Terms and Conditions

Background

(A) The Supplier has developed certain software applications and platforms to assist in the understanding and management of risk exposure which it makes available to subscribers via the internet on a pay basis.

(B) The Customer wishes to use the Supplier's service in its business operations.

(C) The Supplier has agreed to provide and the Customer has agreed to take and pay for the Supplier's service subject to the terms and conditions of this agreement.

Agreed terms

1. Interpretation

1.1 The definitions and rules of interpretation in this clause apply in this agreement.

AI Features: the AI features used in the Services, as further described in clause 9;

“AI Output” means any output, results, predictions, or other content generated by or using the AI Features.

Authorised Users: those employees, agents and independent contractors of the Customer who are authorised by the Customer to use the Services and the Documentation, as further described in clause 2.2.

Business Day: a day other than a Saturday, Sunday or public holiday in England when banks in London are open for business.

Change of Control: shall be as defined in section 1124 of the Corporation Tax Act 2010, and the expression change of control shall be interpreted accordingly.

Confidential Information: information that is proprietary or confidential and is either clearly labelled as such or identified as Confidential Information in clause 12.1.

Customer: the entity entering into this agreement with the Supplier.

Customer Data: the data inputted by the Customer, Authorised Users, or the Supplier on the Customer's behalf for the purpose of using the Services or facilitating the Customer's use of the Services.

Documentation: the documents (if any) made available to the Customer by the Supplier online via https://riskflag.com/software or such other web address notified by the Supplier to the Customer from time to time which sets out a description of the Services and the user instructions for the Services.

Effective Date: the date of this agreement, being the date of acceptance of these terms by use of the Services.

Free Trial: refers to a limited period of time that may be free of charge when purchasing a licence to the Services;

Heightened Cybersecurity Requirements: any laws, regulations, codes, guidance (from regulatory and advisory bodies (whether mandatory or not), international and national standards, and sanctions, which are applicable to either the Customer or an Authorised User (but not the Supplier) relating to security of network and information systems and security breach and incident reporting requirements, which may include the cybersecurity Directive ((EU) 2016/1148), Commission Implementing Regulation ((EU) 2018/151), the Network and Information systems Regulations 2018 (SI 506/2018), all as amended or updated from time to time.

Initial Licence Term: the initial term of this agreement as set out in the Invoice.

Intellectual Property Rights: any and all patents, trademarks, trade names, copyright, moral rights, rights in design, rights in databases, know-how and all or other intellectual property rights whether or not registered or capable of registration and subsisting in any part of the world together with all or any goodwill relating to them.

Normal Business Hours: 8.00 am to 6.00 pm local UK time, each Business Day.

Renewal Period: the period described in clause 15.1.

Services: the services provided by the Supplier to the Customer for the Fee(s) under this agreement via https://www.riskflag.com or any other website notified to the Customer by the Supplier from time to time, as more particularly described in the Documentation and as specified in the Proposal, including the AI Features where relevant.

Software: any of the RiskFlag modules or any combination of the online software applications provided by the Supplier from time to time as part of the Services.

Licence Fees: the fees payable by the Customer to the Supplier for the User Licences or such other subscription model as applicable from time to time and as set out in the Initial Invoice.

Licence Term: has the meaning given in clause 15.1 (being the Initial Licence Term together with any subsequent Renewal Periods).

Supplier: RiskFlag Ltd incorporated and registered in England and Wales with company number 14114560 whose registered office is at Chancery House, 30 St Johns Road, Woking, GU21 7SA.

Support Services Policy: the Supplier's policy for providing support in relation to the Services as made available at www.riskflag.com or such other website address as may be notified to the Customer from time to time.

User Licences: the user s and/or safety case licences (as the case may be) purchased by the Customer pursuant to clause 10.1 which entitle Authorised Users to access and use the Services and the Documentation in accordance with this agreement.

Virus: any thing or device (including any software, code, file or programme) which may: prevent, impair or otherwise adversely affect the operation of any computer software, hardware or network, any telecommunications service, equipment or network or any other service or device; prevent, impair or otherwise adversely affect access to or the operation of any programme or data, including the reliability of any programme or data (whether by re-arranging, altering or erasing the programme or data in whole or part or otherwise); or adversely affect the user experience, including worms, trojan horses, viruses and other similar things or devices.

Vulnerability: a weakness in the computational logic (for example, code) found in software and hardware components that when exploited, results in a negative impact to the confidentiality, integrity, or availability, and the term Vulnerabilities shall be interpreted accordingly.

1.2 Clause, schedule and paragraph headings shall not affect the interpretation of this agreement.

1.3 A person includes an individual, corporate or unincorporated body (whether or not having separate legal personality) and that person's legal and personal representatives, successors or permitted assigns.

1.4 A reference to a company shall include any company, corporation or other body corporate, wherever and however incorporated or established.

1.5 Unless the context otherwise requires, words in the singular shall include the plural and in the plural shall include the singular.

1.6 Unless the context otherwise requires, a reference to one gender shall include a reference to the other genders.

1.7 A reference to a statute or statutory provision is a reference to it as it is in force as at the date of this agreement.

1.8 A reference to a statute or statutory provision shall include all subordinate legislation made as at the date of this agreement under that statute or statutory provision.

1.9 A reference to writing or written excludes fax but not email.

1.10 References to clauses and schedules are to the clauses and schedules of this agreement; references to paragraphs are to paragraphs of the relevant schedule to this agreement.

2. User licences

2.1 Subject to the Customer purchasing the User Licences in accordance with clause 3.3 and clause 10.1, the restrictions set out in this clause 2 and the other terms and conditions of this agreement, the Supplier hereby grants to the Customer a non-exclusive, non-transferable right and licence, without the right to grant sublicences, to permit the Authorised Users to use the Services and the Documentation during the Licence Term solely for the Customer's internal business operations.

2.2 In relation to the Authorised Users, the Customer undertakes that:

(a) the maximum number of Authorised Users that it authorises to access and use the Services and the Documentation shall not exceed the number permitted by the User Licences it has purchased from time to time which at the Effective Date is as set out in the Initial Invoice;

(b) it will not allow or suffer any User Licence to be used by more than one individual Authorised User unless it has been reassigned in its entirety to another individual Authorised User, in which case the prior Authorised User shall no longer have any right to access or use the Services and/or Documentation; and

(c) each Authorised User shall keep a secure and confidential password for their use of the Services and Documentation, in accordance with the Customer’s own internal IT security protocols.

2.3 The Customer shall not access, store, distribute or transmit any Viruses, or any material during the course of its use of the Services, or misuse the AI Features in a way that:

(a) is unlawful, deceptive, harmful, threatening, defamatory, obscene, infringing, harassing or racially or ethnically offensive;

(b) facilitates illegal activity;

(c) depicts sexually explicit images;

(d) promotes unlawful violence;

(e) is discriminatory based on race, gender, colour, religious belief, sexual orientation, disability; or

(f) is otherwise illegal or causes damage or injury to any person or property;

and the Supplier reserves the right, without liability or prejudice to its other rights to the Customer, to disable the Customer's access to any material that breaches the provisions of this clause.

2.4 The Customer shall not:

(a) except as may be allowed by any applicable law which is incapable of exclusion by agreement between the parties and except to the extent expressly permitted under this agreement:

(i) attempt to copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, display, transmit, or distribute all or any portion of the Software, Documentation and / or the AI Features (as applicable) in any form or media or by any means; or

(ii) attempt to discover the underlying components, models, or algorithms of the AI Features, or to bypass, disable, or override their safety filters and built-in protections;

(iii) attempt to de-compile, reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Software or the AI Features; or

(b) access all or any part of the Services, the AI Features and / or Documentation in order to build a product or service which competes with the Services and/or the Documentation; or

(c) use the Services, the AI Features and/or Documentation to provide services to third parties other than those agreed with the Supplier at the Effective Date; or

(d) subject to clause 23.1, license, sell, rent, lease, transfer, assign, distribute, display, disclose, or otherwise commercially exploit, or otherwise make the Services, the AI Features and/or Documentation available to any third party except the Authorised Users, or

(e) attempt to obtain, or assist third parties in obtaining, access to the Services, the AI Features and/or Documentation, other than as provided under this clause 2; or

(f) introduce or permit the introduction of, any Virus or Vulnerability into the Supplier's network and information systems, including the AI Features.

2.5 The Customer shall use all reasonable endeavours to prevent any unauthorised access to, or use of, the Services, the AI Features and/or the Documentation and, in the event of any such unauthorised access or use, promptly notify the Supplier.

2.6 The rights provided under this clause 2 are granted to the Customer only, and shall not be considered granted to any subsidiary or holding company of the Customer.

3. Additional user licences

3.1 Subject to clause 3.2 and clause 3.3, the Customer may, from time to time during any Licence Term, adjust the number of User Licences or safety cases as applicable and provided that any increase in Licence Fee is paid, the Supplier shall grant access to the Services and the Documentation to such additional Authorised Users in accordance with the provisions of this agreement.

3.2 If the Customer wishes to adjust the number of User Licences or safety cases as applicable, the Customer shall notify the Supplier in writing. The Supplier shall evaluate such request for such change and respond to the Customer with approval or rejection of the request (such approval not to be unreasonably withheld). Where the Supplier approves the request, the Supplier shall activate the additional User Licences and/or safety cases within 3 days of its approval of the Customer's request.

3.3 If the Supplier approves the Customer's request to purchase additional User Licences, the Customer shall, within 30 days of the date of the Supplier's invoice, pay to the Supplier the relevant fees for such additional User Licences and, if such additional User Licences are purchased by the Customer part way through the Initial Licence Term or any Renewal Period (as applicable), such fees shall be pro-rated from the date of activation by the Supplier for the remainder of the Initial Licence Term or then current Renewal Period (as applicable).

4. Services

4.1 The Supplier shall, during the Licence Term, provide the Services and make available the Documentation to the Customer on and subject to the terms of this agreement.

4.2 The Supplier shall use commercially reasonable endeavours to make the Services available 24 hours a day, seven days a week, except for:

(a) planned maintenance carried out during the maintenance window of 10.00 pm to 2.00 am UK time; and

(b) unscheduled maintenance performed outside Normal Business Hours, provided that the Supplier has used reasonable endeavours to give the Customer at least 6 Normal Business Hours' notice in advance.

4.3 The Supplier will, as part of the Services and at no additional cost to the Customer (unless otherwise agreed in writing in the case of exceptional levels of support), provide the Customer with the Supplier's standard customer support services during Normal Business Hours in accordance with the Supplier's Support Services Policy in effect at the time that the Services are provided. The Supplier may amend the Support Services Policy in its sole and absolute discretion from time to time. The Customer may purchase enhanced support services separately at the Supplier's then current rates.

5. Data protection

5.1 The parties acknowledge that the Supplier may have access to personal data which the Customer has introduced into the Software. The Customer expressly acknowledges and agrees that it will not input or otherwise upload sensitive personal data (as that term is defined in Applicable Data Protection Laws) into the Services and shall indemnify and hold the Supplier harmless in respect of any claims, actions, proceedings, losses, damages, expenses and costs (including without limitation court costs and reasonable legal fees) arising out of or in connection with all Customer sensitive personal data in the Services.

5.2 The parties agree that the Supplier's data processing activities shall be governed by the Data Processing Addendum attached hereto.

6. Third party providers

The Customer acknowledges that the Services may enable or assist it to access the website content of, correspond with, and purchase products and services from, third parties via third-party websites and that it does so solely at its own risk. The Supplier makes no representation, warranty or commitment and shall have no liability or obligation whatsoever in relation to the content or use of, or correspondence with, any such third-party website, or any transactions completed, and any contract entered into by the Customer, with any such third party. Any contract entered into and any transaction completed via any third-party website is between the Customer and the relevant third party, and not the Supplier. The Supplier recommends that the Customer refers to the third party's website terms and conditions and privacy policy prior to using the relevant third-party website. The Supplier does not endorse or approve any third-party website nor the content of any of the third-party website made available via the Services.

7. Supplier's obligations

7.1 The Supplier undertakes that the Services will be performed substantially in accordance with the Documentation and with reasonable skill and care.

7.2 The undertaking at clause 7.1 shall not apply to the extent of any non-conformance which is caused by use of the Services contrary to the Supplier's instructions, or modification or alteration of the Services by any party other than the Supplier or the Supplier's duly authorised contractors or agents. If the Services do not conform with the foregoing undertaking, Supplier will, at its expense, use all reasonable commercial endeavours to correct any such non-conformance promptly, or provide the Customer with an alternative means of accomplishing the desired performance. Such correction or substitution constitutes the Customer's sole and exclusive remedy for any breach of the undertaking set out in clause 7.1.

7.3 The Supplier:

(a) does not warrant that:

(i) the Customer's use of the Services will be uninterrupted or error-free; or

(ii) that the Services, Documentation and/or the information obtained by the Customer through the Services will meet the Customer's requirements; or

(iii) the Software or the Services will be free from Vulnerabilities or Viruses; or

(iv) the Software, Documentation or Services will comply with any Heightened Cybersecurity Requirements.

(b) is not responsible for any delays, delivery failures, or any other loss or damage resulting from the transfer of data over communications networks and facilities, including the internet, and the Customer acknowledges that the Services and Documentation may be subject to limitations, delays and other problems inherent in the use of such communications facilities.

7.4 This agreement shall not prevent the Supplier from entering into similar agreements with third parties, or from independently developing, using, selling or licensing documentation, products and/or services which are similar to those provided under this agreement.

7.5 The Supplier warrants that it has and will maintain all necessary licences, consents, and permissions necessary for the performance of its obligations under this agreement.

7.6 The Supplier shall follow its archiving procedures for Customer Data. In the event of any loss or damage to Customer Data, the Customer's sole and exclusive remedy against the Supplier shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data maintained by the Supplier in accordance with its archiving procedures. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party (except those third parties sub-contracted by the Supplier to perform services related to Customer Data maintenance and back-up for which it shall remain fully liable.

8. Customer's obligations

8.1 The Customer shall:

(a) provide the Supplier with:

(i) all necessary co-operation in relation to this agreement; and

(ii) all necessary access to such information as may be required by the Supplier;

in order to provide the Services, including but not limited to Customer Data, security access information and configuration services;

(b) without affecting its other obligations under this agreement, comply with all applicable laws and regulations with respect to its activities under this agreement;

(c) carry out all other Customer responsibilities set out in this agreement in a timely and efficient manner. In the event of any delays in the Customer's provision of such assistance as agreed by the parties, the Supplier may adjust any agreed timetable or delivery schedule as reasonably necessary;

(d) ensure that the Authorised Users use the Services and the Documentation in accordance with the terms and conditions of this agreement and shall be responsible for any Authorised User's breach of this agreement;

(e) obtain and shall maintain all necessary licences, consents, and permissions necessary for the Supplier, its contractors and agents to perform their obligations under this agreement, including without limitation the Services;

(f) ensure that its network and systems comply with the relevant specifications provided by the Supplier from time to time; and

(g) be, to the extent permitted by law and except as otherwise expressly provided in this agreement, solely responsible for procuring, maintaining and securing its network connections and telecommunications links from its systems to the Supplier's data centres, and all problems, conditions, delays, delivery failures and all other loss or damage arising from or relating to the Customer's network connections or telecommunications links or caused by the internet.

8.2 The Customer shall own all right, title and interest in and to all of the Customer Data that is not personal data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of all such Customer Data.

9. AI Features

9.1 The Supplier uses a range of proprietary and third-party optical character recognition (OCR) and large language model (LLM) systems in the AI Features. The Customer may elect to use the AI Features at its option.

9.2 The Customer may choose to connect the Customer’s own AI tools instead of Supplier's. Where the Customer does this, data protection and data residency for that processing are governed by the Customer’s agreement with the Customer’s AI provider. The Supplier’s proprietary AI tools are hosted using the same systems as the main Supplier platform.

9.3 The Supplier will provide the AI Features in a responsible manner and in compliance with all applicable laws.

9.4 The Customer shall use the AI Features in an ethical and responsible manner, and in compliance all applicable laws. Without limiting the foregoing, the Customer shall not use the AI Features to generate or share any harmful, offensive, illegal, or misleading content, or in a way that discriminates against any individual or group. The Supplier has not verified the accuracy, completeness or reliability of any AI Output and is not responsible for the Customer’s use or reliance on it. The Customer shall exercise reasonable discretion when using the AI Features. If the Customer publishes externally any AI Output, or any content based on the AI Output, the Customer will clearly and transparently disclose the role of AI in generating that content and will not represent that the content was generated solely by a human.

9.5 The Customer shall use the AI Features fairly, reasonably and in accordance with the Agreement and any applicable usage limits notified by the Supplier. The Customer must not use the AI Features in a manner that is excessive, abusive or likely to impair their availability, security or performance for other users. Where the Supplier reasonably considers that use by the Customer exceeds fair and reasonable levels, the Supplier may give notice requiring the Customer to reduce its use and, if necessary, suspend or restrict access to the AI Features until the issue is remedied.

9.6 AI Features may use technology designed and developed by third party Sub-processors (listed here). However, Customer Data is never used to train large language models or third-party models. The Supplier will publish information here about the models and technologies used in the AI Features, including attribution notices and links to any applicable third-party license conditions And the Customer is responsible for reviewing and complying with those license conditions. The Supplier may use Customer Data to create aggregated and anonymised data sets for the purpose of analysing, developing, improving and enhancing the Services, provided that such data does not identify the Customer, any Authorised User or any individual. The Supplier shall ensure that Customer Data remains confidential at all times and shall not disclose Customer Data except as permitted under this agreement.

9.7 The AI Features are provided on an as-is and as-available basis without warranties of any kind and as such any warranties, service level commitments, or indemnification provided by the Supplier with respect to the Services as set out in the agreement do not apply to the AI Features. The Supplier may remove, modify, discontinue or deprecate the AI Features at its sole discretion without any further liability or obligation.

9.8 If the Customer inputs Customer Data containing personal data into the Services using the AI Features, then the Customer shall be deemed to be instructing the Supplier to process that data for the additional purpose of generating AI Output.

10. Charges and payment

10.1 The Customer shall pay the Licence Fees to the Supplier for the User Licences in accordance with this clause 10 and any support fees agreed in accordance with clause 4.3.

10.2 The Customer shall on or before the Effective Date provide to the Supplier valid, up-to-date and complete payment details or approved purchase order information acceptable to the Supplier and any other relevant valid, up-to-date and complete contact and billing details and, if the Customer provides:

(a) its credit card details to the Supplier, the Customer hereby authorises the Supplier to bill such credit card:

(i) on the Effective Date for the Licence Fees payable in respect of the Initial Licence Term; and

(ii) subject to clause 15.1, on each anniversary of the Effective Date for the Licence Fees payable in respect of the next Renewal Period;

(b) its approved purchase order information to the Supplier, the Supplier shall invoice the Customer:

(i) on or before the Effective Date for the Licence Fees payable in respect of the Initial Licence Term; and

(ii) subject to clause 15.1, at least 30 days prior to each anniversary of the Effective Date for the Licence Fees payable in respect of the next Renewal Period,

and the Customer shall pay each invoice within 30 days after the date of such invoice.

10.3 If the Supplier has not received payment within 30 days after the due date, and without prejudice to any other rights and remedies of the Supplier:

(a) the Supplier may, without liability to the Customer, disable the Customer's password, account and access to all or part of the Services and the Supplier shall be under no obligation to provide any or all of the Services while the invoice(s) concerned remain unpaid; and

(b) interest shall accrue on a daily basis on such due amounts at an annual rate equal to 4% over the then current base lending rate of Barclays Bank plc from time to time, commencing on the due date and continuing until fully paid, whether before or after judgment.

10.4 All amounts and fees stated or referred to in this agreement:

(a) shall be payable in pounds sterling;

(b) are, subject to clause 14.3(b), non-cancellable and non-refundable;

(c) are exclusive of value added tax, which shall be added to the Supplier's invoice(s) at the appropriate rate.

10.5 The Supplier shall be entitled to increase the Licence Fees, the fees payable in respect of the additional User Licences purchased pursuant to clause 3.3 and/or the support fees payable pursuant to clause 4.3 at the start of each Renewal Period by a percentage amount no greater to the equivalent percentage increase in the CPI over the preceding 12 months and upon 90 days' prior notice to the Customer and the Licence Fees shall be deemed to have been amended accordingly.

10.6 The Supplier may at its sole discretion, offer certain Services as part of a Free Trial for a limited period of time. The Customer may be required to submit billing information in order to sign up for the Free Trial. The Customer will not be charged until the Free Trial has expired. Once the Free Trial has expired, the Customer will be charged accordingly for the Services that the Customer selects. The Supplier reserves the right to (i) modify the terms and conditions of the Free Trial offer, and (ii) cancel the Free Trial.

11. Proprietary rights

11.1 The Customer acknowledges and agrees that the Supplier and/or its licensors own all Intellectual Property Rights in the Services and the Documentation. Except as expressly stated herein, this agreement does not grant the Customer any rights to, under or in, any patents, copyright, database right, trade secrets, trade names, trade marks (whether registered or unregistered), or any other rights or licences in respect of the Services or the Documentation.

11.2 The Supplier confirms that it has all the rights in relation to the Services and the Documentation that are necessary to grant all the rights it purports to grant under, and in accordance with, the terms of this agreement.

12. Confidentiality

12.1 Confidential Information means all confidential information (however recorded or preserved) disclosed by a party or its Representatives (as defined below) to the other party and that party's Representatives whether before or after the date of this agreement in connection with the business of either party, including but not limited to:

(a) the existence and terms of this agreement or any agreement entered into in connection with this agreement;

(b) any information that would be regarded as confidential by a reasonable business person relating to:

(i) the business, assets, affairs, customers, clients, suppliers, or plans, intentions, or market opportunities of the disclosing party; and

(ii) the operations, processes, product information, know-how, designs, trade secrets or software of the disclosing party;

(c) any information developed by the parties in the course of carrying out this agreement and the parties agree that:

(i) details of the Services, and the results of any performance tests of the Services, shall constitute Supplier Confidential Information; and

(ii) Customer Data shall constitute Customer Confidential Information.

Representatives means, in relation to a party, its employees, officers, contractors, subcontractors, representatives and advisers.

12.2 The provisions of this clause shall not apply to any Confidential Information that:

(a) is or becomes generally available to the public (other than as a result of its disclosure by the receiving party or its Representatives in breach of this clause);

(b) was available to the receiving party on a non-confidential basis before disclosure by the disclosing party;

(c) was, is or becomes available to the receiving party on a non-confidential basis from a person who, to the receiving party's knowledge, is not bound by a confidentiality agreement with the disclosing party or otherwise prohibited from disclosing the information to the receiving party;

(d) the parties agree in writing is not confidential or may be disclosed.

12.3 Each party shall keep the other party's Confidential Information secret and confidential and shall not:

(a) use such Confidential Information except for the purpose of exercising or performing its rights and obligations under or in connection with this agreement (Permitted Purpose); or

(b) disclose such Confidential Information in whole or in part to any third party, except as expressly permitted by this clause 12.

12.4 A party may disclose the other party's Confidential Information to those of its Representatives who need to know such Confidential Information for the Permitted Purpose, provided that:

(a) it informs such Representatives of the confidential nature of the Confidential Information before disclosure; and

(b) at all times, it is responsible for such Representatives' compliance with the confidentiality obligations set out in this clause.

12.5 A party may disclose Confidential Information to the extent such Confidential Information is required to be disclosed by law, by any governmental or other regulatory authority or by a court or other authority of competent jurisdiction provided that, to the extent it is legally permitted to do so, it gives the other party as much notice of such disclosure as possible and, where notice of disclosure is not prohibited and is given in accordance with this clause 12.5, it takes into account the reasonable requests of the other party in relation to the content of such disclosure.

12.6 A party may, provided that it has reasonable grounds to believe that the other party is involved in activity that may constitute a criminal offence under the Bribery Act 2010, disclose Confidential Information to the Serious Fraud Office without first informing the other party of such disclosure.

12.7 Each party reserves all rights in its Confidential Information. No rights or obligations in respect of a party's Confidential Information other than those expressly stated in this clause are granted to the other party, or to be implied from this agreement.

12.8 On termination or expiry of this agreement, each party shall:

(a) destroy or return to the other party all physical documents and materials (and any copies) containing, reflecting, incorporating or based on the other party's Confidential Information;

(b) erase or return all the other party's Confidential Information from the computer and communications systems and devices used by it, including such systems and data storage services provided by third parties (to the extent technically and legally practicable), provided that the Supplier may retain such Confidential Information in its back-up and disaster recovery environments for a minimum period of 12 months following termination or expiry of this agreement;

(c) ensure that any Confidential Information retained in accordance with paragraph (b) is not accessed, used or disclosed other than as necessary for back-up, disaster recovery or restoration purposes, is subject to the confidentiality obligations in this agreement, and is deleted in accordance with the Supplier’s applicable back-up retention procedures following the expiry of that minimum 12-month period; and

(d) certify in writing to the other party that it has complied with the requirements of this clause, provided that a recipient party may retain documents and materials containing, reflecting, incorporating or based on the other party's Confidential Information to the extent required by law or any applicable governmental or regulatory authority.

12.9 No party shall make, or permit any person to make, any public announcement concerning this agreement without the prior written consent of the other parties (such consent not to be unreasonably withheld or delayed), except as required by law, any governmental or regulatory authority (including, without limitation, any relevant securities exchange), any court or other authority of competent jurisdiction.

12.10 Except as expressly stated in this agreement, no party makes any express or implied warranty or representation concerning its Confidential Information.

12.11 The above provisions of this clause 12 shall continue to apply after termination or expiry of this agreement.

13. Indemnity

13.1 The Customer shall defend, indemnify and hold harmless the Supplier against claims, actions, proceedings, losses, damages, expenses and costs (including without limitation court costs and reasonable legal fees) arising out of or in connection with the Customer's use of the Services and/or Documentation, provided that:

(a) the Customer is given prompt notice of any such claim;

(b) the Supplier provides reasonable co-operation to the Customer in the defence and settlement of such claim, at the Customer's expense; and

(c) the Customer is given sole authority to defend or settle the claim.

13.2 The Supplier shall defend the Customer, its officers, directors and employees against any claim that the Customer's use of the Services or Documentation in accordance with this agreement infringes any United Kingdom patent effective as of the Effective Date, copyright, trade mark, database right or right of confidentiality, and shall indemnify the Customer for any amounts awarded against the Customer in judgment or settlement of such claims, provided that:

(a) the Supplier is given prompt notice of any such claim;

(b) the Customer does not make any admission, or otherwise attempt to compromise or settle the claim and provides reasonable co-operation to the Supplier in the defence and settlement of such claim, at the Supplier's expense; and

(c) the Supplier is given sole authority to defend or settle the claim.

13.3 In the defence or settlement of any claim, the Supplier may procure the right for the Customer to continue using the Services, replace or modify the Services so that they become non-infringing or, if such remedies are not reasonably available, terminate this agreement on 2 Business Days' notice to the Customer without any additional liability or obligation to pay liquidated damages or other additional costs to the Customer.

13.4 In no event shall the Supplier, its employees, agents and sub-contractors be liable to the Customer to the extent that the alleged infringement is based on:

(a) a modification of the Services or Documentation by anyone other than the Supplier; or

(b) the Customer's use of the Services or Documentation in a manner contrary to the instructions given to the Customer by the Supplier; or

(c) the Customer's use of the Services or Documentation after notice of the alleged or actual infringement from the Supplier or any appropriate authority.

13.5 The foregoing and clause 14.3(b) state the Customer's sole and exclusive rights and remedies, and the Supplier's (including the Supplier's employees', agents' and sub-contractors') entire obligations and liability, for infringement of any patent, copyright, trade mark, database right or right of confidentiality.

14. Limitation of liability

14.1 Except as expressly and specifically provided in this agreement:

(a) the Customer assumes sole responsibility for results obtained from the use of the Services and the Documentation by the Customer, and for conclusions drawn from such use. The Supplier shall have no liability for any damage caused by errors or omissions in any information, instructions or scripts provided to the Supplier by the Customer in connection with the Services, or any actions taken by the Supplier at the Customer's direction;

(b) all warranties, representations, conditions and all other terms of any kind whatsoever implied by statute or common law are, to the fullest extent permitted by applicable law, excluded from this agreement; and

(c) the Services and the Documentation are provided to the Customer on an "as is" basis.

14.2 Nothing in this agreement excludes the liability of the Supplier:

(a) for death or personal injury caused by the Supplier's negligence; or

(b) for fraud or fraudulent misrepresentation.

14.3 Subject to clause 14.1 and clause 14.2:

(a) the Supplier shall not be liable whether in tort (including for negligence or breach of statutory duty), contract, misrepresentation, restitution or otherwise for any loss of profits, loss of business, depletion of goodwill and/or similar losses or loss or corruption of data or information, or pure economic loss, or for any special, indirect or consequential loss, costs, damages, charges or expenses however arising under this agreement; and

(b) the Supplier's total aggregate liability in contract (including in respect of the indemnity at clause 13.2), tort (including negligence or breach of statutory duty), misrepresentation, restitution or otherwise, arising in connection with the performance or contemplated performance of this agreement shall be limited to the total Licence Fees paid for the User Licences during the 12 months immediately preceding the date on which the claim arose.

14.4 Nothing in this agreement excludes the liability of the Customer for any breach, infringement or misappropriation of the Supplier’s Intellectual Property Rights.

15. Term and termination

15.1 This agreement shall, unless otherwise terminated as provided in this clause 15, commence on the Effective Date and shall continue for the Initial Licence Term and, thereafter, this agreement shall be automatically renewed for successive periods of 12 months (each a Renewal Period), unless:

(a) either party notifies the other party of termination, in writing, at least 60 days before the end of the Initial Licence Term or any Renewal Period, in which case this agreement shall terminate upon the expiry of the applicable Initial Licence Term or Renewal Period; or

(b) otherwise terminated in accordance with the provisions of this agreement;

and the Initial Licence Term together with any subsequent Renewal Periods shall constitute the Licence Term.

15.2 Without affecting any other right or remedy available to it, either party may terminate this agreement with immediate effect by giving written notice to the other party if:

(a) the other party fails to pay any amount due under this agreement on the due date for payment and remains in default not less than 15 days after being notified in writing to make such payment;

(b) the other party commits a material breach of any other term of this agreement and (if such breach is remediable) fails to remedy that breach within a period of 30 days after being notified in writing to do so;

(c) the other party suspends, or threatens to suspend, payment of its debts or is unable to pay its debts as they fall due or admits inability to pay its debts or is deemed unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986 (IA 1986) as if the words "it is proved to the satisfaction of the court" did not appear in sections 123(1)(e) or 123(2) of the IA 1986;

(d) the other party commences negotiations with all or any class of its creditors with a view to rescheduling any of its debts, or makes a proposal for or enters into any compromise or arrangement with its creditors other than for the sole purpose of a scheme for a solvent amalgamation of that other party with one or more other companies or the solvent reconstruction of that other party;

(e) the other party applies to court for, or obtains, a moratorium under Part A1 of the Insolvency Act 1986;

(f) a petition is filed, a notice is given, a resolution is passed, or an order is made, for or in connection with the winding up of that other party other than for the sole purpose of a scheme for a solvent amalgamation of that other party with one or more other companies or the solvent reconstruction of that other party;

(g) an application is made to court, or an order is made, for the appointment of an administrator, or if a notice of intention to appoint an administrator is given or if an administrator is appointed, over the other party (being a company, partnership or limited liability partnership);

(h) the holder of a qualifying floating charge over the assets of that other party (being a company or limited liability partnership) has become entitled to appoint or has appointed an administrative receiver;

(i) a person becomes entitled to appoint a receiver over the assets of the other party or a receiver is appointed over the assets of the other party;

(j) a creditor or encumbrancer of the other party attaches or takes possession of, or a distress, execution, sequestration or other such process is levied or enforced on or sued against, the whole or any part of the other party's assets and such attachment or process is not discharged within 14 days;

(k) any event occurs, or proceeding is taken, with respect to the other party in any jurisdiction to which it is subject that has an effect equivalent or similar to any of the events mentioned in clause 15.2(c) to clause 15.2(j) (inclusive);

(l) the other party suspends or ceases, or threatens to suspend or cease, carrying on all or a substantial part of its business; or

(m) the other party's financial position deteriorates so far as to reasonably justify the opinion that its ability to give effect to the terms of this agreement is in jeopardy.

15.3 On termination of this agreement for any reason:

(a) all licences granted under this agreement shall immediately terminate and the Customer shall immediately cease all use of the Services and/or the Documentation;

(b) each party shall return and make no further use of any equipment, property, Documentation and other items (and all copies of them) belonging to the other party;

(c) the Supplier may destroy or otherwise dispose of any of the Customer Data in its possession unless the Supplier receives, no later than ten days after the effective date of the termination of this agreement, a written request for the delivery to the Customer of the then most recent back-up of the Customer Data. The Supplier shall use reasonable commercial endeavours to deliver the back-up to the Customer within 30 days of its receipt of such a written request, provided that the Customer has, at that time, paid all fees and charges outstanding at and resulting from termination (whether or not due at the date of termination). The Customer shall pay all reasonable expenses incurred by the Supplier in returning or disposing of Customer Data; and

(d) any rights, remedies, obligations or liabilities of the parties that have accrued up to the date of termination, including the right to claim damages in respect of any breach of the agreement which existed at or before the date of termination shall not be affected or prejudiced.

16. Force majeure

Neither party shall be in breach of this agreement nor liable for delay in performing, or failure to perform, any of its obligations under this agreement if such delay or failure result from events, circumstances or causes beyond its reasonable control. The time for performance of such obligations shall be extended accordingly. If the period of delay or non-performance continues for 60 days, the party not affected may terminate this agreement by giving 30 days' written notice to the affected party.

17. Conflict

If there is an inconsistency between any of the provisions in the main body of this agreement and the Schedules, the provisions in the main body of this agreement shall prevail.

18. Variation

No variation of this agreement shall be effective unless it is in writing and signed by the parties (or their authorised representatives).

19. Waiver

19.1 A waiver of any right or remedy is only effective if given in writing and shall not be deemed a waiver of any subsequent right or remedy.

19.2 A delay or failure to exercise, or the single or partial exercise of, any right or remedy shall not waive that or any other right or remedy, nor shall it prevent or restrict the further exercise of that or any other right or remedy.

20. Rights and remedies

Except as expressly provided in this agreement, the rights and remedies provided under this agreement are in addition to, and not exclusive of, any rights or remedies provided by law.

21. Severance

21.1 If any provision or part-provision of this agreement is or becomes invalid, illegal or unenforceable, it shall be deemed deleted, but that shall not affect the validity and enforceability of the rest of this agreement.

21.2 If any provision or part-provision of this agreement is deemed deleted under clause 21.1 the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.

22. Entire agreement

22.1 This agreement constitutes the entire agreement between the parties and supersedes and extinguishes all previous and contemporaneous agreements, promises, assurances and understandings between them, whether written or oral, relating to its subject matter.

22.2 Each party acknowledges that in entering into this agreement it does not rely on, and shall have no remedies in respect of, any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in this agreement.

22.3 Each party agrees that it shall have no claim for innocent or negligent misrepresentation or negligent misstatement based on any statement in this agreement.

22.4 Nothing in this clause shall limit or exclude any liability for fraud.

23. Assignment

23.1 The Customer shall not, without the prior written consent of the Supplier (not to be unreasonably withheld or delayed), assign, novate, transfer, charge, sub-contract or deal in any other manner with all or any of its rights or obligations under this agreement.

23.2 The Supplier may at any time assign, transfer, charge, sub-contract or deal in any other manner with all or any of its rights or obligations under this agreement.

24. No partnership or agency

Nothing in this agreement is intended to or shall operate to create a partnership between the parties, or authorise either party to act as agent for the other, and neither party shall have the authority to act in the name or on behalf of or otherwise to bind the other in any way (including, but not limited to, the making of any representation or warranty, the assumption of any obligation or liability and the exercise of any right or power).

25. Third party rights

This agreement does not confer any rights on any person or party (other than the parties to this agreement and, where applicable, their successors and permitted assigns) pursuant to the Contracts (Rights of Third Parties) Act 1999.

26. Counterparts

26.1 This agreement may be executed in any number of counterparts, each of which shall constitute a duplicate original, but all the counterparts shall together constitute the one agreement.

26.2 Transmission of the executed signature page of a counterpart of this agreement by email (in PDF, JPEG or other agreed format, including electronic digital signature) shall take effect as the transmission of an executed "wet-ink" counterpart of this agreement.

26.3 No counterpart shall be effective until each party has delivered to the other at least one executed counterpart.

27. Notices

27.1 Any notice given to a party under or in connection with this agreement shall be in writing and shall be:

(a) delivered by hand or by pre-paid first-class post or other next working day delivery service at its registered office (if a company) or its principal place of business (in any other case); or

(b) sent by email to the following addresses (or an address substituted in writing by the party to be served):

(i) RiskFlag Ltd: info@riskflag.com with a copy to mkeeble@riskflag.com.

(ii) Customer: the email address specified in the Proposal.

27.2 Any notice shall be deemed to have been received:

(a) if delivered by hand, at the time the notice is left at the proper address;

(b) if sent by pre-paid first-class post or other next working day delivery service, at 9.00 am on the second Business Day after posting; or

(c) if sent by email, at the time of transmission, or, if this time falls outside Business Hours in the place of receipt, when Business Hours resume.

27.3 This clause does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.

28. Governing law

This agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and interpreted in accordance with the law of England and Wales.

29. Jurisdiction

Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this agreement or its subject matter or formation (including non-contractual disputes or claims).

Personal Data Processing Addendum

This Personal Data Processing addendum (“Addendum”) forms part of this agreement and the parties agree to be bound by its terms in respect of the provision by the Supplier of the Services.

Definitions

Adequate Jurisdiction means a country or jurisdiction that is found by the European Commission or the United Kingdom to ensure an adequate level of data protection within the meaning of the Applicable Data Protection Laws and therefore does not require Standard Contractual Clauses.

Applicable Data Protection Laws: means any applicable laws regarding the Processing of Personal Data, including:

• To the extent the UK GDPR applies, the law of the United Kingdom or of a part of the United Kingdom which relates to the protection of personal data;

• To the extent the EU GDPR applies, the law of the European Union or any member state of the European Union to which the Supplier is subject, which relates to the protection of personal data;

and where applicable the guidance and codes of practice issued by the data protection authorities or others in connection with such laws, all as amended from time to time.

Applicable Laws means all applicable laws, statutes, regulation from time to time in force.

Customer Personal Data: means any personal data which the Supplier processes in connection with this Agreement, in the capacity of a processor on behalf of the Customer.

EU GDPR: means the General Data Protection Regulation ((EU) 2016/679), as it has effect in EU law.

Standard Contractual Clauses means (i) the standard contractual clauses adopted by the European Commission on 4 June 2021 for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“EU SCCs”); (ii) the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner’s Office and laid before the UK Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022 (the “UK Addendum to the EU SCCs”) and which came into force on 21 March 2022 , all as amended from time to time.

UK GDPR: has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.

Customer Personal Data

1. For the purposes of this Addendum, the terms controller, processor, data subject, personal data, personal data breach and processing shall have the meaning given to them in the UK GDPR. Save where expressly stated to the contrary herein, this Addendum is subject to the agreement for the provision of the Service and is incorporated into the agreement. Interpretations and defined terms set forth in the agreement apply to the interpretation of this Addendum unless otherwise defined herein.

2. Both parties will comply with all applicable requirements of Applicable Data Protection Laws including the Standard Contractual Clauses, where applicable, and shall not cause the other party to breach any of its applicable obligations under the Applicable Data Protection Laws and/or the Standard Contractual Clauses. This Addendum is in addition to, and does not relieve, remove or replace, a party's obligations or rights under Applicable Data Protection Laws and/or the Standard Contractual Clauses.

3. The parties have determined that, for the purposes of Applicable Data Protection Laws:

(a) the Supplier shall process the personal data as set out in Part 1 of this Addendum as processor on behalf of the Customer; and

(b) the Supplier shall act as controller of the personal data set out in Part 2 of this Addendum.

4. Should the determination in paragraph 3 change, the parties shall use all reasonable endeavours to make any changes that are necessary to this Addendum and to Part 1 and/or Part 2.

5. Without prejudice to the generality of paragraph 2, the Customer will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the Supplier Personal Data, to the extent applicable, and Customer Personal Data to the Supplier and lawful collection of the same by the Supplier for the duration and purposes of this agreement.

6. In relation to the Customer Personal Data, Part 1 sets out the scope, nature and purpose of processing by the Supplier, the duration of the processing and the types of personal data and categories of data subject.

7. Without prejudice to the generality of paragraph 2, the Supplier shall, in relation to Customer Personal Data:

(a) process that Customer Personal Data only on the documented instructions of the Customer, which shall be to process the Customer Personal Data for the purposes set out in Part 1 (Processing, personal data and data subjects) unless the Supplier is required by Applicable Laws to otherwise process that Customer Personal Data (purpose). Where the Supplier is relying on Applicable Laws as the basis for processing Customer Processor Data, the Supplier shall notify the Customer of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit the Supplier from so notifying the Customer on important grounds of public interest. The Supplier shall inform the Customer if, in the opinion of the Supplier, the instructions of the Customer infringe Applicable Data Protection Laws;

(b) implement appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Customer Personal Data and against accidental loss or destruction of, or damage to, Customer Personal Data, which are appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures;

(c) ensure that any personnel engaged and authorised by the Supplier to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory or common law obligation of confidentiality;

(d) assist the Customer insofar as this is possible (taking into account the nature of the processing and the information available to the Supplier), and at the Customer's cost and written request, in responding to any request from a data subject and in ensuring the Customer's compliance with its obligations under Applicable Data Protection Laws with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

(e) notify the Customer without undue delay on becoming aware of a personal data breach involving the Customer Personal Data;

(f) at the written direction of the Customer, delete or return Customer Personal Data and copies thereof to the Customer on termination of the Service Terms unless the Supplier is required by Applicable Law to continue to process that Customer Personal Data. For the purposes of this paragraph 7(f) Customer Personal Data shall be considered deleted where it is put beyond further use by the Supplier; and

(g) maintain records to demonstrate its compliance with the terms of this Addendum, and allow for reasonable audits by the Customer or the Customer's designated auditor, at the Customer’s expense for this purpose, on reasonable written notice.

8. The Customer provides its prior, general authorisation for the Supplier to:

(a) appoint processors to process the Customer Personal Data, provided that the Supplier:

(i) shall ensure that the terms on which it appoints such processors comply with Applicable Data Protection Laws, and are consistent with the obligations imposed on the Supplier in this Addendum and the agreement;

(ii) shall remain responsible for the acts and omission of any such processor as if they were the acts and omissions of the Supplier; and

(iii) shall inform the Customer of any intended changes concerning the addition or replacement of the processors.

9. The Supplier shall not transfer or otherwise process any Customer Personal Data across national borders without the Customer’s prior written consent. The Customer expressly agrees to the transfers of Customer Personal Data subject to compliance with this clause 9:

(a) To the extent Customer Personal Data is transferred from the European Economic Area (“EEA”) or the UK to a processor or Customer Affiliate in a non-Adequate Jurisdiction, the EU SCCs and the UK Addendum to the EU SCCs, as applicable will apply respectively. The Standard Contractual Clauses, i.e., the EU SCCs and the UK Addendum to the EU SCCs replace the European Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries;

(b) For the purposes of the Standard Contractual Clauses the following additional provisions shall apply:

(i) The Customer shall be regarded as the data exporter and the Supplier shall be regarded as the data importer;

(ii) the parties agree to observe the terms of the Standard Contractual Clauses without substantive modification; and

(iii) the parties’ signature to this agreement shall be considered as a signature for the Standard Contractual Clauses.

(c) Except where expressly required by the Standard Contractual Clauses or under this Addendum, the Supplier shall not permit any third party to have access to Customer Personal Data transferred to the Supplier by the Customer without the prior consent of the Customer.

(d) In the event of any conflict between the provisions of (1) the Standard Contractual Clauses; and (2) the remaining terms of this Addendum, then the Standard Contractual Clauses, or any replacement thereof, shall take precedence. The terms of this Addendum shall not vary the Standard Contractual Clauses in any way.

10. Either party may, at any time on not less than 30 days' notice, revise this Addendum by replacing it with any applicable controller to processor standard clauses or similar terms forming part of an applicable certification scheme (which shall apply when replaced by attachment to this Addendum).

11 The Supplier 's liability for losses arising from breaches of this Addendum shall be limited as set out in clauses 13.1 and 13.2 of the agreement.

12. This Addendum will remain in full force and effect so long as:

(a) the agreement remains in effect; or

(b) The Supplier otherwise retains any of the Customer Personal Data related to the Service in its possession or control pursuant to Applicable Laws.

13. Any provision of this Addendum that expressly or by implication should come into or continue in force on or after termination of the agreement in order to protect the Customer Personal Data will remain in full force and effect.

Part 1

Personal Data processing purposes and details

Subject matter of processing: Provision of Services

Duration of Processing: Throughout the Term of this Agreement

Nature of Processing: To enable the Software to fully function in the provision of the Services.

Personal Data Categories: name(s); email address(es); social media handles and comments on social media feeds

Data Subject Types: individuals

Sub-processors

Please see the list of Sub-processors.

Part 2

All personal data which is not included in Part 1.