Assurix Master Subscription Agreement (UK)

Parties

This Master Subscription Agreement (the "Agreement") is entered into between:

Assurix Ltd, a company registered in England and Wales (company number 16401354) with its registered office at 4 Crown Place, London, EC2A 4BT ("Assurix"), and

the company identified on an Order Form ("Client").

Each a "Party" and together the "Parties".

Background

This Agreement sets out the terms and conditions under which Assurix will provide the Services to the Client.

This Agreement is a framework agreement between Parties, such that once an Order Form is entered, this Agreement shall apply to it and any subsequent Order Form entered into between the Parties.

Interpretation

The definitions in Schedule 1 apply in this Agreement.

A reference to a statute or statutory provision:

• Is a reference to it as amended, extended or re-enacted from time to time; and
• Shall include all subordinate legislation made from time to time under it.

A reference to writing or written includes email.

Structure of Agreement

This Agreement consists of the following documents. In the event of any conflict or inconsistency between the terms contained in these documents, the following order of precedence shall apply (in decreasing order):

1. all Order Forms executed under this Agreement;
2. this Agreement;
3. Exhibit A - Support Services; and
4. Exhibit B - Data Processing Details.

5. Services and Support

5.1 Provision of Services

Assurix will provide the subscription-based Trustmark, certification, and monitoring services described in each Order Form, including the Software, Trial and Beta Features (as applicable) and Support (together, the "Services") to the Client in accordance with this Agreement.

Once an Order Form has been agreed and signed by the Parties, no amendment shall be made to it unless it is in writing and signed by the Parties. Notwithstanding, Assurix shall have the right to make changes to the Services which are necessary to comply with applicable laws and safety requirements.

Assurix shall use its commercially reasonable endeavours to meet any dates and timescales set out in the applicable Order Form and Exhibit A, but any dates and timescales specified for Assurix's performance are estimates only.

Except for any warranties and service levels expressly set out in this Agreement, the Services (including any Beta Features or Trial) are provided on an "as is" basis, without any guarantees as to performance, accuracy, availability, compatibility, or that the Client's use of the Services will be uninterrupted or error-free. Assurix disclaims all other warranties, whether express, implied, statutory or otherwise, including, without limitation, any implied warranties of merchantability, fitness for a particular purpose, and those arising from a course of dealing, usage, or trade practice.

Except as provided under any Order Form, Assurix makes no warranty or representation of any data backup with the Services. The Client is solely responsible for all Client Data, database and/or system backups.

5.2 Trial or Beta Services

If applicable to the Services as set out under the relevant Order Form, Trial or Beta Features are provided to enable Client to conduct evaluation of the suitability of the Services only, and may be modified, suspended or withdrawn by Assurix at any time without prior notice, and:

• Unless Assurix withdraws the Trial or Beta Features, the Client's access thereto shall continue until the date set out in the Order Form ("Trial Period"), after which Client shall cease using the Trial and/or Beta Features.
• Any data supplied by the Client during the Trial Period will be deleted at the end of the Trial Period unless the Client purchases the corresponding Services. The Client must ensure that it exports its data prior to the end of the Trial Period, and Assurix is not responsible to maintain or store any Client data beyond the Trial Period.
• No warranties or service level commitments shall apply during the Trial Period.

6. Client Responsibilities

6.1 System Access

Where the Services require integration with Client systems, Client shall provide Assurix with read-only access using least-privilege principles. Assurix will not alter or manage Client systems and will access only as necessary.

6.2 Client Control and Security

Client is solely responsible for the administration, security, and maintenance of its systems and data. Client warrants that it has and shall maintain for the duration of the Agreement suitable authority, consents, lawful bases, and licences in place to procure the Services from Assurix, and provide the required information, materials, data (including personal data) and access to Assurix and its subcontractors (as applicable). In addition, the Client:

• shall fully virus check all data it supplies to Assurix;
• acknowledges and accepts that Assurix has no liability or responsibility with respect to the compatibility of Client's own computer systems or equipment;
• shall ensure that it handles any Assurix property, systems, infrastructure and networks with due care, in accordance with all applicable laws and industry best practices, and shall implement appropriate technical and organisational measures to protect against unauthorised access, loss, damage, misuse, or interference. The Client shall not access, use, or interfere with any Assurix systems, infrastructure or networks except as expressly authorised in writing by Assurix, and shall promptly notify Assurix of any actual or suspected security incident or breach involving Assurix property; and
• shall notify Assurix as soon as it becomes aware of any unauthorised access to or use of the Services by any person and, if required, pay for broadening the scope of the licences granted under this Agreement to pay for the unauthorised use.

6.3 Authorised Users

Client shall keep any passwords issued by Assurix secure and only allow Authorised Users to use the Services. Client may permit its employees or contractors to use the Services in accordance with this Agreement ("Authorised Users"). Client is responsible and liable for their use and all actions and omissions by Authorised Users in respect of the Services, and Client shall indemnify, defend and hold harmless Assurix against any losses, damages, liabilities, costs or expenses (including reasonable legal fees) arising out of or in connection with any use of the Services by the Client or its Authorised Users in breach of this Agreement.

6.4 Acceptable Use

The Client and Authorised Users shall not use the Services to receive, store or transmit material or data that is obscene, threatening, offensive, discriminatory, defamatory or in breach of the confidentiality provisions herein, violates data protection or privacy laws, infringes Intellectual Property Rights or other rights of a third party, gives rise to any cause of action against Assurix in any jurisdiction or is otherwise unlawful, or misrepresents the output of the Services as a substitute for legal, regulatory or professional advice. Client and Authorised Users must not:

• use the Services in breach of applicable law or in contravention of this Agreement;
• interfere, modify, disapply or otherwise tamper with security controls within the Services;
• reverse engineer, adapt, decompile, modify, disassemble, make error corrections or copy the Services;
• introduce harmful code or Viruses;
• build or support a competing product or any software whose expression is substantially similar to that of the Services, during the Term and for a period of six (6) years thereafter;
• use the Services in a manner that could damage, disable, overburden or impair the Services or interfere with any other party's use and enjoyment of the Services;
• use the Services to process or transmit any data that is subject to sector-specific regulation (including but not limited to health, financial or children's data) without Assurix's prior written consent;
• attempt to use the Services to generate or validate compliance certifications in a misleading or unauthorised manner; or
• allow access to any third parties (including Assurix competitors), except as expressly permitted in this Agreement.

For the avoidance of doubt, any breach of the restrictions set out in this Clause 6.4 by the Client or its Authorised Users shall constitute a material breach, and Assurix shall be entitled to immediately suspend the Services and/or terminate this Agreement in accordance with Clause 8.3. The Client shall indemnify Assurix against all liabilities, costs, expenses, damages and losses (including all interest, penalties and legal and other reasonable professional costs and expenses) suffered or incurred by Assurix in connection with any breach of the acceptable use set out in this Clause 6.4.

7. Fees, Invoicing and Taxes

7.1 Fees

Client will pay the Fees set out in each Order Form. All Fees are payable in advance of Service delivery, and are non-cancellable and non-refundable except as expressly stated in this Agreement or the Order Form.

7.2 Payment Terms

Unless otherwise stated in an Order Form, Fees are invoiced in advance. Unless otherwise expressly agreed in the applicable Order Form, all subscription fees are invoiced annually in advance. Services may not begin until payment is received in full and cleared funds. Fees are collected via Assurix's third-party payment processor (currently Stripe). By providing payment details, the Client authorises Assurix to collect Fees in accordance with the payment schedule in the applicable Order Form.

7.3 VAT and Taxes

Fees exclude VAT and other taxes, which will be added at the prevailing rate. Should the Client be required by any law or regulation to make any deduction on account of tax, the Fees payable shall be increased by the amount of such tax to ensure that Assurix receives a sum equal to the Fees.

7.4 Late Payment

Should the Client be in breach of its payment obligations, and fails to remedy such breach within fourteen (14) days of Assurix's notice requiring payment, Assurix shall be entitled to terminate or suspend the Services without prejudice to any pre-existing rights or obligations. Overdue sums may accrue statutory interest and compensation under the Late Payment of Commercial Debts (Interest) Act 1998. Whilst any overdue Fees remain unpaid, Assurix may suspend Services and may, at its sole discretion, restore access upon full payment of the Fees and interest from the Client.

7.5 Fee Disputes

Client must notify Assurix within thirty (30) days of the date of an invoice if it disputes any charge in respect of that invoice. The Parties will act in good faith to resolve the dispute. For the avoidance of doubt, the Client shall not be entitled to challenge any invoice after thirty (30) days from the invoice date.

7.6 Fee Increases

Assurix may increase the Fees of the Services:

• on an annual basis with effect from each anniversary of the Commencement Date to include additional annual maintenance as a result of system enhancements, in accordance with the details on enhancement sales orders authorised by the Customer. This can be anything up to current list price unless otherwise agreed; and/or
• related to any third party services or software incorporated in the Services, at any time in line with any increases imposed on Assurix by such third parties upon reasonable notice (to the extent such notice is provided to Assurix).

8. Term, Renewal, Suspension and Termination

8.1 Term and Renewal

Each Order Form begins on the effective date set out therein ("Commencement Date") and continues for the service period stated therein, unless terminated earlier in accordance with this Clause 8 ("Term"). Order Forms for the Trial and/or Beta Features (as applicable) shall terminate automatically after the Trial Period, and Order Forms for Subscriptions shall renew automatically at the end of each Term for an equivalent period ("Renewal Term"), unless either Party gives the other a minimum of sixty (60) days' advanced notice before the next Renewal Term.

8.2 Termination for Cause

Subject to Clause 8.3, either Party may terminate this Agreement and/or the applicable Order Form with immediate effect by giving notice to the other Party if:

• the other Party's material breach of any material term not cured within thirty (30) days of notification;
• the other Party suspends, or threatens to suspend, payment of its debts, or is unable to pay its debts as they fall due or admits inability to pay its debts, or is deemed unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986;
• the other Party suspends or ceases, or threatens to suspend or cease, carrying on all or a substantial part of its business.

8.3 Immediate Termination for Security or Misuse

Assurix may suspend or terminate the Client's access to the Services immediately and without liability if continued access would compromise system security or if misuse (including as set out under Clause 6.4) occurs.

8.4 Effect of Termination

Upon termination, the Client's access to the Services ends and Client shall immediately cease use of the Services, and:

• the Client shall pay Assurix any costs that have been actually and properly incurred by Assurix, including any and all unpaid Fees (and any interest);
• if termination by Client is due to Assurix's uncured material breach, Assurix will refund pre-paid unused Fees for Services which have not been delivered (as applicable);
• all licences granted under this Agreement will terminate immediately;
• termination of an Order Form shall not by default terminate other Order Forms nor this Agreement, unless expressly set out, and shall be without prejudice to any other rights which any Party may have under any other Order Form. On termination of the Agreement all existing Order Forms shall terminate automatically; and
• termination of this Agreement, for any reason, shall not affect the accrued rights, remedies, obligations or liabilities of the Parties existing at termination.

9. Intellectual Property & Licensing

9.1 Ownership

The Client acknowledges and agrees that unless otherwise expressly set out in the applicable Order Form, Assurix and/or its licensors own all Intellectual Property Rights in its (i) Background Materials; (ii) the Services; and (iii) ideas, concepts, techniques and know-how discovered, created or developed by Assurix during the performance of the Services that are of general application and that are not based on or derived from the Client's business or Confidential Information (together the "Assurix Intellectual Property"). Except as expressly stated herein, this Agreement does not grant the Client any rights to, or in, patents, copyrights, database rights, trade secrets, trade names, trade marks (whether registered or unregistered), or any other rights or licences in respect of the Assurix Intellectual Property or any related documentation. Upon receipt of full payment from the Client, Assurix grants to the Client a non-exclusive, revocable, worldwide, royalty free and non-transferable licence to use the Assurix Intellectual Property insofar as is necessary for the provision of the Services, and for the duration of this Agreement.

9.2 Licence to Assurix

Client grants Assurix a non-exclusive, irrevocable, worldwide, and royalty free licence to use Client Data and any Client Intellectual Property Rights as is necessary to provide the Services.

9.3 Feedback

Assurix may use Client feedback to improve the Services, provided confidentiality is maintained.

9.4 Aggregated Data

Assurix may derive, compile and use data generated through the provision or use of the Services in aggregated and anonymised form for analytics, industry research, benchmarking, market insights and to develop or improve the Services, provided such data cannot reasonably identify the Client, its customers or any individual. Assurix shall exclusively own all aggregated outputs and methodologies, and such creation, retention and use shall not constitute a breach of confidentiality, data protection obligations, and its use shall survive termination.

9.5 Client's IPR Indemnity

The Client shall pay and indemnify Assurix, from and against all actions, claims, liabilities, demands, proceedings, costs suffered or incurred by Assurix, arising by reason of claims that (i) Assurix's possession of or use of the Client's Intellectual Property Rights in connection with the provision of the Services infringes the Intellectual Property Rights of a third party; (ii) the Client or any of its Authorised Users or customers, modify, alter, replace, combine with any other data, code, documents or other software, which alters Assurix's Intellectual Property and such alterations infringe the Intellectual Property Rights of a third party. This indemnity applies whether or not legal proceedings are instituted and, if such proceedings are instituted, irrespective of the means, manner or nature of any settlement, compromise or determination.

9.6 Assurix's IPR Indemnity

Subject to Clause 13.3, Assurix shall pay and indemnify the Client, from and against all actions, claims, liabilities, demands, proceedings, costs suffered or incurred by the Client, arising from (i) the Client's possession of or use of Assurix's Intellectual Property in connection with the provision of the Services infringes the Intellectual Property Rights of a third party; (ii) Assurix modifies, alters, replaces combines with any other data, code, documents or other software, which alters the Client's Intellectual Property Rights and such alterations infringe the Intellectual Property Rights of a third party. This indemnity applies whether or not legal proceedings are instituted and, if such proceedings are instituted, irrespective of the means, manner or nature of any settlement, compromise or determination.

If an IPR Claim is brought or in the reasonable opinion of Assurix is likely to be made or brought, Assurix may at its own expense ensure that the Client is still able to use the Services by either:

• modifying any and all of the provisions of the Services without reducing the performance and functionality for any or all of the provision of the Services, so as to avoid the infringement or the alleged infringement, provided that the terms herein shall apply mutatis mutandis to such modified or substituted services and such modified or substituted services shall be acceptable to the Client, such acceptance not to be unreasonably withheld; or
• procuring a licence or permission to use the Services on terms which are acceptable to the Client, such acceptance not to be unreasonably withheld.

Except to the extent that Assurix should reasonably have known or advised the Client in relation to the foregoing, Assurix shall have no obligation or liability for any IPR Claim to the extent such IPR Claim arises from:

• any use by or on behalf of the Client of the combination with any item not supplied or recommended by Assurix where such use of the Services directly gives rise to the claim, demand or action; or
• any modification carried out on behalf of the Client to any item supplied by Assurix under this Agreement if such modification is not authorised by Assurix in writing where such modification directly gives rise to a claim, demands or action.

9.7 IPR Claims

Assurix shall have no obligation or liability for any IPR Claim, and the Client shall indemnify Assurix from any claim and/or losses incurred by Assurix, that arise from:

• any use by or on behalf of the Client or Authorised Users of the Services in combination with any item not supplied or recommended by Assurix where such use of the Services directly gives rise to the claim, demand or action;
• any infringement caused by Assurix having followed any specification or instructions given by the Client, or use of the Services for a purpose prohibited by Assurix;
• any modification carried out on behalf of the Client to any item supplied by Assurix under this Agreement if such modification is not authorised by Assurix in writing where such modification directly gives rise to a claim, demands or action; or
• Assurix's use of the Client Intellectual Property Rights and/or Client Data in the provision of the Services.

9.8 Conduct of Claims

If either Party ("Indemnifying Party") is required to indemnify the other Party ("Indemnified Party") under this Agreement, the Indemnified Party shall:

• notify the Indemnifying Party in writing of any IPR Claim against it in respect of which it wishes to rely on the indemnity at Clause 9.5, Clause 9.6 or Clause 9.7 (as applicable);
• allow the Indemnifying Party, at its own cost, to conduct all negotiations and proceedings and to settle the IPR Claim, always provided that the Indemnifying Party shall obtain the Indemnified Party's prior approval of any settlement terms, such approval not to be unreasonably withheld;
• provide the Indemnifying Party with such reasonable assistance regarding the IPR Claim as is required by the Indemnifying Party, subject to reimbursement by the Indemnifying Party of the Indemnified Party's costs so incurred; and
• not, without prior consultation with the Indemnifying Party, make any admission relating to the IPR Claim or attempt to settle it, provided that the Indemnifying Party considers and defends any IPR Claim diligently, using competent counsel and in such a way as not to bring the reputation of the Indemnified Party into disrepute.

9.9 Inspection

The Client shall permit Assurix to inspect and have access to any premises (and to the computer equipment located there) at or on which the Services are being used, and have access to any records kept in connection with the licence granted under Clause 9.1, to ensure that the Client is complying with the terms of this licence, provided that Assurix provides reasonable advance notice to the Client of such inspections, which shall take place at reasonable times.

10. Security and Data Protection

Assurix shall promptly notify the Client in writing of any loss or damage to the Client Data. In the event of any loss or damage to Client Data caused by Assurix, Assurix shall use commercially reasonable endeavours to restore the lost or damaged Client Data from the latest backup of such Client Data. Assurix shall not be responsible for any loss, destruction, alteration or unauthorised disclosure of Client Data caused by third parties not engaged by Assurix and outside Assurix's reasonable control. For the avoidance of doubt, Assurix remains responsible for subcontractors and sub-processors it engages in connection with the Services to the extent set out in this Agreement and applicable law.

For the purposes of this Clause 10, the terms controller, processor, data subject, Personal Data, personal data breach and processing shall have the meaning given to them in the Applicable Data Protection Laws.

Both Parties will comply with all applicable requirements of Applicable Data Protection Laws. This Clause 10 is in addition to, and does not relieve, remove or replace, a Party's obligations or rights under Applicable Data Protection Laws.

The Parties have determined that, for the purposes of Applicable Data Protection Laws, where Assurix processes personal data on behalf of the Client in providing the Services, Assurix shall process the personal data set out in Exhibit B, as a processor on behalf of the Client. Assurix may also process certain personal data as an independent controller where necessary for account administration, billing, service communications, security logging, fraud prevention, authentication and compliance with legal obligations which shall be undertaken in accordance with its Privacy Policy located at https://assurix.com/privacy-policy, as updated from time to time.

Without prejudice to the generality of Clause 10.3, the Client will ensure that it has all necessary and appropriate consents and notices in place to enable lawful transfer of the Client Personal Data to Assurix for the duration and purposes of this Agreement.

In relation to the Client Personal Data, Exhibit B sets out the scope, nature and purpose of processing by Assurix, the duration of the processing and the types of personal data and categories of data subject.

Without prejudice to the generality of Clause 10.3, Assurix shall, in relation to Client Personal Data:

• process that Client Personal Data only on the documented instructions of the Client, which shall be to process that Client Personal Data for the purposes set out in Exhibit B, unless Assurix is required by applicable laws to otherwise process that Client Personal Data. Where Assurix is relying on applicable laws as the basis for processing Client Personal Data, Assurix shall notify the Client of this before performing the processing required by the applicable laws unless those applicable laws prohibit Assurix from so notifying the Client on important grounds of public interest. Assurix shall inform the Client if, in the opinion of Assurix, the instructions of the Client infringe Applicable Data Protection Laws;
• implement appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Client Personal Data and against accidental loss or destruction of, or damage to, Client Personal Data, which the Client has reviewed and confirms are appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures;
• ensure that any personnel engaged and authorised by Assurix to process Client Personal Data have committed themselves to confidentiality or are under an appropriate statutory or common law obligation of confidentiality;
• assist the Client insofar as this is reasonably possible (taking into account the nature of the processing and the information available to Assurix), and at the Client's cost and written request, in responding to any request from a data subject and in ensuring the Client's compliance with its obligations under Applicable Data Protection Laws with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
• notify the Client without undue delay on becoming aware of a personal data breach involving the Client Personal Data;
• at the written direction of the Client, delete or return Client Personal Data and copies thereof to the Client on termination of the Agreement unless Assurix is required by Applicable Law to retain and/or continue to process that Client Personal Data. For the purposes of this Clause 10.7(f) Client Personal Data shall be considered deleted where it is put beyond further use by Assurix; and
• maintain records to demonstrate its compliance with this Clause 10 and allow for reasonable audits by the Client or the Client's designated auditor, for this purpose, on reasonable written notice.

The Client hereby provides its prior, general authorisation for Assurix to:

• appoint processors to process the Client Personal Data, provided that Assurix (i) shall ensure that the terms on which it appoints such processors comply with Applicable Data Protection Laws, and are consistent with the obligations imposed on Assurix in this Clause 10; (ii) shall remain responsible for the acts and omissions of any such processor as if they were the acts and omissions of Assurix; and (iii) shall inform the Client of any intended changes concerning the addition or replacement of the processors, thereby giving the Client the opportunity to object to such changes in writing within fourteen (14) days of notice, provided that if the Client objects to the changes and cannot demonstrate, to Assurix's reasonable satisfaction, that the objection is due to an actual or likely breach of Applicable Data Protection Law, the Client shall indemnify Assurix for any losses, damages, costs (including legal fees) and expenses suffered by Assurix in accommodating the objection;
• only transfer Client Personal Data outside of the UK as required for the Services, provided that Assurix shall ensure that all such transfers are effected in accordance with Applicable Data Protection Laws. For these purposes, the Client shall promptly comply with any reasonable request of Assurix, including any request to enter into standard data protection clauses adopted by the Commissioner from time to time.

10.9 AI Features

AI features in the Services may produce inaccurate or incomplete results. The Client shall be responsible for reviewing, quality assuring and verifying outputs of the Services, and shall be responsible for deciding whether or not to rely on the results produced by the Services. Assurix shall have no liability for (i) Client inputs that result in inaccurate, biased, infringing or otherwise unlawful outputs, (ii) Client usage that is not responsible or is otherwise unlawful or unethical, or (iii) Client reliance on outputs of the Services including, without limitation, hallucinations. Assurix does not train external AI models on Client Data.

11. Warranties and Disclaimers

11.1 Authority and Conformity

Each Party warrants it has full capacity and authority to enter into and perform this Agreement. Assurix warrants the Services, when used in accordance with this Agreement and the applicable Order Form, will materially conform as described within the relevant Order Form for i) twenty-four (24) months from the Commencement Date; or ii) until the relevant Order Form is terminated, which ever is sooner. If the Services are found not to conform to the applicable Order Form, the Client shall be entitled to the Support described in Exhibit A, which shall constitute the Client's sole and exclusive remedy in respect of such non-conformance.

11.2 Assurance-Tool Disclaimer

The Client acknowledges and accepts that the Services are not intended to constitute legal or regulatory advice, nor do they provide any form of assurance or guarantee regarding the Client's security posture. The Client remains solely responsible for its own compliance obligations and shall not rely on the Services as a substitute for its own due diligence or professional advice. Assurix shall in no way be liable for the Client's security or compliance with applicable law or regulation.

11.3 Relief Events

Subject to Clause 13.1, and notwithstanding any other provision of this Agreement, Assurix shall have no liability for failure to perform the Services or its other obligations under this Agreement if it is prevented, hindered or delayed from doing so as a result of any Relief Event.

12. Confidentiality

Each Party must keep the other Party's non-public Confidential Information strictly confidential. Disclosure of Confidential Information is not permitted save for disclosure to the receiving Party's personnel, contractors, or professional advisors who need to know it for the purposes of the Services, provided they are bound by equivalent confidentiality obligations, or as required by applicable law. Obligations under this Clause 12.1 shall survive for five (5) years after termination of this Agreement.

The obligations of confidentiality set out in this Clause 12 shall not apply to any information or matter which: (i) is in the public domain other than as a result of a breach of this Agreement; (ii) was in the possession of the receiving Party prior to the date of receipt from the disclosing Party or was rightfully acquired by the receiving Party from sources other than the disclosing Party; (iii) is required to be disclosed by law, or by a competent court, tribunal, securities exchange or regulatory or governmental body having jurisdiction over it wherever situated; or (iv) was independently developed by the receiving Party without use of or reference to the Confidential Information.

13. Limitation of Liability

Nothing in this Agreement shall limit or exclude either Party's liability for (i) death or personal injury caused by its negligence, or (ii) fraud or fraudulent misrepresentation.

Subject to Clause 13.1, neither Party shall be liable to the other Party for breach of statutory duty or otherwise, arising under or in connection with this Agreement for:

• loss of profits;
• loss of sales or business opportunity;
• loss of actual or anticipated savings;
• loss of goodwill or reputation;
• loss of wasted expenditure;
• loss of, damage to or corruption of data;
• any indirect or consequential loss; and/or
• a Force Majeure Event.

Subject to Clauses 11.3, 13.1 and 13.2, the Parties' total liability to the other, whether in contract, tort (including negligence), breach of its statutory duty, or otherwise, arising under or in connection with the performance or contemplated performance of the Services (including liability for any indemnities provided hereunder) shall be limited to one hundred percent (100%) of the total Fees paid for the applicable Service under this Agreement during the twelve (12) months preceding the date on which the claim arose.

14. General

14.1 Compliance and Publicity

Each Party shall comply with applicable laws including the Bribery Act 2010 and Modern Slavery Act 2015. Assurix may identify Client by name and logo in its promotional and marketing materials with the Client's prior written consent (such consent not to be unreasonably withheld or delayed). Any case studies or press releases shall require approval of both Parties, subject always to confidentiality obligations hereunder.

Where the applicable Order Form includes a public directory, registry, profile, badge or verification service, the Client authorises Assurix to publish the Client's name, logo, profile information, certificate details and verification status for the purpose of providing that service. Assurix may make that information publicly accessible and searchable, including through internet search engines. Assurix shall not publish contact details or other optional profile information unless supplied or approved by the Client for publication. The Client may request correction or removal of optional directory information in accordance with the applicable service terms. Any case study, press release or other promotional use outside the directory, registry, profile or verification service remains subject to the Client's prior written approval.

14.2 Subcontracting and Assignment

Assurix may use subcontractors and shall be liable for them in respect of the Services for the duration of the Agreement. The Client may not assign, transfer, novate, mortgage, charge, sub-licence, delegate, or subcontract this Agreement without the prior written consent of Assurix. Assurix may assign and transfer its rights and obligations under this Agreement.

14.3 Third-Party Rights

No third party has rights under the Contracts (Rights of Third Parties) Act 1999.

14.4 Notices

Notices must be in writing and sent by email and/or courier to the addresses below. This Clause 14.4 does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.

• To Assurix: legal@assurix.com and 4 Crown Place, London, EC2A 4BT.
• To Client: as per the details in the Order Form.

Email is deemed received on delivery (provided that no automated delivery failure or out-of-office notification is received by the sender); courier on signature or 2 business days after dispatch.

14.5 Entire Agreement

This Agreement and each Order Form constitutes the entire agreement between the Parties and supersedes and extinguishes all prior agreements, promises, warranties, representations, terms or purchase orders relating to its subject matter.

14.6 Variation

No variation of this Agreement shall be effective unless it is in writing and signed by the Parties (or their authorised representatives).

14.7 Dispute Resolution

In the event of a dispute arising out of or in connection with this Agreement, the Parties shall first seek to resolve it amicably through good-faith negotiations. If unresolved within thirty (30) days from a Party first raising it to the other, either Party may request mediation under the CEDR Model Mediation Procedure. Nothing in this clause restricts a Party from seeking urgent court relief.

14.8 Force Majeure

If the period of delay or non-performance caused by a Force Majeure Event continues for four (4) weeks or more, the Party not affected may terminate this Agreement by giving fourteen (14) days' written notice to the affected Party.

14.9 No Partnership or Agency

Nothing in this Agreement shall be construed to create a partnership, joint venture or other legal relationship of any kind between the Parties that would impose liability upon one Party for the acts or omissions of the other Party, or authorise either Party to act as agent for, or otherwise bind, the other.

14.10 Waiver

No failure or delay by a Party to exercise any right or remedy provided under this Agreement or by law shall constitute a waiver of that or any other right or remedy.

14.11 Governing Law and Jurisdiction

This Agreement and any related non-contractual matters are governed by English law. The courts of England and Wales shall have exclusive jurisdiction in respect of any claim or matter arising out of or in connection with this Agreement and any Order Form.

Exhibit A - Support Services

Support Scope

The Support to be provided by Assurix to the Client on a remote basis as part of the Services includes:

• Incident diagnosis and resolution where the incident is within Assurix's reasonable control;
• Assistance with configuration and integration; and
• General technical advice on Client's use of the Services to the extent reasonably required.

Severity Levels

• Severity 1 / Critical: Services down.
• Severity 2 / High: Major function affected.
• Severity 3 / Medium: Minor issue.
• Severity 4 / Low: General queries.

Response Times

*Resolution may be a workaround or fix. Assurix shall use commercially reasonable endeavours to adhere to the resolution targets.

Requesting Support

Support requests from the Client must be submitted by email to customerservices@assurix.com or via the Assurix platform. Client shall include in its request for Support the impact suffered as a result of the incident, any applicable logs, and screenshots of the issue, if possible.

Availability

Support is available during UK business hours (9:00-17:00 Monday to Friday excluding public holidays).

Limitations

Support excludes the following which Assurix shall not be required to provide:

• Resolution or assistance for issues caused by third-party systems or Client modifications;
• Trial or Beta Features unless agreed in the applicable Order Form; and
• Professional services unless separately agreed in the applicable Order Form.

Complaints

Any complaint about the Services, a certification decision, or Assurix's conduct should be sent in writing to customerservices@assurix.com.

Assurix will acknowledge complaints within 2 business days and aims to provide a substantive response within 10 business days. If more time is needed to investigate, Assurix will issue a holding response setting out the expected timing.

Complaints will be handled fairly, confidentially, and by a person who is not the subject of the complaint where reasonably possible.

If the complainant is not satisfied with the outcome, they may escalate the matter internally to the CEO. Where relevant, they may also escalate externally to the appropriate body, including the ICO for data protection matters, the UK Cyber Security Council for ACSP conduct matters, or the courts for contractual matters.

Exhibit B - Data Processing Details

Data subjects

• Customers of the Client
• Employees and/or contractors of the Client
• Client third parties
• Business contacts in general

Types of personal data

• Name
• Job title
• Email address
• Phone number
• Business/home address
• Audit Logs
• Ticket Records
• Any other personal data provided by Client to Assurix

Special categories of personal data

n/a

Purpose of processing

For the purpose of providing the Services and Support to Client's business as set out in the Order Form.

Nature of processing

As set out in the body of the Agreement.

Duration of processing

For the term of this Order Form plus thirty (30) days.

Approved Sub-Processors

At the time of this Agreement, Assurix engages the following sub-processors for the processing of Client personal data in connection with the Services:

• Microsoft Azure - hosting, storage and infrastructure
• WorkOS - authentication and identity services
• Sentry - application error and performance monitoring
• SendGrid - transactional email delivery

Approved international transfers

None.

Additional instructions

None.

Schedule 1 - Definitions

Applicable Data Protection Laws

means all applicable data protection and privacy legislation in force from time to time in the UK including the "UK GDPR" (as defined in section 3(10) (supplemented by section 205(4)) of the DPA 2018), the Data Protection Act 2018 ("DPA 2018") (and regulations made thereunder), and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended.

Background Materials

means all Intellectual Property Rights, know-how, information, methodologies, techniques, tools, schemata, diagrams, ways of doing business, trade secrets, instructions manuals and procedures (including, but not limited to, software, documentation, and data of whatever nature and in whatever media) owned, developed or controlled by Assurix which may have been created outside the scope, or independently of, the Services and/or this Agreement, and including all updates, modifications, derivatives or future developments thereof.

Beta Features

means the components, functionalities, or enhancements of Assurix's subscription-based trustmark, certification and monitoring services that are made available to the Client prior to general commercial release.

Client Data

means any information that is provided by the Client to Assurix as part of the Client's use of the Services, including any information derived from such information.

Confidential Information

means all confidential information (however recorded or preserved) disclosed by a Party or its employees, officers, representatives, advisers or subcontractors involved in the provision or receipt of the Services, to the other Party in connection with this Agreement, which information is either labelled as such or should reasonably be considered as confidential because of its nature and the manner of its disclosure.

Fees

means the fees, expenses and other costs payable by the Client for receipt of the Services as set out in the Order Form.

Force Majeure Event

means any event beyond a Party's reasonable control that prevents or delays the performance of its obligations under this Agreement, including but not limited to acts of God, natural disasters, war, terrorism, civil unrest, strikes, epidemics, pandemics, or failures of suppliers or utilities.

Intellectual Property Rights

means any and all intellectual property rights of any nature, whether registered, registerable or otherwise, including patents, utility models, trademarks, registered designs and domain names, applications for any of the foregoing, trade or business names, goodwill, copyright and rights in the nature of copyright, design rights, rights in databases, moral rights, know-how and any other intellectual property rights that subsist in computer software, computer programs, websites, documents, information, techniques, business methods, drawings, logos, instruction manuals, lists and procedures and particulars of clients, marketing methods and procedures and advertising literature, including the "look and feel" of any websites, and in each case all rights and forms of protection of a similar nature or having equivalent or similar effect to any of these that may subsist anywhere in the world now or in the future.

IPR Claim

means a claim by a third party arising from the infringement of its IPR.

Order Form

means the statement of work, order form or proposal which sets out the Services and Fees, and which incorporates the terms and conditions of this Agreement.

Relief Event

means the following events: (a) any failure by the Client to comply with its obligations under this Agreement; (b) any error or malfunction in the Client's business systems or any other software, hardware or systems for which Assurix is not responsible or any failure by the Client, its agents or contractors (including any existing service provider) to obtain sufficient support and maintenance, as required, for any software, hardware or systems for which Assurix is not responsible; (c) any failure by the Client or its agents or contractors (including any existing service provider) to provide any information, co-operation or instructions to Assurix which is reasonably required for the proper performance of this Agreement; and/or (d) any telecommunications network defect, delay or failure or failure of the Client's hardware or other systems.

Software

means Assurix's proprietary software in machine-readable object code form only, including any error corrections, updates, upgrades, modifications and enhancements to it.

Support Services

means the support services and service levels applicable to Assurix's provision of the Services to the Client as set out in Exhibit A.

Trial

means a limited period during which the Client is granted access to the Services, for the purposes of evaluation only.

Virus or Viruses

means viruses, "logic bombs", "Trojan horses" and any other corruption, deterioration, defects, malfunctions or errors.

Contact

If you have any questions about this Agreement, please contact us at:

Email: legal@assurix.com

Address: Assurix Ltd, 4 Crown Place, London, EC2A 4BT, United Kingdom