Cloud Hosting Terms of Service Verito Inc.

2. General Provisions; Order documents

(a) Service and System Control. Except as otherwise expressly provided in this Agreement, as between the Parties: (i) Provider has and will retain control over the operation, provision, maintenance, and management of the Provider's systems; and (ii) Customer has and will retain control over the operation, maintenance, and management of, and all access to and use of, the customer systems, and sole responsibility for all access to and use of the Provider Materials by any person by or through the Customer Systems or any other means controlled by Customer or any Authorized User, including any: (i) information, instructions, or materials provided by any of them to the Services or Provider; (ii) results obtained from any use of the Services or Provider Materials; and (iii) conclusions, decisions, or actions based on such use.

(b) Authorized Users/Contacts. "Authorized Contact" means an individual or individuals designated by Customer on its account as authorized to request or approve billable changes or other modifications to Customer's account or the scope of Services. If Customer designates one or more Authorized Contacts, only those individuals may request or approve billable changes or other modifications to Customer's account or Services. Customer may add or remove Authorized Contacts by written notice from an existing Authorized Contact. An "Authorized User" is authorized only to access and use the Services and may not modify Customer's account or incur additional charges unless that individual is also an Authorized Contact.

(c) Order Documents; Acceptance. Provider may provide or make available one or more Order Documents relating to the Services, and the Parties may enter into one or more SOWs or other Order Documents for the provision of specific Services. An SOW may incorporate one or more other Order Documents. Customer's execution or acceptance of an SOW, onboarding agreement, Order Document, or other agreement that incorporates or references this Agreement, or Customer's access to or use of the Services, constitutes Customer's acceptance of and agreement to be bound by this Agreement, which is available at https://verito.com/cloud-terms-of-service/ or upon request.

"Order Documents" are any quote, proposal, SOW, onboarding agreement, order form, service order, invoice, or similar written or electronic commercial document provided or made available by Provider to Customer that sets forth, describes, or identifies the Services, or any applicable service specifications, Service Tier, Authorized Users, quantities, Fees, commencement dates, service scope, term, or other commercial terms offered to or ordered by Customer.

(d) Fee Disclosure. The applicable Order Documents will itemize recurring fees, one-time fees, minimum user or device commitments, dedicated-environment fees, setup or onboarding fees, included resources, and rates for additional users, applications, storage, devices, or professional services. Provider will provide Customer with advanced notice of any change in the amount to be charged to Customer outside of the amount stated in the applicable Order Documents. Added users or devices may be prorated from activation through the current Service Period. Reductions take effect at the next renewal, subject to a minimum expressly stated in the Order Documents. Provider may change recurring rates with at least thirty (30) days' written notice. Changes take effect at the next monthly renewal or the next annual renewal, as applicable. Fixed subscription rates will not increase during a prepaid annual period except for taxes or identified third-party pass-through charges.

3. Access and Use

(a) Provision of Access. Subject to and conditioned on Customer's payment of fees and compliance with all the terms and conditions of this Agreement, Provider hereby grants Customer a non-exclusive, non-transferable right to access and use the Services during the Term, solely for use by Authorized Users in accordance with the terms and conditions herein. Such use is limited to Customer's internal use. Provider shall provide to Customer the necessary passwords and network links or connections to allow Customer to access the Services. The total number of Authorized Users will not exceed the number as mentioned in the attached Order Documents and invoice for Services.

(b) Documentation License. Subject to the terms and conditions contained in this Agreement, Provider hereby grants to Customer a non-exclusive, non-transferable license to use the Documentation during the Term solely for Customer's internal business purposes in connection with its use of the Services.

(c) Unacceptable Use. Provider reserves the right, in its sole discretion, to remove any content for any reason, including any violation of applicable law or of the use restrictions and limitations set forth in this Agreement. The examples of prohibited conduct described in this Section 3 relate to content, use, and operation of the Services that Provider considers inappropriate and therefore prohibits. These examples are illustrative and not exhaustive. If Customer is unsure whether any contemplated use or action is permitted, Customer should contact a Provider representative. Provider's right to remove inappropriate content, suspend the account, terminate the account, and pursue any other remedy available under this Agreement does not obligate Provider to monitor or supervise Customer, any Authorized User, or any End User.

(d) Use Restrictions. Customer shall not use the Services for any purposes beyond the scope of the access granted in this Agreement. Customer shall not at any time, directly or indirectly, and shall not permit any Authorized Users to: (i) copy, modify, or create derivative works of the Services or Documentation, in whole or in part; (ii) rent, lease, lend, sell, license, sublicense, assign, distribute, publish, transfer, or otherwise make available the Services or Documentation; (iii) reverse engineer, disassemble, decompile, decode, adapt, or otherwise attempt to derive or gain access to any software component of the Services, in whole or in part; (iv) remove any proprietary notices from the Services or Documentation; or (v) use the Services or Documentation in any manner or for any purpose that intentionally infringes, misappropriates, or otherwise violates any intellectual property right or other right of any person, or that violates any applicable law.

(e) End User License Agreements. Customer shall not reverse engineer, decompile, translate, disassemble, attempt to discover the source code of, or in any other way manipulate any Provider service, RDP Application, or third party application in order to "break" or use it outside of this Agreement for that particular Application or software, or ask that Provider assist in or complete such actions on behalf of the Customer. Customer agrees that they are solely responsible for the content of any material posted to their Application, and that no End User will attempt to access programs, options, settings, services, files, applications, or servers not within their user rights. Customer is solely responsible for any damages, whether technically, virtually, physically, or financially to a software, application, or Provider service, that derives from tampering by an End User breaking or attempting to break the terms of acceptable use for a particular service, software, or application. At no time may the Customer share user credentials, license numbers, or any other applicable information used to access Provider Services or third-party applications. All login credentials and license information should directly and accurately reflect the proper names, amounts, and versions of both the end users and software/applications being utilized by the Customer. If the Customer is found to be performing any of the aforementioned actions or soliciting the services of Provider in performing these actions, Provider reserves the right to cancel the existing contract with the Customer immediately with no refund.

(f) Piracy. Customer shall not license, sub-license, distribute, or disclose the use of their Application(s) to any third party, or use their Application(s) for any purpose other than accessing the Customer's own data in accordance with this Agreement. At no time may the Customer share user credentials, license numbers, or any other applicable information used to access Provider services or third-party applications. All login credentials and license information should directly and accurately reflect the formal names, amounts, and versions of both the end users and software/applications being utilized by the Customer. If the Customer is found to be performing any of the aforementioned actions or soliciting the services of Provider in performing these actions, Provider shall view these actions as piracy and can cancel the existing contract with the Customer immediately with no refund.

(g) No High-Risk Use. Customer acknowledges that the Services are not fault-tolerant and are not guaranteed to be error-free or to operate uninterrupted. You shall not use the Services in any application or situation where the Services' failure could lead to death or serious bodily injury of any person, or to severe physical or environmental damage ("High Risk Use"). High Risk Use does not include utilization of the Services for administrative purposes, to store configuration data, engineering and/or configuration tools, or other non-control applications, the failure of which would not result in death, personal injury, or severe physical or environmental damage. Customer agrees to indemnify and hold harmless Provider from any third-party claims arising out of Customer's use of the Services in connection with any High-Risk Use.

(h) Customer Liability. Customer is solely responsible for damages resulting from their actions relating to the use of the Provider's Services under this Agreement, and those damages will be subject to the obligations of indemnification set forth herein. Our hosting of any software solution Services or Customer Data does not relieve You of Your responsibility or obligation to indemnify Provider pursuant to the terms of this Agreement and any Service Level Agreements.

(i) Reservation of Rights. Provider reserves all rights not expressly granted to Customer in this Agreement. Except for the limited rights and licenses expressly granted under this Agreement, nothing in this Agreement grants, by implication, waiver, estoppel, or otherwise, to Customer or any third party any intellectual property rights or other right, title, or interest in or to the Provider IP.

(j) Suspension. Notwithstanding anything to the contrary in this Agreement, Provider may temporarily suspend Customer's and any Authorized User's access to any portion or all of the Services if: (i) Provider reasonably determines that (A) there is a threat or attack on any of the Provider IP; (B) Customer's or any Authorized User's use of the Provider IP disrupts or poses a security risk to the Provider IP or to any other customer or vendor of Provider; (C) Customer, or any Authorized User, is using the Provider IP for fraudulent or illegal activities; (D) subject to applicable law, Customer has ceased to continue its business in the ordinary course, made an assignment for the benefit of creditors or similar disposition of its assets, or become the subject of any bankruptcy, reorganization, liquidation, dissolution, or similar proceeding; or (E) Provider's provision of the Services to Customer or any Authorized User is prohibited by applicable law; or (ii) any vendor of Provider has suspended or terminated Provider's access to or use of any Third Party services or products required to enable Customer to access the Services. Provider shall use commercially reasonable efforts to provide written notice of any Service Suspension to Customer before any Service Suspension and to provide updates regarding resumption of access to the Services following any Service Suspension. Provider shall use commercially reasonable efforts to resume providing access to the Services as soon as reasonably possible after the event giving rise to the Service Suspension is cured. Provider will have no liability for any damage, liabilities, losses (including any loss of data or profits), or any other consequences that Customer or any Authorized User may incur as a result of a Service Suspension. This Section does not limit any of Provider's other rights or remedies, whether at law, in equity, or under this Agreement.

(k) Third Party Products. Provider may from time to time make Third Party Products available to Customer. For purposes of this Agreement, such Third-Party Products are subject to their own terms and conditions. If Customer does not agree to abide by the applicable terms for any such Third-Party Products, then Customer should not install or use such Third Party Products.

(l) Third Party Application Hosting. Virtual Server contracts are issued with a set number of third-party applications, each additional application that Customer would like installed on the server will be billed according to the following criteria:

• (i) All server applications must be installed by the Provider; no users on the system can install applications. Customers must ask the Provider to install applications on their behalf and the Provider will only install properly licensed applications. Each additional application will be an additional charge. Customers who violate this requirement are solely responsible for any consequences or liability.
• (ii) Provider does not guarantee the functionality of any third-party applications. There will be no refunds by Provider should an app not function to Customer's satisfaction. An application is anything that requires an installation. If Customer is hosting a tax software, all years of that same tax application count as one single application. Each separate application is counted individually. Customer will be notified when resources have been added to maintain stability after addition of Users, Applications or other Services that Provider had authorization to add. Customer will be notified of the additional costs and given an opportunity to approve or decline, after which the resources will be removed. However, if the Customer declines, Provider's standard SLA (Service Level Agreement) for technical issues cannot be honored, as the actions Provider deemed fit to resolve issues have been reversed.

4. Customer Obligations

(a) General. Customer is responsible and liable for all uses of the Services and Documentation resulting from access provided by Customer, directly or indirectly, whether such access or use is permitted by or in violation of this Agreement. Without limiting the generality of the foregoing, Customer is responsible for all acts and omissions of Authorized Users, and any act or omission by an Authorized User that would constitute a breach of this Agreement if taken by Customer will be deemed a breach of this Agreement by Customer. Customer shall use reasonable efforts to make all Authorized Users aware of this Agreement's provisions as applicable to such Authorized User's use of the Services, and shall cause Authorized Users to comply with such provisions.

(b) Consequences for Breaching Restrictions or Obligations. Customer agrees that they are solely responsible for the content of any material posted to their Application, and that no end-user will attempt to access programs, options, settings, services, files, applications, or servers not within their user rights. At no time may the Customer share user credentials, license numbers, or any other applicable information used to access Provider Services or third-party applications. All login credentials and license information should directly and accurately reflect the proper names, amounts, and versions of both the end users and software/applications being utilized by the Customer. If the Customer is found to be performing any of the aforementioned actions or soliciting the services of Provider in performing these actions, Provider reserves the right to cancel the existing contract with the Customer immediately with NO refund.

(c) Security. Customer shall adhere to the following security protocols:

• (i) Login Information Assignment. You agree that upon the assignment of Your login information such as a username and password that You will maintain the confidentiality of Your account information and assume all responsibility of and from any loss, theft or other destruction of any data as the result of any access to Your account via the use of Your login information. You further agree to defend and indemnify and hold harmless Provider of and from any and all third party claims, causes of action, demands, costs, damages including both direct and consequential damages, specifically including attorney's fees and costs, expert fees and costs and mediation and/or arbitration fees and costs incurred (whether paid or not) as the result of any claim for damages in any way related to the disclosure of your confidential login information. Choice of counsel remains exclusively that of Provider.
• (ii) Login Information; Protection/Password Strength. You are solely responsible for ensuring that your login information is utilized only by You. Your responsibility includes ensuring the secrecy and strength of your passwords. Provider shall have no liability resulting from the unauthorized use of Your login information. If you use weak passwords or do not change your password frequently, you increase the risk of your password being discovered by unauthorized parties. If login information is lost, stolen, or used by unauthorized parties or if You believe that your hosted data has been accessed by unauthorized parties, it is Your responsibility to notify Provider to request the login information be reset or unauthorized access otherwise be prevented. Provider will use commercially reasonable efforts to affect such requests as soon as practicable after their receipt. Provider will use commercially reasonable efforts to notify Customer's primary contact in the event of a confirmed security breach within two (2) days of Provider's knowledge of the breach. Provider requires all applications with Personal Data, including but not limited to the RDP Application and ATX Application, be password protected.
• (iii) Unauthorized Use; Prohibition on Sharing Credentials. Customer is responsible for all activity occurring under Customer's, Customer's clients, or any End User accounts and shall take commercially reasonable efforts to comply with all applicable laws and regulations in connection with Customer's use of the Services, including but not limited to those related to data privacy, international communications, the transmission of technical or personal data and export control laws and regulations. Customer shall: (i) notify Provider immediately of any unauthorized use of any password or account or any other known or suspected breach of security with respect to the Services; (ii) report to Provider immediately and use reasonable efforts to stop immediately any copying or distribution or misuse of any content, Provider's RDP Application or technology, Services or deliverable that becomes known or suspected by Customer's, Customer's clients, or any End User accounts; (iii) not impersonate another Provider user or provide false identity information to gain access to or use the Services. Customer shall not share its login credentials with another geo-location site. Each site must have its own login credentials.
• (iv) Security Protocol Violation. If Customer violates any of these security protocols, such violation shall be considered a breach of contract. Provider retains all rights to disable and the right to restrict access to all data until Customer becomes compliant with the terms in this Agreement. Customer remains solely responsible for any claims or causes of actions related to any violations of this Section.

5. Service Levels

(a) Service Levels. Subject to the terms and conditions of this Agreement, Provider will use commercially reasonable efforts to make the contracted Services available as described in the applicable exhibit or Order Document, but in all cases, at least 99.95% of the time as measured over the course of each calendar month during the Term (each such calendar month, a "Service Period"), excluding unavailability as a result of applicable Exceptions (the "Availability Requirement"). "Service Level Failure" means a material failure of the Services to meet the Availability Requirement. "Available" means the Services are available for access and use by Customer and its Authorized Users over the Internet and operating in material accordance with the Specifications. See Exhibit B for a breakdown of Service Level calculations.

(b) Exceptions. For purposes of calculating the availability requirement, the following are "Exceptions" to the availability requirement, and neither the Services will be considered unavailable nor any Service Level Failure be deemed to occur in connection with any failure to meet the Availability Requirement or impaired ability of Customer or its Authorized Users to access or use the Services that is due, in whole or in part, to any: (a) act or omission by Customer or any Authorized User/access to or use of the Services by Customer or any Authorized User, or using Customer's or an Authorized User's Access Credentials, which does not strictly comply with this Agreement and the Specifications; (b) Customer Failure; (c) Customer's or its Authorized User's Internet connectivity; (d) Force Majeure Event; (e) failure, interruption, outage, or other problem with any software, hardware, system, network, facility, or other matter not supplied by Provider pursuant to this Agreement; (f) scheduled downtime; or (g) disabling, suspension, or termination of the Services permitted by the terms of this Agreement. "Customer Failure" means any act or omission of Customer or an Authorized User, or any failure of Customer Systems, Customer Data, a hosted application, or another Third-Party Product outside Provider's reasonable control, that causes or contributes to a delay, interruption, or degradation of the Services.

(c) Service Level Failures and Remedies. In the event of a Service Level Failure, Provider may issue a credit to Customer for the Services lost due to the Service Level Failure occurred (each a "Service Credit"), subject to the following:

• Provider has no obligation to issue any Service Credit unless: (i) Customer reports the Service Failure to Provider immediately on becoming aware of it; and (ii) requests such Service Credit in writing within 30 days of the Service Level Failure;
• in no event will a Service Credit for any Service Period exceed 100% percent of the total Fees that would be payable during that Service Period; and
• Any Service Credit payable to Customer under this Agreement will be issued within three months following the Service Period in which the Failure occurred.

6. Hosting and Support

(a) General. Subject to the terms and conditions of this Agreement, Provider, or its designee (which may include, without limitation, its Affiliates and employees), will host and provide Customer and its Authorized Users remote access over the Internet, via RDP, to Provider's hosted desktop environment and the applications Provider makes available to Customer thereunder (the "RDP Application"). Provider does not guarantee any third-party applications, and Customer must maintain proper licenses for all third-party applications and provide the applicable license numbers to Provider upon request; provided that Provider will ensure that any integrations Provider makes to third-party applications function as intended.

(b) Hours of Availability. Provider shall use commercially reasonable efforts to make the RDP services available twenty-four (24) hours per day, seven (7) days a week. Notwithstanding the foregoing, Provider reserves the right to suspend Customer's access to the RDP Application (i) in the event that Customer materially fails to fulfill its obligations under this Agreement, (ii) for purposes of scheduled maintenance, or (iii) for purposes of emergency maintenance work at any time as deemed appropriate by Provider.

(c) License. Subject to the terms and conditions of this Agreement (including the Authorized User limits in Section 3(a) and the use restrictions in Section 3(d)), Provider grants Customer, during the Term, a non-exclusive, non-transferable, non-sublicensable, royalty-free license to access and use the RDP Application solely to receive and use the Services in accordance with this Agreement. Customer may permit its Authorized Users, and, to the extent expressly permitted in the applicable Order Document, its clients (each as an End User), to access the RDP Application under this license. Customer remains responsible and liable for all access to and use of the RDP Application by any End User as provided in Section 4.

(d) Support Availability. Provider will accept support requests twenty-four (24) hours per day, 365 days per year through the channels identified on its support page. Contractual response commitments are limited to those stated in Exhibit B or the applicable Order Document. "Initial Response" means acknowledgment and initial assessment by a support representative after Provider receives sufficient information to investigate. It does not mean final resolution. Resolution targets pause while Provider reasonably awaits Customer information, access, approval, a third-party vendor, or completion of an approved maintenance window.

(e) Protection of Customer Data and Confidential Information. Provider will use commercially reasonable efforts to ensure that its facilities, computer systems, and networks are maintained in a secure environment as to protect Customer Data and Confidential Information against unauthorized access, use, or disclosure. Such efforts shall, at a minimum, use protections generally accepted by industry standard and comply with all Applicable Data Protection Laws.

7. Fees and Payment

(a) Fees. Customer shall pay Provider the fees ("Fees") as set forth in Exhibit A or applicable Order Document. If Customer fails to make any payment when due, without limiting Provider's other rights and remedies: (i) Provider may charge a fifty dollar ($50) late fee if the payment is overdue for more than a month; (ii) Customer shall reimburse Provider for all reasonable costs incurred by Provider in collecting any late payments or interest, including reasonable attorneys' fees, court costs, and collection agency fees; and (iii) if such failure continues, Provider may suspend Customer's and its Authorized Users' access to any portion or all of the Services until such amounts are paid in full.

(b) Taxes. All Fees and other amounts payable by Customer under this Agreement are exclusive of taxes and similar assessments. Customer is responsible for all sales, use, and excise taxes, and any other similar taxes, duties, and charges of any kind imposed by any federal, state, or local governmental or regulatory authority on any amounts payable by Customer hereunder, other than any taxes imposed on Provider's income.

(c) Auditing Rights and Required Records. Customer agrees to maintain complete and accurate records in accordance with generally accepted accounting principles during the Term and for a period of at least six months after the termination or expiration of this Agreement with respect to matters necessary for accurately determining amounts due hereunder. Provider may, at its own expense, on reasonable prior notice, periodically inspect and audit Customer's records with respect to matters covered by this Agreement, provided that if such inspection and audit reveals that Customer has underpaid Provider with respect to any amounts due and payable during the Term, Customer shall promptly pay the amounts necessary to rectify such underpayment, together with interest. Customer shall pay for the costs of the audit if the audit determines that Customer's underpayment equals or exceeds 10% for any quarter. Such inspection and auditing rights will extend throughout the Term of this Agreement and for a period of six months after the termination or expiration of this Agreement.

8. Privacy

(a) Scope of Confidential Information. From time to time during the Term, either Party may disclose or make available to the other Party information about its business affairs, products, confidential intellectual property, trade secrets, third-party confidential information, Personal Data, Customer Information, and other sensitive or proprietary information, whether disclosed orally or in written, electronic, or other form or media, and whether or not marked, designated, or otherwise identified as "confidential" (collectively, "Confidential Information"). Confidential Information does not include information that, at the time of disclosure: (i) is in the public domain; (ii) is known to the receiving Party at the time of disclosure; (iii) is rightfully obtained by the receiving Party on a non-confidential basis from a third party; or (iv) is independently developed by the receiving Party without use of or reference to the disclosing Party's Confidential Information. The receiving Party shall take all reasonable precautions necessary to safeguard the Confidential Information, including, at a minimum, those it takes to protect its own Confidential Information and in no event less than a reasonable standard of care, and in compliance with all applicable data security and privacy laws. The receiving Party will not use any trade secrets or Confidential Information in any way to compete (directly or indirectly) with the disclosing Party or any of its Affiliates, or in any other manner adverse to the disclosing Party. The receiving Party shall not disclose the disclosing Party's Confidential Information to any person or entity, except to the receiving Party's Representatives who have a need to know it for the receiving Party to exercise its rights or perform its obligations under this Agreement and who are bound by confidentiality obligations at least as protective as those in this Section 8; the receiving Party is responsible for any breach of this Section 8 by its Representatives. Notwithstanding the foregoing, each Party may disclose Confidential Information to the limited extent required (i) to comply with the order of a court or other governmental body, or as otherwise necessary to comply with applicable law, provided that the disclosing Party shall first, to the extent legally permitted, give the other Party written notice and a reasonable opportunity to seek a protective order; or (ii) to establish a Party's rights under this Agreement, including making required court filings. In each case, the Party compelled to disclose must limit the disclosure to that which is legally required. On expiration or termination of this Agreement, the receiving Party shall, at the disclosing Party's option, promptly return or destroy all copies of the disclosing Party's Confidential Information and, if requested, certify such destruction in writing; provided that the receiving Party may retain Confidential Information (A) contained in routine backup, disaster-recovery, or archival systems, or (B) to the extent required by applicable law, in each case subject to the obligations of this Section 8 for as long as such copies are retained. Customer Data will be retained, released, and deleted in accordance with Sections 17 and 18. Each Party's obligations of non-disclosure with regard to Confidential Information will survive the termination or expiration of this Agreement for a period of five (5) years thereafter; provided that (i) with respect to trade secrets, such obligations continue for as long as the information remains subject to trade secret protection under applicable law, and (ii) with respect to Personal Data and Customer Information, such obligations continue for as long as such information remains in the possession or control of the receiving Party.

(b) Third Party Providers. Some components of the Services or the Provider Materials may be provided through or licensed from third parties. Customer's use of all such components is subject to the terms of this Agreement. Provider may be obligated to provide certain information to those third parties regarding the Services and/or regarding your identity. In such instances, Provider will disclose only the minimum information reasonably necessary, will require the recipient to maintain the confidentiality of such information consistent with this Section 8, and will notify Customer of the disclosure where permitted by applicable law and the relevant third-party terms.

(c) Customer Information. "Customer Information" means all personally identifiable financial information (as defined by the Gramm-Leach-Bliley Financial Services Modernization Act of 1999 and its implementing regulations (the "GLB Act")), and any listings, descriptions, or other groupings of such information, about the clients or customers of a Party or its Affiliates that: (i) is provided by Customer to Provider; or (ii) is collected or acquired by Provider in connection with this Agreement. Customer Information is Confidential Information and is subject to the additional protections of this Section 8(c); it will be protected for as long as it remains in the possession or control of Provider and is not subject to the five (5)-year limitation in Section 8(a). Provider will access, use, and disclose Customer Information only in compliance with the GLB Act, all other applicable privacy and data-protection laws and regulations, applicable industry data-security standards, and the terms of this Agreement, and will protect Customer Information using no less than the standard of care it uses to protect its own confidential information of like kind (and in no event less than a reasonable standard of care). Provider will ensure that its Representatives comply with this Section 8(c). The obligations of this Section 8(c) will not be affected by bankruptcy, receivership, assignment, attachment, or seizure proceedings, or by a trustee in bankruptcy, debtor-in-possession, or the equivalent of any of the foregoing under applicable law.

(d) Permitted Access to and Use of Customer Data. Provider will access, use, and process Customer Data only as necessary to: (i) provide, maintain, secure, monitor, and support the Services; (ii) prevent, detect, investigate, or address technical, security, fraud, or integrity issues, including through automated tooling; (iii) act in accordance with Customer's or an Authorized User's instructions or requests, including support requests; (iv) comply with applicable law or valid legal process; and (v) as otherwise described in the Data Processing Addendum located at https://verito.com/data-processing-agreement/ and incorporated into this Agreement (the "DPA"). Provider will not access, use, sell, or disclose Customer Data for any other purpose without Customer's prior authorization, except as expressly permitted by this Agreement.

(e) Aggregated and De-Identified Data. Notwithstanding anything to the contrary, Provider may collect, generate, and use aggregated, anonymized, and de-identified data derived from the operation or use of the Services, including Provider's system-generated operational logs, metrics, and analytics to operate, secure, analyze, develop, and improve the Services and Provider's other products and offerings, provided that such data is maintained in a form that does not identify Customer, any Authorized User, or any individual, and Provider does not disclose such data in a manner that identifies Customer. As between the Parties, Provider owns all such aggregated and de-identified data.

(f) Data Processing; Roles of the Parties. As between the Parties, with respect to any Personal Data contained in Customer Data, Customer (or its applicable clients) is the Data Controller and Provider is the Data Processor, and Provider will Process such Personal Data only in accordance with this Agreement, the applicable Order Document, and Customer's documented instructions. The Parties' Processing of Personal Data is further governed by the DPA. In the event of any conflict between this Section 8 and the DPA with respect to the Processing of Personal Data, the DPA controls.

(g) Provider Privacy Policy. Provider's collection, use, and disclosure of Personal Data that Provider collects directly about Customer, its Authorized Users, and visitors to Provider's websites—including account, billing, and contact information and information collected through Provider's websites and support channels, as distinct from Customer Data hosted within the Services—is described in Provider's Privacy Policy, available at https://verito.com/privacy-policy/.

(h) Affiliates and Subprocessors. This Section 8(h) govern Provider's use of its Affiliates and subprocessors; Section 8(b) addresses unaffiliated third-party licensors and vendors. Customer acknowledges and agrees that Provider may engage its Affiliates located outside the United States to perform or assist in the performance of the provision of the Services, including technical support, and to access and Process Customer Data and Personal Data in connection therewith. Provider will engage each such Affiliate and subprocessor under a written agreement that imposes confidentiality, data-protection, and security obligations at least as protective as those in this Agreement and the DPA.

9. Security

(a) Security Generally. Provider has hardware firewall and Trend Micro Deep security installed on the server level. Provider also employs a strong password policy and password expiration policy. Provider will use any other commercially reasonable efforts to employ measures it deems appropriate to endeavor to mitigate security risks with respect to its Services, but does not guarantee that any Service, or the use thereof, or any data stored, transferred, disseminated or otherwise used through or using a Service, will be secure, including against accidental or unlawful loss, access or disclosure.

(b) Customer Control and Responsibility. Customer has and will retain sole responsibility for: (a) all Customer Data, including its content and use; (b) all information, instructions, and materials provided by or on behalf of Customer or any Authorized User in connection with the Services; (c) Customer's information technology infrastructure, including computers, software, databases, electronic systems (including database management systems), and networks, whether operated directly by Customer or through the use of third party services ("Customer Systems"); (d) the security and use of Customer's and its Authorized Users' Access Credentials; and (e) all access to and use of the Services and Provider Materials directly or indirectly by or through the Customer Systems or its or its Authorized Users' Access Credentials, with or without Customer's knowledge or consent, including all results obtained from, and all conclusions, decisions, and actions based on, such access or use.

(c) Access and Security Responsibilities of Customer. Customer shall employ all physical, administrative, and technical controls, screening, and security procedures and other safeguards necessary to: (a) securely administer the distribution and use of all Access Credentials and protect against any unauthorized access to or use of the Services; and (b) control the content and use of Customer Data.

(d) Security Cooperation. Each Party will reasonably cooperate in investigating and responding to a suspected or confirmed Security Incident. Nothing in this Agreement requires either Party to delay any notification, report, or action required by applicable law. Provider's ordinary investigation, containment, and remediation of a suspected incident affecting Provider-managed systems is included in the Services. Provider may charge for forensic work involving Customer-managed systems, unsupported third-party systems, litigation support, regulator assistance, or services outside Provider's standard incident-response obligations only after providing a written estimate and receiving approval from an Authorized Contact. Security Incident notification and cooperation will otherwise be governed by the DPA, which controls in the event of conflict.

10. Maintenance

(a) Scheduled Maintenance. The maintenance protocols will be hosted and updated as needed on the Provider's website. If there are any inconsistencies between the maintenance protocols described herein and the protocols described on the website, the protocols on the website shall be controlling. In order to keep Provider infrastructure up-to-date and performing optimally, Provider will perform scheduled maintenance from time to time. Provider performs system maintenance every Sunday night midnight EST from 00:00 hours Monday - 00:15 hours. Outside of the regular scheduled maintenance, should there be any updates that are necessary, or system reboots, or other software adjustments not regularly scheduled, Provider will inform the Customer via email and will request the customers preferred time to employ these, but is not obligated to conform the customer's request. Provider is not responsible for the loss of hours in connectivity for the Customer or the Customers' Customers during scheduled maintenance, and a reasonable effort will be made by Provider to schedule all maintenance during off-peak, or weekend hours in order to minimize the impact to our Customers.

(b) Unscheduled Maintenance. The Provider's maintenance protocols may change from time to time and the Provider will keep the most updated protocol on the Provider's website. If there are any conflicts or inconsistencies between the maintenance protocols on the website and the protocols herein, the website's descriptions shall be controlling. In the event of unforeseen outages, service impacting issues, and other emergency maintenance that Provider deems necessary, unscheduled maintenance may need to be performed in order to restore services, or repair underlying hardware and software. Provider will make every reasonable effort to limit the amount of time that the Customer's services are unavailable, up to the time allowed for by our Service Level Agreement, and proper updates and notifications will be provided as deemed necessary by Provider. After any such unscheduled maintenance is performed, Provider will provide a Post Incident Report to the affected Customers that will give a brief summary of the cause and the resolution of the unscheduled maintenance.

(c) Backup. Provider will schedule and monitor automated backup jobs of the Hosted Environment as described in Exhibit C or as otherwise provided for in the applicable Order Document. Available successfully completed recovery points will be retained on a rolling basis for sixty (60) calendar days for VeritSpace Essentials and Pro and ninety (90) calendar days for VeritSpace Elite, unless the applicable Order Document expressly states otherwise. Provider's backup schedule for the Hosted Environment is designed to a recovery point objective of twenty-four (24) hours ("RPO"), meaning the maximum interval between successfully completed recovery points under normal operation. Following data loss or corruption within Provider's managed environment, Provider will use commercially reasonable efforts to restore the Hosted Environment from the most recent available recovery point within a recovery time objective of two (2) hours ("RTO"), measured from Provider's confirmation of the restoration request. The RPO and RTO are performance objectives, not guarantees. Failure to meet the RPO or RTO does not constitute a Service Level Failure and does not entitle Customer to a Service Credit under Section 5. The RTO does not include time attributable to Customer Failure, Customer's or an Authorized User's Internet connectivity, Third-Party Products, restoration of individual files at Customer's request, or a Force Majeure Event. Provider will use commercially reasonable efforts to restore Customer Data from an available recovery point following data loss, corruption, or a Customer request. Restoration required because of a failure within Provider's managed environment is included in the Services. Restoration requested because of Customer or Authorized User action may be billable only after Provider discloses the applicable charge and an Authorized Contact approves it. Backups are intended for operational recovery and are not an archival or legal records-retention service. Provider does not warrant that every individual file, transaction, version, or recovery point will be recoverable in every circumstance. Customer remains responsible for legal and business retention requirements extending beyond the purchased retention period. Without limiting the foregoing, Provider shall not be liable for any loss of data caused by, or resulting from, (i) acts or omissions of Customer or any Authorized User, (ii) any third-party software, hardware, system, or service not provided by Provider, or (iii) any cause outside of Provider's reasonable control.

11. Refund Policy; Trials

(a) Standard Refund Conditions. Customer may submit a cancellation or refund request through the authenticated customer portal or by email to Provider's designated billing address. Provider will return an approved refund to the original payment method within fifteen (15) business days.

(b) Thirty-Day Money-Back Guarantee. A first-time Customer may cancel its initial paid subscription within thirty (30) calendar days after the paid service start date and receive a refund of recurring Verito subscription fees paid for that initial period. The guarantee does not cover setup or onboarding fees, professional services, hardware, third-party licenses, taxes, usage charges, or pass-through expenses identified in the applicable Order Document. The guarantee is available once per Customer and does not apply to renewals, additional users, service expansions, or separately quoted projects. After the thirty-day guarantee, annual subscription fees are non-refundable except when Customer terminates because of Provider's uncured material breach or Provider terminates without cause.

(c) Free Trials. An eligible first-time Customer may receive a fifteen (15) calendar-day VeritSpace trial beginning when Provider first makes trial access available. No payment card is required, and the trial will not automatically convert into a paid subscription. Continued paid service requires Customer to authorize payment and is subject to the applicable commercial terms, which may be set forth in an Order Document.

12. Intellectual Property Ownership

Customer acknowledges that, as between Customer and Provider, Provider owns all right, title, and interest, including all intellectual property rights, in and to the Provider IP and, with respect to Third Party Products, the applicable third party providers own all right, title, and interest, including all intellectual property rights, in and to the Third Party Products.

Provider acknowledges that, as between Provider and Customer, Customer owns all right, title, and interest, including all intellectual property rights, in and to the Customer Data.

13. Limited Warranty and Warranty Disclaimer

Provider warrants that the Services will conform in all material respects to the service levels described within this agreement when accessed and used in accordance with the Documentation. Provider does not make any representations, warranties, or guarantees regarding uptime or availability of the Services except as specifically set forth within the Service Levels provision above. The remedies set forth in this agreement are the Customer's sole remedies and Provider's sole liability under the limited warranty set forth in this Section.

EXCEPT FOR THE EXPRESS LIMITED WARRANTIES SET FORTH IN THIS AGREEMENT, THE LICENSED SOFTWARE, THE SERVICES, AND THE DELIVERABLES ARE PROVIDED "AS IS." PROVIDER HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHER (INCLUDING ALL WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE), AND SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

PROVIDER FURTHER DISCLAIMS ANY AND ALL LIABILITY AND MAKES NO WARRANTY WHATSOEVER WITH RESPECT TO ANY FAILURE, MALFUNCTION, OR ERROR OF THE SERVICES OR DELIVERABLES THAT IS CAUSED IN WHOLE OR IN PART BY ANY CUSTOMER FAILURE, INCLUDING CUSTOMER'S FAILURE TO FULFILL ITS OBLIGATIONS AS SET FORTH IN THIS AGREEMENT.

WITHOUT LIMITING THE FOREGOING, PROVIDER MAKES NO WARRANTY OF ANY KIND THAT THE LICENSED SOFTWARE, THE SERVICES, OR THE DELIVERABLES WILL MEET CUSTOMER'S REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, ACHIEVE ANY INTENDED RESULT, BE COMPATIBLE WITH ANY OTHER GOODS OR SERVICES, OR BE SECURE, ACCURATE, COMPLETE, FREE OF HARMFUL CODE, OR ERROR FREE. ALL THIRD-PARTY MATERIALS ARE PROVIDED "AS IS," AND ANY REPRESENTATION OR WARRANTY CONCERNING THEM IS STRICTLY BETWEEN CUSTOMER AND THE THIRD-PARTY OWNER.

14. Indemnification

(a) Provider Indemnification. Provider shall indemnify, defend, and hold harmless Customer from and against any and all losses, damages, liabilities, costs ("Losses") incurred by Customer resulting from any third party claim, suit, action, or proceeding ("Third Party Claim") that the Services, or any use of the Services in accordance with this Agreement infringes or misappropriates such third party's US intellectual property rights, US patents, copyrights, or trade secrets, provided that Customer promptly notifies Provider in writing of the claim, cooperates with Provider, and allows Provider sole authority to control the defense and settlement of such claim. If such a claim is made or appears possible, Customer agrees to permit Provider, at Provider's sole discretion, to (A) modify or replace the Services, or component or part thereof, to make it non-infringing, or (B) obtain the right for Customer to continue use. If Provider determines that neither alternative is reasonably available, Provider may terminate this Agreement, in its entirety or with respect to the affected component or part, effective immediately on written notice to Customer. This will not apply to the extent that the alleged infringement arises from: (A) use of the Services in combination with data, software, hardware, equipment, or technology not provided by Provider or authorized by Provider in writing; (B) modifications to the Services not made by Provider; (C) Customer Data; or (D) Third Party Products.

(b) Customer Indemnification. Customer shall indemnify, hold harmless, and, at Provider's option, defend Provider from and against any Losses resulting from any Third Party Claim that the Customer Data, or any use of the Customer Data in accordance with this Agreement, infringes or misappropriates such third party's intellectual property rights and any Third Party Claims based on Customer's or any Authorized User's (i) negligence or willful misconduct; (ii) use of the Services in a manner not authorized by this Agreement; (iii) use of the Services in combination with data, software, hardware, equipment or technology not provided by Provider or authorized by Provider in writing; or (iv) modifications to the Services not made by Provider, provided that Customer may not settle any Third Party Claim against Provider unless Provider consents to such settlement, and further provided that Provider will have the right, at its option, to defend itself against any such Third Party Claim or to participate in the defense thereof by counsel of its own choice.

15. Limitations of Liability

IN NO EVENT WILL EITHER PARTY BE LIABLE UNDER OR IN CONNECTION WITH THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, AND OTHERWISE, FOR ANY: (a) CONSEQUENTIAL, INCIDENTAL, INDIRECT, EXEMPLARY, SPECIAL, ENHANCED, OR PUNITIVE DAMAGES; (b) INCREASED COSTS, DIMINUTION IN VALUE OR LOST BUSINESS, PRODUCTION, REVENUES, OR PROFITS; (c) LOSS OF GOODWILL OR REPUTATION; (d) USE, INABILITY TO USE, LOSS, INTERRUPTION, DELAY OR RECOVERY OF ANY DATA, OR BREACH OF DATA OR SYSTEM SECURITY; OR (e) COST OF REPLACEMENT GOODS OR SERVICES, IN EACH CASE REGARDLESS OF WHETHER PROVIDER WAS ADVISED OF THE POSSIBILITY OF SUCH LOSSES OR DAMAGES OR SUCH LOSSES OR DAMAGES WERE OTHERWISE FORESEEABLE. IN NO EVENT WILL PROVIDER'S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, AND OTHERWISE EXCEED THE AMOUNTS PAID TO PROVIDER UNDER THIS AGREEMENT IN THE SIX MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

In no event will either Party be liable or responsible to another party, or be deemed to have defaulted under or breached this Agreement, for any failure or delay in fulfilling or performing any term of this Agreement, (except for any obligations to make payments), when and to the extent such failure or delay is caused by any circumstances beyond such Party's reasonable control (a "Force Majeure Event"), including acts of God, flood, fire, earthquake or explosion, war, terrorism, invasion, riot or other civil unrest, embargoes or blockades in effect on or after the date of this Agreement, national or regional emergency, strikes, labor stoppages or slowdowns or other industrial disturbances, passage of Law or any action taken by a governmental or public authority, including imposing an embargo, export or import restriction, quota, or other restriction or prohibition or any complete or partial government shutdown, or national or regional shortage of adequate power or telecommunications or transportation. Either party may terminate this Agreement if a Force Majeure Event continues substantially uninterrupted for a period of thirty (30) days or more.

SECTION 14 AND THIS SECTION 15 SETS FORTH THE PARTIES' SOLE REMEDIES AND LIABILITIES AND OBLIGATIONS FOR ANY ACTUAL, THREATENED, OR ALLEGED CLAIMS THAT THE SERVICES INFRINGE, MISAPPROPRIATE, OR OTHERWISE VIOLATE ANY INTELLECTUAL PROPERTY RIGHTS OF ANY THIRD PARTY. NOTWITHSTANDING ANY OTHER PROVISION IN THIS AGREEMENT, PROVIDER'S AGGREGATE LIABILITY FOR SUCH CLAIMS SHALL IN NO EVENT EXCEED THE TOTAL FEES PAID TO PROVIDER BY CUSTOMER IN THE SIX (6) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

16. Term

The initial term of this Agreement unless terminated earlier pursuant to this Agreement's express provisions, will continue in effect until the agreed upon end date, or if not provided, until there is a proper request for termination of services and the completion of the termination process by both Parties.

This Agreement will automatically renew unless an end date is provided or this agreement is terminated pursuant to this Agreement's express provisions or either Party gives the other Party written notice of non-renewal at least thirty days prior to the expiration of the then-current term.

17. Termination

(a) Termination. In addition to any other express termination right set forth in this Agreement:

(i) Non-payment. Provider may terminate this Agreement, effective on written notice to Customer, if Customer fails to pay any amount when due and does not cure that failure within seven (7) days after Provider's written notice of nonpayment.

(ii) Material breach. Either Party may terminate this Agreement, effective on written notice to the other Party, if the other Party materially breaches this Agreement and the breach is (A) incapable of cure; or (B) capable of cure but remains uncured thirty (30) days after the non-breaching Party provides written notice describing the breach.

(b) Effect of Expiration or Termination. Upon expiration or earlier termination of this Agreement, Customer shall immediately discontinue use of the Provider IP and, without limiting Customer's obligations under Section 4, shall delete, destroy, or return all copies of the Provider IP and certify in writing to the Provider that the Provider IP has been deleted or destroyed. No expiration or termination will affect Customer's obligation to pay all Fees that may have become due before such expiration or termination.

(c) Suspension. In addition to Provider's suspension rights under Section 3(j), Provider may suspend Customer's access to the Services or to information or data related to Customer's account as permitted under this Agreement. During any suspension, Fees continue to accrue and Customer remains responsible for their payment. Suspension does not shorten any data-retrieval period under Section 18.

(d) Consequences of Termination on Third Parties. If Customer's or Customer's clients use of the Services is paid for by or through a third party, Customer or Customer's clients understand and agree that the third party has the right to have Customer or Customer's clients account suspended or terminated at any time for any reason and that their failure to pay for services that Customer or Customer's clients use could result in termination or suspension of Customer or Customer's clients access to the services and/or Customer or Customer's clients hosted data.

(e) Early Termination for Convenience.

(i) By Customer. Customer may terminate this Agreement or an applicable SOW for convenience upon thirty (30) days' prior written notice; provided that such termination does not relieve Customer of its obligation to pay all Fees for the remainder of the then-current subscription term specified in the applicable Order Documents, and prepaid Fees are non-refundable except as expressly provided in Section 11 (Refund Policy; Trials).

(ii) By Provider. Provider may terminate this Agreement and/or terminate the provision of Services to Customer upon thirty (30) days written notice, in which case Provider will refund to Customer, on a pro-rata basis, any prepaid Fees for Services not yet rendered as of the effective date of termination.

This Section 17(e) does not limit either Party's termination rights for cause under Section 17(a) or the non-renewal right under Section 16.

(f) Survival. This Section and Sections 4, 7, 8, 9, 10, 12, 13, 14, 15, 18, 19, and 20 survive any termination or expiration of this Agreement.

18. Right to Data After Termination of Contract

After thirty days from date of termination, Provider has the right to permanently remove all Customer data from Provider's active production systems, including live and archived data for Customer, and all live and archived data for Customer's Customers, subject to Provider's backup-retention cycles, disaster recovery procedures, archival practices, legal retention requirements, and residual copies retained in the ordinary course of business. Provider will not be responsible for any losses of data after thirty days from Customer termination date. It is the Customer's responsibility to request or perform a backup or retrieval of all personal data and Customer Data on Provider's active production systems within this thirty day period. Customer has right to request backup or retrieval of personal and Customer data for a period of thirty days from date of termination. Provider's standard release of a file containing Customer Data available from active production systems will generally be provided without a separate data-release fee; however, Provider may charge reasonable fees for special, unique, non-standard, or unusually burdensome requests, including custom formatting, conversion, restoration, migration assistance, third-party software support, or other services outside Provider's standard data release process. Provider will send courtesy reminders regarding data retrieval or deletion; however, failure to send or receive any reminder does not extend the retrieval period, limit Provider's deletion rights, or create liability for Provider.

Upon Termination Date Customer will not be allowed access to Provider infrastructure, including Provider's servers, backup systems, disaster recovery systems, administrative tools, or proprietary systems, and Customer Data in active production systems will be retained for no longer than thirty days from date of termination, subject to Provider's backup-retention cycles, disaster recovery procedures, archival practices, legal retention requirements, and residual copies retained in the ordinary course of business.

CUSTOMER AGREES AND ACKNOWLEDGES THAT PROVIDER IS NOT OBLIGATED TO RETAIN ANY CUSTOMER DATA IN ACTIVE PRODUCTION SYSTEMS FOR LONGER THAN THIRTY (30) CALENDAR DAYS AFTER THE EFFECTIVE DATE OF TERMINATION, UNLESS EXPLICITLY AGREED OTHERWISE IN THE APPLICABLE ORDER DOCUMENT. THE THIRTY (30) CALENDAR-DAY PERIOD INCLUDES WEEKENDS, HOLIDAYS, AND DAYS PROVIDER IS CLOSED, AND IS MEASURED AS THIRTY (30) CONSECUTIVE CALENDAR DAYS FROM THE EFFECTIVE DATE OF TERMINATION. AFTER THE THIRTY (30) DAY PERIOD EXPIRES, PROVIDER MAY DELETE CUSTOMER DATA FROM THE ACTIVE SERVER. IF CUSTOMER REQUESTS CONFIRMATION OF DELETION, PROVIDER MAY CONFIRM DELETION FROM THE ACTIVE SERVER ONLY, AND ANY SUCH CONFIRMATION WILL NOT APPLY TO BACKUPS, DISASTER RECOVERY SYSTEMS, ARCHIVES, LOGS, LEGAL-RETENTION SYSTEMS, OR RESIDUAL COPIES.

19. Governing Law; Dispute Resolution

This Agreement and any applicable Order Document, and all matters arising out of or relating to the Services provided thereunder, are governed by and construed in accordance with the substantive laws of the State of Florida, without regard to its conflict of laws principles.

Any dispute, controversy, or claim arising out of or relating to this Agreement, any applicable Order Document, or the Services, including any breach thereof, shall be required to be brought and resolved through binding arbitration administered by the American Arbitration Association (AAA). The arbitration shall take place in Orange County, Florida, and judgment on the award rendered by the arbitrator(s) may be entered in any court having jurisdiction thereof.

The Parties irrevocably and unconditionally agree that any action to compel arbitration, to enforce an arbitration award, or seeking injunctive or other equitable relief (if such relief is not available through arbitration) arising out of or relating to this Agreement shall be brought and litigated exclusively in the federal and state courts sitting in Orange County, Florida. The Parties hereby consent to the exclusive jurisdiction and venue of such courts and waive any objection to such jurisdiction or venue based on inconvenient forum or any other ground.

The Parties hereby waive any right to a trial by jury or to participate in a class action.

20. Miscellaneous

(a) Complete Understanding. This Agreement, including its Exhibits, together with any applicable onboarding agreement and Order Document, constitutes the complete and exclusive agreement of the Parties with respect to the Services and supersedes all prior or contemporaneous agreements relating to its subject matter. In the event of a conflict, an applicable SOW or Order Document controls solely with respect to the commercial terms specifically identified therein, including pricing, service specifications, commencement dates, and subscription terms; this Agreement controls in all other respects.

(b) Subcontracting. Provider may subcontract any work under this Agreement to any third party or Affiliate without Customer's prior written consent; provided that (i) each subcontractor or Affiliate that accesses Customer Data (including any Personal Data or Customer Information) is bound by a written agreement imposing confidentiality, data-protection, and security obligations at least as protective as those set forth in Section 8 and the DPA; (ii) Provider's engagement of Affiliates and subprocessors remains subject to Section 8 and the subprocessor provisions of the DPA; and (iii) Provider remains responsible for its subcontractors' and Affiliates' performance in connection with the Services as provided in Section 8 and the DPA.

(c) Severability. If any provision of this Agreement is held to be invalid, illegal, or unenforceable, that provision shall be modified or limited to the minimum extent necessary so that it becomes valid and enforceable while giving effect, as closely as possible, to the Parties' original intent. Such holding shall not affect the validity or enforceability of that provision in any other circumstance or of the remaining provisions of this Agreement, which shall remain in full force and effect.

(d) Non-assignability and Binding Effect. Customer shall not assign this Agreement to any third party without the prior written consent of Provider which will not be unreasonably withheld, except that either Party may, without prior written consent, assign this Agreement to any successor of all or substantially all of its stock or assets. Provider may assign this contract and any rights or obligations herein, in whole or in part, freely and without the prior written consent of Customer.

(e) Notices. All notices, requests, consents, approvals, and other communications under this Agreement must be in writing and sent to the receiving Party at the address or email address specified in the applicable Order Documents or, if none is specified, (A) for notices to Customer, to the primary business or billing contact associated with Customer's account; and (B) for notices to Provider, to the address or contact identified on Provider's website or support page. A Party may change its contact information for notices by giving notice in accordance with this Section.

(f) Amendment and Modification; Waiver. Except as otherwise expressly provided in this Agreement, no amendment to or modification of this Agreement agreed between the Parties is effective unless in writing and signed by an authorized representative of each Party. Notwithstanding the foregoing, Provider may amend or modify this Agreement in accordance with Section 20(i) without Customer's consent. No waiver by any Party of any provision of this Agreement shall be effective unless expressly set forth in writing and signed by the Party so waiving. No failure or delay in exercising any right, remedy, power, or privilege under this Agreement will operate as a waiver thereof, and no single or partial exercise thereof will preclude any other or further exercise of that or any other right, remedy, power, or privilege

(g) State or Federal Tax Code. Provider is not responsible for Customer's obligations under State or Federal Tax Code, procedures, or regulations related to maintaining electronic or hard copies of tax returns. Customer is solely responsible for its compliance with its obligations under State or Federal Tax Code, procedures, or regulations and its relation to maintaining electronic or hard copies of Customer information or tax returns.

(h) Headings; Interpretation. The headings used in this Agreement are solely for convenience of reference and shall not affect its interpretation. For purposes of this Agreement: (a) "include," "includes," and "including" mean "including without limitation"; (b) "hereof," "herein," "hereunder," and similar terms refer to the entire Agreement, not specific sections; (c) "or" is not exclusive. This Agreement shall not be construed against the drafting party.

(i) Changes to this Agreement. Provider may amend or modify this Agreement from time to time without Customer's consent. Nonmaterial changes may become effective upon posting the revised Agreement at https://verito.com/cloud-terms-of-service/. Provider will provide Customer at least thirty (30) days' notice of any material change by posting the revised Agreement at such URL, sending Customer an email notifying Customer of the update, or providing other similar electronic notice. Notice will be deemed given upon such posting, transmission, or other delivery, as applicable. Any material change will become effective upon expiration of the applicable thirty (30)-day notice period. Notwithstanding the foregoing, Provider may make any change effective immediately if reasonably necessary to comply with applicable law or regulation, address an urgent security or operational risk, or respond to requirements imposed by a third-party provider necessary for the Services, in which case Provider will provide notice as soon as reasonably practicable. All changes apply prospectively from their effective date. Customer's continued access to or use of the Services after the effective date of any change constitutes Customer's acceptance of the revised Agreement.