

Definitions

"Account Data" means personal data about Customer's Users and business contacts that Infera processes to manage its relationship with Customer, including names, contact details, login credentials, and billing information.

"Customer Personal Data" means Personal Data contained in Customer Content that Infera processes on Customer's behalf in providing the Services. Customer Personal Data does not include Account Data.

"Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Agreement, including, as applicable, the GDPR; the UK GDPR and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection (the "FADP"); the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations (the "CCPA"); and other U.S. state consumer privacy laws.

"GDPR" means Regulation (EU) 2016/679, and "UK GDPR" means the GDPR as it forms part of UK law under section 3 of the European Union (Withdrawal) Act 2018.

"Personal Data Breach" means a breach of security of the Services leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data.

"Restricted Transfer" means a transfer of Customer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country that is not recognized under the applicable Data Protection Laws as providing an adequate level of protection.

"SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.

"Subprocessor" means any third party, including an Infera affiliate, that Infera engages to process Customer Personal Data, and "Subprocessor List" means the list of Subprocessors at https://www.infera.com/docs/terms#subprocessors.

"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, as revised from time to time.

The terms "controller," "processor," "data subject," "personal data," "processing," and "supervisory authority" have the meanings given in the GDPR, and the terms "business," "business purpose," "consumer," "sell," "service provider," and "share" have the meanings given in the CCPA.

Scope and Roles

Roles. For Customer Personal Data, Customer is the controller, or a processor acting on behalf of its own controllers, and Infera is Customer's processor or subprocessor and, under the CCPA, its service provider. Where Customer acts as a processor, Customer is responsible for obtaining any authorizations its controllers require for Infera's processing.

Account Data. Infera processes Account Data as an independent controller under the Infera Privacy Policy at https://www.infera.com/docs/terms#privacy. This DPA does not apply to Account Data.

Details of Processing. Annex I describes the subject matter, nature, purpose, and duration of the processing, the types of Customer Personal Data, and the categories of data subjects.

Prohibited Data. Customer will not submit Prohibited Data to the Services unless the Agreement expressly allows it. This DPA does not authorize the processing of Prohibited Data, including protected health information regulated by HIPAA.

Customer Obligations

Customer will comply with Data Protection Laws in its use of the Services, including by having a lawful basis for the processing, providing any required notices, obtaining any required consents, and ensuring that its instructions to Infera comply with Data Protection Laws. Customer is responsible for the accuracy, quality, and legality of Customer Personal Data and the means by which Customer obtained it.

Infera Obligations

Instructions. Infera will process Customer Personal Data only on Customer's documented instructions, unless applicable law requires otherwise, in which case Infera will inform Customer of that legal requirement before processing unless the law prohibits it. Customer instructs Infera to process Customer Personal Data to provide, maintain, secure, and support the Services in accordance with the Agreement and this DPA, and as initiated by Customer and its Users through their use of the Services. Any additional instructions require Infera's written agreement. Infera will inform Customer if, in Infera's opinion, an instruction infringes Data Protection Laws.

De-identified Data. Infera may create De-identified Data from Customer Content as the Agreement permits. Infera will take reasonable measures to ensure that De-identified Data cannot be associated with an individual, will maintain and use it only in de-identified form, will not attempt to re-identify it, and will contractually require any recipient of De-identified Data to meet the same requirements.

Confidentiality. Infera will ensure that all personnel authorized to process Customer Personal Data are bound by confidentiality obligations and have received appropriate security and privacy training.

Security. Infera will implement and maintain the technical and organizational measures described in Annex II. Infera may update those measures over time, but will not materially reduce the overall protection of Customer Personal Data during a paid subscription term.

Assistance. Taking into account the nature of the processing and the information available to Infera, Infera will provide reasonable assistance to Customer with any data protection impact assessments and prior consultations with supervisory authorities that Data Protection Laws require of Customer, to the extent Customer cannot obtain the necessary information from the Services, the Documentation, or Infera's SOC 2 report.

Subprocessors

Authorization. Customer gives Infera general written authorization to engage Subprocessors and specifically authorizes the Subprocessors on the Subprocessor List as of the date this DPA takes effect.

Subprocessor Obligations. Infera will review each Subprocessor's security and privacy practices before engaging it and at least annually after that. Infera will bind each Subprocessor by written agreement to data protection obligations no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the Subprocessor's services. Infera remains liable to Customer for each Subprocessor's performance of those obligations.

Notice of New Subprocessors. Customer may subscribe to notices of changes to the Subprocessor List by emailing privacy@infera.com with the subject line "Subprocessor updates." Infera will update the Subprocessor List and notify subscribers by email at least 30 days before a new Subprocessor begins processing Customer Personal Data. If Customer has not subscribed, the update to the Subprocessor List is notice to Customer. If Infera must replace a Subprocessor urgently to protect the security or availability of the Services, Infera may do so and will give notice as soon as practicable, and the objection period below runs from that notice.

Objections. Customer may object to a new Subprocessor by emailing privacy@infera.com within 30 days after notice, on reasonable grounds relating to the protection of Customer Personal Data. The parties will discuss the objection in good faith, and Infera may offer a commercially reasonable alternative, such as not using that Subprocessor to process Customer Personal Data. If the parties do not resolve the objection within 30 days after Infera receives it, Customer may terminate the affected Services by written notice, and if Customer has a paid subscription, Infera will refund any prepaid fees for the unused portion of the terminated Services. If Customer does not object within the objection period, Customer is deemed to have authorized the new Subprocessor.

Copies of Subprocessor Agreements. Where the SCCs require Infera to provide copies of Subprocessor agreements, Infera will provide them on Customer's request and may first remove commercial terms and provisions unrelated to data protection.

Personal Data Breaches

Infera will notify Customer of a Personal Data Breach without undue delay, and no later than 72 hours after Infera confirms it. The notice will describe, to the extent known, the nature of the Personal Data Breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed to address it. Infera will provide further information as it becomes available. Infera will take reasonable steps to contain, investigate, and mitigate the Personal Data Breach and will reasonably cooperate with Customer so that Customer can meet its breach notification obligations under Data Protection Laws. Infera's notification of or response to a Personal Data Breach is not an acknowledgment of fault or liability. This section does not apply to incidents caused by Customer or its Users, including the compromise of User credentials.

Data Subject Requests

If Infera receives a request from a data subject relating to Customer Personal Data, Infera will promptly forward it to Customer and will not respond to the data subject directly, other than to direct them to Customer, unless required by law. Taking into account the nature of the processing, Infera will assist Customer through appropriate technical and organizational measures, including the functionality of the Services, in responding to data subject requests. Customer is responsible for responding to those requests.

Audits

Reports. Infera maintains a SOC 2 Type 2 report issued by an independent auditor covering the Security, Availability, and Confidentiality trust services criteria. On Customer's written request, Infera will provide its most recent SOC 2 report and reasonable responses to security questionnaires, subject to confidentiality obligations.

Audits. If those materials are not sufficient to demonstrate Infera's compliance with this DPA as required by Data Protection Laws, or if a supervisory authority requires it, or following a Personal Data Breach, Customer may audit Infera's compliance with this DPA. Customer must give at least 30 days' written notice, and audits may occur no more than once in any 12-month period (unless a supervisory authority requires otherwise), during normal business hours, without unreasonable disruption to Infera's operations, and subject to reasonable confidentiality and security requirements. Customer will bear its own costs and reimburse Infera's reasonable costs of supporting the audit. Audits under the SCCs will be conducted in accordance with this section to the extent the SCCs permit.

Return and Deletion

Before the Agreement ends, Customer may export Customer Content using the features of the Services or by request to support@infera.com. After the Agreement ends, Infera will delete Customer Personal Data within 60 days, unless applicable law requires Infera to keep it. Copies in backups will be deleted as those backups expire in the ordinary course and will remain protected under this DPA until deleted. On Customer's request, Infera will confirm deletion in writing, and any certification of deletion required by the SCCs will be provided only on Customer's request.

International Transfers

Location of Processing. Infera processes Customer Personal Data in the United States. Subprocessors process Customer Personal Data in the locations stated on the Subprocessor List.

Transfers from the EEA. For Restricted Transfers from the European Economic Area, the SCCs are incorporated into this DPA and completed as follows: Module Two applies where Customer is a controller, and Module Three applies where Customer is a processor; Clause 7 (docking clause) does not apply; in Clause 9, Option 2 (general written authorization) applies, with the notice period stated in the Subprocessors section of this DPA; the optional wording in Clause 11 does not apply; the competent supervisory authority under Clause 13 is determined as that clause provides; in Clause 17, Option 1 applies and the SCCs are governed by the laws of Ireland; under Clause 18, disputes are resolved by the courts of Ireland; and Annexes I, II, and III of the SCCs are completed by Annex I, Annex II, and Annex III of this DPA.

Transfers from the United Kingdom. For Restricted Transfers from the United Kingdom, the SCCs as completed above apply as amended by the UK Addendum, which is incorporated into this DPA. Table 1 of the UK Addendum is completed with the parties' details in Annex I; Tables 2 and 3 are completed with the selections in the previous clause and the Annexes to this DPA; and for Table 4, either party may end the UK Addendum as described in its Section 19.

Transfers from Switzerland. For Restricted Transfers from Switzerland, the SCCs as completed above apply with these changes: references to the GDPR include the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; and references to "Member State" do not prevent data subjects in Switzerland from bringing claims in their place of habitual residence.

Government Requests. If Infera receives a request from a public authority for access to Customer Personal Data, Infera will, unless legally prohibited, attempt to redirect the authority to Customer and promptly notify Customer. Infera will challenge any request it reasonably considers unlawful and will disclose only the minimum Customer Personal Data needed to comply.

Alternative Transfer Mechanisms. If a transfer mechanism in this DPA is invalidated or replaced, Infera may adopt an alternative lawful transfer mechanism, and the parties will cooperate to implement it.

U.S. State Privacy Laws

Where the CCPA or another U.S. state privacy law applies to Customer Personal Data, Infera acts as Customer's service provider or processor and will:

1. process Customer Personal Data only for the limited and specified business purposes of providing, maintaining, securing, and supporting the Services under the Agreement;
2. not sell or share Customer Personal Data;
3. not retain, use, or disclose Customer Personal Data for any purpose other than those business purposes, or outside the direct business relationship between Infera and Customer, except as the CCPA permits;
4. not combine Customer Personal Data with personal data it receives from or on behalf of others, or collects from its own interactions with consumers, except as the CCPA permits;
5. comply with the obligations that apply to it under the CCPA and provide the same level of privacy protection that the CCPA requires;
6. notify Customer if it determines that it can no longer meet its obligations under the CCPA; and
7. allow Customer, on notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.

Infera certifies that it understands and will comply with these restrictions. Infera will also meet the processor obligations of other U.S. state privacy laws as described in this DPA, including confidentiality, deletion or return of data, making available information needed to demonstrate compliance, and binding Subprocessors by written contract.

General

Liability. Each party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits the rights of data subjects under the SCCs.

Order of Precedence. With respect to the processing of Customer Personal Data, if there is a conflict, the SCCs (where they apply) control, then this DPA, and then the Agreement.

Term. This DPA remains in effect for as long as Infera processes Customer Personal Data under the Agreement.

Updates. Infera may update this DPA by posting a new version at https://www.infera.com/docs/terms#dpa and notifying Customer by email or in the Services. For Customers with a paid subscription, updates will not materially reduce the protection of Customer Personal Data during the current subscription term without Customer's written agreement.

Governing Law. Except where the SCCs require otherwise, this DPA is governed by the law that governs the Agreement.

Annex I: Details of Processing

Annex II: Technical and Organizational Security Measures

Independent assurance. Infera maintains a SOC 2 Type 2 report issued by an independent auditor covering the Security, Availability, and Confidentiality trust services criteria.

Hosting and physical security. The Services are hosted on Amazon Web Services in the United States. Physical and environmental security of data centers is provided by Amazon Web Services, whose attestation reports Infera reviews at least annually.

Encryption. Customer Content is encrypted in transit and at rest. Encryption keys are managed through AWS Key Management Service, and access to keys is restricted to authorized personnel with a business need.

Network security. Production systems run in a virtual private cloud, with network segmentation through security groups, firewalls that deny unauthorized inbound traffic, and automated intrusion detection.

Access control. Access to production systems follows role-based, least-privilege principles and requires unique credentials and multi-factor authentication. Remote access to production systems requires an encrypted VPN connection. Access rights are reviewed at least quarterly, and access is revoked within three days after personnel leave Infera.

Logging and monitoring. Infera collects and monitors system and security logs and uses automated alerting to detect and respond to events that may affect the security or availability of the Services.

Vulnerability management. External-facing systems are scanned for vulnerabilities continuously, third-party vulnerability scans are performed quarterly, and an independent firm performs penetration testing at least annually. Source code and open-source dependencies are scanned for known vulnerabilities. Critical and high findings are tracked to remediation.

Secure development and change management. Changes follow a documented secure development life cycle and are reviewed, tested, and approved before deployment to production. Development and testing environments are logically separated from production, and version control maintains a history of changes.

Backups and continuity. Customer Content is backed up regularly. Backups are encrypted, access to them is restricted to key personnel, and restoration is tested. Infera maintains a business continuity and disaster recovery plan that it tests at least annually.

Incident response. Infera maintains a documented security and privacy incident response plan, which it tests through tabletop exercises.

Personnel. Infera performs background checks on new employees, requires employees and contractors to sign confidentiality agreements and acknowledge a code of conduct, and requires security awareness training within 30 days of hire and at least annually after that.

Vendor management. Infera maintains an inventory of critical vendors, reviews them at least annually, and has written agreements with vendors that include confidentiality and privacy commitments.

Data retention and disposal. Infera maintains documented data retention and disposal procedures, removes customer data from the production environment when customers leave the Services, and securely destroys electronic media containing confidential information.

AI model providers. Customer Content is sent to third-party AI model providers only as needed to provide the Services, under terms that prohibit those providers from using it to train their models.

Annex III: Subprocessors

The Subprocessors authorized under this DPA are those listed on the Subprocessor List at https://www.infera.com/docs/terms#subprocessors, as updated in accordance with the Subprocessors section of this DPA.

Infera Health, Inc. ("Infera") uses the subprocessors listed below to process customer personal data in providing the Infera platform. Each subprocessor is reviewed before engagement and at least annually after that, and is bound by a written agreement with data protection obligations consistent with the Infera Data Processing Addendum at https://www.infera.com/docs/terms#dpa.

This list does not include third-party tools that a customer chooses to connect to Infera, such as Jira, Confluence, GitHub, or Google Drive. Those tools are provided under the customer's own agreements with their providers. It also does not include vendors that process only Infera's own business information.

Current Subprocessors

Notice of Changes

To receive email notice at least 30 days before a new subprocessor begins processing customer personal data, email privacy@infera.com with the subject line "Subprocessor updates." Objections to a new subprocessor can be sent to the same address, as described in the Data Processing Addendum.

Change Log

Table of Contents

1. Introduction
2. Data Protection Officer
3. How We Collect and Use (Process) Your Personal Information
4. Use of the Infera.com Website
5. Cookies and Tracking Technologies
6. Use of the Infera Services
7. When and How We Share Information with Third Parties
8. Transferring Personal Data to the U.S.
9. Data Subject Rights
10. Security of Your Information
11. Data Storage and Retention
12. Children’s Data
13. Questions, Concerns, or Complaints

Introduction

Infera, Inc. (“Infera,” “we,” “us,” or “our”) is a medical device compliance automation company. We provide cloud-based software and services to help medtech companies automate regulatory compliance, streamline documentation, and achieve faster market access.

We understand that you are aware of and care about your own personal privacy interests, and we take that seriously. This Privacy Notice describes Infera’s policies and practices regarding its collection and use of your personal data, and sets forth your privacy rights. We recognize that information privacy is an ongoing responsibility, and so we will from time to time update this Privacy Notice as we undertake new personal data practices or adopt new privacy policies.

Data Protection Officer

Infera is headquartered in Los Angeles, California, United States. Infera has appointed an internal data protection officer for you to contact if you have any questions or concerns about Infera’s personal data policies or practices. If you would like to exercise your privacy rights, please direct your query to Infera’s data protection officer. Infera’s data protection officer’s name and contact information are as follows:

Harry Blumsack
Infera, Inc.
834 N Avenue 65
Los Angeles, CA 90042
privacy@infera.com
(310) 751-0767

How We Collect and Use (Process) Your Personal Information

Infera collects personal information about its website visitors and customers. With a few exceptions, this information is generally limited to:

• Name
• Job title
• Employer name
• Work address
• Work email
• Work phone number

We use this information to provide prospects and customers with services. We do not sell personal information to anyone and only share it with third parties who are facilitating the delivery of our services.

From time to time, Infera receives personal information about individuals from third parties. Typically, information collected from third parties will include further details on your employer or industry. We may also collect your personal data from a third-party website (e.g., LinkedIn).

Use of the Infera.com Website

As is true of most other websites, Infera’s website collects certain information automatically and stores it in log files. The information may include:

• Internet protocol (IP) addresses
• The region or general location where your computer or device is accessing the internet
• Browser type
• Operating system
• Other usage information about the use of Infera’s website, including a history of the pages you view

We use this information to help us design our site to better suit our users’ needs. We may also use your IP address to help diagnose problems with our server and to administer our website, analyze trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences.

Infera has a legitimate interest in understanding how members, customers, and potential customers use its website. This assists Infera with providing more relevant products and services, with communicating value to our sponsors and corporate members, and with providing appropriate staffing to meet member and customer needs.

Cookies and Tracking Technologies

Infera makes available a comprehensive notice that describes the cookies and tracking technologies used on the Infera website and provides information on how users can accept or reject them. To view the notice, just click Cookie Notice.

Use of the Infera Services

Infera services involve the processing of customer data as part of delivering regulatory compliance automation solutions. Data collected during service use is handled according to this Privacy Statement and any contractual agreements with our customers.

When and How We Share Information with Third Parties

The personal information Infera collects from you is stored in one or more databases hosted by third parties located in the United States. These third parties do not use or have access to your personal information for any purpose other than cloud storage and retrieval. On occasion, Infera engages third parties to send information to you, including information about our products, services, and events.

A list of our third party sub-processors can be provided upon request.

We do not otherwise reveal your personal data to non-Infera persons or businesses for their independent use unless:

1. You request or authorize it
2. It’s in connection with Infera-hosted and Infera co-sponsored conferences as described above
3. The information is provided to comply with the law (for example, compelled by law enforcement to comply with a search warrant, subpoena, or court order), enforce an agreement we have with you, or to protect our rights, property or safety, or the rights, property or safety of our employees or others
4. The information is provided to our agents, vendors or service providers who perform functions on our behalf
5. To address emergencies or acts of God
6. To address disputes, claims, or to persons demonstrating legal authority to act on your behalf

We may also gather aggregated data about our services and website visitors and disclose the results of such aggregated (but not personally identifiable) information to our partners, service providers, advertisers, and/or other third parties for marketing or promotional purposes.

The Infera website connects with third party services such as Facebook, LinkedIn, Twitter, and others. If you choose to share information from the Infera website through these services, you should review the privacy policy of that service. If you are a member of a third party service, the aforementioned connections may allow that service to connect your visit to our site to your personal data.

Transferring Personal Data to the U.S.

Infera has its headquarters in the United States. Information we collect about you will be processed in the United States. By using Infera’s services, you acknowledge that your personal information will be processed in the United States.

The United States has not sought nor received a finding of “adequacy” from the European Union under Article 45 of the GDPR. Pursuant to Article 46 of the GDPR, Infera is providing for appropriate safeguards by entering binding, standard data protection clauses, enforceable by data subjects in the EEA and the UK. These clauses have been enhanced based on the guidance of the European Data Protection Board and will be updated when the new draft model clauses are approved.

Depending on the circumstance, Infera also collects and transfers to the U.S. personal data with consent; to perform a contract with you; or to fulfill a compelling legitimate interest of Infera in a manner that does not outweigh your rights and freedoms. Infera endeavors to apply suitable safeguards to protect the privacy and security of your personal data and to use it only consistent with your relationship with Infera and the practices described in this Privacy Statement. Infera also enters into data processing agreements and model clauses with its vendors whenever feasible and appropriate. Since it was founded, Infera has received zero government requests for information.

For more information or if you have any questions, please contact us at privacy@infera.com.

Data Subject Rights

The European Union’s General Data Protection Regulation (GDPR) and other countries’ privacy laws provide certain rights for data subjects. Data Subject rights under GDPR include the following:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right of data portability
• Right to object
• Rights related to automated decision making including profiling

This Privacy Notice is intended to provide you with information about what personal data Infera collects about you and how it is used.

If you wish to confirm that Infera is processing your personal data, or to have access to the personal data Infera may have about you, please contact us.

You may also request information about:

• The purpose of the processing
• The categories of personal data concerned
• Who else outside Infera might have received the data from Infera
• What the source of the information was (if you didn’t provide it directly to Infera)
• How long it will be stored

You have a right to correct (rectify) the record of your personal data maintained by Infera if it is inaccurate. You may request that Infera erase that data or cease processing it, subject to certain exceptions. You may also request that Infera cease using your data for direct marketing purposes. In many countries, you have a right to lodge a complaint with the appropriate data protection authority if you have concerns about how Infera processes your personal data. When technically feasible, Infera will—at your request—provide your personal data to you.

Reasonable access to your personal data will be provided at no cost. If access cannot be provided within a reasonable time frame, Infera will provide you with a date when the information will be provided. If for some reason access is denied, Infera will provide an explanation as to why access has been denied.

For questions or complaints concerning the processing of your personal data, you can email us at privacy@infera.com. Alternatively, if you are located in the European Union, you can also have recourse to the European Data Protection Supervisor or with your nation’s data protection authority.

Data Storage and Retention

Your personal data is stored by Infera on its servers, and on the servers of the cloud-based database management services Infera engages, located in the United States. Infera retains service data for the duration of the customer’s business relationship with Infera and for a period of time thereafter, to analyze the data for Infera’s own operations, and for historical and archiving purposes associated with Infera’s services. Infera retains prospect data until such time as it no longer has business value and is purged from Infera systems. All personal data that Infera controls may be deleted upon verified request from Data Subjects or their authorized agents.

For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact us at privacy@infera.com.

Children’s Data

We do not knowingly attempt to solicit or receive information from children.

Questions, Concerns, or Complaints

If you have questions, concerns, complaints, or would like to exercise your rights, please contact us at privacy@infera.com or call us at (310) 751-0767.

Service Access and Use

During the Subscription Period and subject to the terms of this Agreement, Customer may (a) access and use the Cloud Service; and (b) copy and use the included Software and Documentation only as needed to access and use the Cloud Service, in each case, for its internal business purposes. If a Customer Affiliate enters a separate Order Form with Provider, the Customer’s Affiliate creates a separate agreement between Provider and that Affiliate, where Provider’s responsibility to the Affiliate is individual and separate from Customer and Customer is not responsible for its Affiliates’ agreement.

Support

During the Subscription Period, Provider will provide Technical Support as described in the Order Form.

User Accounts

Customer is responsible for all actions on Users’ accounts and for all Users’ compliance with this Agreement. Customer and Users must protect the confidentiality of their passwords and login credentials. Customer will promptly notify Provider if it suspects or knows of any fraudulent activity with its accounts, passwords, or credentials, or if they become compromised.

Feedback and Usage Data

Customer may, but is not required to, give Provider Feedback, in which case Customer gives Feedback “AS IS”. Provider may use all Feedback freely without any restriction or obligation. In addition, Provider may collect and analyze Usage Data, and Provider may freely use Usage Data to maintain, improve, enhance, and promote Provider’s products and services without restriction or obligation. However, Provider may only disclose Usage Data to others if the Usage Data is aggregated and does not identify Customer or Users.

Customer Content

Provider may copy, display, modify, and use Customer Content only as needed to provide and maintain the Product and related offerings. Customer is responsible for the accuracy and content of Customer Content.

Machine Learning

Usage Data and Customer Content may be used to develop, train, or enhance artificial intelligence or machine learning models that are part of Provider's products and services, including third-party components of the Product, and Customer authorizes Provider to process its Usage Data and Customer Content for such purposes. However:

• (a) Usage Data and Customer Content must be aggregated before it can be used for these purposes, and
• (b) Provider will use commercially reasonable efforts consistent with industry standard technology to de-identify Usage Data and Customer Content before such use.

Nothing in this section will reduce or limit Provider's obligations regarding Personal Data that may be contained in Usage Data or Customer Content under Applicable Data Protection Laws. Due to the nature of artificial intelligence and machine learning, information generated by these features may be incorrect or inaccurate. Product features that include artificial intelligence or machine learning models are not human and are not a substitute for human oversight.

Restrictions & Obligations

Restrictions on Customer

Except as expressly permitted by this Agreement, Customer will not (and will not allow anyone else to):

1. reverse engineer, decompile, or attempt to discover any source code or underlying ideas or algorithms of the Product (except to the extent Applicable Laws prohibit this restriction);
2. provide, sell, transfer, sublicense, lend, distribute, rent, or otherwise allow others to access or use the Product;
3. remove any proprietary notices or labels;
4. copy, modify, or create derivative works of the Product;
5. conduct security or vulnerability tests on, interfere with the operation of, cause performance degradation of, or circumvent access restrictions of the Product;
6. access accounts, information, data, or portions of the Product to which Customer does not have explicit authorization;
7. use the Product to develop a competing service or product;
8. use the Product with any High Risk Activities or with any activity prohibited by Applicable Laws;
9. use the Product to obtain unauthorized access to anyone else’s networks or equipment; or
10. upload, submit, or otherwise make available to the Product any Customer Content to which Customer and Users do not have the proper rights.

Use of the Product must comply with all Documentation and Use Limitations.

Suspension

If Customer:
(a) has an outstanding, undisputed balance on its account for more than 30 days;
(b) breaches Section 2.1 (Restrictions on Customer); or
(c) uses the Product in violation of the Agreement or in a way that materially and negatively impacts the Product or others,

then Provider may temporarily suspend Customer’s access to the Product with or without notice. However, Provider will try to inform Customer before suspending Customer’s account when practical. Provider will reinstate Customer’s access to the Product only if Customer resolves the underlying issue.

Privacy & Security

Personal Data

Before submitting Personal Data governed by GDPR, Customer must enter into a data processing agreement with Provider. If the parties have a DPA, each party will comply with its obligations in the DPA, the terms of the DPA will control each party’s rights and obligations as to Personal Data, and the terms of the DPA will control in the event of any conflict with this Agreement.

Prohibited Data

Customer will not (and will not allow anyone else to) submit Prohibited Data to the Product unless authorized by the Order Form or Key Terms.

Payment & Taxes

Fees

Unless the Order Form specifies a different currency, all Fees are in U.S. Dollars and are exclusive of taxes. Except for the prorated refund of prepaid Fees allowed with specific termination rights given in the Agreement, Fees are non-refundable.

Invoicing

For a Payment Process with invoicing, Provider will send invoices for usage-based Fees in arrears and for all other Fees in advance, in each case according to the Payment Process.

Automatic Payment

For a Payment Process with automatic payment, Provider will automatically charge the credit card, debit card, or other payment method on file for Fees according to the Payment Process and Customer authorizes all such charges. In this case, Provider will make a copy of Customer's bills or transaction history available to Customer.

Taxes

Customer is responsible for all duties, taxes, and levies that apply to Fees, including sales, use, VAT, GST, or withholding, that Provider itemizes and includes in an invoice. However, Customer is not responsible for Provider’s income taxes.

Payment

Customer will pay Provider Fees and taxes in U.S. Dollars, unless the Order Form specifies a different currency, according to the Payment Process.

Payment Dispute

If Customer has a good-faith disagreement about the Fees charged or invoiced, Customer must notify Provider about the dispute before payment is due, or within 30 days of an automatic payment, and must pay all undisputed amounts on time. The parties will work together to resolve the dispute within 15 days. If no resolution is agreed, each party may pursue any remedies available under the Agreement or Applicable Laws.

Term & Termination

Order Form and Agreement

For each Order Form, the Agreement will start on the Order Date, continue through the Subscription Period, and automatically renew for additional Subscription Periods unless one party gives notice of non-renewal to the other party before the Non-Renewal Notice Date.

Framework Terms

These Framework Terms will start on the Effective Date and continue for the longer of one year or until all Order Forms governed by the Framework Terms have ended.

Termination

Either party may terminate the Framework Terms or an Order Form immediately:

• if the other party fails to cure a material breach of the Framework Terms or an Order Form following 30 days notice;
• upon notice if the other party:

1. materially breaches the Framework Terms or an Order Form in a manner that cannot be cured;
2. dissolves or stops conducting business without a successor;
3. makes an assignment for the benefit of creditors; or
4. becomes the debtor in insolvency, receivership, or bankruptcy proceedings that continue for more than 60 days.

Force Majeure

Either party may terminate an affected Order Form upon notice if a Force Majeure Event prevents the Product from materially operating for 30 or more consecutive days. Provider will pay to Customer a prorated refund of any prepaid Fees for the remainder of the Subscription Period. A Force Majeure Event does not excuse Customer's obligation to pay Fees accrued prior to termination.

Effect of Termination

Termination of the Framework Terms will automatically terminate all Order Forms governed by the Framework Terms. Upon any expiration or termination:

• Customer will no longer have any right to use the Product.
• Upon Customer’s request, Provider will delete Customer Content within 60 days.
• Each Recipient will return or destroy Discloser’s Confidential Information in its possession or control.
• Provider will submit a final bill or invoice for all outstanding Fees accrued before termination and Customer will pay the invoice according to Section 4 (Payment & Taxes).

Survival

The following sections will survive expiration or termination of the Agreement:

• Section 1.4 (Feedback and Usage Data)
• Section 1.6 (Machine Learning)
• Section 2.1 (Restrictions on Customer)
• Section 4 (Payment & Taxes) for Fees accrued or payable before expiration or termination
• Section 5.5 (Effect of Termination)
• Section 5.6 (Survival)
• Section 6 (Representations & Warranties)
• Section 7 (Disclaimer of Warranties)
• Section 8 (Limitation of Liability)
• Section 9 (Indemnification)
• Section 10 (Confidentiality)
• Section 11 (Reservation of Rights)
• Section 12 (General Terms)
• Section 13 (Definitions)
• and the portions of a Cover Page referenced by these sections.

Each Recipient may retain Discloser’s Confidential Information in accordance with its standard backup or record retention policies maintained in the ordinary course of business or as required by Applicable Laws, in which case Section 3 (Privacy & Security) and Section 10 (Confidentiality) will continue to apply to retained Confidential Information.

Representations & Warranties

Mutual

Each party represents and warrants to the other that:
(a) it has the legal power and authority to enter into this Agreement;
(b) it is duly organized, validly existing, and in good standing under the Applicable Laws of the jurisdiction of its origin;
(c) it will comply with all Applicable Laws in performing its obligations or exercising its rights in this Agreement; and
(d) it will comply with the Additional Warranties.

From Customer

Customer represents and warrants that it, all Users, and anyone submitting Customer Content each have and will continue to have all rights necessary to submit or make available Customer Content to the Product and to allow the use of Customer Content as described in the Agreement.

From Provider

Provider represents and warrants to Customer that it will not materially reduce the general functionality of the Cloud Service during the Subscription Period.

Provider Warranty Remedy

If Provider breaches the warranty in Section 6.3 (Representations & Warranties from Provider), Customer must give Provider notice (with enough detail for Provider to understand or replicate the issue) within 45 days of discovering the issue. Within 45 days of receiving sufficient details of the warranty issue, Provider will attempt to restore the general functionality of the Cloud Service. If Provider cannot resolve the issue, Customer may terminate the affected Order Form and Provider will pay to Customer a prorated refund of prepaid Fees for the remainder of the Subscription Period. Provider’s restoration obligation, and Customer’s termination right, are Customer’s only remedies if Provider does not meet the warranty in Section 6.3 (Representations & Warranties from Provider).

Disclaimer of Warranties

Provider makes no guarantees that the Product will always be safe, secure, or error-free, or that it will function without disruptions, delays, or imperfections. The warranties in Section 6 (Representations & Warranties) do not apply to any misuse or unauthorized modification of the Product, nor to any product or service provided by anyone other than Provider. Except for the warranties in Section 6 (Representations & Warranties), Provider and Customer each disclaim all other warranties and conditions, whether express or implied, including the implied warranties and conditions of merchantability, fitness for a particular purpose, title, and non-infringement. These disclaimers apply to the maximum extent permitted by Applicable Laws.

Limitation of Liability

Liability Caps

Except as provided in Section 8.4 (Exceptions), each party’s total cumulative liability for all claims arising out of or relating to this Agreement will not be more than the General Cap Amount. If there are Increased Claims, each party’s total cumulative liability for all Increased Claims arising out of or relating to this Agreement will not be more than the Increased Cap Amount.

Damages Waiver

Except as provided in Section 8.4 (Exceptions), under no circumstances will either party be liable to the other for lost profits or revenues (whether direct or indirect), or for consequential, special, indirect, exemplary, punitive, or incidental damages relating to this Agreement, even if the party is informed of the possibility of this type of damage in advance.

Applicability

The limitations and waivers contained in Sections 8.1 (Liability Caps) and 8.2 (Damages Waiver) apply to all liability, whether in tort (including negligence), contract, breach of statutory duty, or otherwise.

Exceptions

The liability cap in Section 8.1(a) does not apply to any Increased Claims. Section 8.1 (Liability Caps) does not apply to any Unlimited Claims. Section 8.2 (Damages Waiver) does not apply to any Increased Claims or a breach of Section 10 (Confidentiality). Nothing in this Agreement will limit, exclude, or restrict a party's liability to the extent prohibited by Applicable Laws.

As a specific exception to the foregoing, the Provider’s aggregate liability for any and all claims arising from a breach of Section 3 (Privacy & Security) or Section 10 (Confidentiality) shall not exceed 5.0 times the fees paid or payable by Customer to Provider in the 12 month period immediately before the claim if at the time of the claim the contract is active, otherwise 5.0 times the fees paid or payable by Customer to Provider in the 12 month period immediately prior to the effective date of termination or expiration of this Agreement.

Any such claim must be brought no later than five (5) years following the expiration or termination of this Agreement.

Indemnification

Protection by Provider

Provider will indemnify, defend, and hold harmless Customer from and against all Provider Covered Claims made by someone other than Customer, Customer’s Affiliates, or Users, and all out-of-pocket damages, awards, settlements, costs, and expenses, including reasonable attorneys’ fees and other legal expenses, that arise from the Provider Covered Claims.

Protection by Customer

Customer will indemnify, defend, and hold harmless Provider from and against all Customer Covered Claims made by someone other than Provider or its Affiliates, and all out-of-pocket damages, awards, settlements, costs, and expenses, including reasonable attorneys’ fees and other legal expenses, that arise from the Customer Covered Claims.

Procedure

The Indemnifying Party’s obligations in this section are contingent upon the Protected Party:
(a) promptly notifying the Indemnifying Party of each Covered Claim for which it seeks protection;
(b) providing reasonable assistance to the Indemnifying Party at the Indemnifying Party’s expense; and
(c) giving the Indemnifying Party sole control over the defense and settlement of each Covered Claim.

A Protected Party may participate in a Covered Claim for which it seeks protection with its own attorneys only at its own expense. The Indemnifying Party may not agree to any settlement of a Covered Claim that contains an admission of fault or otherwise materially and adversely impacts the Protected Party without the prior written consent of the Protected Party.

Changes to Product

If required by settlement or court order, or if deemed reasonably necessary in response to a Provider Covered Claim, Provider may:
(a) obtain the right for Customer to continue using the Product;
(b) replace or modify the affected component of the Product without materially reducing the general functionality of the Product; or
(c) if neither (a) nor (b) are reasonable, terminate the affected Order Form and issue a pro-rated refund of prepaid Fees for the remainder of the Subscription Period.

Exclusions

Provider’s obligations as an Indemnifying Party will not apply to Provider Covered Claims that result from:

1. modifications to the Product that were not authorized by Provider or that were made in compliance with Customer’s instructions;
2. unauthorized use of the Product, including use in violation of this Agreement;
3. use of the Product in combination with items not provided by Provider; or
4. use of an old version of the Product where a newer release would avoid the Provider Covered Claim.

Customer’s obligations as an Indemnifying Party will not apply to Customer Covered Claims that result from the unauthorized use of the Customer Content, including use in violation of this Agreement.

Exclusive Remedy

This Section 9 (Indemnification), together with any termination rights, describes each Protected Party’s exclusive remedy and each Indemnifying Party’s entire liability for a Covered Claim.

Confidentiality

Non-Use and Non-Disclosure

Except as otherwise authorized in the Agreement or as needed to fulfill its obligations or exercise its rights under this Agreement, Recipient will not:
(a) use Discloser’s Confidential Information; nor
(b) disclose Discloser’s Confidential Information to anyone else.

In addition, Recipient will protect Discloser’s Confidential Information using at least the same protections Recipient uses for its own similar information but no less than a reasonable standard of care.

Exclusions

Confidential Information does not include information that:
(a) Recipient knew without any obligation of confidentiality before disclosure by Discloser;
(b) is or becomes publicly known and generally available through no fault of Recipient;
(c) Recipient receives under no obligation of confidentiality from someone else who is authorized to make the disclosure; or
(d) Recipient independently developed without use of or reference to Discloser’s Confidential Information.

Required Disclosures

Recipient may disclose Discloser’s Confidential Information to the extent required by Applicable Laws if, unless prohibited by Applicable Laws, Recipient provides Discloser reasonable advance notice of the required disclosure and reasonably cooperates, at Discloser’s expense, with Discloser’s efforts to obtain confidential treatment for the Confidential Information.

Permitted Disclosures

Recipient may disclose Discloser’s Confidential Information to Users, employees, advisors, contractors, and representatives who each have a need to know the Confidential Information, but only if the person or entity is bound by confidentiality obligations at least as protective as those in this Section 10 (Confidentiality) and Recipient remains responsible for everyone’s compliance with the terms of this Section 10 (Confidentiality).

Reservation of Rights

Except for the limited license to copy and use Software and Documentation in Section 1.1 (Access and Use), Provider retains all right, title, and interest in and to the Product, whether developed before or after the Effective Date. Except for the limited rights in Section 1.5 (Customer Content) and 1.6 (Machine Learning), Customer retains all right, title, and interest in and to the Customer Content.

General Terms

Entire Agreement

This Agreement is the only agreement between the parties about its subject and this Agreement supersedes all prior or contemporaneous statements (whether in writing or not) about its subject. Provider expressly rejects any terms included in Customer’s purchase order or similar document, which may only be used for accounting or administrative purposes. No terms or conditions in any Customer documentation or online vendor portal will apply to Customer's use