MASTER TERMS AND CONDITIONS

Sirius Office Solutions (“Supplier”) provides a range of services including managed services and professional services and resells various cloud services including Microsoft cloud services, in accordance with these terms and conditions and the applicable ‘Associated Agreement’. The Supplier may amend or replace these terms and conditions on one month’s written notice to the Customer at any time (for existing Contracts the terms and conditions in place at the time that the Contract was made continue to apply for that Contract, unless the Customer agrees otherwise in writing). By ordering services such as managed services, professional services and/or cloud services from the Supplier, the Customer accepts the terms and conditions that apply at that time. Any additional or different terms that the Customer includes in any communication with the Supplier will not be binding on the Supplier or included in any Contract unless expressly agreed upon in writing by the Supplier.

1 Definitions and interpretation

1.1 In these terms and conditions:

“Associated Agreement” means:

(a) any agreement or statement of work or statement of supply that is entered into between the parties which is made pursuant to these terms and conditions (for example by referencing that it is made under these Master Terms and Conditions) and may include by way of example only a ‘Managed Services Agreement’ or ‘Statement of Work – Managed Services’, and/or ‘Cloud Supply Agreement’ or ‘Statement of Supply – Cloud Supply’; and

(b) any additional terms and conditions (including by way of example only the ‘Professional Services Terms and Conditions’) together with:

i. the relevant order, proposal, statement of work or other document that is accepted and agreed by the Customer in the manner required under those additional terms and conditions; or

ii. a request by the Customer of a type which is anticipated and not out of scope in any way under those terms and conditions and which is accepted by the Supplier in the manner required under those additional terms and conditions (including a request that is not required to be in writing where applicable under those additional terms and conditions, such as a request that is a “Small Task” under the Professional Services Terms and Conditions),,

which are expressed as being made pursuant to these Master Terms and Conditions.

“Confidential Information” means any information disclosed in confidence to one party by the other party including without limitation the Customer Data, whether of a business, financial, technical or non-technical nature or otherwise and whether existing in hard copy form, electronically or otherwise but does not include any information which is:

(a) on receipt by the recipient party, in the public domain or which subsequently enters the public domain without any breach of the Contract;

(b) on receipt by the recipient party, already known by that party (otherwise than as a result of disclosure by the other party);

(c) at any time after the date of receipt by the recipient party, received in good faith by the recipient party from a third party;

(d) required by law to be disclosed by the recipient party;

“Contract” means these terms and conditions and the attached Data Protection Addendum, and the relevant Associated Agreement;

“Customer Data” means the Customer’s data including all text, sound, video or image files and the Customer’s software and includes Personal Data;

“Data Protection Laws” means any and all laws relating to Personal Data (including data security, protection, privacy or the processing of Personal Data), and includes any statutory modification or re-enactment of such laws for the time being in force;

“Force Majeure Event” means any war, riot, third party strike, pandemic, civil emergency, natural disaster or other circumstance of a similar nature that is outside of the control of the affected party;

“Intellectual Property” means copyright, patents, designs, trademarks, trade names, goodwill rights, trade secrets, confidential information and any other intellectual proprietary right or form of intellectual property;

“Personal Data” means any information:

i) relating to an identified or identifiable individual;

ii) that is ‘personal information’, ‘personal data’, or similar terms under applicable Data Protection Laws; or

iii) linked to, associated with, or combined with information identified in (a) or (b) above;

“Personal Data Breach” means unauthorised access to, unauthorised disclosure of, or loss of, Personal Data (being Personal Data that is Processed by the Supplier under a Contract, or any equivalent definition in relevant Data Protection Laws;

“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, and ‘Process’ and ‘Processed’ has/have a corresponding meaning, or any equivalent definition in relevant Data Protection Laws;

“Products, Deliverables and Services” means the products, deliverables and/or services provided under an Associated Agreement, as described in the relevant Associated Agreement;

“Working Day” means a day other than a Saturday, Sunday or public holiday in Arizona.

1.2 Interpretation

(a) In these terms and conditions, reference to the plural includes reference to the singular, and vice versa.

(b) Headings inserted in these terms and conditions are for convenience of reference only and do not affect the interpretation of these terms and conditions.

2 Term

2.1 Each Contract will commence on the date specified in the relevant Associated Agreement or if not specified will commence on the date that the Associated Agreement is signed by both parties or, where signing by both parties is not required, on the date that the Customer accepts in writing or signs the relevant Associated Agreement (as applicable).

2.2 Each Contract will, subject to the parties’ rights of earlier termination, continue:

(a) for the term specified in the relevant Associated Agreement; or

(b) if no term is specified, until terminated in accordance with the relevant Associated Agreement or under the termination provisions in these terms and conditions.

3 Order of precedence

3.1 If there is any conflict or inconsistency between these terms and conditions and an Associated Agreement, the following order of precedence applies to the extent of that conflict or inconsistency (listed below in order of high to low priority):

(a) each Associated Agreement (with the order of priority of the parts of each Associated Agreement being as described in the relevant Associated Agreement);

(b) these terms and conditions.

4 Products, Deliverables and Services

4.1 The Suppler will provide Products, Deliverables and Services (as applicable) to the Customer:

(a) in accordance with each Associated Agreement;

(b) using reasonable care and skill;

(c) using people who have the necessary skills and experience; and

(d) in accordance with all applicable laws.

4.2 If the Customer requests services which are not covered by an existing Associated Agreement, the Supplier will issue a draft of the relevant Associated Agreement to the Customer for review and acceptance or signing (as applicable). Nothing in these terms and conditions commits the Supplier to providing products or services unless an applicable Associated Agreement is agreed and signed by both parties, or accepted by the Customer in writing or signed by the Customer (as applicable).

4.3 The Customer will:

(a) only use the Products, Deliverables and Services, for lawful purposes and not for fraudulent, illegal or destructive purposes;

(b) adhere to any specific requirements or restrictions in respect of the Products, Deliverables and Services included or referenced in an Associated Agreement;

(c) not sell, re-sell, or otherwise provide the Products, Deliverables and Services to any third party unless such selling, re-selling, or provision is expressly permitted or anticipated in the relevant Associated Agreement;

(d) not allow the Products, Deliverables or Services to be affected by any virus or destructive media, or use the Products, Deliverables or Services in any way which is intended to be, or is, detrimental to:

iii. the use of those Products, Deliverables or Services by other customers of the Supplier or other users; or

iv. the systems utilized to provide the Products, Deliverables and Services.

5 Customer’s obligations

5.1 Without limiting the Customer’s obligations under any Associated Agreement, the Customer will:

(a) where required to provide data to the Supplier, provide that data in a format suitable for import and otherwise as reasonably requested by the Supplier;

(b) where the Supplier’s personnel will work on site at the Customer’s premises, provide for the safety of the Supplier’s personnel while on site in accordance with all applicable health and safety legislation;

(c) meet all of the Customer’s obligations as specified in these terms and conditions and in each Associated Agreement;

(d) where applicable in light of the services provided under an Associated Agreement, undertake frequent and adequate backups of the Customer’s data, except and to the extent that the Supplier is providing relevant backup services under an Associated Agreement or under another written agreement between the parties. . The Customer should ensure that backups are always completed, as well as ensuring the backups are secure and checking that they can be successfully restored;

(e) make available to the Supplier in a timely manner (and in accordance with any timeframes which the Customer has agreed to) all assistance (including availability of relevant personnel), permissions (including permissions from any relevant third parties), information, facilities and access to systems reasonably required by the Supplier; and

(f) follow the Supplier’s reasonable directions.

6 Pricing and payment

6.1 Each Associated Agreement will specify the basis of the Supplier’s charges for the relevant supply of Products, Deliverables and Services and the Supplier will invoice the Customer accordingly. All amounts specified in an Associated Agreement are exclusive of any taxes unless expressly specified otherwise.

6.2 Unless otherwise specified in an Associated Agreement, all invoices issued by the Supplier are due for payment by the Customer on the 20th of the month following the date of the invoice.

6.3 All reasonable accommodation, travel and other expenses incurred in providing Products, Deliverables and Services to the Customer will be charged to the Customer provided that such expenses are identified and agreed in advance. Expenses will be invoiced on a monthly basis by the Supplier.

6.4 Subject to clause 6.5, the Customer must pay all invoices in full without set-off or deduction of any kind.

6.5 If the Customer wishes to dispute an invoice, it must notify the Supplier in writing within 15 days of the date of the invoice and provide details of the dispute. The Customer may withhold payment of the disputed part of an invoice only and must pay that part (or any amount subsequently agreed or determined to be the correct amount owing) promptly on resolution of the dispute.

6.6 Without limiting any other remedies available to the Supplier for late payment or failure to pay any amount due, if any amount due is not paid by the Customer by the due date, the Supplier may:

(a) charge the Customer interest calculated at 1.5% per month on the balance of the amount due by the Customer from the due date until payment is received in full by the Supplier; and/or

(b) charge the Customer all collection costs reasonably incurred by the Supplier in collection of the amount outstanding (including solicitor and/or collection agency fees); and/or

(c) on 5 Working Days’ notice in writing, suspend delivery of further Products, Deliverables and Services under the relevant Contract and/or any other Contract and/or may suspend delivery of services or deliverables under any other agreement between the Supplier and the Customer until the outstanding amount is paid in full.

6.7 Unless otherwise specified in the relevant Associated Agreement:

(a) the Supplier may increase its pricing from time to time but not more often than once every 12 months;

(b) the Supplier will give the Customer one month’s notice in writing of any price increase.

7 Taxes

7.1 In addition to the amounts due under clause 6, the Customer will pay the Supplier amounts equal to any applicable government taxes or duties however designated, based on the relevant Contract (or the Products, Deliverables and/or Services provided under it), paid or payable by the Supplier in respect of the foregoing, exclusive however of taxes based on the Supplier’s income.

8 Customer Data

8.1 Subject to clause 8.2, the Supplier will access the Customer Data only as required in the performance of the relevant Contract.

8.2 Without limiting clause 9 or clause 10.2, the Supplier will only access the Customer Data and disclose the Customer Data to law enforcement or government authorities to the extent required by law. If a request for Customer Data is made by a law enforcement agency or government authority (whether directly to the Supplier or through Microsoft or a third party vendor), the Supplier will redirect the request to the Customer or if redirection is not permitted or feasible in the available time frame and unless legally prohibited from doing so, the Supplier will notify the Customer of the request as soon as practically possible.

8.3 Nothing in a Contract transfers ownership of the Customer Data to the Supplier.

9 Personal Data and Data Protection

9.1 The Customer consents to the Processing of Personal Data by the Supplier for the purposes of each Contract in accordance with these terms and conditions including in particular the Data Protection Addendum. Before providing Personal Data to the Supplier, the Customer will obtain all required consents from third parties (including Customer’s contacts, partners, distributors, administrators, and employees) under applicable Data Protection Laws.

9.2 To the extent permitted by applicable law, Personal Data collected by the Supplier under a Contract may be transferred, stored and processed in the State(s) and/or country (or countries) in which the Supplier maintains facilities or any other country in which the Supplier’s contractors or service providers (including for example Microsoft and other third party vendors) maintain facilities.

9.3 In the event of any Personal Data Breach, the Supplier will comply with its obligations, including notification obligations, (if any), under applicable Data Protection Laws.

9.4 Where the CCPA (California Consumer Privacy Act) or similar US data protection laws in other States apply, the US Data Protection Addendum (attached) applies. Where the CCPA or similar data protection laws in other States do not apply, the US Data Protection Addendum may not be attached or if it is attached in any event does not apply.

10 Confidential Information

10.1 Each party agrees to:

(a) hold in confidence all Confidential Information disclosed to it by the other party and disclose that information to its directors, employees and contractors only to the extent required in the performance of the Contract;

(b) ensure that all Confidential Information is protected at all times from unauthorised access or use by, or disclosure to, any third party or misuse, damage or destruction by any person.

10.2 A party may disclose the other party’s Confidential Information if and to the extent required by law if it first notifies the other party of the obligation to disclose the Confidential Information, provided that a party is not required to notify the other party under this clause if it is not legally permitted to do so or if the timing within which the party is required by law to disclose the Confidential Information does not permit notification to the other party.

11 Intellectual property

11.1 The Supplier or its licensors own the Intellectual Property in the means, methods, processes and know-how used by the Supplier to provide the Products, Deliverables and Services and to otherwise perform the Supplier’s obligations under the Associated Agreements.

11.2 The provisions relating to Intellectual Property ownership in relation to particular Products, Deliverables and Services are included in the relevant Associated Agreement.

12 Warranties

12.1 Each party warrants that it has all requisite right, power and authority to enter into each Contract.

12.2 Except as provided under clause 12.1 and in any express warranties contained in an Associated Agreement, to the extent permitted by law, all warranties, terms and conditions (including without limitation, warranties and conditions as to fitness for purpose and merchantability) implied by legislation or otherwise, are excluded by the Supplier.

13 Termination of Contracts

13.1 Except where a Contract has a fixed term or where otherwise provided under a Contract, either party may terminate a Contract at any time without cause on giving thirty days’ notice in writing to the other party.

13.2 Either party may terminate a Contract immediately (or with effect from any later date that it may nominate) by written notice to the other party if:

(a) one or more Insolvency Events occurs in relation to that other party. For the purposes of this clause, ‘Insolvency Event’ means, in respect of a party (other than for the purpose of solvent reconstruction or amalgamation):

i. a receiver, manager or liquidator is appointed over the party’s undertaking or assets or the party enters into any assignment, composition or arrangement with its creditors; or

ii. the party is unable to pay its debts when due or is deemed unable to pay its debts under any law or suspends payment to its creditors.

(b) the other party commits a material breach of any of its obligations under the Contract and fails to remedy that breach within 30 days of prior written notice of such breach. For the purposes of this clause 13.2 (b), non-payment by the Customer for a period of 30 days or more after due date of any undisputed invoice constitutes a material breach by the Customer.

13.3 Additional rights of termination that apply to individual Associated Agreements may be included in each of those agreements.

14 Consequences of termination

14.1 On termination of a Contract, in addition to any other consequences of termination included in the relevant Associated Agreement, and unless otherwise agreed in writing in the relevant Associated Agreement, and without limiting either party’s rights or remedies:

(a) each party will, on request, return the other’s Confidential Information in its possession or control in respect of that Contract except for copies that it may be required to hold for compliance, audit or legal reasons;

(b) all amounts owed to the Supplier under the Contract which accrued before termination will be due and payable in accordance with the payment terms in that Contract;

(c) the Supplier will deliver to the Customer all Deliverables for which the Customer has paid in full.

14.2 On any termination of a Contract, all clauses which by their nature survive termination, will survive the termination.

15 Liability and indemnity

15.1 THE SUPPLIER’S LIABILITY UNDER A CONTRACT IS LIMITED TO DIRECT LOSS ONLY, TO THE AMOUNT PAID BY THE CUSTOMER UNDER THE RELEVANT CONTRACT IN THE 12 MONTH PERIOD PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

15.2 TO THE EXTENT PERMITTED BY LAW, IN NO EVENT IS THE SUPPLIER LIABLE FOR ANY INDIRECT LOSS OR FOR ANY LOSS OF PROFITS, LOST SAVINGS, LOSS OF DATA, BUSINESS INTERRUPTION, INCIDENTAL OR SPECIAL DAMAGES, OR FOR ANY CONSEQUENTIAL LOSS. IN ADDITION, THE SUPPLIER IS NOT LIABLE FOR ANY DAMAGES CLAIMED BY THE CUSTOMER BASED ON ANY THIRD PARTY CLAIM, INCLUDING, BUT NOT LIMITED TO, ANY CLAIM IN NEGLIGENCE. IN NO EVENT IS THE SUPPLIER LIABLE FOR ANY DAMAGES CAUSED (WHETHER DIRECTLY OR INDIRECTLY) BY THE CUSTOMER NOT ACCEPTING OR NOT ACTING ON A RECOMMENDATION MADE TO THE CUSTOMER IN WRITING BY THE SUPPLIER OR THE CUSTOMER’S FAILURE TO PERFORM ITS RESPONSIBILITIES UNDER THE CONTRACT.

15.3 THE CUSTOMER INDEMNIFIES THE SUPPLIER AGAINST ANY COSTS (INCLUDING LEGAL COSTS ON AN ATTORNEY AND OWN CLIENT BASIS, ALL AND ANY COURT COSTS AND WITNESS FEES AND RELATED LEGAL EXPENSES), EXPENSES, CLAIMS, DEMANDS OR LIABILITY WHETHER DIRECT, INDIRECT OR OTHERWISE, AND WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), EQUITY OR OTHERWISE, ARISING OUT OF, AND MUST AT THE SUPPLIER’S REQUEST, AND SUBJECT TO CLAUSE 15.4 AND ANY REASONABLE CONDITIONS IMPOSED AT THE SUPPLIER’S DISCRETION, AT THE CUSTOMER’S OWN COST DEFEND OR SETTLE, ANY CLAIM, ACTION OR PROCEEDINGS BROUGHT AGAINST THE SUPPLIER IN CONNECTION WITH:

(a) USE OF ANY PRODUCT OR SERVICE OTHERWISE THAN IN ACCORDANCE WITH THE RELEVANT CONTRACT; OR

(b) A BREACH BY THE CUSTOMER OF ANY CONTRACT.

15.4 If the Supplier wishes to rely on an indemnity under clause 15.3, the Supplier:

(a) must ensure that the Customer is notified promptly in writing of the relevant claim, action or proceedings (“Claim”) once it becomes aware of the Claim;

(b) will make no admission of liability regarding the Claim nor any offers of settlement regarding the Claim without the Customer’s written approval;

(c) may, at its discretion, grant control of the defence or settlement to the Customer;

(d) will, where the Supplier has granted control of the defence or settlement negotiations to the Customer:

i. co-operate reasonably with the Customer in defending or settling the Claim and make its employees available to give statements, advice and evidence, as the Customer may reasonably request, all at the expense of the Customer; and

ii. give the Customer sufficient authority and relevant information in its possession or control in order to assist the Customer to conduct the defence of the Claim and all negotiations for its settlement or compromise.

16 Dispute Resolution

16.1 In the event of any dispute arising between the parties in relation to a Contract, no party may commence any proceedings relating to the dispute (except where the party seeks urgent interlocutory relief) unless that party has complied with the procedures in this clause 16.1.

16.2 The party initiating the dispute (“the first party”) must provide written notice of the dispute to the other party (“the other party”) and nominate in that notice the first party’s representative for the negotiations. The other party must within fourteen days of receipt of the notice, give written notice to the first party naming its representative for the negotiations (“Other Party’s Notice”). Each nominated representative will have authority to settle or resolve the dispute. The parties will co-operate with each other and endeavour to resolve the dispute through discussion and negotiation.

16.3 If the dispute is not resolved within one month following the date of the Other Party’s Notice (or such longer period as may be agreed upon in writing by the parties), either party may utilise any other legal remedies available to it in seeking to resolve the dispute.

17 Non-Solicitation

17.1 Neither party will, without the written consent of the other party, solicit, employ, or otherwise engage the services of, the other party’s personnel (including employees and contractors). This clause will apply from commencement of the first Contract between the parties and will continue until there has been no Contract between the parties for a continuous period of six months (and if there is subsequently a Contract between the parties the non-solicitation period will re-commence).

17.2 A party may as a condition of granting its consent under clause 17.1 above, require the other party to pay to it a fee of 15% of the person’s gross annual remuneration to cover the cost of replacing the employee or contractor.

18 Notices

18.1 Any notice or other communication in connection with a Contract must be:

(a) marked for the attention of the primary contact person and delivered or sent to the address of the other party by prepaid post or email, as set out in the relevant Associated Agreement.

18.2 Notices or other communications are deemed received:

(a) if delivered by hand, on delivery;

(b) if delivered by post:

i. on the fifth Working Day following posting if sent and received within the US; and

ii. on the tenth day following posting if posted internationally; or

(c) if sent by email, on sending the email provided that no email is successfully sent if the sender receives any type of delivery notification failure and provided further that the onus is on the sender to ensure that the email has been successfully received by the recipient.

19 Force majeure

19.1 Either party may suspend its obligations to perform under a Contract if it is unable to perform as a direct result of a Force Majeure Event. Any such suspension of performance must be limited to the period during which the Force Majeure Event continues.

19.2 Where a party’s obligations have been suspended pursuant to clause 19.1 for a period of 30 days or more, the other party may immediately terminate the Contract by giving notice in writing to the other party.

20 General

20.1 Assignment:

(a) Subject to clause 20.1(b), neither the Customer nor the Supplier may assign its rights under a Contract without the prior written consent of the other party.

(b) The Supplier may, without the consent of the Customer, assign it rights under a Contract to an assignee that it reasonably considers has the personnel, skills, experience and resources to perform the Contract. The Supplier will notify the Customer of any assignment made pursuant to this clause 20.1(b) prior to the assignment unless it is not permitted to do so in which case it will notify the Customer as soon as practical following the assignment.

20.2 Contractors: The Supplier may perform its obligations under a Contract by the use of the Supplier-selected independent contractors.

20.3 Other agreements: Subject to clauses 10 and 11, nothing in these terms and conditions prevents the Supplier from entering into similar agreements with others that are the same or similar to any Contract entered into with the Customer or from providing products, deliverables or services which are the same or similar to the Products, Deliverables or Services provided under a Contract.

20.4 Entire agreement: Each Contract constitutes the complete and exclusive statement of the agreement between the parties, superseding all proposals or prior agreements, oral or written, and all other communications between the parties relating to the subject matter of that Contract.

20.5 Further assurances: The parties must each do all such further acts (and sign any documents), as may be necessary or desirable for effecting the transactions contemplated by the Contract.

20.6 Amendments: Except as specifically provided in a Contract, no amendment to a Contract will be effective unless:

(a) the amendment is in writing and signed by both parties (if the relevant Associated Agreement was signed by both parties); or

(b) the amendment is in writing and signed by the Customer (if the relevant Associated Agreement was such that only the Customer needed to sign the Associated Agreement; or

(c) the amendment is in writing and accepted in the same manner that, in accordance with the Associated Agreement, the Associated Agreement was made.

20.7 Waiver: No exercise or failure to exercise or delay in exercising any right or remedy by a party will constitute a waiver by that party of that or any other available right or remedy.

20.8 Partial invalidity: If any provision of a Contract or its application to any party or circumstance is or becomes invalid or unenforceable to any extent, the remainder of the Contract and its application will not be affected and will remain enforceable to the greatest extent permitted by law.

20.9 Relationship of the Parties: The parties agree that the Supplier is an independent contractor to the Customer and that nothing in these terms and conditions or any Contract constitutes a partnership, joint venture or relationship of employer and employee between the parties. Neither party may:

(a) act or hold itself out as an agent or representative of the other party; or

(b) assume or create any obligations on behalf of the other party.

21 Governing Law

21.1 The Contract is governed by the laws of Arizona, USA.

 

DATA PROTECTION ADDENDUM

1 Scope

1.1 This Addendum applies only to the extent that the Supplier Processes Customer Personal Data under or in connection with a Contract.

2 Definitions

“Covered Incident” means any instance in which Supplier becomes aware of actual access to or acquisition of Customer Confidential Information that was not authorized in writing by the Customer;

“Customer Personal Data” means any Personal Data Processed arising from a Contract or otherwise on behalf of the Customer, including Personal Data provided to Supplier by the Customer, collected by the Supplier on the Customer’s behalf, or generated by a user;

“Personal Data” means any information (a) relating to an identified or identifiable individual, (b) that is ‘personal information’, ‘personal data’, or analogous variations of such terms under applicable laws related to privacy, data security or protection of information about individuals, or (c) linked to, associated with, or combined with information identified in (a) or (b) above. Personal Data includes, without limitation, identification number, location data, online identifier, or any one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity, including but not limited to an individual’s name, signature, address, telephone number, email address, employee identification number, Social Security or Social Insurance number, driver’s license number, other government-issued identification number, financial account number including but not limited to credit or debit card number, credit report information, password, PIN, account credentials (e.g., username and password), biometric data, medical or health data, answers to security questions, or any other authentication information;

“Process” or “Processing” (or derivatives) means any operation or set of operations which is performed on information or on sets of information, including by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, viewing, disclosure by transmission, dissemination, alignment or combination, restriction, erasure or destruction.

3 Handling of Customer Personal Information

3.1 Limitation of Processing. Supplier will or may Process Customer Personal Data solely to the extent necessary to perform its obligations under the relevant Contract and for the purposes of that Contract.

3.2 Geographic Limitation on Data Storage and Access. Unless otherwise agreed by the parties in writing, Supplier will make available to any requesting party who is legally entitled to request the Personal Information, including the Customer or end user customers, in the United States any Personal Information, stored communications data or call identifying information (including, for example, and without limitation, call detail records and CPNI) of the Customer and its end user customers. Notwithstanding the preceding sentence, the Customer acknowledges and agrees that Supplier may access but not store Customer Personal Information, stored communications data or call identifying information from offshore locations.

3.3 Deletion. On written request from the Customer, the Supplier will delete from the Supplier’s systems all Customer Personal Information, including copies, unless this requirement conflicts with an applicable law(s) or conflicting contractual commitments to the Customer.

3.4 De-Identified Data. Supplier will not, unless otherwise mutually agreed to in writing, re-identify any De-Identified Data with any Personal Data or otherwise perform functions that would re-identify the data. Supplier has implemented technical and business Safeguards, aligned with industry standards, designed to prohibit the re-identification of De-Identified Data. “De-Identified Data” means Customer Personal Data that has been scrubbed, hashed, encrypted or otherwise obscured to remove any information that is reasonably linked to an identified or identifiable individual. Data that is readable only with a key or other technical measure is not De-Identified Data if Supplier has access to the associated key or measure.

3.5 Data Subject Access Requests. Supplier will make commercially reasonable efforts to notify the Customer, in a timely manner, of:

(a) any individual’s request to access, modify, delete or correct Customer Personal Information; and

(b) any complaint received by Supplier relating to the Processing of Customer Personal Information.

3.6 Third Party Legal Process. Unless prohibited by an applicable law or court order, Supplier will make commercially reasonable efforts to notify the Customer in writing of any third-party legal process relating to an event impacting Customer Personal Information.

3.7 Compelled Disclosures. Supplier agrees that it will not release Customer Personal Data to any government, entity or individual except when legally required to do so. If Supplier receives a legal demand or other request for release of Customer Personal Information, Supplier will provide written notice to the Customer, so that the Customer, at its election, may seek a protective order or other appropriate relief at its sole cost and expense. If the Customer does not seek a protective order or other appropriate relief, Supplier will cooperate with the Customer, at the Customer’s expense, with respect to the production and delivery of Customer Personal Data to ensure compliance with all governing laws and relevant Customer policies. If Supplier is prohibited by applicable law from providing notice to the Customer of a legal demand for Customer Personal Information, Supplier will abide by all federal and state law governing release of such data.

3.8 No Third-Party Sales of Information. Supplier must not sell, rent, transfer, share, disclose or otherwise make available or communicate orally, in writing, or by electronic or other means, whether for monetary or other valuable consideration or for any other reason, Customer Personal Data to any third party, including, without limitation, any subcontractors, without the express written consent of the Customer. Supplier’s use of Customer Personal Data will be limited to only that which is necessary to deploy, maintain, or repair the equipment and/or systems designated in Supplier’s scope of work.

3.9 Certification. This Addendum is Supplier’s certification, to the extent required by the California Consumer Privacy Act or any other legislation requiring a similar attestation, that Supplier understands the Personal Data use and sharing limitations under each Contract, that Supplier is acting as a service provider to the Customer under each Contract, and will comply with all restrictions on the processing of Personal Data set out in each Contract.

4 Privacy and Information Security Measures

4.1 Supplier has established, implemented, and will maintain during the Term, certain measures designed to (a) address privacy risks related to the development and management of existing and new products and services that Process Personal Information; (b) protect the privacy and confidentiality of Personal Information, (c) address industry standard security risks related to the development and management of existing and new products and services that Process Personal Data and (d) protect the security of Personal Data in each case, containing controls and procedures appropriate to Supplier’s size and complexity, the nature and scope of Supplier’s activities, and the sensitivity of the information processed.

5 Notification and Cooperation

5.1 Covered Incidents. Supplier will notify the Customer of a Covered Incident as soon as commercially practical, and within the timeframe required by applicable law. Where the Supplier is required, by applicable law, to investigate a Covered Incident, the Supplier will keep the Customer fully informed at all stages of its investigation, and of all actions taken in response, in line with applicable law.

5.2 Additional Actions. Supplier will reasonably assist the Customer in investigating, remedying and taking any other action that the Customer deems necessary regarding any Covered Incident.

6 Additional Requirements Applicable Only if Supplier Processes Cardholder Information.

6.1 Security of Cardholder Information. This clause 6 only applies to the extent Supplier Processes Personal Data relating to the use of credit or debit card accounts, including the account numbers, cardholder names, expiration dates, service codes, track data (e.g., magnetic stripe or chip), PINs or PIN blocks (collectively, “Cardholder Information”).

6.2 PCI Standards. Supplier will remain in compliance with the current versions of all rules, regulations, and industry standards adopted or required (a) by any entity offering or supporting payment card brands (collectively, “Card Brands”) whose Cardholder Information is Processed by Supplier under a Contract, and (b) by the Payment Card Industry Security Standards Council (the “Council”), in either case relating to privacy, data security or the safeguarding, disclosure or handling of Cardholder Information, including the Payment Card Industry Data Security Standards, the Payment Card Industry’s Payment Application Data Security Standard, the Payment Card Industry’s PIN Transaction Security requirements, Visa’s Cardholder Information Security Program and Payment Application Best Practices, American Express’s Data Security Operating Policy, MasterCard’s Site Data Protection Program and POS Terminal Security program, and the analogous security programs implemented by Card Brands (collectively referred to as the “PCI Standards”).

7 Order of precedence.

7.1 If there is any conflict or inconsistency between this Addendum and any provision of the general terms and conditions of the relevant Contract, such conflict or inconsistency will be resolved by giving precedence to this Addendum.