Inpart Master Service Agreement

1. Definitions

In this Agreement, unless otherwise stated or unless the context otherwise requires, the following capitalized term will have the following meanings:

“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than fifty percent (50%) of the voting interests of the subject entity.

“Content” means information obtained by Inpart from content licensors or publicly available sources and provided to Client pursuant to this Agreement.

“Client” or “Customer” means the company or other legal entity and Affiliates of that company or entity identified as such in the Statement of Work and/or Quote(s) and who is entering into a commercial relationship for its business or professional purposes.

“Data” means electronic data and information submitted by or for Client to the Platform, including by Users, in connection with use of the ordered Services, or collected and processed by or for Client using the ordered Services, including any personal data and excluding Content.

“Effective Date” means the date of signature of this Agreement by the Client.

“Platform” means all the software and infrastructure constituting the “Inpart Platform” as described in the Inpart Platform Description and allowing access to the subscribed Services.

“Quote(s)” means a document issued by Inpart and signed by the Client in addition to the hereby Agreement, such document describing the subscriptions, services and the price.

“Services” means the Subscription services and professional services that are ordered by Client and made available online by Inpart, all as described and set forth in the Statement of Work or in the Annex D. “Services” exclude Content.

“Services Period” means the period for which the Client has ordered Services as specified in the Statement of Work.

“Service Description” means the description(s) set forth or referenced in the Statement of Work, or in the Annex D, that are applicable to the ordered Services, including any documentation, hosting, support and security policies, and other descriptions referenced or incorporated in such descriptions or directly in the Statement of Work, or in the Annex D, and as updated from time to time.

“Statement of Work” means a document executed by the parties and incorporated herein by reference and made a part of this Agreement that will, among other things, describe the specific Services ordered by Client and related parameters and other provisions, including specific payment terms and any other terms that these terms and conditions contemplate will be addressed in the Statement of Work or that are otherwise set forth therein.

“Subscription” means Client’s act of subscription to a free or purchased Service, as described in a Statement of Work and/or Quote, or in the Annex D.

“User” means an individual who is authorized by Client to use a Service, for whom Client has ordered the Service, and to whom Client, or Inpart at Client request, have supplied a user identification and password. Users may include, for example, Client employees, consultants, contractors and agents, and third parties with which Client transact business.

2. Obligations of Parties

2.1. Provision of Services.

Inpart will (a) make the Services and Content available to Client pursuant to this Agreement and the Statement of Work, (b) provide Client standard support and backup services as described in the Statement of Work for the Services purchased to Client at no additional charge, and/or upgraded support if purchased, and (c) use commercially reasonable efforts to make the online Services available twenty-four (24) hours a day, seven (7) days a week, except for: (i) planned downtime (of which Inpart shall give five (5) days, and no less than twenty-four (24) hours, electronic notice and which Inpart shall schedule to the extent practicable during the weekend hours), and (ii) any unavailability caused by circumstances beyond Inpart reasonable control, including, for example, an act of God, act of government, flood, fire, earthquake, civil unrest, act of terror, strike or other labor problem (other than one involving Inpart employees), Internet service provider failure or delay, or denial of service attack.

2.2. Protection of Data.

Inpart will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Data, as described in the Privacy Policy Statement. Those safeguards will include, but will not be limited to, measures for preventing access, use, modification or disclosure of Data by Inpart personnel except (a) to provide the Services purchased by Client and prevent or address service or technical problems, (b) as compelled by law in accordance with the section “Compelled Disclosure” below, or (c) as Client expressly permits in writing.

2.3. Inpart Personnel.

Inpart will be responsible for the performance of Inpart personnel (employees and contractors) and their compliance with Inpart obligations under this Agreement, except as otherwise specified herein.

2.4. Client Responsibilities.

Client will (a) be responsible for Users’ compliance with this Agreement, (b) be responsible for the accuracy, quality and legality of Data and the means by which Client acquired Data, including, but not limited to, lawfulness of providing Data to Inpart for processing under applicable data protection and privacy laws and regulations as amended from time to time, such as the GDPR and any enacting laws, (c) deploy the necessary means and technical measures to prevent unauthorized access to or use of Services and notify Inpart promptly of any such unauthorized access or use, (d) use Services and Content only in accordance with the documentation and applicable laws and government regulations.

3. Use of Services

3.1. Subscriptions.

Unless otherwise provided in the Statement of Work and/or Quotes, (a) Services are purchased as Subscriptions, (b) Subscriptions may be added during a Subscription term at the same pricing as the underlying Subscription pricing, prorated for the portion of that Subscription term remaining at the time the Subscriptions are added, and (c) any added Subscriptions will terminate on the same date as the underlying Subscriptions.

3.2. Usage Limits.

Services are subject to usage limits, including, for example, the quantities specified in the Statement of Work and/or Quote(s). Unless otherwise specified, (a) a quantity in a Statement of Work and/or Quote(s) refers to Users, and the Service may not be accessed by more than that number of Users, (b) a User’s password may not be shared with any other individual, and (c) a User identification may be reassigned to a new individual replacing one who no longer requires ongoing use of the Service or Content. If Client exceeds a contractual usage limit, Inpart may work with Client to seek to reduce Client’s usage so that it conforms to that limit. If, notwithstanding Inpart efforts, Client is unable or unwilling to abide by a contractual usage limit, Client will execute an amendment to the Statement of Work for additional quantities of the applicable Services promptly upon Inpart’s request.

3.3. Usage Restrictions.

Client will not (a) make any Service available to, or use any Service for the benefit of, anyone other than Client or Users, (b) sell, resell, license, sublicense, distribute, rent or lease any Service, or include any Service in a service bureau or outsourcing offering, (c) use a Service to store or transmit infringing, libelous, or otherwise unlawful or tortious material, or to store or transmit material in violation of third-party privacy rights, (d) use a Service to store or transmit malicious code, (e) interfere with or disrupt the integrity or performance of any Service or third-party data contained therein, (f) attempt to gain unauthorized access to any Service or its related systems or networks, (g) permit direct or indirect access to or use of any Service in a way that circumvents a contractual usage limit, (h) copy a Service or any part, feature, function or user interface thereof, (i) copy Content except as permitted herein or in the Statement of Work, (j) frame or mirror any part of any Service, other than framing on Client’s own intranets or otherwise for Client’s own internal business purposes or as permitted in the documentation, (k) access any Service in order to build a competitive product or service, (l) reverse engineer any Service (to the extent such restriction is permitted by law), (m) access the Services if Client is a direct competitor, except with Inpart’s prior written consent, or (n) access the Services for purposes of monitoring their availability, performance or functionality, or for any other benchmarking or competitive purposes.

3.4. Integration with Non-Inpart applications.

The Services may contain features designed to interoperate with Non-Inpart applications. To use such features, Client may be required to obtain access to Non-Inpart applications from their providers and may be required to grant Inpart access to Client account(s) on the Non-Inpart applications. If the provider of a Non-Inpart application ceases to make the Non-Inpart application available for interoperation with the corresponding Service features on reasonable terms, Inpart may cease providing those Service features without entitling Client to any refund, credit, or other compensation.

4. Financial Terms

4.1. Fees.

Client will pay all fees specified in the Statement of Work and/or Quote(s). Except as otherwise specified herein or in the Statement of Work and/or Quote(s), (i) fees are based on Services purchased and not actual usage, (ii) payment obligations are non-cancelable and fees paid are non-refundable, and (iii) quantities purchased cannot be decreased during the relevant Subscription term.

4.2. Invoicing and Payment.

Inpart will invoice Client in advance and otherwise in accordance with the Statement of Work and/or Quote(s). Unless otherwise stated in the Statement of Work and/or Quote(s), invoiced charges are due net thirty (30) days from the invoice date. Client is responsible for providing complete and accurate billing and contact information to Inpart and notifying Inpart of any changes to such information.

4.3. Payment default and overdue Charges.

If any invoiced amount is not received by Inpart by the due date, then without limiting Inpart rights or remedies, (a) those charges may accrue late interest at the rate of one-and-a-half percent (1.5%) of the outstanding balance per month, or the maximum rate permitted by law, whichever is lower, and/or (b) Inpart may condition future Subscription renewals on payment terms shorter than those specified in the above section “Invoicing and Payment.” These overdue charges accrue without prior formal notice from the day following the due date, and they are computed on the amount tax inclusive of the sum remaining due. (ii) The Client is also liable ipso jure for all-inclusive compensation for recovery costs in the amount of forty (40) euros. This all-inclusive compensation is payable without a reminder being necessary the day following the date of payment specified in the invoice. Inpart reserves the right to claim additional compensation on presentation of supporting documents if the recovery costs incurred are in excess of this amount. Non-payment by the Client of an invoice that is due shall entitle Inpart to require payment of all other outstanding invoices, even if they are not yet due.

4.4. Suspension of Service.

If any amount owing by Client under this or any other agreement for Inpart services is ten (10) or more days overdue, Inpart may, without limiting Inpart’s other rights and remedies, suspend Inpart services to Client until such amounts are paid in full. Inpart will give Client ten (10) days’ prior notice that Client account is overdue before suspending services to Client.

4.5. Payment Disputes.

Inpart will not exercise its rights under the above sections “Overdue Charges” or “Suspension of Service” if Client is disputing the applicable charges reasonably and in good faith and is cooperating diligently to resolve the dispute.

4.6. Taxes.

Inpart fees do not include any taxes, levies, duties or similar governmental assessments of any nature, including, for example, value-added, sales, use or withholding taxes, assessable by any jurisdiction whatsoever (collectively, “Taxes”). Client is responsible for paying all Taxes associated with Client purchases hereunder. If Inpart has the legal obligation to pay or collect Taxes for which Client is responsible under this section, Inpart will invoice Client and Client will pay that amount unless Client provides Inpart with a valid tax exemption certificate authorized by the appropriate taxing authority.

4.7. Future Functionality.

Client agrees that Client purchases are not contingent on the delivery of any future functionality or features, or dependent on any oral or written public comments made by Inpart regarding future functionality or features.

5. Term & Termination

5.1. Term of Agreement.

This Agreement commences on the Effective date and continues until all Subscriptions hereunder have expired or have been terminated.

5.2. Term of Purchased Subscriptions.

The term of each Subscription shall be one year or as specified in the Statement of Work and/or Quote(s). Except as otherwise specified in the Statement of Work, Subscriptions will automatically renew for additional periods equal to the expiring Subscription term or one year (whichever is shorter), unless either party gives the other notice of non-renewal at least sixty (60) days before the end of the relevant Subscription term. Regardless of the length of the Subscription term, the per unit pricing may be reviewed and adjusted no more than once annually by Inpart. In case of pricing increase, Inpart shall give Client written notice of a pricing increase at least ninety (90) days before the end of the current subscription term, in which case the pricing increase will be effective upon the following subscription term. Any such pricing increase will not exceed eight percent (8%) of the pricing for the applicable Service in the immediately prior Subscription term.

5.3. Termination.

A party may terminate this Agreement for cause (i) upon sixty (60) days written notice to the other party of a material breach if such breach remains uncured at the expiration of such period, or (ii) if the other party becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, liquidation or assignment for the benefit of creditors.

5.4. Refund or Payment upon Termination.

If this Agreement is terminated by Inpart in accordance with the section “Termination”, Client will pay any unpaid fees covering the entire Subscription Term. In no event will termination relieve Client of its obligation to pay any fees payable to Inpart. For the avoidance of any doubt, the agreed term or any renewal term is binding. Client will remain responsible for any and all fees and charges payable under this Agreement and/or as specified in the Statement of Work and/or Quote(s) through the end of the term.

5.5. Data Portability and Deletion.

Upon request by Client made upon the effective date of termination or expiration of any or all the Services offered by Inpart, or this Agreement, Inpart will make the relevant Data corresponding to the terminated or expired Services, available to Client for export or download within twenty-eight (28) days after receiving such request. Unless Client requests export or download of Data, and if it does, after twenty-eight (28)-day period from such request, Inpart will have no obligation to maintain or provide Data and will thereafter delete or destroy all copies of Data in Inpart systems or otherwise in Inpart’s possession or control as provided in the documentation, unless legally prohibited. Should Client request additional assistance from Inpart than what is described above – the obligation to prepare Data for export or download upon timely Client request, as part of this Agreement, such assistance will be subject to Inpart professional services terms and conditions, then in effect. It is expressly agreed that any additional and specific assistance from Inpart regarding Data export, portability and deletion or more generally regarding the termination of this Agreement and/or any Statement of Work shall be extra-cost for Client and subject to professional services.

5.6. Surviving Provisions.

The sections titled “Fees and Payment for Purchase Services,” “Proprietary Rights and Licenses,” “Confidentiality,” “Disclaimers,” “Mutual Indemnification,” “Limitation of Liability,” “Refund or Payment upon Termination,” “Portability and Deletion of Data,” and “General” will survive any termination or expiration of this Agreement.

6. Proprietary Rights and Licenses

6.1. Reservation of Rights.

Subject to the limited rights expressly granted hereunder, Inpart and Inpart licensors reserve all Inpart/their right, title and interest in and to the Services and Content, including all of Inpart/their related intellectual property rights. For clarity this includes the Inpart Platform and all the Services, Content, and documentation offered on the Platform, Inpart trademarks and copyrights, Inpart licensors’ trademarks and copyrights, Inpart licensors’ operating system licenses or other software used to run the Platform such as database management systems, storage systems, backup and safety devices and equipment. All copyrights, intellectual and industrial property rights (trademarks, patents, signs, logos, etc.) as well as all technical, commercial or financial documents belonging to Inpart are and shall remain Inpart’s property. No rights are granted to Client hereunder other than as expressly set forth herein. This Agreement does not confer to Client any property rights concerning the Service, its technology or the intellectual property rights of Inpart or a third party. Client shall not cause any damage whatsoever to the Service or notably use the Service other than for its intended purpose according to the conditions in the Agreement. Consequently, Client shall refrain from any reverse engineering of the Service with a view to creating a competing product or Service and/or copying or reproducing any functionalities, functions or graphic attributes of the Service.

6.2. Client’s Data.

Client is and remains the sole owner of its Data.

6.3. License by Inpart to Use Content.

Inpart grants to Client a worldwide, limited-term license, under Inpart applicable intellectual property rights and licenses, to use Content acquired by Client pursuant to the terms and conditions set forth in this Agreement and the Statement of Work.

6.4. License by Client to host Data.

Client grants to Inpart a worldwide, limited-term license to host, copy, transmit and display Data, as necessary for Inpart to provide the Services to Client in accordance with this Agreement. Subject to the limited licenses granted herein, Inpart acquires no right, title or interest from Client or Client licensors under this Agreement in or to Data. As such, Inpart assumes no responsibility, nor any liability whatsoever should the Data infringe or violate the intellectual proprietary rights of any third party.

6.5. License by Client to Use Feedback.

Client grants to Inpart a worldwide, perpetual, irrevocable, royalty-free license to use and incorporate into the Services any suggestion, enhancement request, recommendation, correction or other feedback provided by Client or Users relating to the operation of the Services.

7. Confidentiality

7.1. Definition of Confidential Information.

“Confidential Information” means all information disclosed by a party (“Disclosing Party”) to the other party (“Receiving Party”), whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Client Confidential Information includes Data; Inpart Confidential Information includes the Services; and Confidential Information of each party includes the terms and conditions of this Agreement and all Quotes/Order Forms (including pricing), as well as business and marketing plans, technology and technical information, product plans and designs, and business processes disclosed by such party. However, Confidential Information does not include any information that (i) is or becomes generally known to the public without breach of any obligation owed to the Disclosing Party, (ii) was known to the Receiving Party prior to its disclosure by the Disclosing Party without breach of any obligation owed to the Disclosing Party, (iii) is received from a third party without breach of any obligation owed to the Disclosing Party, or (iv) was independently developed by the Receiving Party.

7.2. Protection of Confidential Information.

The Receiving Party will use the same degree of care that it uses to protect the confidentiality of its own confidential information of like kind (but not less than reasonable care) (i) not to use any Confidential Information of the Disclosing Party for any purpose outside the scope of this Agreement, and (ii) except as otherwise authorized by the Disclosing Party in writing, to limit access to Confidential Information of the Disclosing Party to those of its and its Affiliates’ employees and contractors who need that access for purposes consistent with this Agreement and who have signed confidentiality agreements with the Receiving Party containing protections no less stringent than those herein. Neither party will disclose the terms of this Agreement or any Quote/Order Form to any third party other than its Affiliates, legal counsel and accountants without the other party’s prior written consent, provided that a party that makes any such disclosure to its Affiliate, legal counsel or accountants will remain responsible for such Affiliate’s, legal counsel’s or accountant’s compliance with this section. Obligations of the parties with regards to the Confidential Information will remain in force during the full term of the Agreement and for a period of ten (10) years after the term of the Agreement.

7.3. Compelled Disclosure.

The section “Protection of Confidential Information” is not construed to prohibit any disclosure that is (a) necessary to establish the rights or obligations of a party under this Agreement in connection with a legal proceeding or (b) required by applicable law or a valid court order or subpoena, provided in the latter case that either party notifies the other party (whose Confidential Information is to be disclosed) thereof promptly and in writing and cooperates with the other party in all reasonable respects if the other party seeks to contest or limit the scope of such disclosure.

8. Personal Data

8.1. Processing of Personal Data.

“Processing” means any operation or set of operations performed on personal data, by any means whatsoever (including by computer or manually), including the collection, recording, organization, structuring, storage, adaptation, modification, retrieval, consultation, deletion, use, making available, alignment, combination, restriction, erasure or destruction. A description of Processing under this Agreement is provided in Annex B to this Agreement. “Personal Data” means any Data relating to an identified or identifiable individual, within the meaning of and to which EU Regulation 2016/679 on the protection of natural persons about the processing of personal data and on the free movement of such data (the “GDPR”) applies.

8.2. General Obligations.

The parties agree to comply with all applicable data protection and privacy laws and regulations as amended from time to time, such as the GDPR and any enacting laws. The parties agree to maintain a record of processing activities under their respective responsibility, in accordance with the terms of the GDPR. The Parties acknowledge that Client is the Data Controller (as defined in the GDPR) and Inpart is a Processor (as defined in the GDPR) with respect to the Processing of the Personal Data in the context of the Services rendered under this Agreement.

8.3. Inpart Obligations.

Inpart shall use commercially reasonable efforts to comply with the following provisions:

a) Ensure that the Personal Data collected by Inpart are Processed only in accordance with this Agreement, or as otherwise instructed in writing from time to time by Client, including with regard to transfers of Personal Data to a third country or an international organization within the meaning of the GDPR, unless required to do so by EU or EU member state law to which Inpart is subject. In such a case, Inpart shall inform Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. Inpart shall, without undue delay, inform Client if, in its opinion, an instruction from the Client infringes applicable data protection laws.

b) Use the Personal Data strictly as necessary to carry out its obligations as part of the Services and for no other purpose, thereby excluding any processing or use of the Personal Data for its own purposes as well as transfer of the Personal Data to any third party unless expressly authorized by Client. For the avoidance of any doubt, any personal data collected or otherwise Processed by Inpart independently of the provision of Services, including but not limited to personal data collected in the context of organizing or co-organizing events, shall not be governed by this Agreement and Inpart shall be considered a controller for such personal data and use it for its own purposes by means it determines. Notwithstanding anything to the contrary in the foregoing or otherwise in this Agreement, Client acknowledges and agrees that Inpart may use, at its sole option and discretion, the Personal Data in order to provide Client with information regarding the following: (i) product news and new features (including VP events and free access to them); (ii) thought leadership communications (e.g., white papers, webinars); and (iii) the Inpart newsletter, similar publications and copies thereof.

c) Ensure that the Personal Data are not disclosed or transferred to any third party without the prior written consent of Client, except (i) as specifically stated or for the necessary performance of the Services in this Agreement, or (ii) where such disclosure or transfer is required by any applicable law, regulation or supervisory authority, in which case Inpart shall, wherever possible, notify promptly in writing Client prior to complying with any such request for disclosure or transfer and shall comply with all reasonable lawful directions of Client with respect to such disclosure or transfer.

d) Implement and maintain commercially reasonable technical and organizational measures to protect the Personal Data against accidental or unlawful destruction or accidental loss, destruction, damage, corruption or alteration, or unauthorized disclosure or access and against all other unlawful forms of Processing.

e) Assist Client by providing it with information necessary to demonstrate its compliance with obligations under this Agreement and Article 28 of the GDPR;

f) Ensure that each of its employees and agents are made aware of, and comply with, Inpart’s obligations under this Agreement and Client acknowledges that any failure by Inpart’s employees and agents to comply with the terms of this Agreement shall be deemed a breach of this Agreement by Inpart;

g) Promptly notify Client about (i) any legally binding request for disclosure of the Personal Data by a law enforcement authority unless otherwise prohibited from doing so by law; (ii) any request received for the Personal Data directly from a data subject; and (iii) any complaint, communication or request relating to Client’s obligations under applicable laws (including requests from a competent supervisory authority), unless it is prevented to do so under the applicable laws.

h) Assist Client with the fulfilment of the its obligation to respond to requests for exercising the data subject's rights with regards to their Personal Data under the GDPR, by implementing appropriate mechanisms to ensure that Personal Data can be accessed, corrected, restricted, deleted and/or blocked (upon objection), as well as ensure Personal Data portability, due to statutory requirements, upon demand of a supervisory authority, or upon the such data subject’s requests, subject to any exceptions and conditions under applicable data protection laws;

i) Ensure that only such of its employees and agents who may be required by Inpart to assist in performing tasks related to performance of Services under this Agreement will have access to the Personal Data and who committed themselves to confidentiality;

j) Notify Client of any actual breach of security leading to the, accidental or unlawful loss, destruction, damage, alteration or disclosure of the Personal Data as soon as it becomes aware of it, but not later than thirty-six (36) hours after the even occurred, and keep Client informed of any related developments;

k) Take into account the nature of Processing and Personal Data available to Inpart, it shall provide Client with reasonable assistance in ensuring compliance with Client’s obligations with respect to the security of the Processing, data breach notifications and communications, data protection impact assessments and consultation of supervisory authorities.

(l) Undertake that Personal Data will not be transferred out of the European Economic Area and countries which are considered to provide adequate levels of protection pursuant to applicable data protection laws, unless appropriate safeguards are in place for such transfers. Client shall be responsible for and provide Inpart with any such assistance as needed for, securing and/or concluding such appropriate safeguards.

8.4. Client Obligations.

Client shall ensure it is entitled to transfer the relevant Personal Data to Inpart so that Inpart may lawfully use, process, transfer or otherwise Process such Personal Data in accordance with the Agreement and applicable data protection laws. In the event of any breach or other violation of such obligation, Client shall, at its own expense, defend, indemnify and hold Inpart harmless from and against any claims, demands, causes of action, judgements, complaints, administrative fine, penalty, or liability, and reasonable costs and expenses relating thereto made by third parties or natural persons whose Personal Data are reproduced, hosted or otherwise Processed via the Platform arising from, related to, or in connection with this Agreement and in particular from any breaches of this Agreement caused by Client’s acts or omissions.

9. Representations, Warranties & Disclaimers

9.1. Representations and Warranties.

Each party represents that it has validly entered into this Agreement and has the legal power to do so. Further, Inpart warrants that: (a) Inpart will not materially decrease the overall security of the Services during a Subscription term, (b) the Services will perform materially in accordance with the applicable documentation, (c) the Services have been properly tested for viruses, Trojan horses, trap doors and similar devices that could disrupt or disable a computer system or any of its components and that, to the best of Inpart knowledge the Services, as delivered, contains no such devices, and (d) any maintenance, and support services provided hereunder shall be performed by qualified personnel in a professional manner, consistent with industry standards. For any breach of an above warranty, Client exclusive remedies are those described in the sections “Termination” and “Refund or Payment upon Termination”.

9.2. Disclaimers.

EXCEPT AS EXPRESSLY PROVIDED HEREIN, NEITHER PARTY MAKES ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, AND EACH PARTY SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW. CONTENT AND BETA SERVICES ARE PROVIDED “AS IS,” EXCLUSIVE OF ANY WARRANTY WHATSOEVER. EACH PARTY DISCLAIMS ALL LIABILITY AND INDEMNIFICATION OBLIGATIONS FOR ANY HARM OR DAMAGES CAUSED BY ANY THIRD-PARTY HOSTING PROVIDERS.

10. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW: (1) IN NO EVENT SHALL INPART BE LIABLE FOR ANY CONSEQUENCES OF A SECURITY DEFAULT (HARDWARE OR SOFTWARE) OF THE TERMINAL (E.G. COMPUTER, LAPTOP, TABLET, CELL PHONE, ETC.) USED BY CLIENT TO ACCESS THE SERVICES; (2) IN NO EVENT SHALL INPART OR ITS AFFILIATES BE LIABLE FOR ANY LOSS OF DATA, LOST PROFITS, GOODWILL, OR COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INCIDENTAL, CONSEQUENTIAL OR INDIRECT AND PUNITIVE DAMAGES ARISING UNDER, RELATED TO, OR IN CONNECTION WITH THIS AGREEMENT OR THE USE OR OPERATION OF THE HOSTING SERVICES, IN WHOLE OR IN PART, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY; (3) IN NO EVENT SHALL THE ENTIRE LIABILITY OF INPART OR ITS AFFILIATES ARISING UNDER, RELATED TO, OR IN CONNECTION WITH THIS AGREEMENT, EXCEED THE AMOUNT OF LICENSE FEES RECEIVED BY INPART FROM LICENSEE FOR THE APPLICABLE LICENSED MATERIALS IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENTS GIVING RISE TO SUCH LIABILITY; (4) THESE LIMITATIONS AND EXCLUSIONS SHALL APPLY EVEN IF SUCH LOSS WAS REASONABLY FORESEEABLE OR IF INPART HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; AND (5) THESE LIMITATIONS SHALL APPLY NOTWITHSTANDING THE FAILURE OF THE ESSENTIAL PURPOSE OF ANY LIMITED REMEDIES HEREIN.

11. Mutual Indemnification

11.1. Indemnification by Inpart.

Subject to the provisions of this Agreement, Inpart shall (i) defend Client against any direct third-party claim that the Services infringe a United States or European patent or copyright and (ii) pay the resulting reasonable cost and damages finally awarded against Client by a court of competent jurisdiction or the amount stated in a written settlement signed by Inpart. The foregoing obligations are subject to the following: Client (a) notifies Inpart promptly in writing of such claim, (b) grants Inpart sole control over the defense and settlement thereof, (c) reasonably cooperates in response to Inpart request for assistance, and (d) is not in material breach of this Agreement. Inpart shall have no liability under this section to the extent that the alleged infringement arises out of or relates to: (A) the use or combination of the Services with third party products or services, (B) use for a purpose or in a manner for which the Services was not designed, (C) any use of other than the current, unaltered version of the Service, (D) Content, or (E) any unauthorized use of the Service (F) Client’s breach of this Agreement, (G) Client’s failure to incorporate software updates or upgrades that would have avoided the alleged infringement or misappropriation, or (H) Inpart’s creation or modification of the Services in compliance with specifications furnished by Client.

11.2. Indemnification by Client.

Client will defend Inpart against any claim, demand, suit or proceeding made or brought against Inpart by a third party alleging that Data, or Client use of any Service or Content in breach of this Agreement, infringes or misappropriates such third party’s intellectual property rights or violates applicable law, and will indemnify Inpart from any damages, attorney fees and costs finally awarded against Inpart as a result of, or for any amounts paid by Inpart under a court-approved settlement of such a claim against Inpart, provided Inpart (a) promptly gives Client written notice of such claim, (b) gives Client sole control of the defense and settlement thereof (except that Client may not settle any such claim unless Client unconditionally releases Inpart of all liability), and (c) give Client all reasonable assistance, at Client expense.

11.3. Exclusive Remedy.

This section states the indemnifying party’s sole liability to, and the indemnified party’s exclusive remedy against, the other party for any type of claim described in this section.

12. General

12.1. Cooperation.

Each of the Parties shall actively commit to fulfillment of its obligations under the Agreement, refrain from any conduct which could affect and/or hinder fulfillment of the other Party’s obligations, provide by a mutually agreed-upon date, all information and documents necessary for implementation of the Agreement, alert the other as quickly as possible in case of difficulty and deploy the best possible solution as soon as possible. For a good and satisfactory performance of the Agreement, the Parties shall negotiate in good faith to resolve any difficulty relating to such Agreement as quickly as possible. After agreement by the Parties on the hereby Agreement, the Client shall have thirty (30) days’ to sign it from sending by Inpart on an electronic platform legally admitted for signatory authentication (e.g. DocuSign) or in originals by registered letter. Despite the agreement between the Parties, if the Client does not effectively sign the Agreement as sent by Inpart within thirty (30) days from the date of sending, the Agreement will not be valid anymore and Inpart shall be entitled to re-negotiate the Agreement, including without limitation the price and payment terms.

12.2. Force Majeure and hardship.

Neither party shall be liable to the other for any delay in performing, or failure to perform, any of its obligations under this Agreement if and to the extent that the failure or delay is caused as a result of any Force Majeure event, provided that such failure or delay could not have been prevented by reasonable precautions. Force Majeure event means any circumstance not within a party’s reasonable control including, without limitation, acts of God, flood, drought, earthquake or other natural disaster, epidemic or pandemic, terrorist attack, civil war, civil commotion or riots, national and/or internal strikes or other labor disputes, war, threat of or preparation for war, armed conflict, imposition of sanctions, embargoes, or breaking off of diplomatic relations, government orders responding to any of the foregoing. The time for performance of an obligation which is affected by such an event shall be extended by a period which reflects the delay caused by the Force Majeure event. A party shall only be entitled to claim relief in respect of a Force Majeure event if it informs the other party, by registered mail, as promptly as possible, of the nature and severity of the Force Majeure event (including its estimated duration and impact on that party's ability to perform its obligations), and its wish to claim relief and takes commercially reasonable efforts to resume or maintain performance of its obligations under this Agreement as soon as reasonably possible. If the impediment is temporary, fulfillment of the obligation is suspended until the Party invoking the Force Majeure event is no longer impeded by such Force Majeure event. The Party invoking the Force Majeure event shall keep the other Party informed and undertakes to make every effort to limit the duration of the suspension. If the suspension continues beyond three (3) months, either of the Parties may terminate the Agreement without liability by notice to the other Party by registered mail.

If, due to a change of circumstances which couldn’t have been foreseen upon conclusion of the Agreement, performance becomes excessively costly for Inpart which didn’t accept to bear the related risk, then Inpart may request the Client to re-negotiate the Agreement. Therefore, Inpart will notify the Client its wish to re-negotiate the Agreement within a thirty (30) days period. Parties undertake to negotiate in good faith in order to restore the initial balance of the Contract.

12.3. Export Compliance.

Client acknowledges that the Services, Content, other technology Inpart makes available, and derivatives thereof may be subject to export laws and regulations of the United States and other jurisdictions. In this case, each party represents that it is not named on any U.S. government denied-party list. Client shall not permit Users to access or use any Service or Content in a U.S.-embargoed country (currently Cuba, Iran, North Korea, Sudan or Syria) or in violation of any U.S. export law or regulation.

12.4. Anti-Corruption.

Client represents that it shall not, and shall not permit any of its subsidiaries or affiliates or any of its or their respective directors, officers, managers, employees, independent contractors, representatives or agents, to engage in any activity, practice or conduct which would constitute an offence under ethics, anti-bribery and anti-corruption applicable laws and regulations including without limitation the OECD Convention, the US Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act 2010 (Bribery Act). Client has not received or been offered any illegal or improper bribe, kickback, payment, gift, or thing of value from any of Inpart employees or agents in connection with this Agreement. Reasonable gifts and entertainment provided in the ordinary course of business do not violate the above restriction. If Client learns of any violation of the above restriction, Client will use reasonable efforts to promptly notify Inpart.

12.5. Entire Agreement and Order of Precedence.

This Agreement is the entire agreement between Client and Inpart regarding Client use of Services and supersedes all prior and contemporaneous agreements, proposals or representations, written or oral, concerning its subject matter. The parties agree that any term or condition stated in Client purchase order or in any other of document issued by Client is void. In the event of any conflict or inconsistency among the following documents, the order of precedence shall be: (1) this Agreement, and (2) the Statement of Work.

12.6. Assignment.

Client may not assign, delegate, sublicense or otherwise transfer its rights or obligations under this Agreement without Inpart's prior written consent.

12.7. Relationship of the Parties.

The parties are independent contractors. This Agreement does not create a partnership, franchise, joint venture, agency, fiduciary or employment relationship between the parties.

12.8. Waiver and Modifications.

No failure or delay by either party in exercising any right under this Agreement will constitute a waiver of that right. Alterations or modifications of this Agreement will be valid only if made in writing signed by both parties.

12.9. Severability.

If any provision of this Agreement is held by a court of competent jurisdiction to be contrary to law, the provision will be deemed null and void, and the remaining provisions of this Agreement will remain in effect.

12.10. Notices and Manner of Giving Notice.

All notices permitted or required under this Agreement will be sent to the recipient party's address stated in this Agreement (as may be modified in writing). Except as otherwise specified in this Agreement, all notices, permissions and approvals hereunder shall be in writing and shall be deemed to have been given upon: (i) personal delivery, (ii) the second business day after mailing, (iii) the second business day after sending by confirmed facsimile, or (iv) the first business day after sending by email (provided email shall not be sufficient for notices of termination or a claim for indemnification). Billing-related notices to Client shall be addressed to the relevant billing contact designated by Client. All other notices to Client shall be addressed to the relevant Services system administrator designated by Client.

12.11. Electronic signature.

The Parties may authenticate their agreement with an electronic signature (also called e-signature) and deliver their agreement by electronic means which guarantee the signatory identification and the document integrity. A Party’s electronic signature shall be given the same legal force and effect as a handwritten signature for the purposes of validity, enforceability, and admissibility. Delivery of the agreement by electronic means constitutes valid and effective delivery.

12.12. Non-Solicitation.

During the term of this Agreement and for a period of one (1) year thereafter, Client will not solicit or hire for employment any employee or contractor of Inpart with whom Client has had contact in connection with the relationship arising under this Agreement.

12.13. Insurance.

Each party declares to be insured during the entire term of the Agreement with a reputable insurance company for all the financial consequences of its civil liability, or its professional operation, including: fire, tort due to personal injury, property damage and loss caused to the other party or any third by its employees in connection with the execution of this Agreement.

12.14. Contracting Parties; Governing Law; Venue.

Annex A – Statement of Work

Account Information

The Statement of Work (SoW) will be executed separately by the parties and is hereby incorporated into, and made part of, this Agreement by reference.

1. Purpose.

This SoW describes the Subscription as well as Professional Services purchased by Client. This includes subscription quantities, usage limits and term. It also addresses the implementation of the Inpart Plan for Client.

2. Subscription Services - Purchase Summary.

The following Subscription Services are subscribed to by Client.

Maintenance and Hosting are included in the Service Plan Subscription. Unless otherwise agreed by the Parties, the Subscription Services start at the Client’s signature date of this SoW.

3. Professional Services’ Scope.

The scope of the Professional Services is to have Inpart prepare and deploy the Plan for use by Client. To that end, each party will perform its responsibilities as further described herein

3.1. Inpart’s Responsibilities.

In consideration for Client’s provision of payments as set forth herein, Inpart agrees to perform all or parts of the Professional Services as listed below:

• Service set-up and implementation assistance to Client’s technical contact
• Provision of application’s initial configuration and design
• Provision of basic assistance to support Client to import historical data through Inpart’s standard import template
• Onboarding and training services (train the trainer approach)
• Regular in-app communication to all users regarding important product updates such as new features and functionality
• Provision of project management services

Inpart will make available qualified personnel necessary to fulfill its obligations hereunder. Inpart warrants that the services provided hereunder will be provided (i) in a professional, workmanlike manner in consistent with industry standards; (ii) in accordance with the standard of care customarily observed with regard to such services in Inpart’s field of expertise; (iii) in a timely manner; and (iv) in compliance with all applicable laws, rules, and regulations and (v) any other laws, rules, regulations and guidelines specified in the applicable SoW.

The relationship of Inpart to Client will be that of an independent contractor and neither this SoW nor the services to be rendered hereunder will for any purpose whatsoever (i) create an employer-employee relationship between Inpart or its employees or subcontractors and Client, or (ii) make Inpart an agent of Client.

3.2 Client’s Responsibilities.

Client agrees to perform the following responsibilities in accordance with Section 3.3:

• Provide a primary point of contact for coordination of the project plan and associated tasks
• Provide necessary information and data about its operating environment to allow Inpart to perform its responsibilities described herein
• Provide regular feedback on the product and overall experience with Inpart over the initial six weeks of use (e.g., three phone interviews with the primary point of contact and three in-app surveys to all end users of the platform). This is applicable to all participating companies in the Early Adopter Program.

3.3. Professional services - Purchase Summary.

The following professional services are purchased by Client and are to be provided by Inpart to Client on a case-by-case basis.

4. Payment Terms.

4.1 For Product Subscriptions: Inpart will invoice Client upon signature of this SoW. Invoiced fees and charges are due net, [Payment terms] from the invoice date.

4.2 For Professional services: Upon signature of this SoW, Inpart will submit an invoice for [Services invoicing details] of the fees listed above. Professional services will commence on the date specified above and subject to receipt of the payment.

Upon completion of work, Inpart will submit a valid invoice for the associated travel expenses to Client for payment.

Any additional services will be mutually agreed upon by both parties and will be covered under a separate statement of work or incorporated to the present statement of work by amendment. A day of professional services is defined as an 8-hour day.

5. Payment Information.

The table underneath must be completed

Client must include the following language on all purchase orders: “This purchase order is subject to the terms and conditions of the agreement between Client and Inpart SAS”

To purchase, please sign and return this SoW with purchase order or credit card information. Inpart’s wire transfer information will be transmitted with the Invoice from Inpart.

6. General.

This SoW is governed by the Agreement between Client and Inpart SAS and the terms and conditions set forth herein.

This SoW replaces all prior oral or written communications between the parties relating to the subject matter hereof. Both parties accept the terms of this SoW by signing below. Once signed, any reproduction of this SoW made by reliable means (for example, photocopy or facsimile) is considered an original, unless prohibited by local law. This SoW may only be modified by a writing signed by both parties. The effective date is the last date this SoW is signed by both parties.

IN WITNESS WHEREOF, each of the parties hereto has executed this Agreement by its duly authorized representatives.

Annex B – Data Processing Agreement

This data processing agreement (the “Data Processing Agreement”) has been entered into between

Inpart SAS
190-194 Rue Garibaldi, 69003 Lyon, France
SIRET 43444886600039
(the “Data Processor”)

and

[Client name and address]
(the “Data Controller”)

The Data Controller and the Data Processor are hereinafter collectively referred to as the “Parties” and individually as a “Party”.

WHEREAS, the Parties wish to conclude a data processing agreement which is compliant with the Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation), hereinafter referred to as the “GDPR”;

WHEREAS, the Data Controller has ensured a pre-audit of the Data Processor as set out in Article 28 (1) of the GDPR;

WHEREAS, personal data processed under the Master Agreement, including this Data Processing Agreement (“Personal Data”), shall have the meaning set out in the GDPR Article 4(1);

1. Scope of the Data Processing Agreement

1.1. During the term of this Data Processing Agreement, the Data Processor will process Personal Data on behalf of the Data Controller.

1.2. The Personal Data to be processed by the Data Processor concerns (i) the categories of data; (ii) the categories of data subjects; and (iii) the nature and purposes of the processing as set out in detail in the Data Processing Register.

2. Instructions

2.1. The Data Processor shall only process Personal Data in accordance with this Data Processing Agreement and only upon documented instructions from the Data Controller, unless required to do so by applicable law to which the Data Processor is subject. In such cases, the Data Processor shall inform the Data Controller of such legal requirement prior to processing, unless such law prohibits this on grounds of public interest.

2.2. The Data Processor is instructed to process Personal Data only for the purposes of providing the services described in the documented instructions and as further specified in the Register maintained by the Data Processor. The Data Processor will not process or otherwise use the Data Controller’s Personal Data for any other purpose, including but not limited to training, fine-tuning, or improving any internal or third-party artificial intelligence or machine learning model.

2.3. The Data Processor shall ensure that all its employees, contractors, and other persons authorized to process Personal Data under this Agreement are bound by appropriate confidentiality obligations and have received adequate training in data protection requirements. The Data Processor shall be responsible for ensuring the compliance of all such persons.

2.4. If the Data processor considers that any instruction received from the Data Controller infringes the GDPR or other Union or Member State data protection provisions (hereinafter collectively the “Data Protection Legislation”), the Data Processor shall immediately notify the Data Controller in writing. The Data Processor shall not be obliged to follow an instruction it reasonably considers to be unlawful, pending written clarification from the Data Controller.

3. Location and Transfer of Personal Data outside the EU/EEA

3.1. The Data Processor shall process Personal Data within the European Union/European Economic Area (“EU/EEA”) as a default. Where Personal Data is transferred to a third country or international organisation outside the EU/EEA, such transfers shall only take place in accordance with the conditions set out in Chapter V of the GDPR and this Clause 3.

3.2. The Data Controller hereby grants general authorisation for the Data Processor to transfer Personal Data to the Sub-Processors listed in Clause 6.6 of this Agreement, where such Sub-Processors are located outside the EU/EEA or process Personal Data in third countries. Such transfers are subject to appropriate safeguards as set out in Clause 3.3, and the Data Processor warrants that all such transfers are conducted in compliance with applicable Data Protection Legislation.

3.3. Where Personal Data is transferred outside the EU/EEA, the Data Processor shall ensure that at least one of the following safeguards is in place:

(i) the transfer is to a country recognised by the European Commission as providing an adequate level of protection pursuant to Article 45 of the GDPR; or

(ii) the transfer is governed by Standard Contractual Clauses ("SCCs") adopted or approved by the European Commission pursuant to Article 46(2) of the GDPR, copies of which are available to the Data Controller upon request; or

(iii) another appropriate safeguard permitted under Article 46 of the GDPR is in place and documented.

3.4. The Data Processor shall notify the Data Controller in writing if it intends to add a new Sub-Processor whose processing activities involve transfers of Personal Data outside the EU/EEA, in accordance with the sub-processor notification procedure set out in Clause 6. The Data Controller retains the right to object to such transfers in accordance with Clause 6.

3.5. If the Data Processor is required by Union or Member State law to transfer Personal Data outside the EU/EEA, the Data Processor shall inform the Data Controller of that legal requirement before the transfer is made, unless such law prohibits disclosure on grounds of public interest.

3.6. The Data Processor shall maintain records of all third-country transfers, including the legal basis and safeguards applied, and shall make such records available to the Data Controller upon request.

4. Security Obligations

4.1. The Data Processor shall implement and maintain appropriate technical and organizational security measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, and against all other unlawful forms of processing. Such measures shall take into account: (a) the state of the art; (b) the costs of implementation; and (c) the nature, scope, context, and purposes of processing, as well as the risks to the rights and freedoms of natural persons.

4.2. The technical and organizational measures maintained by the Data Processor shall cover, as a minimum, the following areas: access control and authentication; encryption of Personal Data at rest and in transit; network and cloud platform security; endpoint and device security; vulnerability management and secure software development; security monitoring and incident response; backup, recovery, and business continuity; physical and environmental security; staff security training and confidentiality obligations; supplier security management; and secure disposal of data and equipment.

4.3. The Data Processor's current technical and organizational security measures are described in its Security Assurance Plan ("SAP"). The Data Processor shall maintain the SAP and update it to reflect any material changes to its security practices. The most current version of the SAP shall be made available to the Data Controller upon request.

4.4. The Data Processor operates an ISMS certified to ISO 27001, covering the Inpart Cloud Solution Development and Operation scope. The Data Processor commits to maintaining this certification and to continual improvement of its security posture through regular risk assessments, internal audits, and management reviews.

4.5. The Data Processor shall perform its obligations under this Agreement with the level of skill, diligence, and competence expected of an experienced and certified data processor operating in the SaaS sector, and as a minimum in compliance with applicable Data Protection Legislation and recognized industry standards.

5. Audit and Assistance

5.1. The Data Processor shall maintain, and make available to the Data Controller upon request, up-to-date documentation of its information security certifications. Where additional certifications are obtained by the Data Processor, these shall similarly be made available to the Data Controller upon request. The Data Controller acknowledges that such certifications constitute sufficient evidence of the Data Processor’s compliance with its security obligations under Clause 4, unless the Data Controller has reasonable and specific grounds to request further information.

5.2. Notwithstanding Clause 5.1, the Data Controller, or an independent expert appointed by the Data Controller at the Data Controller’s cost, may request an audit or inspection of the Data Processor’s relevant systems, processes and documentation, provided that: (i) prior written notice of thirty (30) days is given to the Data Processor; (ii) audits are conducted during normal business hours and in a manner that minimizes disruption to the Data Processor’s operations; (iii) audits are conducted no more than once per calendar year; and (iv) where an existing certification or audit report already covers the scope of the requested audit, the Data Controller shall accept such documentation in lieu of a separate audit, unless it can demonstrate that the documentation does not adequately address its specific concerns. The Data Processor may require any appointed independent expert to sign a customary non-disclosure agreement prior to the audit.

5.3. The Data Processor shall upon request provide the Data Controller with sufficient information to enable the Data Controller to verify the Data Processor’s compliance with the obligations laid down in Article 28 of the GDPR and this Data Processing Agreement, including the appropriate technical and organizational security measures, cf. Clause 4.

5.4. The Data Processor will immediately notify the Data Controller in writing about:

(i) any request for disclosure of Personal Data processed under the Data Processing Agreement by authorities, unless such notice is expressly prohibited under Union or Member State law; and

(ii) any request from a data subject which the Data Processor receives directly from the data subject.

5.5. The Data Processor must promptly assist the Data Controller with the handling of any requests from data subjects under Chapter III of the GDPR, including requests for access, rectification, blocking and/or deletion. The Data Processor must also assist the Data Controller by implementing appropriate technical and organizational measures for the fulfilment of the Data Controller's obligation to respond to such requests.

5.6. Taking into account the nature of processing and the information available to the Data Processor, the Data Processor must assist the Data Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, i.e. with regard to security measures, notification of supervisory authorities, notification of individuals, preparation of data protection impact assessments and prior consultation with supervisory authorities.

6. Use of Sub-Processors

6.1. The Data Processor shall not engage another data processor (hereinafter the “Sub-Processor(s)”) for the processing of Personal Data under this Data Processing Agreement without prior, written and specific approval of the Data Controller.

6.2. The Data Processor must inform the Data Controller in writing of any discontinued use of a Sub-Processor.

6.3. Prior to the Data Processor engaging a Sub-Processor to carry out specific processing activities covered by this Data Processing Agreement, the Data Processor must ensure a pre-audit as set out in GDPR Article 28(1) and conclude a written data processing agreement with the Sub-Processor (hereinafter the “Sub-Processor Agreement”).

6.4. The Sub-Processor Agreement shall at least impose the same obligations on the Sub-Processor as those set out in this Data Processing Agreement, including an obligation to implement appropriate technical and organizational security measures in such a manner that the processing will comply with the requirements of the Data Protection Legislation. The Data Controller has the right to receive documentation relating to pre-audit as well as a copy of the Sub-Processor Agreement as regards the provisions related to data protection obligations.

6.5. The use of any Sub-Processor by the Data Processor shall not relieve or release the Data Processor from any of its obligations under this Data Processing Agreement and the Data Processor shall remain fully liable for the performance of any Sub-Processor’s obligations.

6.6. Below is a list of Sub-Processors currently in use by the Data Processor, their locations, and respective processing activities:

7. Artificial Intelligence

7.1. The Data Processor may integrate artificial intelligence (“AI”) capabilities into the services provided under this Agreement. Any such AI capabilities are subject to the Data Processor's Secure Software Development Lifecycle (S-SDLC), including a dedicated security assessment prior to production deployment, and are managed in accordance with the Data Processor's Information Security Management System (ISMS).

7.2. AI features are disabled by default for all customer tenants. No AI capability is activated in respect of the Data Controller's Personal Data without an explicit request from the Data Controller, followed by deliberate enablement by the Data Processor. Each AI feature is individually toggled — activation of one feature does not imply or result in the activation of any other. No Personal Data is transmitted to any AI inference service until the relevant feature has been explicitly enabled for the Data Controller's tenant.

7.3. All AI processing is performed within the EU/EEA, through a model provider integrated within the Data Processor's AWS infrastructure. No Personal Data is transferred outside the EU/EEA in connection with AI processing, unless separately authorized in accordance with Clause 3 of this Agreement.

7.4. The Data Processor warrants that:

(i) Personal Data processed through AI capabilities is not used to train, fine-tune, or improve any AI model, whether operated by the Data Processor or any third-party AI service provider;

(ii) data submitted to the AI inference service is not shared with any third party beyond what is necessary for delivery of the contracted service; and

iii) AI processing is scoped exclusively to the delivery of features explicitly activated by the Data Controller under Clause 7.2.

These warranties are underpinned by contractual guarantees obtained by the Data Processor from its AI service provider, which are reviewed as part of the Data Processor's annual supplier security assessment process.

7.5. The Data Processor shall ensure that no AI component makes autonomous decisions with material business or legal impact on data subjects without human review by an accountable owner within the Data Processor's organisation. Where AI-generated outputs inform user-facing decisions, these are subject to human oversight prior to any consequential action being taken.

7.6. Where any processing under this Agreement involves automated decision-making that produces legal or similarly significant effects on data subjects within the meaning of Article 22 of the GDPR, the Data Processor shall notify the Data Controller in writing prior to implementing such processing. The Data Processor shall not proceed with such processing without the Data Controller's explicit written authorization and shall provide sufficient information for the Data Controller to fulfil its own obligations under Article 22.

7.7. Data Processor shall maintain logs of AI feature activity for a minimum period of three (3) months. Such logs shall include the input prompt and any context variables, the AI-generated output, the AI model and version used, a timestamp, the calling user or process, and the tenant identifier. Logs shall be stored in immutable, encrypted storage and shall be made available to the Data Controller upon request for support, audit, or incident response purposes.

7.8. AI service providers engaged by the Data Processor in connection with the services are treated as sub-processors for the purposes of this Agreement and are subject to Clause 6, including registration in the Data Processor's sub-processor list and compliance with the Data Processor's supplier security assessment process.

7.9. The Data Processor shall monitor applicable regulatory developments in relation to AI, including the EU AI Act, and shall update its practices and, where material, this Agreement, as relevant obligations come into force. The Data Processor shall notify the Data Controller of any material changes to its AI practices that affect the processing of Personal Data under this Agreement.

8. Confidentiality

8.1. The Data Processor shall keep all Personal Data confidential.

8.2. The Data Processor warrants that its personnel (and the personnel of any authorized Sub-Processor and/or other authorized persons) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality as regards the Personal Data covered by this Data Processing Agreement.

8.3. The Data Processor must limit the access to Personal Data to employees (and/or other authorized persons) for whom access to said data is necessary to fulfil the Data Processor’s obligations towards the Data Controller.

8.4. The Data Processor shall not make any copies of the Personal Data or disclose the Personal Data to third parties unless this is strictly required for the performance of the Data Processor’s obligations towards the Data Controller according to this Data Processing Agreement.

8.5. The obligations of the Data Processor under this Clause 8 persist without time limitation and regardless of whether the cooperation between the Parties has been terminated (for whatever reason).

9. Personal Data Breach

9.1. The Data Processor shall inform the Data Controller immediately and no later than thirty-six (36) hours after having become aware of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed under this Data Processing Agreement (“Personal Data Breach”).

9.2. In case of other substantive disruptions of the normal course of operations or failure to comply with the Data Processor's obligations under Clause 4 of this Data Processing Agreement, the Data Processor must inform the Data Controller hereof immediately.

9.3. The Data Processor shall be obliged to provide the Data Controller with any and all information necessary for the Data Controller to comply with its obligations pursuant to the Data Protection Legislation, including (i) a description of the nature of the Personal Data Breach, (ii) the categories and approximate number of data subjects concerned, (iii) the categories and approximate number of Personal Data records concerned, and

9.4. (iv) information about any initiatives to safeguard against future Personal Data Breaches.

10. Indemnification

10.1. In accordance with the Parties liability under the Master Agreement, the Data Processor agrees to indemnify and hold harmless the Data Controller against all claims and proceedings and all liability, loss, fines, costs and expenses incurred by the Data Controller as a result of violation of this Data Processing Agreement (or the Data Protection Legislation) by the Data Processor, its employees, subcontractors (including Sub-Processors) in the course of the Data Processor’s processing of Personal Data under this Data Processing Agreement.

11. Term and Termination

11.1. This Data Processing Agreement shall enter into force on the date of the last signature and shall remain in force until the termination of the Master Service Agreement.

11.2. Irrespective of the formal term of the Master Service Agreement and this Data Processing Agreement, this Data Processing Agreement continues to apply for as long as the Data Processor processes Personal Data, also if such processing takes place after termination of this Data Processing Agreement.

11.3. After the end of the provision of services relating to processing of Personal Data under this Data Processing Agreement, and on request of the Data Controller, the Data Processor shall immediately (i) delete all the Personal Data; or (ii) return all Personal Data to the Data Controller (or another data processor if so requested by the Data Controller). The Data Processor shall, however, be entitled to retain the Data Controller’s Personal Data (or parts of the Personal Data) to the extent Union or Member State law requires the Data Processor’s continued storage of such Personal Data. If the Data Processor is obligated to retain the Data Controller’s Personal Data on the basis of applicable legislation in third countries, the Data Processor must notify the Data Controller thereof, including provision of a reference to the legal grounds for continued storage. The Data Controller may object to the continued storage of the Personal Data and if the objection is well founded, the Data Processor must comply with the instruction of the Data Controller.

11.4. For the avoidance of doubt, the Data Processor is not entitled to condition the full and unlimited compliance with the Data Controller’s instructions under this Data Processing Agreement on payment of outstanding invoices etc., and the Data Processor has no right of retention over the Data Controller’s Personal Data.

12. Amendments and Assignment

12.1. The Parties may at any time agree to amend this Data Processing Agreement. Amendments must be in writing, including in electronic form, and signed by both Parties.

12.2. Unless specifically regulated in this Data Processing Agreement, the Data Processor may not assign or transfer any of its rights or obligations arising from this Data Processing Agreement without the prior, written consent of the Data Controller.

13. Miscellaneous

13.1. If the Data Processor is subject to data protection legislation of a third country, the Data Processor declares that, to the best of his knowledge, nothing in the said legislation prevents the Data Processor from fulfilling this Data Processing Agreement, and that the Data Processor will notify the Data Controller in writing without undue delay if the Data Processor becomes aware of any such hindrance is present or will occur.

13.2. The Data Processor must immediately notify the Data Controller in writing regarding events, which significantly and adversely impacts the Data Processors current or future ability to perform the data processing in accordance with this Data Processing Agreement.

13.3. If any of the provisions of this Data Processing Agreement conflict with the provisions of any other written or oral agreement concluded between the Parties, then the provisions of this Data Processing Agreement shall prevail in all matters concerning processing of Personal Data.

13.4. Each Party shall obtain (and maintain throughout the term of this Data Processing Agreement) all necessary registrations or notifications which such Party is obligated to obtain and maintain pursuant to the Data Protection Legislation or other data protection legislation of a third country.

Signatures

Each Party warrants that it has the authority to enter into this Data Processing Agreement.

Annex C – Service Level Agreement

This Inpart Service Level Agreement (“SLA”) describes the service level policies under which Inpart provides the Services to Client.

1. Service Availability

Access to the Services is granted via a URL address on the Internet (Software as a Service).

Inpart shall use commercially reasonable efforts to ensure that the Services achieve a quarterly Availability target of 99.5%, twenty-four (24) hours a day, seven (7) days a week (including holidays), excluding Excusable Downtime.

Inpart is free at any time to modify configurations and IP addresses of its servers without notifying the Client in so far as access via the URL is maintained and that the quality of the Services is not altered. The Client shall not configure (in its local network or otherwise) any rules which may prevent Inpart’s capacity to modify its IP addresses.

1.1. Excusable Downtime

Excusable Downtime means any period of Downtime that is excluded from the Availability calculation, including but not limited to the following events:

Scheduled Maintenance

Each month, the Services may be temporarily unavailable to perform Maintenance (software updates, security patches, etc.). Inpart shall use its best efforts to notify Client in advance via electronic notice (e-mail or in-app notification), and within twenty-four (24) hours for any emergency downtime. To the extent practicable, Inpart will use its best efforts to schedule planned downtime during weekend hours or other low-usage periods.

Emergency Updates

Inpart may perform emergency updates to address security, privacy, legal, regulatory, or third-party hardware or software issues without prior notice. In such cases, Inpart will notify Client as soon as reasonably practicable.

Client-Side Issues

The Service is unavailable due to: (a) Client’s or a third party’s software, network, links, products, services, widgets, apps, integrations, hardware or other equipment; or (b) Client’s use of the service in violation of, or in a manner not authorized by the Agreement.

Third-Party and Network Unavailability

Unavailability arising from: (a) third-party APIs; (b) add-ons, apps, widgets or third-party services integrated or otherwise interfaced with the Inpart Services, whether developed by Inpart or a third party; (c) interruptions of service on the hosted services provider side, and (d) any products or features identified as trial, pre-release, release candidate, beta, or similar.

Force Majeure

Unavailability caused by any act, event, or incident beyond Inpart’s reasonable control, including but not limited to: catastrophic storms, floods, lightning, earthquakes, acts of God, government acts, insurrection, war, national or internal strikes, explosions, nuclear incidents, fire, global pandemics, and general unavailability of telecommunications or internet services (including DDoS attacks).

1.2. Availability Calculation

Availability percentage is determined as follows:

[Total minutes accessible to Client + Excusable Downtime]
[Total minutes in each quarter] x 100

2. Support Services

Standard Support is included in all active Subscriptions at no additional charge. It provides access to Inpart's support resources during normal business hours and covers the activities set out below.

Standard Support applies uniformly to all Subscribers. Support priority levels — including emergency response — are determined solely by the severity and business impact of the incident, not by any commercial tier or additional services contracted. No named or dedicated point of contact is included in the Subscription.

2.1 Incident Management

Clients submit issues through Inpart's designated support portal. Issues are routed to a pool of technical support analysts with expertise in Inpart products and services. Inpart must be able to reproduce a reported issue in order to attempt resolution. Client agrees to cooperate and conduct diagnostic or troubleshooting activities as reasonably requested by Inpart. Subject to Client approval on a case-by-case basis, Users may be asked to grant Inpart access to their accounts for troubleshooting purposes.

2.2 Bug Fixes and Platform Updates

Correction of software defects identified in production and reproducible by Inpart. Platform updates and feature enhancements are included in the Subscription and will be compatible with previous versions, except for custom interfaces or configurations delivered under Professional Services. New features are provided at no additional charge to Clients current on their Subscription fees.

2.3 Knowledge Base and Self-Service Resources

Access to the Inpart Help Centre, including documentation, FAQs, tutorial videos, and user guides.

In-app product update notifications and release notes. Regular in-app communications to all users regarding important product updates, including new features and functionality.

2.4 Performance Monitoring and Data Backup

Inpart conducts ongoing performance monitoring for platform stability purposes. Backup and recovery mechanisms are maintained in accordance with Inpart's Security Assurance Plan.

2.5 Onboarding

Standard onboarding is included in the Subscription and follows a train-the-trainer model.

Standard onboarding does not cover Client's failure to anticipate certificate requirements or other internal configuration issues. Any onboarding support beyond what is described here will be subject to additional charges at Inpart's discretion.

2.6 Support Request Priority Levels

All support requests must be submitted through Inpart's designated support channels.

Support request types

Support requests are classified according to the following types. The type of request does not determine priority; priority is assessed independently based on business impact as described in section "Priority framework".

Priority Framework

The priority level assigned to each support request reflects its overall business impact, as assessed by Inpart's support team at the time of submission.

Priority is determined by consideration of the following factors: the number of users affected; the criticality of the affected roles or functions to business operations; the impact on core system functionality; the presence of operational blockers preventing normal business activity; and the time-sensitivity of the resolution. Priority classification is made by Inpart's support team in accordance with the framework set out below.

Improvement requests are governed separately and are not subject to the priority levels below. They are addressed through Inpart's product roadmap process.

Service level commitments

The following priority framework governs Inpart's response and resolution obligations for all Clients:

Initial Response means the period between the time an issue is reported in full and the time an initial acknowledgement is published either on Inpart's system status page (status.inpart.io) or within the Client's open ticket.

Inpart reserves the right to reclassify priority levels at any time where the initial classification was incorrect or where the business impact of the issue changes.

3. Professional Services

The following services are not included in the Subscription and shall only be provided under a separately executed Statement of Work. No Professional Services will commence prior to execution of the relevant SOW and receipt of applicable fees. Professional services are charged on a per-day basis at Inpart’s applicable daily rate, unless otherwise agreed in writing. A day of Professional Services is defined as eight (8) hours.

Dedicated Customer Success Manager

• Acts as an advocate and primary point of contact for Client within Inpart
• Periodic review meetings on usage, adoption and outcome.
• Communication of product updates, new feature releases, and roadmap information.
• Coordination with Inpart Support, Technical Services, and Product teams on issue follow-up and enhancement discussions, as applicable.
• Participation in customer satisfaction or service feedback initiatives.
• Guidance on change management, stakeholder engagement, and adoption strategies.
• Set up of success metrics definition and progress tracking
• Delivery of short enablement or refresher sessions to promote effective platform use

Platform Configuration and Data Services

• Reconfiguration of the platform setup, workflows, permissions, or integrations after go-live.
• Data import, migration, or batch updates beyond standard platform functionality.
• Creation or customisation of dashboards, reports, or data visualisations.

Process Optimisation and Change Enablement

• Business process review, redesign, or optimisation workshops, based on industry standards and product usage insights and expertise.
• Development of tailored change management plans, training programs, or documentation.
• Dedicated consulting support for complex internal process transformation projects.

Specialist and Extended Engagements

• On-site or multi-day sessions requiring dedicated Inpart resources.
• Cross-functional workshops involving Inpart Product, Engineering, or multiple Client teams.
• Any custom development, scripting, or technical implementation beyond standard platform capabilities.
• Extended information security requirements not covered by Inpart's standard Security Assurance Plan, including dedicated security reporting or bespoke security review meetings.

4. Procurement of Professional Services

Professional Services are only available following receipt of a written quote from Inpart and execution of a Statement of Work. No Professional Services will be provided on the basis of a verbal commitment or a Client purchase order alone. Any additional services agreed during an active engagement will be incorporated by written amendment to the existing SOW.

5. Service Level Credits

If Client believes that Inpart has failed to meet the Availability target for a particular quarter and wishes to claim a Service Credit, Client must notify Inpart within ten (10) business days following the end of the relevant quarter. The notification must include the dates and times of unavailability and any supporting documentation.

Service Credits are the exclusive remedy for Inpart's failure to meet its Availability obligations. No other damages, including breach of warranty claims, may be claimed in connection with Availability failures.

This SLA does not apply where the unavailability arises from Client’s breach of its obligations under the Agreement, including in cases of payment default.

6. Hardware and System Requirements

Client is solely responsible for acquiring, servicing, maintaining, and updating all equipment, computers, software, and communications services (including a professional-grade internet connection) not owned or operated by or on behalf of Inpart, and for all associated costs and applicable taxes.

Client agrees to access and use the Services in accordance with all operating instructions or procedures issued by Inpart from time to time. Inpart does not make any commitments regarding use or performance of the Services with browsers other than those currently supported under Inpart's product requirements documentation.

Client acknowledges that the availability and performance of the systems used to access the Services — including public telephone networks, computer networks, and the internet — may be unpredictable and may from time to time interfere with or prevent access to and use of the Services. Inpart is not liable for any such interference or prevention.

7. Updates to this SLA

Inpart may update this Service Level Agreement at any time. Where any change would materially and adversely decrease the level of service, Inpart shall notify Client at least five (5) days in advance by posting an announcement on Inpart's system status page, via the Service, and/or by email.

8. Roles and Responsibilities

The following table sets out the primary responsibilities of each party and each Inpart function in the context of this SLA:

Annex D – Inpart Deal Platform Description

General Description.

Inpart Deal is a partnering platform designed for biopharma companies to initiate, track, and manage in-licensing, out-licensing, research collaboration, and investment deals. It centralizes partnering data, drives dealmaking efficiency and alliance operational success, and enables quick and insightful reporting.

Platform Description.

Client subscribes to Inpart Deal through an annual Subscription. The platform includes but is not limited to the following features and functionality:

• Modern and intuitive user interface for ease of use and simplicity.
• CRM-like functionality for creating, managing, and storing companies, contacts, meetings, opportunities, agreements, obligations, and alliances information.
• Quick and advanced search.
• Reporting capabilities: Import or export data, in-app dashboards, one-pager reports, and integration to Power BI to track and monitor progress with data-driven decisions.
• Strategic initiatives to clearly communicate company goals and align teams and their work around these goals.
• Integrations with third-party pipeline databases, like Cortellis, Pharmaprojects, and Evaluate Pharma to streamline data entry with autofill, reduce duplicates, and allow continuous data enrichment.
• Different opportunity types with customizable default workflows designed for out-licensing, in-licensing, research collaboration, and investment deals.
• Best practice opportunity templates for different types of use cases such as pharma assets, technology, consumer health assets, or a company that the organization is interested in partnering with. With possibility to customize fields, make them mandatory, and create personalized layout for clean and easy data entry.
• Evaluation management, including best practice evaluation templates for quick assessments, and built-in survey tool for due diligence and other standard evaluations.
• Monitoring of the life cycle of agreements and alliances with amendments, obligations, milestones, legal clauses, risk and issue, and health check management tools.
• Different levels of access control to data within the platform to increase security and data confidentiality.
• Document storage with customizable folder structure for important documents, emails, and publications with the ability to quickly drag and drop these files, or import them directly from our Outlook add-in.
• Collaboration capabilities between users via comments, user tagging, evaluations with teams, task management, status update and next steps, email notifications, and reminders.
• Admin center for user management to control user access and permissions to data and features with different role types and user groups with defined group rules.
• Mobile access through any Internet-enabled phone, tablet, or computer.
• Standard integration with Outlook, Office Suite, and Inpart ecosystem of products.
• Access to update activity history for opportunities, agreements, alliances, companies, and contacts, as well as full history and audit logs.
• Support services.

Inpart may add more capabilities over time to leverage any suggestion, enhancement request, recommendation, correction, or other feedback provided by Client or Users relating to the operation of the Platform.

“Hosting”: Inpart’s selection of its hosting partner is done with high level of requirement based on: the best-in-class facilities, the level of certification, the geographical situation, the security culture and a strong legal environment.

Annex E – Artificial Intelligence Features

This Annex sets out the commercial terms governing Inpart's provision of artificial intelligence features as part of the Services (the "AI Features"). Data protection obligations relating to AI processing, including activation controls, data residency, processor warranties, sub-processor management, logging, human oversight, and regulatory compliance are governed exclusively by the Data Processing Agreement executed between the Parties. Capitalized terms not otherwise defined herein shall have the meaning ascribed to them in the Agreement.

1. Availability and Changes to AI Features

1.1. AI Features are made available as part of the Services on an opt-in basis. Inpart reserves the right to introduce new AI Features, modify existing AI Features, or discontinue AI Features, in each case with reasonable prior written notice to Client.

1.2. Where a modification to an AI Feature would materially affect the Services delivered to Client, Inpart shall provide no less than thirty (30) days' prior written notice. Client may, within that notice period, raise any objection in writing, and the Parties shall discuss in good faith.

2. Risk Management

2.1. AI-specific risks are identified, assessed, and managed as part of Inpart's formal risk management framework and reviewed as part of its ISMS governance cycle. Further details of Inpart's security practices in relation to AI are set out in the Security Assurance Plan, available to Client upon request.

3. Precedence

3.1. In the event of any conflict between this Annex and the body of the Agreement with respect to AI Features, this Annex shall prevail. In the event of any conflict between this Annex and the Data Processing Agreement with respect to the processing of Personal Data in connection with AI Features, the Data Processing Agreement shall prevail.