Terms of use

These user terms (together with any applicable order(s), this "Agreement") govern the access to, and use of, the Services (as defined below) or any part thereof by Customer. The Services comprise the ThreatAware Service and/or the Dimension Service, and Customer may order one, or both, as specified in the applicable Order. By selecting the "accept" option, or otherwise accessing or using the Services, or entering into an order that references this Agreement, the person doing so on behalf of Customer represents and warrants that they are at least 18 years old (or the age of majority where they reside, whichever is older), can form a legally binding contract online, and have full authority to bind Customer to this Agreement, which constitutes a binding contract between Customer and the ThreatAware entity named below ("ThreatAware"). If Customer does not agree to these user terms, or if such person is not at least 18 years old (or the age of majority where they reside), cannot form a legally binding contract online, or does not have authority to bind Customer, then Customer will not be authorised to access or use the Services or any part thereof. The Agreement becomes binding on Customer on the earliest of the following dates: the date Customer accepts these user terms, the date specified on an Order or the date on which Customer activates or otherwise accesses or uses the Services (the "Effective Date").

1. Definitions

Certain capitalised terms used in this Agreement have the meanings given to them in clause 13.

2. Procurement and Payments

2.1 Procurement of Services

(a) Customer shall procure the Services (whether the ThreatAware Service, the Dimension Service, or both) through an Authorised Partner pursuant to a Partner Agreement, or from ThreatAware directly. Any Services procured through an Authorised Partner are subject to, and ThreatAware's obligations and liabilities to Customer are governed by, this Agreement only. Customer acknowledges and agrees that any terms set out in the Partner Agreement, and any representations, warranties, guarantees or other promises given by an Authorised Partner in respect of the Services or any obligations of ThreatAware do not bind ThreatAware. The Authorised Partner is not authorised to agree any inconsistent terms with Customer in respect of the Services.

(b) Orders are non-cancellable once agreed.

2.2 Payment and invoicing

(a) Partner Agreement. Where Customer procures the Services through an Authorised Partner, all fees, invoicing arrangements and payment terms are governed exclusively by the Partner Agreement. Customer agrees that ThreatAware shall not invoice Customer, nor collect any fees or other payments, and ThreatAware is not responsible for issuing any refunds or credits to Customer.

(b) Direct procurement. Where Customer procures the Services directly from ThreatAware, all fees, invoicing arrangements and payment terms are governed exclusively by the Order, which may refer to ThreatAware's online pricing plan(s). Customer shall make payment in accordance with the terms of the Order. Except where separately agreed in writing between Customer and ThreatAware, ThreatAware may increase its pricing upon sixty (60) days' written notice, such increase to take effect upon commencement of the next Subscription Period (if any).

(c) Active Devices. Where Customer has ordered the ThreatAware Service, Customer agrees that pricing for the ThreatAware Service is calculated on a per-Active Device basis and may be variable across the Subscription Period. This clause 2.2(c) does not apply to the Dimension Service.

(d) Non-refundable. All fees are non-refundable except as expressly provided in this Agreement.

3. Services

3.1 Trial Services

ThreatAware may allow Customer to use the Services or any part thereof (including parts or features offered for preview or beta testing purposes), on a free-of-charge basis ("Trial Services"). This Agreement also applies to access and use of the Trial Services, except as follows:

(a) the duration of the evaluation is 2 weeks from the date full access to the Services is granted (unless otherwise specified by ThreatAware in writing) ("Trial Period"), at the end of which period Customer's right to access and use the Trial Services may automatically terminate (however ThreatAware shall use its reasonable efforts to ensure continuity of Services between a Trial Period and a Subscription Period); and

(b) the Trial Services are provided "AS-IS" without warranty of any kind, and to the maximum extent permitted under applicable law, ThreatAware disclaims all representations, conditions, warranties, support obligations, and other liabilities and obligations for the Trial Services, express or implied, including but not limited to any implied warranties of merchantability, fitness for a particular purpose or non-infringement, and any warranties arising out of course of dealing or usage of trade.

3.2 Access and Use

Subject to the terms and conditions of this Agreement, ThreatAware grants Customer a non-exclusive, non-transferable (except as expressly provided in clause 12.4), non-sublicensable license to access and use the Services solely for Customer's and Customer Affiliates' internal business purposes in accordance with this Agreement and the applicable Service Description (which is hereby incorporated into and forms part of this Agreement) during the applicable Subscription Period. Customer's access and use of the Services is limited to the usage metrics set forth in the applicable Order or Partner Agreement, and Customer agrees it may be subject to the payment of additional fees, or suspension of the Services, if the applicable usage metrics are exceeded.

3.3 Restrictions

Customer will not, with respect to the Services (or any portion thereof):

(a) use the Services in any manner beyond the scope of rights expressly granted in this Agreement;

(b) modify or create derivative works of the Services, in whole or in part;

(c) reverse engineer, disassemble, decompile, decode or otherwise attempt to derive or gain improper access to any software component of the Services, in whole or in part;

(d) frame, mirror, sell, resell, rent or lease use of the Services to any third party, or otherwise allow any third party to use the Services for any purpose (except for Customer Affiliates as expressly permitted herein);

(e) use the Services in any manner or for any purpose that infringes, misappropriates, or otherwise violates any Intellectual Property Right or other right of any third party, or that violates any Applicable Laws;

(f) interfere with, or disrupt the integrity or performance of, the Services;

(g) access or search any software component of the Services (or download any data or content contained therein or transmitted thereby) through the use of any engine, software, tool, agent, device or mechanism (including spiders, robots, crawlers or any other similar data mining tools or otherwise through the use of screen scraping) other than software or Services features provided or made available by ThreatAware for use expressly for such purposes;

(h) use the Services for benchmarking or competitive analysis with respect to competitive or related products or services, or to develop, commercialise, license or sell any product, service or technology that could, directly or indirectly, compete with the Services or any part thereof;

(i) employ or authorize a ThreatAware competitor to use or view the Services, or to provide management, hosting, or support for the Services;

(j) use the Services to circumvent the security of a third party's network/information, develop malware, unauthorised surreptitious surveillance, data modification, data exfiltration, data ransom or data destruction; or

(k) cause, encourage or assist any third party to do any of the foregoing.

Any non-compliance with this clause 3.3 by Customer may, at ThreatAware's discretion, be deemed a material breach incapable of remedy.

3.4 Customer Affiliates

Customer will ensure that any Affiliate of Customer ("Customer Affiliate") using or accessing the Services, or benefitting from Customer's use of the Services, complies with this Agreement. Customer is responsible for Customer Affiliates' acts and omissions in connection with their access to, or use of, the Services.

3.5 Licensed not sold

The Services are provided on a subscription access basis, not sold. Subject to the limited rights expressly granted hereunder, ThreatAware reserves and, as between the parties will solely own, the Services and all right, title and interest (including all Intellectual Property Rights) in and to the Services. No rights are granted to Customer hereunder (whether by implication, estoppel, exhaustion or otherwise) other than as expressly set forth in this Agreement. Notwithstanding the foregoing, as between Customer and ThreatAware, Customer owns all right, title and interest (including all Intellectual Property Rights) in and to each App that Customer creates using the Dimension Service, excluding (a) the underlying Dimension Service, including any Third-Party Products, templates, models or other components made available by ThreatAware through which such App is created, hosted or deployed, which remain owned by ThreatAware as set out above, and (b) any App made available to Customer by ThreatAware or a third party (including any other customer) as described in the definition of "App(s)", which remains owned by ThreatAware or that third party (as applicable). For the avoidance of doubt, Customer's ownership of an App does not restrict ThreatAware from developing, offering or making available to any customer (including by using Customer Data in accordance with clause 5.2) an application that is functionally similar or equivalent to that App.

3.6 Third-Party Products

ThreatAware may offer integrations with third party technologies or services, and/or (in respect of the Dimension Service) make available Apps developed by third parties ("Third-Party Products"), however ThreatAware:

(a) does not and will not be deemed to provide any aspect of the Third-Party Products;

(b) makes no representation or warranty regarding any Third-Party Products; and

(c) is not and will not be responsible for any compatibility issues or errors in the Services or Third-Party Products caused in whole or in part by the Third-Party Products.

3.7 Updating the Services

ThreatAware may update or modify the Services from time to time without notice to Customer, provided that such changes do not materially reduce the overall functionality of the Services during the Subscription Period.

3.8 Feedback

ThreatAware may freely use any feedback, suggestions, comments or the like that Customer provides to ThreatAware in relation to the Services (collectively, the "Customer Feedback"), and Customer hereby grants ThreatAware a perpetual, irrevocable, worldwide, royalty-free, fully paid-up, transferable, sublicensable (through multiple tiers) right and license to make, use, reproduce, modify, create derivative works of, distribute, disclose, commercialize, and otherwise exploit all Customer Feedback for any purpose, without restriction and without any duty of attribution, accounting, or compensation to Customer or any User. As between the parties, ThreatAware will own all right, title, and interest (including Intellectual Property Rights) in and to any improvements to the Services derived from any Customer Feedback. For greater certainty and for the purposes of this Agreement, Customer Feedback will not be deemed to be Confidential Information.

4. ThreatAware's warranties

4.1 Services Warranty

ThreatAware warrants to Customer during the applicable Subscription Period that:

(a) the Services shall be performed with reasonable care and skill; and

(b) the Services will perform materially in accordance with the Service Description; and

(c) the Services shall be performed in accordance with any service levels published by ThreatAware,

together the "Services Warranty".

4.2 Malicious Software warranty

(a) ThreatAware warrants to Customer during the applicable Subscription Period that it shall implement and maintain appropriate technical and organisational measures, including the use of industry-standard anti-virus and malware protection tools, in accordance with good industry practice, to detect and prevent the introduction of Malicious Software into the Services.

(b) If Malicious Software is identified in connection with the Services, the Parties shall co-operate in good faith to mitigate its effects and to restore the affected Services as soon as reasonably practicable.

4.3 Remedy for non-compliance

(a) Customer shall notify ThreatAware in writing of any non-compliance with the Services Warranty promptly upon becoming aware, and shall provide such detail as ThreatAware may reasonably require.

(b) ThreatAware will use commercially reasonable efforts to provide a work-around or correct any reported non-conformity with the Services Warranty, and, if ThreatAware determines that it is unable to do so in its discretion, ThreatAware may terminate Customer's rights to access and use the applicable non-conforming Services and arrange a refund to Customer of any prepaid fees prorated for the unused period of the applicable Subscription Period.

(c) The rights and remedies set forth in this clause will be Customer's sole and exclusive remedy and ThreatAware's sole and exclusive liability for any breach of the Services Warranty.

(d) The Services Warranty does not apply to Trial Services.

4.4 Exclusions

The Services Warranty shall not apply if:

(a) the Services have been modified, except by or at the direction of ThreatAware;

(b) the Services have not been accessed or used in accordance with this Agreement or the Service Description;

(c) the non-conformity relates to a Third-Party Product;

(d) the non-conformity occurs due to a failure by Customer to allow ThreatAware or its agents to implement any updates, corrections or modifications to the Services made available to Customer by ThreatAware; or

(e) Customer has combined the Services with other software, services, or products that are not provided by ThreatAware or not otherwise specified in the applicable Service Description, and but for such combination, the breach of warranty would have been avoided.

4.5 No Guarantee

Customer agrees that:

(a) ThreatAware does not guarantee or warrant that the Services will find, locate, report or discover all of Customer's or Customer Affiliates' system threats, vulnerabilities, malware, and malicious software, and Customer and Customer Affiliates will not hold ThreatAware responsible therefor;

(b) in respect of the Dimension Service, Customer is solely responsible for the prompts used to create Apps, all integrations with other applications, and the deployment and use of Apps;

(c) in respect of the Dimension Service, Apps are created on Customer's own instructions and may not be fit for Customer's intended purpose or may not achieve Customer's desired result;

(d) in respect of the Dimension Service, ThreatAware is not responsible for the quality or outcome of any Apps which Customer creates and/or chooses to deploy; and

(e) the Services do not constitute any form of representation, condition, warranty or guarantee that Customer's systems are secure from every potential risk, even if fully implemented.

4.6 Disclaimers

Except as expressly set forth in these user terms, the Services are provided on an "as is" basis, and ThreatAware makes no warranties, conditions or representations of any kind, whether express, implied, statutory or otherwise, to Customer or to any other party regarding the Services. To the maximum extent permitted by Applicable Law, ThreatAware disclaims all warranties, conditions and representations, whether express or implied or statutory under any Applicable Law, including, but not limited to, any implied warranties or conditions of merchantability or merchantable quality, fitness for a particular purpose or non-infringement, and any warranties arising out of course of dealing or usage of trade. Without limiting the foregoing, ThreatAware disclaims any warranty that use of the Services will be error-free, bug-free or uninterrupted, or will fulfill any of Customer's particular purposes or requirements. The Services are not designed or intended for use in any application or hazardous environment that requires fail-safe performance, where the failure of the Services might result in or cause death, personal injury or environmental damage. Notwithstanding any warranties, conditions or representations that ThreatAware expressly provides in respect of the Services, ThreatAware makes no representations, warranties or conditions of any kind, whether implied, express or statutory, in respect of any third-party products, integrations or services (including the Third-Party Products).

5. Customer Obligations and Customer Data

5.1 Customer Security Obligation

As between Customer and ThreatAware, Customer will be solely responsible for establishing, monitoring and implementing security practices to control the physical access to and use of the Services and all Customer Data therein. ThreatAware will not be liable, and Customer will be solely responsible for any unauthorised access, damage or loss that may occur through the use or misuse of Customer's credentials, equipment, systems or premises, or through the transmission or processing of any Customer Data on any networks, systems, or devices that are not within the control of ThreatAware. Customer will be responsible for maintaining the confidentiality and security of any credentials used to access the systems, and shall notify ThreatAware promptly upon becoming aware of any unauthorised access or use of the Services. Customer acknowledges that ThreatAware does not provide or undertake backup or maintenance services for Customer Data and Customer will be solely responsible for undertaking backups of Customer Data.

5.2 Customer Data

As between Customer and ThreatAware, Customer will own all right, title and interest in and to the Customer Data. Customer grants to ThreatAware a limited, non-exclusive, worldwide, royalty-free license to host, access and use the Customer Data (a) to operate and provide the Services, and (b) in an anonymised and aggregated form that does not identify Customer, Customer Affiliates or any individual, to analyse usage of the Services and to maintain, support and improve the Services and develop new products and features. ThreatAware will not, and will not permit any third party to, use Customer Data (including any prompts submitted by Customer in connection with the Dimension Service) to train any artificial intelligence or machine learning model, whether proprietary to ThreatAware or operated by a third party, except where such Customer Data has first been anonymised and aggregated in accordance with limb (b) above.

5.3 Representation and Warranties

Customer represents and warrants that:

(a) it has obtained and will obtain and continue to have, during the applicable Subscription Period, all necessary rights, authority, consents and licenses for the access to and use of Customer Data, including any Relevant Data included therein, and Customer Feedback as contemplated by this Agreement; and

(b) ThreatAware's use of Customer Data and Customer Feedback in accordance with this Agreement will not violate any Applicable Laws or cause a breach of any agreement or obligations between Customer and any third party.

5.4 Responsibility for Users

(a) Customer shall be fully responsible and liable for all access to and use of the Services by Users. Any act or omission by a User with respect to the Services shall be deemed an act or omission of Customer.

(b) Customer shall not, and shall procure that each User shall not: (i) allow any other person to access the Services using that User's credentials; or (ii) disclose, share or transfer any password or access code to any other person. User passwords and access codes may not be reassigned except by ThreatAware.

(c) Customer shall ensure all User information (name, location, email address) is current and accurate.

(d) When a User is terminated from employment, re-assigned or is otherwise no longer to be granted access to the Services, Customer shall cease use of the corresponding User password and access codes.

6. Confidentiality and Data Protection

6.1 General Obligation

A recipient of Confidential Information will protect that Confidential Information using the same standard of care it uses to protect its own confidential information of a similar nature, but no less than a reasonable standard of care. This clause 6 will not apply to information which:

(a) is known by the recipient without confidentiality obligations;

(b) is or has become public knowledge through no fault of the recipient; or

(c) is independently developed by, or for, the recipient without reference to the Confidential Information of the discloser.

6.2 Disclosure to Permitted Recipients

A recipient of Confidential Information will not:

(a) use Confidential Information of the other party, except as needed to fulfil its obligations or exercise its rights under this Agreement; or

(b) disclose Confidential Information of the other party to any third party, except to its or its Affiliates' employees, agents and contractors who need to know such Confidential Information.

The recipient is liable for a breach of this clause 6 by its permitted recipients and will ensure each of those permitted recipients have written confidentiality obligations at least as restrictive as the recipient's obligations under this Agreement.

6.3 Required Disclosures

The recipient may reveal Confidential Information of the other party if required by law (including under a court order) but only after it notifies the discloser in writing (if legally permissible), provided that the recipient limits such disclosure solely to those portions of such Confidential Information to the extent necessary to comply with such law. A recipient will reasonably cooperate with a discloser's reasonably requested protective actions, at the discloser's expense.

6.4 Return or Destruction

The recipient will return, delete or destroy all Confidential Information of the other party and confirm in writing it has done so within 30 days of the discloser's written request unless retention is required by law or Confidential Information has been stored in a backup system in the ordinary course of business, provided, however, that any such retained information will remain subject to this Agreement.

6.5 Data Protection

The parties will comply with their respective obligations set out in the Data Processing Terms, which are hereby incorporated into and forms part of this Agreement.

7. Intellectual Property Rights Infringement Indemnity

7.1 ThreatAware's Indemnity

ThreatAware will defend any third-party claim against Customer asserting that Customer's use of the Services in accordance with this Agreement infringes a third party's patent, copyright or registered trademark (the "IP Claim"), subject to the exclusions in clause 7.3. ThreatAware will indemnify Customer against any damages awarded in any final judgment entered by a court of competent jurisdiction or any settlements arising out of an IP Claim, provided that Customer:

(a) notifies ThreatAware in writing of the IP Claim promptly, and in any event, within 20 days of receiving notice of such IP Claim;

(b) fully cooperates with ThreatAware in the defence of the IP Claim; and

(c) grants ThreatAware the right to exclusively control the defence and settlement of the IP Claim and any appeal (provided that any settlement by ThreatAware must include, as an unconditional term, the claimant's or plaintiff's release of Customer from all liability with respect to the IP Claim). Customer may, at Customer's own expense, participate in the defence of any IP Claim but Customer will not enter into any settlement or compromise of any such claim without ThreatAware's prior written consent.

7.2 Remedies

If ThreatAware reasonably believes the Services could infringe any third party's patent, copyright or registered trademark, ThreatAware may, at its sole option and expense use commercially reasonable efforts to:

(a) modify or replace the Services, or any component or part thereof, to make it non-infringing; or

(b) procure the right for Customer to continue to use the Services.

If ThreatAware determines that neither alternative is commercially practicable, ThreatAware may terminate this Agreement, in its entirety or with respect to the affected component, by providing written notice to Customer and arranging a refund of a prorated portion of the pre-paid, unused fees paid by Customer corresponding to the unused period of the applicable Subscription Period.

7.3 Exclusions

ThreatAware will have no obligations under this clause 7 if the IP Claim is based upon or arises out of:

(a) any modification to the Services not made by or at the direction of ThreatAware;

(b) any combination or use of the Services with or in any third party software, hardware, process, firmware, or data, to the extent that such claim is based on such combination or use;

(c) Customer's continued use of the allegedly infringing Services after being notified of the infringement claim or after being provided a modified version of the Services by ThreatAware at no additional cost that is intended to address such alleged infringement;

(d) in respect of the Dimension Service, any App, or any element thereof, to the extent the alleged infringement arises from the prompts, instructions, content, or materials provided or selected by Customer in creating, configuring, or deploying that App, or from Customer's combination of an App with any other application, data, or content not provided by ThreatAware; or

(e) Customer's failure to use the Services in accordance with the terms of this Agreement, including the applicable Service Description.

7.4 Exclusive Remedy

The rights and remedies set forth in this clause 7 will constitute Customer's sole and exclusive remedy, and ThreatAware's sole and exclusive liability, in respect of any IP Claim.

8. Limitation of Liability

8.1 Exclusions

Nothing in this Agreement shall limit or exclude either party's liability for:

(a) death or personal injury caused by its negligence;

(b) fraud or fraudulent misrepresentation;

(c) any matter which may not be excluded or limited pursuant to applicable law;

(d) Customer's non-compliance with the restrictions set out in clause 3.3;

(e) any obligation of Customer to pay fees directly to ThreatAware pursuant to an agreed Order;

(f) any breach by a party of its confidentiality obligations set out in clause 6; or

(g) ThreatAware's indemnity obligation set out in clause 7.

8.2 Excluded types of loss

Other than as set out in clause 8.1, to the maximum extent permitted by Applicable Law, neither party shall in any circumstances be liable whether in contract, tort (including for negligence and breach of statutory duty howsoever arising), misrepresentation (whether innocent or negligent), restitution or otherwise for any lost profits, revenue, or savings, lost business opportunities, lost data, cost of substitute services, or special, incidental, consequential, exemplary or punitive damages arising out of or in connection with this Agreement or the provision of the Services, regardless of the legal or equitable theory on which the applicable claim or liability is based, even if such party has been advised of the possibility of such damages or losses or such damages or losses were reasonably foreseeable.

8.3 Limitation of Liability

Other than as set out in clause 8.1, and subject to clause 8.2, each party's total aggregate liability whether in contract, tort (including negligence and breach of statutory duty howsoever arising), misrepresentation (whether innocent or negligent), restitution or otherwise, arising in connection with the performance or contemplated performance of this Agreement arising during a Subscription Period shall not exceed the Annual Subscription Value recorded on the Platform at the commencement of that Subscription Period. For the purposes of this clause 8.3, "Annual Subscription Value" means ThreatAware's standard list price for Customer's current subscription plan(s) (being, as applicable, the ThreatAware Service and/or the Dimension Service) and usage metrics as recorded through the Services, calculated on a per-annum basis. Where Customer has procured access to the Services through an Authorised Partner, 'Annual Subscription Value' shall be calculated by reference to ThreatAware's list price for the relevant configuration regardless of the commercial terms agreed between Customer and the Authorised Partner. The limitations of liability set forth in this clause 8 shall apply even if held to fail of their essential purpose.

9. Duration, Suspension and Termination

9.1 Commencement and Term

(a) This Agreement commences on the Effective Date and will remain in effect until all active Subscription Periods have expired or until earlier terminated pursuant to the terms of this Agreement or as otherwise specified in these user terms.

(b) On expiry of a Subscription Period, the Services shall cease unless the parties agree in writing to extend or renew the Subscription Period.

9.2 Suspension

ThreatAware may immediately suspend Customer's access to, or use of, the Services if:

(a) ThreatAware believes that there is a significant threat to the security, integrity, functionality, or availability of the Services or any content, data, or applications in the Services;

(b) Customer is in breach of clauses 3.3 (Restrictions) or 5.4(b) (Responsibility for Users);

(c) Customer (or the applicable Authorised Partner) fails to pay ThreatAware when fees are due; or

(d) if required by law (including under a court order);

provided, however, ThreatAware will use commercially reasonable efforts under the circumstances to: (i) provide Customer with prior notice and, if applicable, an opportunity to remedy such violation prior to any such suspension; and (ii) reinstate Customer's access upon the cause of the suspension being rectified to ThreatAware's reasonable satisfaction.

9.3 Termination

Either party may terminate this Agreement, effective on written notice to the other party, if:

(a) the other party materially breaches this Agreement where such breach is capable of remedy, and such breach remains uncured 30 days after the non-breaching party provides the breaching party with written notice of such breach; or

(b) other party materially breaches this Agreement, and such breach is not capable of remedy;

(c) the other Party to this Agreement (i) makes an assignment for the benefit of creditors, (ii) files voluntarily or involuntarily, or acquiesces to a petition in any court (whether or not pursuant to any statute of the United States or of any state, of Canada or of any province, or of the United Kingdom) in any bankruptcy, reorganization, composition, extension, arrangement or insolvency proceedings, (iii) makes an application in any such proceedings for or acquiesce to the appointment of a trustee or receiver, or (iv) takes any action in any jurisdiction which is similar to or the same as any of the foregoing.

9.4 Impact of Partner Agreement ending

(a) In the event that Customer's Partner Agreement terminates or expires, ThreatAware shall be entitled to terminate this Agreement (or, where Customer has also ordered the other Service directly or through a different Authorised Partner, the affected part of this Agreement relating to the Services procured under that Partner Agreement) upon written notice to Customer.

(b) In the event that the Authorised Partner ceases to be an authorised partner of ThreatAware, or ThreatAware's arrangements with the Authorised Partner otherwise come to an end, ThreatAware shall continue providing the affected Services for the remainder of the then-current Subscription Period. Any renewal may be subject to Customer agreeing a new Order with ThreatAware or a different Authorised Partner.

9.5 Effect of Termination

Upon termination of this Agreement for any reason:

(a) Customer's rights to access and use the Services will terminate;

(b) Customer will promptly cease all use of the Services (and ensure that each all Users cease all access and use); and

(c) if applicable, all undisputed fees owing to ThreatAware at the date on which termination or expiry takes effect will become immediately due and payable.

9.6 Survival

Clauses 1, 3.5, 6, 7, 8, 9.4, this 9.6, and 11 to 13 will survive expiration or termination of this Agreement for any reason.

10. Compliance with Laws

Each party agrees to comply with Applicable Laws, including but not limited to, applicable export and import, anti-corruption and employment laws. Customer affirms that Customer is not named on, owned by, or acting on behalf of any United Kingdom, U.S., Canadian or other applicable government denied-party list, and Customer agrees to comply fully with all relevant export control and sanctions laws and regulations of the United Kingdom, the United States, Canada and other applicable jurisdictions ("Export Laws") to ensure that neither the Services, any Customer Data, nor any technical data related thereto is:

(a) used, exported or re-exported directly or indirectly in violation of Export Laws; or

(b) used for any purposes prohibited by the Export Laws, including, but not limited to, nuclear, chemical, or biological weapons proliferation, missile systems or technology, or restricted unmanned aerial vehicle applications.

Customer shall complete all undertakings required by Export Laws, including obtaining any necessary export license or other governmental approval. Any non-compliance with this clause 10 by Customer may, at ThreatAware's discretion, be deemed a material breach incapable of remedy.

11. Governing Law and Dispute Resolution

Any dispute or claim relating in any way to this Agreement will be governed by the Governing Law defined in the table below and adjudicated:

(a) in the Governing Courts defined in the table below, in which case each party consents to the exclusive jurisdiction and venue thereof; or

(b) by final and binding arbitration; in each case, as set forth in the table below. Notwithstanding the foregoing:

(i) each party may enforce its or its Affiliates' Intellectual Property Rights in any court of competent jurisdiction, including to seek injunction, specific performance and any other relief that may be available from any such court; and

(ii) ThreatAware or its Affiliates may bring suit for payment in the country where Customer is located. Where arbitration applies, it will be conducted in English, under the Rules of Arbitration of the International Chamber of Commerce (the "ICC") by three arbitrators in accordance with said Rules.

The award shall be final and binding on the parties. Except to the extent entry of judgment and any subsequent enforcement may require disclosure, all matters relating to the arbitration, including the award, will be held in confidence. Customer and ThreatAware agree that the United Nations Convention on Contracts for the International Sale of Goods shall not apply.

Customer location: United Kingdom

• Governing Law: The laws of England & Wales
• Governing Courts / Arbitration: The courts of England & Wales
• ThreatAware contracting entity: ThreatAware Ltd (Registered number: 14505300, registered address: 224-226 Tower Bridge Road, London, England, SE1 2UP).

Customer location: United States of America

• Governing Law: The laws of the state of Delaware
• Governing Courts / Arbitration: The parties irrevocably agree that any controversy or claim arising out of or relating to this Agreement, or the breach thereof, shall be settled by arbitration administered by the American Arbitration Association in accordance with its Commercial Arbitration Rules, and judgment on the award rendered by the arbitrator(s) may be entered in any court having jurisdiction thereof. The parties agree that the arbitration will take place in New York, New York State, using one (1) arbitrator that is mutually agreed upon by the parties. The Services are a "commercial product" as that term is defined at 48 C.F.R. § 2.101, consisting of "commercial computer software" and "commercial computer software documentation" as such terms are used in 48 C.F.R. § 12.212. Accordingly, if Customer is an agency of the US Government or any contractor therefor, Customer only receives those rights with respect to the Services as are granted to all other end users under license, in accordance with (a) 48 C.F.R. § 227.7201 through 48 C.F.R. § 227.7204, with respect to the Department of Defense and their contractors, or (b) 48 C.F.R. § 12.212, with respect to all other US Government licensees and their contractors.
• ThreatAware contracting entity: ThreatAware USA Inc (Principal address: 1330 Avenue of the Americas, 23rd Floor, New York, NY 10019, USA).

Customer location: Canada

• Governing Law: The laws of the province of Ontario
• Governing Courts / Arbitration: The parties irrevocably agree that any controversy or claim arising out of or relating to this Agreement, or the breach thereof, shall be settled by arbitration conducted in accordance with the Arbitration Act 1991 (Ontario), and judgment on the award rendered by the arbitrator(s) may be entered in any court having jurisdiction thereof. The parties agree that the arbitration will take place in the City of Toronto, Ontario, using one (1) arbitrator that is mutually agreed upon by the parties.
• ThreatAware contracting entity: ThreatAware Canada Inc (Business number: 718934169, registered under the Business Corporations Act (Ontario)).

Customer location: None of the above

• Governing Law: The laws of England & Wales
• Governing Courts / Arbitration: The courts of England & Wales
• ThreatAware contracting entity: ThreatAware Ltd (Registered number: 14505300, registered address: 224-226 Tower Bridge Road, London, England, SE1 2UP).

12. General Provisions

12.1 Entire Agreement

This Agreement is the complete and exclusive agreement between the parties with respect to its subject matter and supersedes any and all prior or contemporaneous agreements, communications and understandings, both written and oral, with respect to its subject matter. Each party acknowledges that in entering into this Agreement it has not relied on any representation, warranty, collateral contract or other assurance not expressly set out in this Agreement, and waives all rights and remedies which might otherwise be available to it in respect of any such representation, warranty, collateral contract or other assurance. Any terms and conditions contained in or referenced by any purchase order, order acknowledgement, invoice or other document issued by either party (including any Authorised Partner) shall have no effect, and no course of dealing, course of performance, trade usage or industry custom shall be incorporated into or used to interpret this Agreement, whether or not such terms or documents are objected to by the other party.

12.2 Amendments

This Agreement may be amended or modified only by a written document executed by duly authorised representatives of the parties, except that ThreatAware may unilaterally modify the Service Description so long as it does not reduce or materially modify the functionality of the Services.

12.3 Conflicts

Unless otherwise specifically agreed to in writing signed by the parties, in the event of any conflict or inconsistency between this Agreement, any Order or any document incorporated by reference into this Agreement, the order of precedence of the documents from highest to lowest is:

(a) the Order;

(b) the main body of this Agreement; and

(c) the documents incorporated herein by reference solely with respect to the subject matter of such documents, and provided, further, that the Data Processing Terms will prevail over the Order, the main body of this Agreement and all other documents solely with respect to its subject matter.

12.4 Assignment

Neither party may assign or transfer this Agreement, by operation of law or otherwise, without the other party's prior written consent. Any attempt to assign or transfer this Agreement without such consent will be void. Notwithstanding the foregoing, ThreatAware may assign or transfer this Agreement to:

(a) an Affiliate in connection with a corporate reorganisation; or

(b) a third party that succeeds to all or substantially all of ThreatAware's business and assets relating to the subject matter of this Agreement, whether by sale, merger, operation of law or otherwise. Subject to the foregoing, this Agreement is binding upon and will inure to the benefit of each of the parties and their respective successors and permitted assigns.

12.5 Customer's Compliance

Customer agrees to permit ThreatAware, or an independent representative appointed by ThreatAware, to verify that Customer's use of the Services complies with this Agreement. ThreatAware will not exercise this right more than once in any 12-month period. If Customer procured the Services through an Authorised Partner, Customer also agrees that ThreatAware may request Customer to provide confirmation of the order(s) placed by Customer with the Authorised Partner, including copies of agreement(s) between Customer and the Authorised Partner, provided that all pricing information will be removed from the copies provided to ThreatAware. Without limiting ThreatAware's rights under this clause 12.5, ThreatAware may monitor Customer's use of the Services solely for the purposes of ensuring compliance with this Agreement, maintaining security of the Services, and improving Service performance.

12.6 Equitable Relief

Each party agrees that a breach or threatened breach by such party of any of its obligations under clause 6 (Confidentiality) or, in the case of Customer, clause 3.3 (Restrictions), would cause the other party irreparable harm and significant damages for which there may be no adequate remedy under law and that, in the event of such breach or threatened breach, the other party will have the right to seek immediate equitable relief, including a restraining order, an injunction, specific performance and any other relief that may be available from any court. Such remedies are not exclusive and are in addition to all other remedies that may be available at law, in equity or otherwise.

12.7 Independent Contractors

The relationship between the parties is that of independent contractors. Nothing in this Agreement will be construed to establish any partnership, joint venture or agency relationship between the parties. Neither party will have the power or authority to bind the other or incur any obligations on the other's behalf without the other party's prior written consent.

12.8 No Third-Party Beneficiaries

No provision of this Agreement is intended to confer any rights, benefits, remedies, obligations, or liabilities hereunder upon any person or entity other than the parties and their respective successors and assigns.

12.9 Waiver; Severability

Either party's failure to enforce any provision of this Agreement will not constitute a waiver of future enforcement of that or any other provision. No waiver of any provision of this Agreement will be effective unless it is in writing and signed by the party granting the waiver. If any provision of this Agreement is held invalid, illegal or unenforceable by a court of competent jurisdiction, that provision will be enforced to the maximum extent permitted by law, given the fundamental intentions of the parties, and the remaining provisions of this Agreement will remain in full force and effect.

12.10 Force Majeure

Other than in respect of Customer's payment obligations (if any), neither party will be responsible for any failure or delay in the performance of its obligations under this Agreement due to causes beyond its reasonable control, which may include, without limitation, labour disputes, strikes, lockouts, shortages of or inability to obtain energy, raw materials or supplies, telecommunications failure or degradation, pandemics, epidemics, public health emergencies, governmental orders and acts (including government-imposed travel restrictions and quarantines), material changes in law, war, terrorism, riot, or acts of God. The party experiencing such event will use commercially reasonable efforts to provide notice of such to the other party. During the continuation of such event, the non-performing party will use commercially reasonable efforts to overcome the effects of the event and, to the extent it is able, continue to perform its obligations under this Agreement.

12.11 Notices

Any notice will be delivered by email with satisfactory proof of such delivery to be retained by sender. Notices will only become effective on the actual date that the notice is received. Any notices required to be given in writing to ThreatAware will be addressed to: hello@threataware.com.

13. Definitions

When used in this Agreement, terms defined in this clause 13 will have the meanings given below. Defined terms may be used in the singular or plural depending on the context.

"Active Device" means, in respect of the ThreatAware Service, each Customer or Customer Affiliate device ThreatAware has identified through an integration within the previous thirty (30) days;

"Affiliate" means any corporation or other business entity that directly or indirectly controls, is controlled by or is under common control with a party. Control means direct or indirect ownership of or other beneficial interest in fifty percent (50%) or more of the voting stock, other vesting interest, or income of a corporation or other business entity;

"Applicable Laws" means all international, domestic and local laws, ordinances, regulations and orders applicable to a party's performance under this Agreement;

"App(s)" means, in respect of the Dimension Service, any application which Customer may create using the Dimension Service, and any application created by ThreatAware or any third party (including any other customer) and made available to Customer as part of the Dimension Service and which Customer chooses to deploy;

"Authorised Partner" means a partner of ThreatAware who is authorised to invoice Customer and accept payments from Customer;

"Confidential Information" means any information, however conveyed or presented, that relates to the business, affairs, operations, customers, suppliers, processes, budgets, pricing policies, product information, strategies, developments, trade secrets, intellectual property, materials, designs, improvements, formulae, discoveries, inventions, networks, concepts, ideas, technical information and know-how of a party, and any other information clearly designated by a party as being confidential to it (whether or not it is marked "confidential"), and information that ought reasonably be considered to be confidential given its nature or circumstance of disclosure, but in all circumstances excludes any Relevant Data;

"Customer" means the party using or accessing the Services, or any portion thereof, in each case, pursuant to the terms of this Agreement;

"Customer Data" means all data and information submitted into, or stored in, the Services by Customer, or otherwise provided by Customer to, or accessible by, ThreatAware in connection with this Agreement; but excluding any information or data owned or controlled by ThreatAware and made available through or in connection with the Services;

"Data Processing Terms" means the data processing terms which are attached to and form part of this Agreement;

"Dimension Service" means the Services marketed by ThreatAware under the name "Dimension", as set out in the applicable Order;

"Intellectual Property Rights" means all intellectual and industrial property rights of any kind, wherever in the world arising and whether registered or unregistered, including: (i) patents, patent applications, utility models, and industrial designs; (ii) rights in works of authorship, including software (in source code and object code), databases, APIs, documentation, and specifications; (iii) rights in confidential information, trade secrets, methodologies, processes, and know-how; (iv) trade marks, service marks, trade names, logos, and domain names, together with associated goodwill; (v) rights in artificial intelligence models, including trained model weights, associated training data, and inference outputs generated by such models; (vi) all rights of action and rights to sue for past, present, and future infringement or misappropriation of any of the foregoing; and (vii) all other intellectual property rights now existing or created in the future;

"Order" means any order form, quote, purchase order or other ordering document agreed to or accepted by ThreatAware, or ThreatAware and an Authorised Partner where applicable, that identifies the Services purchased by Customer (including whether the ThreatAware Service, the Dimension Service, or both, have been ordered), price (if applicable), and the Subscription Period;

"Partner Agreement" means a separate agreement between Customer and an Authorised Partner;

"Relevant Data" has the meaning given to it in the Data Processing Terms;

"Services" means, as applicable, the ThreatAware Service and/or the Dimension Service, in each case as set out in the Order, the Partner Agreement or as otherwise agreed between Customer and ThreatAware;

"Service Description" means the technical and user manuals and guides for the Services as provided in the Order or Partner Agreement (as applicable) as may be updated by ThreatAware from time to time;

"Subscription Period" means the period during which ThreatAware shall make available the Services to Customer as set forth in the applicable Order or as otherwise agreed (but excludes any Trial Period) (subject to earlier termination in accordance with this Agreement);

"ThreatAware Service" means the Services marketed by ThreatAware under the name "ThreatAware", as set out in the applicable Order; and

"User" means each individual employee, agent or contractor who has been authorised to access the Services on Customer's or Customer Affiliate's behalf.

ThreatAware Data Processing Terms

These Data Processing Terms govern the processing of Relevant Data by ThreatAware in its performance of the Services (whether the ThreatAware Service, the Dimension Service, or both). These Data Processing Terms form part of the Agreement to which they are attached and take effect from the Effective Date of such Agreement.

1. Definitions

In these Data Processing Terms, the following terms have the meanings given below. Any term not defined in these Data Processing Terms shall have the meaning given to it in the Agreement.

"Applicable Data Protection Laws" means all laws and regulations applicable to the processing of Relevant Data under the Agreement, which may include (as applicable and without limitation): (a) in the United Kingdom: the UK GDPR and the Data Protection Act 2018; (b) in the European Union: the EU GDPR and any applicable member state implementing legislation; (c) in the United States: applicable federal and state privacy laws, including (where applicable) the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, with relevant implementing regulations, the "CCPA"); (d) in Canada: Canadian Data Protection Laws; and (e) any other applicable national, federal or state-level data protection, privacy or equivalent legislation in any jurisdiction in which ThreatAware processes Relevant Data under the Agreement, in each case as amended, updated or replaced from time to time;

"Canadian Data Protection Laws" means the Personal Information Protection and Electronic Documents Act (PIPEDA) and any substantially similar provincial legislation, as applicable;

"EU GDPR" means the General Data Protection Regulation ((EU) 2016/679);

"EU SCCs" means Module 2 to the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to the EU GDPR, as adopted by the European Commission under Implementing Decision (EU) 2021/914;

"Relevant Data" means any information relating to an identified or identifiable natural person which is contained within Customer Data and processed by ThreatAware on behalf of Customer in connection with the Services, including (as applicable and without limitation) information constituting "personal data" as defined under the UK GDPR or EU GDPR, "personally identifiable information" or "PII" as used under applicable United States privacy laws, "personal information" as defined under Canadian Data Protection Laws, or any equivalent concept under any other Applicable Data Protection Laws;

"Relevant Data Breach" means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, Relevant Data transmitted, stored or otherwise processed by ThreatAware or any Sub-processor in connection with the Services;

"Standard Transfer Clauses" means standard contractual clauses or equivalent transfer instruments approved or recognised under Applicable Data Protection Laws for the purpose of international transfers of personal data.

"Sub-processor" means any third party appointed by or on behalf of ThreatAware to process Relevant Data in connection with the provision of the Services;

"Sub-processor List" has the meaning given to it in paragraph 4.1;

"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner's Office under s.119A of the Data Protection Act 2018 (version B1.0 in force from 21 March 2022, or such successor version as the ICO may issue); and

"UK GDPR" has the meaning given to it in section 3 of the Data Protection Act 2018.

2. Roles

2.1 The parties acknowledge that, based on the nature of the Services and the processing described in the Schedule, Customer determines the purposes and means of processing Relevant Data and accordingly acts as the controller (or equivalent concept under Applicable Data Protection Laws) in respect of that processing. ThreatAware processes Relevant Data only on behalf of, and at the direction of, Customer and accordingly acts as the processor (or equivalent concept). Nothing in these Data Processing Terms shall be construed as altering the status of either party as determined by Applicable Data Protection Laws or the factual circumstances of the processing. Each party will comply, and will take reasonable steps to ensure that its personnel comply, with its respective obligations under Applicable Data Protection Laws in relation to the processing of Relevant Data.

2.2 Where Applicable Data Protection Laws in a given jurisdiction do not adopt the concepts of "controller" and "processor," (including Canada) the parties agree that Customer determines the purposes and means of processing Relevant Data and ThreatAware processes Relevant Data solely on behalf of, and at the direction of, Customer. Where Canadian Data Protection Laws apply, in respect of any Relevant Data, Customer will have and retain control of the Relevant Data and ThreatAware will act as its service provider and collect, use, disclose, and otherwise process such Relevant Data in accordance with the preceding sentence.

3. ThreatAware's Obligations

3.1 ThreatAware shall process Relevant Data only:

(a) in accordance with Customer's documented instructions, including to the extent necessary to provide the Services and as set out in these Data Processing Terms and the Agreement;

(b) as required by applicable laws, in which case ThreatAware shall (to the extent permitted by such law) notify Customer of that legal requirement before processing.

3.2 ThreatAware shall implement and maintain appropriate technical and organisational security measures, not less than those required to achieve ISO 27001 or an equivalent standard, to protect Relevant Data against unauthorised or unlawful processing and against accidental loss, destruction, alteration, or disclosure.

3.3 ThreatAware shall place all personnel who are authorised to process Relevant Data under appropriate written obligations of confidentiality.

3.4 ThreatAware shall not publish, disclose, or divulge Relevant Data to any third party except as expressly permitted under these Data Processing Terms or as required by Applicable Data Protection Laws.

3.5 ThreatAware shall notify Customer in writing within 48 hours of becoming aware of a Relevant Data Breach, providing such detail regarding the nature of the Relevant Data Breach and the number of individuals and data records impacted as is reasonably available to ThreatAware at the time of notification. ThreatAware shall cooperate with Customer and take such reasonable steps as Customer may direct to assist in the investigation, mitigation, and remediation of such Relevant Data Breach.

3.6 Taking into account the nature of the processing of Relevant Data by ThreatAware and the information available to ThreatAware, ThreatAware shall provide reasonable assistance to Customer in:

(a) responding to requests from data subjects (or their equivalents under Applicable Data Protection Laws) seeking to exercise their rights in respect of Relevant Data processed under the Agreement;

(b) complying with Customer's obligations in respect of security and Relevant Data Breach notifications to supervisory authorities and impacted individuals and maintaining records of breaches of security safeguards as required under Applicable Data Protection Laws; and

(c) completing any data protection impact assessments or equivalent processes required under Applicable Data Protection Laws (and, to the extent required by Applicable Data Protection Laws, consultation with competent authorities regarding such data protection impact assessments).

3.7 Subject to the confidentiality obligations under clause 6 of the Agreement, ThreatAware shall provide Customer with all information reasonably necessary to demonstrate ThreatAware's compliance with these Data Processing Terms. ThreatAware shall permit Customer, or an independent auditor appointed by Customer, to audit ThreatAware's processing of Relevant Data upon reasonable prior written notice, subject to Customer's confidentiality obligations under clause 6 of the Agreement, provided that such audit shall be conducted no more than once in any 12-month period save where a Relevant Data Breach has occurred, and provided that the audit is conducted during normal business hours and in a manner that minimises disruption to the business of ThreatAware.

3.8 In addition to the foregoing, where Relevant Data is subject to the CCPA, ThreatAware agrees that it shall: (a) not "sell" or "share" (as terms are defined by the CCPA) any Relevant Data; (b) not process any Relevant Data outside the direct business relationship between the parties; (c) grant Customer the right to take reasonable and appropriate steps to ensure that ThreatAware processes Relevant Data in a manner consistent with the CCPA and this Agreement, and to take reasonable and appropriate steps to stop any unauthorized processing of Relevant Data; and (d) notify Customer if ThreatAware determines it cannot meet its obligations under the CCPA.

4. Sub-processors

4.1 Customer grants ThreatAware general authorisation to engage Sub-processors for the purpose of performing the Services. The current list of approved Sub-processors is published on ThreatAware's Trust Centre at https://trust.threataware.com/ (opens in a new tab) and is updated by ThreatAware from time to time in accordance with this paragraph 4 ("Sub-processor List").

4.2 ThreatAware shall enter into a written agreement with each Sub-processor imposing data protection obligations no less onerous than those imposed on ThreatAware under these Data Processing Terms, and shall remain fully liable to Customer for the acts and omissions of each Sub-processor in relation to Relevant Data to the same extent as if ThreatAware had carried out such processing directly.

4.3 ThreatAware shall notify Customer of any intended addition or replacement of a Sub-processor by:

(a) updating the Sub-processor List on its website; and

(b) providing Customer with email notice of the proposed change at least 14 days before the new or replacement Sub-processor begins processing Relevant Data ("Sub-processor Notice").

4.4 Customer may object to the proposed addition or replacement by giving written notice to ThreatAware within 14 days of receiving the Sub-processor Notice ("Objection Notice"). An Objection Notice must set out the reasonable and documented grounds on which Customer objects, which must relate to data protection compliance. An objection made on commercial or other non-data-protection grounds shall not be valid for the purposes of this paragraph.

4.5 On receipt of a valid Objection Notice:

(a) ThreatAware shall work with Customer in good faith to seek to resolve the objection within a further period of 14 days; and

(b) where the objection cannot be resolved within that period, ThreatAware shall notify Customer in writing. Customer may, within 30 days of receiving that notification, terminate the Agreement on written notice, without liability for early termination, to the extent that the termination relates solely to the Services affected by the change in Sub-processor.

4.6 Where Customer does not serve an Objection Notice within the 14-day period specified in paragraph 4.4, Customer shall be deemed to have accepted the proposed Sub-processor.

4.7 ThreatAware shall procure that any Sub-processor engaged to process Relevant Data in a third country is subject to a transfer mechanism and contractual measures imposing obligations to implement and maintain security safeguards that are appropriate to the sensitivity of the Relevant Data that may be transferred or made available to such Sub-processor, in each case satisfying the requirements of Applicable Data Protection Laws and no less protective than the mechanisms set out in paragraph 5.

5. International Transfers of Relevant Data - Generally

5.1 The parties acknowledge that ThreatAware maintains its systems in the United States and that, in providing the Services, ThreatAware will process Relevant Data in the United States and ThreatAware and its Sub-processors may transfer Relevant Data to countries outside the jurisdiction in which it was originally collected, including to the United States.

5.2 ThreatAware shall not transfer Relevant Data to a third country except where one of the following conditions is satisfied:

(a) the destination country has been the subject of an adequacy decision or equivalent finding under Applicable Data Protection Laws;

(b) appropriate safeguards have been put in place in accordance with Applicable Data Protection Laws, including by way of entering into the applicable Standard Transfer Clauses with the relevant Sub-processor or other third party and ensuring that each Sub-processor to which such Relevant Data is transferred or made available has implemented and maintains security safeguards that are appropriate to the sensitivity of such Relevant Data; or

(c) a derogation applies under Applicable Data Protection Laws which lawfully permits the transfer.

5.3 If any transfer mechanism relied upon by ThreatAware under these Data Processing Terms is invalidated, suspended, or amended by a supervisory authority or court of competent jurisdiction, the parties shall cooperate in good faith to put in place an alternative lawful transfer mechanism as soon as reasonably practicable, and ThreatAware shall suspend the relevant transfers until a compliant mechanism is in place.

6. EEA Transfers

6.1 Where Relevant Data is subject to EU GDPR, the parties agree that the EU SCCs are incorporated into these Data Processing Terms by reference and shall apply to transfers of such Relevant Data from Customer to ThreatAware, with the following specifications:

(a) in Clause 7 of the EU SCCs (Docking clause), the optional docking clause shall not apply;

(b) in Clause 9 of the EU SCCs (Use of sub-processors), Option 2 (General written authorisation) shall apply, and the specified time period for changes to Sub-processors is 14 days;

(c) in Clause 11 of the EU SCCs (Redress), the optional language permitting data subjects to lodge complaints with an independent dispute resolution body shall not apply;

(d) in Clause 17 of the EU SCCs (Governing law), the parties select Option 1 and the law of the Republic of Ireland;

(e) in Clause 18 of the EU SCCs (Choice of forum and jurisdiction), the parties select the courts of the Republic of Ireland; and

(f) the information required for Annexes I, II, and III of the EU SCCs shall be as set out in the Schedule to these Data Processing Terms, which the parties agree constitutes completion of those Annexes for the purposes of the EU SCCs.

6.2 In respect of transfers subject to this paragraph 6, the EU SCCs shall prevail to the extent of any conflict between the EU SCCs and the remaining provisions of these Data Processing Terms.

7. UK Transfers

7.1 Where Relevant Data is subject to UK GDPR, the parties agree that the UK Addendum is incorporated into these Data Processing Terms by reference and shall apply to transfers of such Relevant Data from Customer to ThreatAware, with the following specifications:

(a) Table 1 of the UK Addendum is completed by reference to the parties and transfer details set out in the Schedule to these Data Processing Terms and the 'start date' shall be the Effective Date of this Agreement;

(b) The Addendum EU SCCs (as defined in the UK Addendum) for the purposes of Table 2 of the UK Addendum is completed by reference to the EU SCCs as incorporated under paragraph 6.1 of these Data Processing Terms;

(c) Table 3 of the UK Addendum is completed by reference to the Schedule to these Data Processing Terms; and

(d) Table 4 of the UK Addendum is completed by specifying that neither party may end the UK Addendum.

7.2 In respect of any transfers subject to this paragraph 7, the UK Addendum shall prevail to the extent of any conflict between the UK Addendum and the remaining provisions of these Data Processing Terms.

8. Return and Deletion of Relevant Data

8.1 Upon expiry or termination of the Agreement, or upon Customer's written request at any time, ThreatAware shall, at Customer's election, either:

(a) return all Relevant Data to Customer in a commonly used, machine-readable format; or

(b) irrecoverably delete or destroy all Relevant Data;

(c) and in either case, provide Customer with written certification that it has done so, within 30 days of the Customer's request that it do so.

8.2 ThreatAware may retain Relevant Data beyond the period referred to in paragraph 8.1 only to the extent, and for the duration, required by applicable laws, provided that any such retained Relevant Data shall remain subject to these Data Processing Terms and shall not be used for any other purpose.

8.3 ThreatAware warrants that it shall not retain, process, share, or sell any Relevant Data following expiry or termination of the Agreement except as permitted under paragraph 8.2. Any post-termination retention of data by ThreatAware shall only be in a form that has been rendered permanently anonymous and from which no individual can reasonably be identified.

9. Processing Details

The subject matter, duration, nature, purpose, types of Relevant Data, and categories of data subjects are set out in the Schedule to these Data Processing Terms.

Schedule 1 - Processing Details

This Schedule constitutes the description of the processing for the purposes of these Data Processing Terms and also serves as: (a) Annexes I, II, and III to the EU SCCs incorporated under paragraph 6; and (b) Tables 1, 2, and 3 of the UK Addendum incorporated under paragraph 7.

The current list of approved Sub-processors is published and maintained on ThreatAware's website at https://trust.threataware.com/ (opens in a new tab). As at the Effective Date, ThreatAware's approved Sub-processors are those listed on that page. The Sub-processor List forms part of the information provided for the purposes of Annex III to the EU SCCs and Table 3 of the UK Addendum.

Subject matter and purpose: Customer requires a technology solution to aggregate and visualise event data from across its IT estate, and/or (where Customer has ordered the Dimension Service) to create and deploy Apps. This data relates primarily to security and risk events generated by security software within Customer's IT systems and platforms, or through service providers that host or provide those platforms. Customer may also use task management features within the Services to track and remediate risk events or operational activities. ThreatAware will provide the software and services, including (where necessary through Sub-processors) secure hosting of Customer Data, to deliver this solution.

Duration: On a rolling basis, for the duration of the Agreement.

Nature of processing: Secure hosting of Customer Data and associated event data to ISO 27001 standard or equivalent; aggregation and visualisation of data in software dashboards; generation of events and alerts in relation to risk data; and, in respect of the Dimension Service, creation, hosting and deployment of Apps.

Types of Relevant Data: The scope of Relevant Data contained within event data may be broad but will principally include: name; IP address; and IT access, usage, browsing or compliance data.

Categories of data subjects: Employees, agents and contractors of Customer and Customer Affiliates.

Technical and organisational security measures: ThreatAware shall maintain security measures not less than those required to achieve ISO 27001 or an equivalent standard, including: access controls and user authentication; encryption of Relevant Data in transit and at rest; regular security testing and vulnerability assessments; incident detection and response procedures; and business continuity and disaster recovery arrangements.

Data exporter (for SCCs/UK Addendum purposes): Customer, as identified in the Agreement.

Data importer (for SCCs/UK Addendum purposes): ThreatAware Limited, as identified in the Agreement.