GENERAL CLOUD SERVICE CONDITIONS Solteq Plc General Cloud Service Conditions 2(13) Solteq Plc 9/2019 Solteq Plc, Karhumäentie 3, FI–01530 Vantaa Tel +358 (0)20 14444, Fax +358 (0)20 1444 222 VAT no. FI04904840 Contents CLOUD SERVICE GENERAL CONDITIONS 9/2019 1 About these Conditions 2 Definitions 3 Use of the Service 4 General responsibilities of the Customer 5 Warranties 6 Service Support 7 Changes to Service 8 Fees and taxes 9 Identifiers 10 Intellectual property rights 11 Suspension of Service 12 Backups 13 Data security 14 Processing of Personal Data contained in the Customer Data 15 Management of data security breaches 16 Subcontracting 17 Confidentiality 18 General 19 Indemnification 20 Force Majeure 21 Liability for damages and limitation of liability 22 Audit rights 23 Validity and termination 24 Applicable law and settlement of disputes General Cloud Service Conditions 3(13) Solteq Plc 9/2019 Solteq Plc, Karhumäentie 3, FI–01530 Vantaa Tel +358 (0)20 14444, Fax +358 (0)20 1444 222 VAT no. FI04904840 CLOUD SERVICE GENERAL CONDITIONS 9/2019 1 About these Conditions These General Conditions are applied to the use of the Service ordered by the Customer from Solteq Plc (hereinafter the “Supplier”) By signing or otherwise accepting the Service Agreement, the Customer approves of these General Conditions and commits to observing them. Supplier reserves the right to modify these conditions or any additional terms that apply to the Service to, for example, reflect changes to the law or changes to the Service. Changes will not apply retroactively and will become effective no sooner than fourteen days after they have been made available. However, changes addressing new functions for a Service or changes made for legal reasons will be effective immediately. Any changes will be informed on the Supplier’s website in advance as early as feasible in each case. 2 Definitions “Access Point” means a point or points used by the Supplier to connect the Service to general communications network or other connection point specified in the Service Agreement. “Availability” refers to the availability of the Service as specified in the Service Description. “Client Software” means any software provided or made available to the Customer by or on behalf of the Supplier to access and use the Service. “Customer Data” means any information stored in the Service by or on behalf of the Customer. “Customer Material” means information or material made available to the Supplier by or on behalf of the Customer for purposes of commissioning, operating, maintaining and developing the Service as well as any other information or material specified as Customer Material by the Parties including, but not limited to interface information to connect the Service to the systems of the Customer or any third party. “Date of Entry into Force” refers to the Date of Entry into Force of the Service Agreement specified in the Service Agreement or, if not otherwise agreed in the Service Agreement, to the date on which the Supplier grants the Customer user rights to the Service. “Deployment” refers to the actions of the Customer and services of the Supplier that result in the Service being made available to the Customer. “Deployment Training” refers to the training on the functionality of the Service arranged by the Supplier in connection with the deployment of the Service. The form of the training and other details will be agreed upon in the Service Description. “Error(s)” refers to programming errors in the Service in the form provided by the Supplier that prevent the Service from substantially conforming to its published specifications. “Hardware” means the payment terminals, kiosks, customer displays, and other hardware products used by the Customer to access and use the Service. “Identifier” means user identifier such as password or other method for identifying the user of the Service in a reliable manner. “Immaterial Rights” refer to copyright, related rights (including rights to databases, lists or photographs), patents, utility models, design rights, trademarks, trade names, trade or business secrets, knowhow or any other registered or unregistered immaterial rights. “Party” refers to the Customer and the Supplier (jointly referred to as the “Parties”). “Patch(es)” refers to additional programming code to be integrated with the Client Software to correct and Error or alleviate its effects. “Service” refers to the relevant cloud service as specified in the Service Description and made available by the Supplier. “Service Agreement” refers to a written agreement and its appendices concluded by the Parties for ordering the Service. “Service Description” refers to an appendix of the Service Agreement that sets out the specification of the Service, Availability and Deployment. “Subscription Period” refers to the subscription period agreed upon in the Service Agreement. General Cloud Service Conditions 4(13) Solteq Plc 9/2019 Solteq Plc, Karhumäentie 3, FI–01530 Vantaa Tel +358 (0)20 14444, Fax +358 (0)20 1444 222 VAT no. FI04904840 “Supplier Material” means material provided or made available by the Supplier to the Customer for purposes of the use of the Service and any other information or material specified as Supplier Material by the Parties. “Update” refers to a modification, correction or addition to the Service or documentation, including updates and enhancements for the Service that the Supplier makes generally available to its customers as a part of support and maintenance, without additional charge. The definition of “Update” excludes Upgrades. “Upgrade” refers to an enhancement or addition to the Service other than an Update which the Supplier does not make generally available to its customers as a part of support and maintenance but rather is only made available for the Service subject to payment of a separate incremental fees or upgrade charge. 3 Use of the Service Subject to the Service Agreement and Customer’s continuing compliance with the Service Agreement, the Supplier hereby grants the Customer the right to use the Service solely for its own business purposes through mutually agreed interfaces. Subject to the terms and conditions of this Service Agreement the Supplier shall provide the Service. During the validity of the Service Agreement, the Supplier shall deliver Service to the Access Point(s) in accordance with agreed the Availability. The Service and the Availability of the Services are specified in the Service Agreement and its Appendices. The Supplier shall inform the Customer without delay of any matter that comes to the knowledge of the Supplier and that may prevent use of the Service in conformity with the Service Agreement. The delivery of the Service shall be deemed to have commenced at the moment when the Supplier notifies that the Service is available at any Access Point. The Supplier’s right to invoice for the Service shall begin at the moment when the Service is available to the Customer at the Access Point. If the Deployment of the Service is delayed due to a reason attributable to the Customer, the delivery time will be extended until the issue preventing the Deployment has been repaired or removed. The Supplier shall inform the Customer in writing of the Supplier’s contact person and other necessary contact details, as well as any changes thereto, for the purpose of the Customer’s contact requests relating to the Service. 4 General responsibilities of the Customer The Customer shall use the Service in accordance with the Service Agreement. Subject to the terms of the Service Agreement, the Customer has the limited right to use the Service solely for its internal business purposes. The Customer is not entitled to resell, sublicense, make available or in any other way distribute the Service to third parties without the written consent of the Supplier. The Customer shall be responsible for the hardware, software and connections required for the use of the Service beyond the Access Point(s), unless otherwise agreed in the Service Agreement. The Customer shall provide the Supplier with sufficient and correct information for the Supplier to be able to deliver the Service and also otherwise reasonably contribute to the delivery of the Service. The Customer shall provide the Supplier with information on any laws, regulations and/or standards applicable to its use of the Service and any changes thereto. The Customer shall be responsible for the information and instructions provided to the Supplier and for keeping them up to date. The Customer undertakes to inform the Supplier about any changes to its operating environment for three (3) months in advance. The personnel or contractors of the Customer may install and/or access the Client Software provided that: (i) the Customer is responsible for the acts and omissions of these users with respect to the Service; and (ii) the Customer is responsible for the compliance of these users with the Service Agreement. Unless otherwise agreed the Customer shall not and shall not attempt or allow third parties to modify or change the Service and/or the Client Software in any manner or form. The Customer shall inform the Supplier in writing of the Customer’s contact person and other necessary contact details, as well as any changes thereto, for the purpose of the Supplier’s contact requests relating to the Service. General Cloud Service Conditions 5(13) Solteq Plc 9/2019 Solteq Plc, Karhumäentie 3, FI–01530 Vantaa Tel +358 (0)20 14444, Fax +358 (0)20 1444 222 VAT no. FI04904840 5 Warranties The Supplier represents and warrants that the Service, as available at the Access Point(s), functions and performs in material respects in accordance with the documentation for the Service (including the applicable Availability), as updated in accordance with the Service Agreement, and undertakes to perform the tasks for which it is responsible materially in conformity with the Service Agreement and with due care. The Supplier warrants that any customer specific adaptations to the Service will operate in the specified operating environment in material respects as described in the applicable documentation for 30 days after delivery. The Customer must notify the Supplier of any program warranty deficiency within 30 days after the original Deployment of the Service. The Supplier undertakes to ensure that the instructions reasonably necessary for the use of the Service by appropriately trained persons and requirements for operating environment are available to the Customer. The Supplier shall provide the Customer with other support related to the Deployment of the Service only if separately agreed upon. The Customer undertakes to perform the tasks for which it is responsible in conformity with the Service Agreement and with due care. 6 Service Support During the term of the Service Agreement and subject to payment of all applicable one-time and running fees, as determined in the Service Agreement, as updated with no less than 30 days’ notice by the Supplier, as well as the terms of the Service Agreement, the Supplier shall provide the following: (i) Updates. The Supplier will regularly update and make available to the Customer relevant Service Updates (or as applicable, Upgrades). (ii) Patches. The Supplier will make available to the Customer those Patches which have been published and made generally available to its customers online. (iii) Error Correction. The Supplier will use reasonable commercial efforts to remedy Errors reported by the Customer to the Supplier. Such remedy may consist of Updates to the Service, Patches, or communication of a workaround that gives the Customer the ability to achieve substantially the same functionality as would be obtained without the Error, as determined by the Supplier. (iv) Live Support. As agreed between the parties in more detail Customer contact(s) will have access to live telephone or e-mail support for resolution of support requests. The Supplier shall provide support services to the Customer only during the normal business hours of the Supplier. If the Customer requests, and the Supplier agrees, to correct any problems or issues not covered by the Service Agreement, the Customer will pay the Supplier for all such work performed at the Supplier’s then-current standard time and materials charges. Such amount shall be due and payable within thirty (30) days of the applicable invoice date. Notwithstanding anything in the Service Agreement to the contrary, if the Supplier determines that the Customer requires ongoing help with a particular problem that is not caused by an Error, or that the resolution to such a problem involves customization of the Service, the Supplier may, at its sole discretion, offer the Customer further services to address the need for assistance. The Supplier has no obligation to provide any support and/or maintenance services to the Customer’s customers or any other third party. The Supplier shall have no obligation to investigate or correct problems (including Errors) that cannot be reproduced by the Supplier based on information provided by the Customer, that are due to a breach by the Customer of the terms of the Service Agreement, or, in cases where the Supplier does not deliver the Hardware, problems that cannot be remedied due either to the operational characteristics of the computer equipment on which the Client Software is used or to modifications to the Client Software made by the Customer or any third party. The Supplier will use commercially reasonable efforts to provide the services under the Service Agreement; however, the Customer acknowledges that the Supplier cannot guarantee that every question, problem, issue or Error reported by the Customer can or will be resolved. Nothing in the Service Agreement shall expand or add to any warranty for the Service set forth in Section 5. Except as otherwise agreed to in writing, the Service Agreement shall not apply to, or obligate the Supplier to provide, any support and maintenance services for the Customer’s products that the Customer obtains General Cloud Service Conditions 6(13) Solteq Plc 9/2019 Solteq Plc, Karhumäentie 3, FI–01530 Vantaa Tel +358 (0)20 14444, Fax +358 (0)20 1444 222 VAT no. FI04904840 from or through any source other than the Supplier. 7 Changes to Service The Supplier shall be entitled to make such changes to the Service that (a) relate to the production environment of Service and do not affect the contents of the Service or Availability; (b) are necessary to prevent or mitigate a data security risk related to the Service; or (c) result from law or regulation by authorities. If the Supplier makes a change to the Service as specified in this section 7.1 which has an effect on the Service delivered to the Customer, the Supplier shall inform the Customer of the change in good time in advance or, if this is not reasonably possible, without delay after the Supplier has become aware of such matter. The Supplier may update the prices for the Service based on any of the events (a) - (c) set forth above. The Supplier shall be entitled to make a change to the Service other than specified in section 7.1 after informing the Customer in good time in advance. If the change has a material effect on the contents of the Service or the Availability, the Supplier must inform the Customer about the change in writing at least 90 days before the effective date of the change and the Customer shall have the right to terminate the Service Agreement by giving 30 days’ prior notice. In such case the termination notice shall be given in writing no later than 14 days following the effective date of the change. 8 Fees and taxes The prices and pricing principles applicable to the Service are specified in the Supplier’s Price List annexed to the Service Agreement. The currency to be used for prices and invoicing is Euro. The Supplier shall be entitled to adjust the pricing of the Service by notifying the Customer of the change and of the reason of the change in writing at least 90 days before the effective date of the change. Where a price change occurs, the Customer shall be entitled to terminate the Service Agreement for the product or service in question on the effective date of the price change by notifying the Supplier thereof in writing at least 30 days before the effective date of the change. In that case, the Customer shall also be entitled to terminate the Service Agreement simultaneously with respect to other products and services which, due to the above-mentioned termination, can no longer be essentially used for the benefit of the Customer. The change shall not affect the charges for invoicing periods which have commenced before the effective date of the change. The Customer agrees to pay any sales, value-added or other similar taxes imposed by applicable law that the Supplier must pay based on the Service, except for taxes based on the Supplier’s income. Also, the Customer will reimburse the Supplier for reasonable expenses related to providing the Service. Fees for services listed in an ordering document are exclusive of taxes and expenses. The Customer agrees that the Customer has not relied on the future availability of any programs or updates in entering into the payment obligations in the Customer’s order. In relation to any work performed specifically for the Customer the Supplier shall be entitled to charge for customary and reasonable travel and accommodation costs. The Supplier shall also be entitled to charge, separately, agreed hourly charge for time taken by a journey necessitated by the service and exceeding 60 kilometers back and forth. Other travel arrangements shall be agreed separately. Pursuant to the agreed pricing principles, the Supplier shall be entitled to charge, separately, for work that does not fall within the scope of the Service Agreement but is ordered by the Customer in writing. In addition, the Supplier shall be entitled to charge extra fees in respect of such work pursuant to the agreed pricing principles if the Customer makes a written order for work to be conducted outside the Supplier’s normal working hours. Pursuant to the agreed pricing principles, the Supplier shall be entitled to charge, separately, for additional costs incurred as a result of the provision of incorrect information by the Customer or other similar reason for which the Customer is responsible. The Supplier shall invoice for any Hardware upon delivery and for the Service following their performance. However, the Supplier shall be entitled to invoice for recurring charges and other periodically invoiced charges in advance in accordance with intervals agreed in writing or, if the intervals have not been agreed in writing, monthly in advance. However, if the Parties have agreed on acceptance procedure of the delivery or part of the delivery, the Supplier shall invoice for time-based charges monthly in arrears and for other charges based on delivery following acceptance of such delivery or part of the delivery. General Cloud Service Conditions 7(13) Solteq Plc 9/2019 Solteq Plc, Karhumäentie 3, FI–01530 Vantaa Tel +358 (0)20 14444, Fax +358 (0)20 1444 222 VAT no. FI04904840 The payment term is 30 days net from the date of invoice. Interest on delayed payments accrues in accordance with the Interest Act of Finland. 9 Identifiers The Supplier shall deliver necessary Identifiers to the Customer for the use of the Service in accordance with the Service Agreement and the Customer may issue Identifiers to its personnel or contractors subject to the Service Agreement and applicable documentation. The Customer shall be responsible for ensuring that its users maintain Identifiers diligently and do not disclose them to third parties. The Customer shall be responsible for the use and/or misuse of the Service using the identifiers granted to or generated by the Customer. The Customer undertakes to notify the Supplier without delay if an Identifier has been disclosed to a third party or if the Customer suspects that an Identifier is being misused. The Customer’s responsibility for the use of the Service with its Identifiers expires at the moment the Supplier receives the Customer’s notification or when the Supplier otherwise becomes aware of the misuse. Upon written request by the Supplier, the Customer is obliged to change the Identifier required for using the Service if there is a justifiable reason to do so, for example, to address any vulnerabilities or to allow interoperability with other software. 10 Intellectual property rights The Supplier retains all ownership and intellectual property rights to the Service and anything developed by the Supplier and delivered to the Customer under the Service Agreement including, non-exhaustively, Service, any software used to produce the Service and Supplier Material as well as amendments thereto. The Customer may not: (i) remove or modify any program markings or any notice of the Supplier’s proprietary rights; (ii) make the programs or materials resulting from the Service available in any manner to any third party for use in the third party’s business operations (unless such access is expressly permitted for the specific program license or materials from the Service the Customer has acquired); (iii) cause or permit reverse engineering (unless required by law for interoperability and the Supplier has not provided such interoperability information in a reasonable time upon Customer’s request), disassembly or decompilation of the programs; or (iv) disclose results of any program benchmark tests without the Supplier’s prior written consent. All intellectual property rights and title to the Customer Material shall be vested in the Customer or a third party. The Customer shall be responsible for Customer Material and for ensuring that the Customer Material and the use of it to produce the Service does not infringe any third-party rights or violate any legislation in force from time to time. The Supplier has the right to use Customer Material for the purposes of the Service Agreement. The Supplier has the right to use Customer Data for product development including but not limited to producing background data for analyzing the performance of the Service. Upon expiry of the Service Agreement, the Supplier shall provide the Customer with the Customer Data within 30 days of the Customer’s written request. Customer Data shall be delivered in an electronic form commonly in use or in another form as agreed by the Parties. The Supplier shall have the right to charge for the collection, processing and delivery in accordance with agreed pricing principles. Any responsibility of the Supplier to store the Customer Data terminates 60 days from termination or expiration of the Service Agreement. In addition to any other rights according the Service Agreement the Supplier shall be entitled to retain a copy of the Customer Data for its internal purposes as stipulated in 10.4 as well as to the extent required by law or regulation by authority. 11 Suspension of Service The Supplier shall have the right to suspend delivery of the Service for a reasonable duration on working days (Monday to Friday) from 6:00 pm to 7:00 am, on Saturdays, Sundays and official holidays if this is necessary in order to perform installation, change or maintenance work in respect of the Service and such installation, change or maintenance work cannot be performed at a reasonable cost without suspension of the Service. If the Supplier suspends delivery of the Service for a reason specified in the previous section 11.1, the Supplier shall (a) inform the Customer of the suspension of the Service and the duration of the suspension in good time in advance; and (b) strive to minimize any inconvenience resulting from the suspension. General Cloud Service Conditions 8(13) Solteq Plc 9/2019 Solteq Plc, Karhumäentie 3, FI–01530 Vantaa Tel +358 (0)20 14444, Fax +358 (0)20 1444 222 VAT no. FI04904840 The Supplier shall have the right to suspend delivery of the Service due to installation, fault, change or maintenance work of general communications network or due to a data security risk related to the Service or if required by law or regulation by authorities or due to a force majeure event. If the Supplier suspends delivery of the Service for a reason specified in this section 11.3, the Supplier shall inform the Customer of the suspension and the duration of the suspension in good time in advance or, if this is not reasonably possible, without delay after the Supplier has become aware of such matter. The Supplier shall have the right to prevent the Customer’s access to the Service without first consulting the Customer, if the Supplier justifiably suspects that the Customer uses the Service in a manner that jeopardizes the delivery of the Service to other users. The Supplier shall without undue delay inform the Customer of the reasons for such prevention. 12 Backups The Supplier is responsible for taking backups of the Service, the Customer Data and the results of processing of such data as specifically agreed between the Parties. If the Customer Data stored in the Service is destroyed, lost, altered or damaged while the Customer has used the Customer’s Identifier or if the Customer has otherwise by its own action caused the destruction, loss or alteration of, or damage to, the Customer Data stored in the Service, the Supplier shall have the right to charge for the recovery of such material on the agreed pricing principles. 13 Data security Each Party is responsible for the data security of its own data system and communications network and the Supplier is not responsible for any hardware, software or connections beyond the Access Point(s). Neither Party is responsible towards the other Party for the data security of the general communications network or any disturbance in the general communications network or for any other impediment affecting the use of the Service beyond its control nor for damage resulting thereof. A Party shall be entitled to undertake necessary measures in order to prevent data security breaches and to remove disturbances affecting data security. Such measures may include, for example, prevention of message transmission or reception or removal of malicious software that poses a threat to data security from messages. Any measures implemented by a party shall be commensurate with the seriousness of the disturbance being combated and must be immediately discontinued if the grounds for them no longer exist. 14 Processing of Personal Data contained in the Customer Data The Supplier is entitled to process personal data only in accordance with this Section 14 and any instructions given by the Customer in writing. The Supplier shall process personal data in compliance with the provisions of the EU’s General Data Protection Regulation ((EU) 2016/679). The Supplier shall implement the agreed technical and organisational measures. The Customer is responsible for ensuring that the Customer, or the persons acting on behalf of the Customer, process personal data in accordance with the applicable laws, regulations, decrees and directives on personal data. If Customer Data contains personal data, the Customer is the data controller of such data, and if the Supplier processes such personal data, it processes them on behalf of the Customer. If the Supplier processes personal data on behalf of the Customer: (i) In order to offer services, personal data can be transferred outside the European Economic Area. All transfer of personal data outside the European Economic Area must be conducted in accordance with valid data protection legislation; (ii) The Customer is responsible for ensuring that the Customer has the right to transfer personal data to the Supplier in such a manner that the Supplier can legally use, process or transfer personal data in accordance with the Agreement on behalf of the Customer; (iii) The Customer authorises the Supplier to use subcontractors in data protection measures for purposes of the Agreement; (iv) The Customer ensures that it has, under valid legislation, informed registered persons and third parties of the processing of personal data under the Agreement and has, if necessary, obtained consent to process personal data in accordance with General Cloud Service Conditions 9(13) Solteq Plc 9/2019 Solteq Plc, Karhumäentie 3, FI–01530 Vantaa Tel +358 (0)20 14444, Fax +358 (0)20 1444 222 VAT no. FI04904840 the Agreement if such action is in line with current legislation; (v) The Supplier ensures that its employees and other persons who have the right to process personal data are committed to keeping such data confidential; (vi) To the extent feasible, the Supplier uses the necessary technical and administrative measures to assist the Customer in responding to data requests made by data subjects and to ensure the fulfilment of other legal rights of data subjects. The Customer undertakes to primarily use the functionalities of the Service when ensuring that the rights of data subjects are fulfilled. If the fulfilment of data subjects’ rights cannot be ensured by using the functionalities of the Service, the Supplier has the right to charge the Customer for any assistance provided to the Customer in accordance with this section. The charge is based on hourly fees in accordance with the price list valid at the given time. (vii) The Supplier assists the Customer in complying with the Customer’s legal obligations related to information security, considering the nature of the processing and the information available to the Supplier. The Supplier has the right to charge the Customer for any assistance provided to the Customer in accordance with this section. The charge is based on hourly fees in accordance with the price list. (viii) At the Customer’s request, the Supplier provides the Customer with the data that the Supplier is responsible for, for the Customer to be able to prove that it has performed its legal obligations related to the processing of personal data. The Supplier has the right to charge the Customer for any assistance provided to the Customer in accordance with this section. The charge is based on hourly fees in accordance with the price list valid at the given time. (ix) The Supplier processes personal data only for the purposes set out in the Agreement and solely in accordance with the lawful and technically-feasible, written instructions provided by the Customer. The Customer’s instructions must primarily be provided to the Supplier by using the functionalities of the Service. If instructions cannot be provided to the Supplier by using the functionalities of the Service, the Supplier has the right to charge the Customer for complying with the Customer’s instructions in accordance with this section. The charge is based on hourly fees in accordance with the price list valid at the given time. (x) Both Parties shall undertake technical and administrative measures in order to ensure that personal data is not processed unlawfully, and they shall ensure that the protection of personal data, as defined in legislation, is not compromised. (xi) In accordance with the applicable data protection legislation, the Supplier notifies the Customer without undue delay of any personal data breaches and other data processing carried out on behalf of the Customer in which data protection has been compromised or the Supplier has reason to believe that it may have been compromised. (xii) The Customer has the right to audit the Supplier’s premises and the Supplier’s processing measures related to the Agreement in order to assess the level of protection and security applicable to the personal data processed under the Agreement and in order to evaluate how the Supplier and its sub-processors comply with the terms and conditions set out in the Agreement concerning the processing of personal data. Customer is liable for any costs that incurs as a result of such audits. (xiii) All personal data included in the Customer Data held by the Supplier must be anonymised or erased after the Agreement terminates – either after a reasonable return period or immediately – if the Customer requests the Supplier in writing to do so or if the applicable legislation so requires. The Supplier notifies the Customer when the Agreement for each valid return period is ending. (xiv) The Parties undertake to cooperate in order to comply with the EU’s General Data Protection Regulation (2016/679) if it is applicable to the processing of personal data carried out by the Supplier on behalf of the Customer during the Agreement period. 15 Management of data security breaches A Party shall notify the other Party without undue delay of any significant data security risks and data security breaches, actual or suspected, detected by such Party that pose a threat to the Service or its use. General Cloud Service Conditions 10(13) Solteq Plc 9/2019 Solteq Plc, Karhumäentie 3, FI–01530 Vantaa Tel +358 (0)20 14444, Fax +358 (0)20 1444 222 VAT no. FI04904840 A Party shall, for its part, take immediate action in order to eliminate or reduce the effect of any data security breach. A Party shall be responsible for contributing in the investigation of data security breaches. 16 Subcontracting Either Party shall have the right to subcontract its obligations under the Service Agreement. Upon request by the other Party, such Party shall provide necessary information regarding its subcontractors that execute tasks related to the Service. Each Party shall ensure that its subcontractors comply with the requirements set out for the Party. Each Party shall be liable for the performance of its subcontractors as for its own performance. Each Party shall contribute to the cooperation between its subcontractors and the subcontractors of the other Party where necessary for the tasks related to the Service. 17 Confidentiality Each Party shall keep in confidence all material and information received from the other Party and marked as confidential or which should be understood to be confidential and may not use such material or information for any purposes other than those set out in the Service Agreement. The confidentiality obligation shall, however, not apply to material or information, (a) which is generally available or otherwise public; (b) which the receiving Party has received from a third party without any obligation of confidentiality; (c) which was in the possession of the receiving Party prior to receipt of the same from the other Party without any obligation of confidentiality related thereto; (d) which the receiving Party has independently developed without using material or information received from the other Party; or (e) which the receiving Party is required to provide due to law or regulation by the authorities. Each Party shall promptly upon termination of the Service Agreement or when the Party no longer needs the material or information in question for the purpose set out in the Service Agreement cease using confidential material and information received from the other Party and upon request return or destroy the material including all copies thereof in a reliable manner. Each Party shall, however, be entitled to retain such material as is required by law or regulation by the authorities. Each Party shall be entitled to use the professional skills and experience acquired in connection with the delivery. The rights and responsibilities under this section 17 shall survive the termination, expiration or cancellation of the Service Agreement. These rights and obligations shall expire after 5 years from the termination, expiration or cancellation of the Service Agreement. The termination, expiration or cancellation of the Service Agreement shall, however, not affect the rights and obligations related to this section 17, if applicable laws require a longer confidentiality obligation than the confidentiality period set out in this section 17.4. 18 General Entire Agreement. The Service Agreement, including all accepted order forms, statements of work referencing the Service Agreement and all annexes referred to in the Service Agreement, constitutes the entire agreement between the Supplier and the Customer with respect to the subject matter hereof. Pre-contractual situations. The Service Agreement supersedes all prior or contemporaneous written or oral agreements, representations, understandings and communications regarding such software and/or services. Severability. Should any provision of the Service Agreement in whole or in part be or become invalid, impracticable or unenforceable, the validity of the other provisions shall not be affected thereby. In such a case, the invalid, impracticable or unenforceable provision shall be deemed to be replaced by a provision which, to the extent admissible according to the applicable laws, comes closest to the purpose of the invalid, impracticable or unenforceable provision. The same shall apply with respect to any omissions contained in the Service Agreement. Priority of documents. It is expressly agreed that in case of confusion, the terms of the Service Agreement shall supersede the terms in any purchase order or other ordering document and no terms included in any such purchase order document shall apply to the Service and/or other products ordered. The order of priority of documents relating to the Service Agreement is as follows: 1. The Service Agreement; 2. Annexes to the Service Agreement. In case of discrepancy between the annexes, the annex with a smaller number shall prevail. General Cloud Service Conditions 11(13) Solteq Plc 9/2019 Solteq Plc, Karhumäentie 3, FI–01530 Vantaa Tel +358 (0)20 14444, Fax +358 (0)20 1444 222 VAT no. FI04904840 Amendments. The Service Agreement and ordering documents may not be modified, and the rights and restrictions may not be altered or waived except in a writing signed or accepted online by authorized representatives of the Customer and of the Supplier. Assignment. Neither Party may assign the Service Agreement, either wholly or in part, without the written consent of the other Party. Such consent shall not be unreasonably withheld if the assignee undertakes in writing to comply with the terms and conditions of the Service Agreement and the assignment is to a company belonging to the same group of companies as the Party or is made in connection with the transfer of business operations. The Supplier shall, however, be entitled to assign its receivables under the Service Agreement to a third party by notifying the Customer of the assignment in writing. Notices. All notices required or permitted under the Service Agreement shall be in writing. Notices will be effective upon delivery if delivered in person and upon mailing if delivered by courier service, overnight delivery services or by a form of certified or express mail. No transfer. The Customer may not assign the Service Agreement or give or transfer the Service or an interest in them to another individual or entity. Claims. Except for actions for non-payment or breach of the Supplier’s proprietary rights, no action, regardless of form, arising out of or relating to the Service Agreement may be brought by either Party more than two years after the cause of action has accrued. 19 Indemnification If someone makes a claim against either the Customer or the Supplier (“Recipient”), that any information, design, specification, instruction, software, data, or material including Customer Material, Customer Data or Supplier Material (“Material”) furnished by either the Customer or the Supplier (“Provider”), and used by the Recipient infringes its intellectual property rights, the Provider will indemnify the Recipient against the claim if the Recipient does the following: (i) notifies the Provider promptly in writing, not later than 30 days after the Recipient receives notice of the claim (or sooner if required by applicable law); (ii) gives the Provider sole control of the defense and any settlement negotiations; and (iii) gives the Provider the information, authority, and assistance the Provider needs to defend against or settle the claim. If the Provider believes or it is determined that any of the Material may have violated someone else’s intellectual property rights, the Provider may choose to either modify the Material to be non-infringing (while substantially preserving its utility or functionality) or obtain a license to allow for continued use, or if these alternatives are not commercially reasonable, the Provider may end the license for, and require return of, the applicable Material and refund any fees the Recipient may have paid for it and any unused, prepaid software support fees the Customer has paid for the license. If the Customer is the Provider and such return materially affects the Supplier’s ability to meet its obligations under the relevant order, then the Supplier may, at its option and upon 30 days’ prior written notice, terminate the Service Agreement and the Customer shall compensate the Supplier for the reasonable fees, cost and expenses of the Supplier related to the Service Agreement up to the date of termination and reasonable termination costs. The Provider will not indemnify the Recipient if the Recipient alters the Material or the uses it outside the scope of the use identified in the Provider’s user documentation or if the Recipient uses a version of the Materials which has been superseded, if the infringement claim could have been avoided by using an unaltered current version of the Material which was provided to the Recipient. The Provider will not indemnify the Recipient to the extent that an infringement claim is based upon any information, design, specification, instruction, software, data, or material not furnished by the Provider. This section 19 provides the parties’ exclusive remedy for any infringement claims or damages. 20 Force Majeure Neither Party shall be liable for delay and damage caused by an impediment beyond the Party’s control and which the Party could not have reasonably taken into account at the time of conclusion of the Service Agreement and whose consequences the Party could not reasonably have avoided or overcome. Such force majeure events shall include, if not proven otherwise, inter alia, war or insurrection, earthquake, flood or other similar natural catastrophe, interruptions in general traffic, data communication or supply of electricity, import or export embargo, strike, lockout, boycott or other similar industrial action. A strike, lockout, boycott and other similar industrial action shall also be considered, if not General Cloud Service Conditions 12(13) Solteq Plc 9/2019 Solteq Plc, Karhumäentie 3, FI–01530 Vantaa Tel +358 (0)20 14444, Fax +358 (0)20 1444 222 VAT no. FI04904840 proven otherwise, a force majeure event when the Party concerned is the target or a party to such an action. A force majeure event suffered by a subcontractor of a Party shall also be considered a force majeure event in relation to the Party if the work to be performed under subcontracting cannot be done or acquired from another source without incurring unreasonable costs or significant loss of time. Each Party shall without delay inform the other Party in writing of a force majeure event and the termination of the force majeure event 21 Liability for damages and limitation of liability The Supplier does not guarantee that the Service will perform error-free or uninterrupted or that the Supplier will correct all program errors. To the extent permitted by law, warranties set out in the Service Agreement are exclusive and there are no other express or implied warranties or conditions, including warranties or conditions of merchantability and fitness for a particular purpose. The Supplier waives liability for any malfunction, false results or damage which is due to a change, default, malfunction or any other event resulting from Customer Material or Customer Data or taking place in Hardware, connections, software or data systems, including Service, functioning of which, in accordance with the Service Agreement are the responsibilities of the Customer. In case of any such event, the Customer shall undertake to (i) notify the Supplier without undue delay, (ii) determine the cause of such event and (iii) repair the cause of the event at their own expense. The Supplier shall make available the Service at the Access Point in accordance with the Service Agreement and instructions given by the Customer. The Customer is responsible for the suitability of the Service to its use. The Supplier waives all liability for the Service being non-suitable for the Customer’s use due to false information provided by the Customer or due to any changes to the Hardware or Service. The maximum liability for damages of a Party towards the other Party based on the Service Agreement shall not, excluding possible liquidated damages payable due to delay, service credits or other similar contractual penalties or credits, exceed EUR 5 000. If the breaching Party has an obligation to pay liquidated damages payable due to delay, service credits or other similar contractual penalties or credits, the breaching Party is also liable to pay damages only for the part of the loss exceeding the liquidated damages payable due to delay, service credits or other similar contractual penalties or credits. Neither Party shall be liable for any indirect or consequential damage. Indirect or consequential damage shall mean, inter alia, loss of profits or damage caused due to decrease or interruption in turnover or production. Neither Party shall be liable for the destruction, loss or alteration of the other Party’s data or datafiles, nor for any damages and expenses incurred as a result, including expenses involved in the reconstitution of data files. This section 21.6 shall not apply, if a Party’s obligations under the Service Agreement comprise taking back-up copies of the other party’s data or data files or managing the other Party’s data security and that Party has not fulfilled this duty. The limitations of liability shall not apply to damages caused by (a) the transfer, copying or use of the Service or Party’s data contrary to law or the terms and conditions of the Service Agreement; or (b) willful conduct or gross negligence. 22 Audit rights Customer shall keep accurate, full, and complete records that support the reports and related calculation of the payments due under the Service Agreement. Such records shall be retained for a minimum of three (3) years after the end of the reporting period to which such records pertain. Upon 15 days written notice, Supplier and/or an auditor appointed by the Supplier may audit Customer’s use of Service. Customer agrees to cooperate with Supplier’s audit and provide reasonable assistance and access to information, including access enabling Supplier to scan Customer’s systems for copies of the Service. Customer agrees to pay within 30 days of written notification any fees applicable to the use of the Service in excess of Customer’s license rights. Customer agrees that Supplier shall not be responsible for any of Customer’s costs incurred in cooperating with the audit. Cases of non-payment and non-compliance with this Section 22 are considered as material breaches of the Service Agreement. 23 Validity and termination General Cloud Service Conditions 13(13) Solteq Plc 9/2019 Solteq Plc, Karhumäentie 3, FI–01530 Vantaa Tel +358 (0)20 14444, Fax +358 (0)20 1444 222 VAT no. FI04904840 The Service Agreement enters into force on the Service Agreement’s Date of Entry into Force, however, not later than on the date the Customer has taken the Service into use. The Customer’s Subscription Period is defined in the Service Agreement. The Customer has the right to terminate the Subscription Period in accordance with the termination period defined in the Service Agreement. If no Subscription Period is defined in the Service Agreement, the Subscription Period for the Service is valid for a limited duration of one (1) year starting from the Deployment day, after which the Subscription Period will be renewed for one (1) year at a time, unless the other Party terminates the Subscription Period at the latest ninety (90) days before the end of the current Subscription Period by providing a written notice of termination to the other Party. Unless otherwise agreed by the Parties, Customer shall stop using services covered by the Service Agreement, including the Service upon the termination of the Service Agreement and shall return Supplier Material to Supplier without cost. Supplier may terminate the Service Agreement immediately upon written notice for the material breach of the Customer, which material breach has remained uncured for period of thirty (30) days from the date of delivery of written notice thereof to the Customer. If the Customer has paid a service fee for a certain period of time in advance and the Service Agreement terminates prematurely for a reason not attributable to the Customer, the Customer shall be entitled to receive by way of refund the portion of the advance payment which corresponds to the time period not realized. 24 Applicable law and settlement of disputes The Service Agreement is governed by the substantive and procedural laws of Finland without reference to its conflict of laws principles nor the rules of the United Nations Convention on Contracts for the International Sale of Goods (CISG). Any dispute, controversy or claim arising out of or relating to the Service Agreement, or the breach, termination or validity thereof, shall be finally settled by arbitration in accordance with the Arbitration Rules of the Finland Chamber of Commerce. The number of arbitrators shall be three, the seat of arbitration shall be Helsinki, Finland and the language of the arbitration shall be English. Notwithstanding the preceding sentences, claims for non-payment of monetary charges may be resolved in the district court of the respondent’s place of domicile if the respondent does not contest its payment obligation. If the Parties so agree in writing, any dispute, controversy or claim arising out of the Service Agreement shall be resolved in the district court.