Cloud Compute Services Terms of Service
These Cloud Compute Services Terms of Service (“Agreement”) govern the provision of cloud compute services by Dapple Cloud, Inc., a Delaware corporation having an address at 228 Park Ave. S PMB 899506 New York, NY 10003 or other Affiliate as designated in the applicable Service Order (“Supplier”), to the person or entity that executes a Service Order referencing this Agreement or that otherwise accesses or uses the Services (“Customer”). Customer and Supplier may be referred to in this Agreement individually as a “Party” or jointly as the “Parties”. By executing a Service Order that references this Agreement, or by accessing or using the Services, Customer accepts and agrees to be bound by this Agreement and represents that the individual accepting this Agreement has authority to bind Customer. If Customer does not agree to this Agreement, Customer may not access or use the Services. This Agreement is not required to be signed to be binding on the Parties.
1. Definitions
a. “Affected Party” means a Party who is delayed or fails to perform its obligations under this Agreement as a result of a Force Majeure Event.
b. “Affiliate” means any business entity that directly or indirectly (i) owns or Controls; (ii) is owned or Controlled by; or (iii) is under common ownership or Control with a Party hereto.
c. “Agreement” means these Cloud Compute Services Terms of Service, as may be updated from time to time in accordance with Section 16(b), together with each Service Order and all documents incorporated by reference.
d. “Anti-Corruption Laws” means any and all laws, rules and regulations concerning or relating to the prevention or prohibition of bribery or corruption, including the U.S. Foreign Corrupt Practices Act of 1977, as amended, and the UK Bribery Act 2010.
e. “Customer Materials” has the meaning ascribed to it in Section 9(b).
f. “Business Interruption” means any event, whether anticipated (e.g., grievance, job action) or unanticipated, including, without limitation, a Force Majeure Event that disrupts Supplier’s facilities, Supplier’s systems, Supplier Personnel, or other business operations necessary for Supplier’s supply of Deliverables and/or performance of Services under this Agreement.
g. “CCPA” has the meaning ascribed to it in the definition of Data Protection Laws.
h. “Confidential Information” means any non-public information disclosed during the term of this Agreement by Discloser to Recipient, subject to the exclusions in Section 7(b) below, that is (i) marked “confidential” or “proprietary” or a similar legend; (ii) disclosed in any other manner and identified as confidential at the time of disclosure; (iii) accessed through any web-based or electronic portal of a Discloser; (iv) learned as a result of a visit to a Party’s facilities; and/or (v) disclosed or provided under circumstances by which the Recipient should reasonably understand the information to be confidential (whether or not so marked).
i. “Control” or “Controlled” means that the controlling party directly or indirectly has the beneficial ownership of more than fifty percent (50%) of the stock or other equity interests entitled to vote for the election of directors or an equivalent governing body, or otherwise has the power to direct or cause the direction of the general management of the controlled entity. An entity is an Affiliate only so long as such control exists.
j. “Customer Failure” has the meaning ascribed to it in Section 2(g).
k. “Data Protection Laws” means all applicable laws, rules, regulations, directives and governmental requirements relating in any way to the privacy, confidentiality, security, integrity and protection of Personal Data, including without limitation the EU General Data Protection Regulation 2016/679 (the “GDPR”), the UK Data Protection Act 2018, the EU ePrivacy Directive 2002/58/EC as amended by Directive 2009/136/EC, and any national implementing legislation and the California Consumer Privacy Act of 2018 (the “CCPA”), all as may be amended or superseded from time to time.
l. “De-Identified Data” means information from which Personal Data has been deleted, masked, or suppressed, and information that has been anonymized, all in manner such that the information: (i) does not identify a particular natural person; (ii) does not identify, by network internet protocol address or other identifier a particular device or computer associated with or used by a person; and (iii) is not reasonably linkable to a particular natural person due to technical, legal, or other controls.
m. “Delegate” has the meaning ascribed to it in Section 16(f).
n. “Deliverable” means anything delivered to Customer under this Agreement as part of the Services, including but not limited to goods, products, work, data, items, materials, and any property created, developed, produced, delivered, performed or otherwise provided by Supplier to Customer hereunder.
o. “Discloser” means the Party or its Affiliates disclosing Confidential Information under this Agreement.
p. “Documentation” means Supplier’s user manuals, handbooks, and guides relating to the Services and/or Deliverables, whether provided by Supplier to Customer either electronically or in hard-copy form.
q. “Effective Date” means, with respect to Customer, the earlier of (i) the date on which Customer first executes a Service Order referencing this Agreement and (ii) the date on which Customer first accesses or uses the Services; and, with respect to a Service Order, the date on which such Service Order becomes effective.
r. “Export Controls” means any and all laws, rules and regulations of the United States, United Kingdom, European Union or any EU member state concerning or relating to the export of any goods, services or technology, including but not limited to the Export Administration Regulations administered by the Bureau of Industry and Security of the U.S. Department of Commerce, the International Traffic in Arms Regulations administered by the Directorate of Defense Trade Controls of the U.S. Department of State and the Export Control Regulation (EU) 2021/821, as implemented and enforced in any EU member state.
s. “Export Controls List” means any Export Controls-related list of designated persons or entities, including but not limited to: (a) the Denied Persons List, the Entity List, the Unverified List and the Military End User List, each maintained by the Bureau of Industry and Security of the U.S. Department of Commerce; (b) the Statutorily Debarred Parties list maintained by the Directorate of Defense Trade Controls of the U.S. Department of State; and (c) any other list of persons or entities that are the subject of particularized export restrictions maintained by any relevant governmental authority under Export Controls.
t. “Feedback” has the meaning ascribed to it in Section 13(a).
u. “Fees” means the fees and other amounts payable by Customer to Supplier for the Services, as set out in the applicable Service Order.
v. “Financing Documents” means any and all loan agreements, credit agreements, reimbursement agreements, notes, indentures, bonds, security agreements, pledge agreements, mortgages, guarantee documents, intercreditor agreements, subscription agreements, equity contribution agreements and other agreements, and instruments relating to the financing (or refinancing) of Supplier or its Affiliates, or of any GPUs, equipment, data center space, or other resources or assets utilized by Supplier in connection with any Service Order.
w. “Financing Parties” means the banks, lenders, noteholders, and/or other financial institutions (or an agent or trustee thereof) that are a party to the Financing Documents, including the successors in interest to such parties.
x. “Force Majeure Event” means any acts of God, civil or military authority, or the public enemy; war; riots; accidents; fires; explosions; power surges; earthquakes; floods; droughts; unusually severe weather; natural or man-made disasters or accidents, epidemics; pandemics; public health emergencies of international concern (as defined by the World Health Organization); strikes or labor disputes (excluding Supplier subcontractors); governmental edicts and any state of emergency, terrorism, or threats of terrorism; national or regional emergency; or other similar causes beyond either Party’s control and which by its nature could not have been foreseen, was unavoidable, and was not caused by the delayed or non-performing Party.
y. “GDPR” has the meaning ascribed to it in the definition of Data Protection Laws.
z. “GPU” means graphics processing unit.
a. “GPUaaS Services” means those Services that consist of Supplier providing Customer with the ability to access and conduct on-demand computing using GPUs that are maintained by Supplier.
b. “GPU System” means a cluster or rack-scale system of interconnected GPUs, as further specified in a given Service Order.
d. “Initial Term” has the meaning ascribed to it in Section 3.
e. “Intellectual Property Rights” means any or all intellectual property rights or industrial property rights in the world, whether or not filed or registered or otherwise now or hereafter in existence, under or related to any patent, copyright, trademark, trade secret, database protection, Know-How, other intellectual property rights laws, or any other proprietary rights or equivalent rights or form of protection relating to intangible property anywhere in the world.
f. “Know-How” means unpatented technical or practical information (including, without limitation, information relating to inventions, materials, discoveries, concepts, methodologies, models, research, development and testing procedures, the results of experiments, tests and trials, manufacturing processes, techniques and specifications, quality control data, analyses, reports and submissions) that is not in the public domain.
g. “Personal Data” has the meaning ascribed to it under the Data Protection Laws.
h. “Personnel” means full-time, contract and/or temporary employees, agents, and contractors.
i. “Prepaid Fees” has the meaning ascribed to it in Section 4(a)(i).
j. “Prohibited Person” means any person or entity that is: (a) a Sanctioned Person; (b) identified on any Export Controls List; or (c) owned or controlled by any person(s) described in (b) above.
k. “Recipient” means a Party or its Affiliates receiving Confidential Information under this Agreement.
l. “Renewal Period” has the meaning ascribed to it in Section 3.
m. “Sanctioned Jurisdiction” means any country or territory that is the subject of comprehensive Sanctions broadly prohibiting dealings in, with or involving such country or territory (as of the date hereof, Cuba, Iran, North Korea, the so-called Donetsk People’s Republic, the so-called Luhansk People’s Republic and the Crimea region of Ukraine).
n. “Sanctioned Person” means any person or entity: (a) identified on any Sanctions-related list of blocked or designated persons maintained by any Sanctions Authority, including the Specially Designated Nationals and Blocked Persons List maintained by the Office of Foreign Assets Control of the U.S. Department of the Treasury, the Consolidated List of Persons, Groups and Entities Subject to EU Financial Sanctions maintained by the European Commission, the UK Sanctions List maintained by the Office of Financial Sanctions Implementation of the United Kingdom; (b) domiciled, organized or resident in, or the government of, any Sanctioned Jurisdiction; (c) 50% or more owned, in the aggregate, or controlled by, directly or indirectly, one or more persons described in the foregoing clauses (a) or (b); or (d) otherwise the subject or target of Sanctions.
o. “Sanctions” means any and all economic or financial sanctions imposed, administered or enforced by a Sanctions Authority.
p. “Sanctions Authority” means: (a) the U.S. government (including the Office of Foreign Assets Control of the U.S. Department of the Treasury and the U.S. Department of State); (b) the United Kingdom (including His Majesty’s Treasury); (c) the European Union and its member states; and (d) the United Nations Security Council.
q. “Service Credit” has the meaning ascribed to it in Section 5(a).
r. “Service Levels” has the meaning ascribed to it in Section 5(a).
s. “Service Order” means a Service Order mutually agreed by Supplier and Customer (or by Supplier and an Affiliate of Customer) in writing and explicitly referencing this Agreement.
t. “Services” means the services provided by Supplier under this Agreement, or a Service Order, and shall include, as applicable, GPUaaS Services.
u. “SLA” has the meaning ascribed to it in Section 5(a).
v. “Statistical Data” has the meaning ascribed to it in Section 13(c).
w. “Supplier Platform” means, collectively, the Services, each website and internet and online property or portal maintained by or on behalf of Supplier, materials provided by Supplier in connection with this Agreement or any Service Order, and the information provided therein.
x. “Taxes” means value added taxes, goods and services taxes, sales and use taxes, and/or other transactional taxes legally imposed by any federal, state, local, or other governmental authority upon the transactions arising out of this Agreement.
y. “Technology” means any and all products, materials, data, information, technology, or other property of a scientific, technical, or artistic nature, whether tangible or intangible, whether oral, visual, electronic, or recorded in any form of medium, including but not limited to inventions (whether or not protectable under patent laws), processes, techniques, methodologies, sketches, drawings, models, apparatus, equipment, machines, devices, integrated circuits, hardware, design tools, software, formulae, algorithms, designs, design files, source code (in any language), documentation, specifications, plans, reports, and other subject matter protectable under Intellectual Property Rights including but not limited to know-how, ideas, works of authorship, new or useful art, combinations, developments, and discoveries.
z. “Third-Party Service” has the meaning ascribed to it in Section 14(a).
a. “Third-Party Site” has the meaning ascribed to it in Section 14(b).
b. “Third-Party Site TCs” has the meaning ascribed to it in Section 14(b).
c. “Third-Party Terms” has the meaning ascribed to it in Section 14(a).
2. Scope of Agreement
a. Provision of Services; Service Orders.
Supplier will provide the applicable Services described in the applicable Service Order executed by the Parties. This Agreement does not obligate either Party to enter into any Service Order and does not create an exclusive arrangement between the Parties. Affiliates of the Parties may execute Service Orders to which this Agreement applies, as agreed in writing between the Parties (or their Affiliates, as applicable). Each Service Order shall constitute a separate agreement, as set out in greater detail herein, including as set out in Section 16(q). For the purposes of each Service Order, and only that particular Service Order, the Customer entity (whether Customer or a Customer Affiliate) that executes the applicable Service Order shall be considered “Customer” as that term is used in this Agreement, and the Supplier entity (whether Supplier or a Supplier Affiliate) that executes the applicable Service Order shall be considered “Supplier” as that term is used in this Agreement.
b. Service Deployment Timelines.
i. To the extent the applicable Service Order sets out a binding Services start date, Supplier shall commence providing Services as of the applicable Services start date set out therein; provided, however, that in the event such commencement is delayed due to unavailability or delay in equipment, other resources, or services provided by one or more third parties to or for the benefit of Supplier in connection with the applicable Services, the applicable commencement date shall be delayed with no penalty and at no fault of Supplier until the date that is ninety (90) days after the date on which all such equipment and other resources have been delivered and such services have been completed, and the service term duration and expiration date under the applicable Service Order shall be extended on a day for day basis.
ii. If Supplier has not substantially commenced providing the Services by the date more than ninety (90) days after the later of (i) the Service target go-live date as set out in the applicable Service Order and (ii) the date that is ninety (90) days after the date on which all such equipment and other resources have been delivered and such services have been completed, if Supplier has not commenced performance of any portion of the applicable Services, (A) the Customer shall be entitled to terminate the Service Order without any penalty or liability and Supplier shall refund any applicable Prepaid Fees upon termination and (B) such termination right and such refund of the applicable Prepaid Fees shall be Customer’s sole and exclusive remedy with respect to any failure by Supplier to commence performance of the Services under the applicable Service Order. If Supplier has commenced performance of any portion of the Services under the applicable Service Order, Section 2(b)(iii) shall apply, and this Section 2(b)(ii) shall no longer apply with respect to the applicable Service Order.
iii. If Supplier has partially commenced providing the Services, charges shall accrue with respect to such partial delivery of Services, with charges as set out in the applicable Service Order being prorated as applicable to reflect the partial delivery (e.g., where charges are set based on multiple GPUs being deployed, where only half of the scheduled GPUs have been delivered as of the applicable Services start date, 50% of the charges for that scheduled GPU grouping shall accrue and shall be payable by Customer hereunder). As Supplier commences performance of the remainder of the Services, the charges shall be adjusted on a pro rata basis to reflect the volume of Services then being performed. Such proration of scheduled charges for Services shall be Customer’s sole and exclusive remedy with respect to any partial delivery of the Services by Supplier.
c. Use Restrictions.
Customer will not: (i) decompile, disassemble, or reverse-engineer the Services (except to the extent that applicable law prohibits or restricts reverse-engineering restrictions); or (ii) sell, rent, lease or use the Services (or any portion thereof) for time sharing purposes.
d. Service Suspension.
Supplier may temporarily suspend Customer’s access to, or use of, the Services to the extent necessary upon prior written notice, to the extent practicable under the circumstances: (i) for emergency maintenance; (ii) for maintaining the security or integrity of Supplier’s network, hardware, or associated systems or those of Supplier’s third-party providers; or (iii) to comply with judicial or other governmental demand or order, subpoena or law enforcement request that requires Supplier to do so; provided, that no notice is required for any such suspension to the extent undertaken in connection with, as applicable: (a) a Force Majeure Event; (b) Supplier’s efforts to maintain the security or integrity of the Services or the network, hardware, or associated systems of Supplier or any third party; and (c) complying with applicable law or judicial or other governmental demand or order. Any such suspension by Supplier shall be to the minimum extent required, and of the minimum duration, to prevent, terminate or otherwise resolve the underlying issue giving rise to such need for suspension. Supplier will: (x) only suspend Customer’s right to access or use those portions of the Services at issue, if applicable and to the extent possible; and (y) use commercially reasonable efforts to restore Customer’s rights to access and use those portions of the Service subject to suspension promptly after the underlying issue has been resolved.
e. Service Updates.
Supplier may from time to time update the Services or Service Orders to reflect changes in, among other things, applicable laws, regulations, rules, technology and industry practices and will provide Customer with as much advance written notice as possible under the circumstances but in any event at least thirty (30) days’ advance written notice of any such updates. Any updates to the Services or Service Orders (i) will not reduce or adversely affect the level of performance, features, functionality, security or availability of the Services, (ii) will have substantially similar performance, features, functionality, security and availability, including as may be set forth in the applicable Service Order, and (iii) will not cause any errors or defects and will comply in all respects with the requirements and specifications set forth in the applicable Service Order.
f. Service Upgrades.
Customer may request, by provision of written notice to Supplier, upgrades or other modifications to the Services. Supplier shall review any such Customer request and shall, no later than thirty (30) days following Supplier’s receipt of such request, provide feedback to Customer with respect to the anticipated feasibility, timeline, changes in Fees (if any), and other information as Supplier may provide. If the Parties reach agreement on an upgrade or modification request, such upgrade or modification to the Services shall be memorialized in a new Service Order. Notwithstanding the foregoing, the Parties acknowledge and agree that any such upgrade or modification shall be subject to compliance with applicable laws, including applicable Sanctions and Export Controls.
g. Savings Clause.
In the event that: (i) Customer fails to fulfill its obligations under this Agreement or the applicable Service Order, including relating to the cooperation with, or provision of information, systems access, access to Customer’s Personnel, or access to or use of resources which Supplier reasonably requires in order to perform its obligations under this Agreement; (ii) fails to use the Services in accordance with the terms of this Agreement and applicable law; or (iii) Customer’s negligence, willful misconduct, or breach of applicable law adversely affect Supplier’s performance of the Services (each, a “Customer Failure”), then Supplier shall inform Customer in writing of such Customer Failure (or such other applicable circumstances), and Supplier shall be excused from the performance of its affected obligations hereunder, to the extent it is unable to perform due to such Customer Failure, until such time that Customer fulfills such obligations, remedies or other circumstances, or provides such access or cooperation, as applicable.
3. Term
This Agreement will become operative on the Effective Date and will remain in effect for so long as any Service Order remains in effect or Customer continues to access or use the Services. The term of each Service Order will commence and expire as set out in that Service Order (with respect to each Service Order, the “Initial Term”). Unless the applicable Service Order provides otherwise, the Initial Term will automatically renew for successive twelve (12) month periods (each a “Renewal Period”) unless either Party provides written notice of non-renewal to the other Party at least sixty (60) days prior to the end of the Initial Term or then-current Renewal Period (as the case may be). Notwithstanding the foregoing, to the extent there is a Service Order that has a term period that extends beyond the Initial Term or a Renewal Period, as applicable, this Agreement shall be construed as remaining in effect with respect to each individual applicable Service Order until the individual Service Order is terminated or expires (including being terminated pursuant to provisions of this Agreement as they apply with respect to the applicable Service Order).
4. Compensation; Taxes
a. Fees and other Amounts Payable by Customer.
(i) Fees for Services will be as stated in the applicable Service Order. With respect to each Service Order, the percentage of the total fees to be prepaid by Customer pursuant to the applicable Service Order shall be specified in such Service Order (with respect to the applicable Service Order, the “Prepaid Fees”) and shall be invoiced by Supplier and payable by Customer as of the date such Service Order is executed or as otherwise specified in such Service Order, with the Prepaid Fees being applied as prepayment against the invoices for the final months of the Service period under the applicable Service Order in a manner such that the balance of the applicable Prepaid Fees is reduced to zero when applied against the final invoice for the scheduled Service period. For example, where the Service period under the applicable Service Order is twenty-four (24) months, and the fees for Services are equal in all months during that period, (I) invoices under such Service Order for months one (1) through sixteen (16), inclusive, shall be payable in full without application of any credit resulting from the Prepaid Fees and (II) the Prepaid Fees under such Service Order shall be applied against the invoices for months seventeen (17) through twenty-four (24), inclusive.
(ii) All fees for Services will be priced and settled in U.S. Dollars, unless otherwise agreed in the applicable Service Order. Except as specifically provided in this Agreement or the applicable Service Order, Supplier will not be entitled to any other form of payment, compensation, or reimbursement related to the performance of the Services.
b. Payment Terms.
Unless otherwise agreed in the applicable Service Order, Fees are to be calculated and invoiced on a monthly basis, and Customer shall pay all invoices within fifteen (15) days after Customer’s receipt of Supplier’s itemized invoice regarding the applicable Service Order; provided, however, that Customer shall pay all Prepaid Fees within five (5) days after Customer’s receipt of Supplier’s invoice specifying such amounts. If Customer disputes an invoice, then Customer shall pay all undisputed portions of such invoice in accordance with this Section 4(b), and Customer may withhold payment of disputed amounts until and to the extent it is agreed between the Parties or determined by a court of competent jurisdiction that such amounts are due and payable by Customer to Supplier in connection with the applicable Service Order; provided, however, that the maximum amount that Customer shall be permitted to withhold as disputed fees shall be equal to one (1) month’s fully committed Fees for Services under the applicable Service Order (meaning Customer may continue to dispute in good faith amounts in excess of such amount, but shall pay such excess amounts in accordance with this Agreement under protest, pending the resolution of the applicable dispute). Delinquent payments shall bear interest at the rate of the lesser of (i) one percent (1%) per month and (ii) the highest rate permitted by law, in each case from the payment due date until paid in full.
c. Fees and other Amounts to be Credited to Customer.
(iii) Except as specifically provided in this Agreement or the applicable Service Order, Customer will not be entitled to any other form of credit, discount, reimbursement, or any other compensation related to the performance of the Services. For the avoidance of doubt, any credit or other similar amount owed to Customer that accrues under or in respect of a given Service Order shall not be applicable in respect of any other Service Order.
(iv) If a Service Credit accrues with respect to a Service Order, then the invoice that Supplier provides to Customer under the applicable Service Order with respect to the subsequent month shall include credits to Customer in the amounts of such accrued Service Credits, to the extent applicable. If Customer disputes the amount of, or lack of, a credit, the Parties shall promptly meet to discuss and attempt to resolve such dispute, each acting reasonably. If the Parties are unable to resolve the dispute, Customer may seek additional remedies under Section 12 of this Agreement.
d. Taxes.
(i) Customer shall reimburse Supplier, or pay directly to the appropriate tax authority, or timely issue a valid tax exemption certificate, for applicable Taxes. Supplier agrees to cooperate in a reasonable manner with Customer to minimize all Taxes that are to be paid directly or indirectly by Customer. For reimbursement of Taxes, Supplier will, in compliance with applicable laws, invoice Customer for any such Taxes as separately stated items at the time the Services are invoiced, and Supplier will timely remit collected Taxes to the applicable taxing authorities.
(ii) Notwithstanding any provision of this Agreement to the contrary, if any payment to be made in respect of any invoice is subject, under the law of any foreign or domestic tax jurisdiction, to any withholding tax, Customer shall make payment to Supplier of the amount owing on the invoice, less a deduction for the withholding tax, and shall account to the relevant tax authority for the withheld tax. Payments of the net sum to Supplier and the withholding tax to the relevant tax authority shall constitute, for purposes of this Agreement, full settlement of the amount owing under the invoice. Customer will, upon written request from Supplier and at Customer’s expense, furnish any necessary evidence that may reasonably be required to establish the payment of the withholding tax to the relevant tax authority.
(iii) Supplier shall bear and pay all federal, state, and local taxes based upon or measured by its net income, and all franchise taxes based upon its existence or its general right to transact business. Further, Supplier is exclusively liable for the payment of any and all taxes and contributions for social security or social insurance, health insurance, unemployment insurance, retirement benefits, workers’ compensation insurance or benefits, life insurance, pensions, annuities, and similar benefits, and any other employment related costs, obligations, and duties that may now or hereafter be imposed by law, collective bargaining agreements, or otherwise with respect to persons performing under this Agreement.
(iv) Due to state, federal or other governmental taxing authorities’ legal rights to examine a company’s books and records, either Party may allow such state, federal or other governmental authority access to this Agreement for reading purposes only, provided such authority is under a legal obligation of confidentiality. No copies of this Agreement may be retained by such state, federal or other governmental authority, except as otherwise required by law.
5. Performance Standards for Services
a. General.
With respect to Supplier’s provision of Services to Customer, Supplier shall perform the applicable Services in accordance with the applicable Service Order. Unless otherwise agreed in the applicable Service Order, Supplier will furnish all labor, materials, tools, equipment, and supervision necessary to fully and properly perform the Services (whether being provided to Customer or to Supplier’s third-party customers), and Supplier shall be liable for all expenses incurred by Supplier and its Personnel in connection with performing under this Agreement and any applicable Service Order. The applicable service quality objectives for Supplier’s performance of the Services that are GPUaaS Services (such objectives, the “Service Levels”), shall be as set out in the service level agreement in substantially the form attached hereto as Exhibit A (the “SLA”) (except to the extent a Service Order sets out different, or disclaims, such Service Levels). If Supplier fails to achieve such Service Levels when providing GPUaaS Services to Customer pursuant to the applicable Service Order, then Supplier shall issue a credit to Customer, as a credit on future invoices against amounts payable by Customer to Supplier pursuant to such Service Order, for such failure, to the extent that the SLA (or a Service Order, as applicable) sets out a Service Level credit (each, as further described in such SLA, a “Service Credit”) associated with respect to the applicable Service Level. Service Credits, as applicable, shall be Customer’s sole and exclusive remedy with respect to any failure by Supplier to perform the applicable Services in accordance with the applicable Services Levels, and, for the avoidance of doubt, Customer shall not seek, and Supplier shall not be obligated to pay Customer, damages arising out of Supplier’s failure to meet any applicable Service Level other than the Service Credit that Supplier is obligated to credit to Customer hereunder.
b. Service Warranty.
Supplier represents, warrants and covenants the following:
(i) At all times during negotiation, execution, and performance of this Agreement, Supplier shall hold a valid business license in the country in which it has its principal place of business and shall be duly qualified and licensed (if a license is necessary) to conduct the necessary activities in all countries where it performs Services;
(ii) The Deliverables, as of and limited to the date they are delivered to Customer, will meet all quality and performance standards set forth in the applicable Service Order, to the extent applicable; and
(iii) Supplier’s Personnel and Supplier’s facility, equipment, methods, and procedures are suitable for the performance of the Services and Supplier possesses all necessary expertise to perform the Services in compliance with all applicable specifications, standards and other requirements.
c. Disclaimer of Warranties.
Except as otherwise expressly agreed in writing, Supplier makes no representations or warranties and explicitly disclaims all other representations and warranties, whether express, implied, written, oral, or statutory, including the warranties of merchantability, noninfringement, and fitness for a particular purpose.
d. Force Majeure.
Neither Party will be liable or responsible for any delay or failure in performance of any part of this Agreement or the applicable Service Order that is caused by any Force Majeure Event affecting the performance of the applicable Affected Party; provided, however, that the foregoing shall not apply to excuse or delay Customer from its obligation to pay Fees and other amounts owed in connection with this Agreement or any Service Order and become due prior to the occurrence of such Force Majeure Event under this Agreement or such Service Order. In the event a Force Majeure Event interrupts the Services, the charges for the affected services will be reduced by the lesser of: (i) an amount equal to the effective hourly rate for the Services that are so disrupted by such Force Majeure Event multiplied by the number of hours of such disruption; and (ii) an amount equal to twenty-five percent (25%) of the monthly charges for that specific affected system.
The Affected Party must use commercially reasonable efforts to mitigate and minimize any resulting delay. The Affected Party must provide written notice to the other Party within a reasonable period (under the circumstances) of learning of a Force Majeure Event, stating the nature and cause of the event, the anticipated duration, the measures proposed or taken to minimize the delay, and the projected timetable for implementing such measures. The Affected Party shall resume the performance of its obligations as soon as reasonably practicable after the removal of the cause.
If such Force Majeure Event continues for more than ninety (90) days, either Party may cancel unperformed Services and affected Service Order(s) upon prior written notice.
6. Insurance
Except as otherwise agreed by the Parties in writing, each Party shall maintain insurance policies and coverage limits (per occurrence) with respect to this Agreement, during the term of this Agreement, at their own expense in accordance with their then-current policies and procedures.
7. Confidentiality
a. Non-Disclosure Obligations; Duty of Care.
Recipient receiving Confidential Information from the Discloser shall protect such Confidential Information by using the same degree of care, but no less than a reasonable degree of care, it uses to prevent the unauthorized access, use, dissemination or publication of its own confidential and proprietary information, as Recipient uses to protect its own confidential information of a like nature. Recipient shall not disclose any Confidential Information disclosed hereunder to any third-party and shall limit disclosure of Confidential Information to only those of its employees and contractors with a need to know and who are bound by confidentiality obligations with Recipient at least as restrictive as those contained in this Agreement. Recipient may only retain, use, or disclose any Confidential Information for the purposes of performing this Agreement. Each Party shall be responsible for its employees’ and contractors’ adherence to the terms of this Agreement. Further, except to the extent permitted by applicable law, Recipient shall not reverse engineer, disassemble, or decompile any products, prototypes, software, or other tangible objects that embody Confidential Information. In the event that the Parties receive Personal Data under this Agreement, each Party shall comply with all Data Protection Laws and any applicable privacy and/or security exhibits in respect of all Personal Data that is received or processed as part of this Agreement.
b. Exclusions and Compelled Disclosure.
Except with respect to Personal Data, this Agreement imposes no additional obligations upon Recipient with respect to Confidential Information that Recipient can reasonably demonstrate: (i) was in Recipient’s rightful possession on or before receipt from Discloser without a duty of confidentiality; (ii) is or becomes a matter of public knowledge through no fault of Recipient; (iii) is rightfully received by Recipient from a third-party without a duty of confidentiality; or (iv) is independently developed by Recipient without use of or reference to Confidential Information. If Recipient receives a request, demand, subpoena, or order issued by a court of competent jurisdiction or authorized governmental agency to disclose all or any part of Confidential Information, then Recipient may comply with such request or demand only if Recipient promptly notifies Discloser in writing of any such requirement prior to the disclosure of Confidential Information (except where such notification is prohibited by applicable law) and reasonably cooperates with Discloser regarding Discloser’s efforts, if any, to protect against any such disclosure. Recipient may release only that portion of the Confidential Information as required by the court or agency.
c. Additional Restrictions on Use of Certain Confidential Information.
If a Party receives the Confidential Information of the other Party about the operation or performance of such other Party’s products or services (e.g., technical specifications, source code, etc.), the Recipient of such Confidential Information (i) shall not use or procure others to use any such Confidential Information for developing inventions derived from such Confidential Information and (ii) will refrain from modifying any existing Intellectual Property Rights described in such Confidential Information (e.g., by creating or modifying any patent application, continuation application, continuation in part, or extension of any existing patent or patent application of any kind).
d. Return or Destruction of Confidential Information.
Within fifteen (15) days after Discloser’s written request, Recipient shall, at Discloser’s discretion, securely destroy or return all Confidential Information, except for those copies that are retained in Recipient’s standard backup system in the normal course of business, which copies shall remain subject to the provisions of this Section 7. Destruction of hardware provided under this Agreement shall be in compliance with all applicable laws.
8. Intellectual Property Rights
All right, title, and interest in and to the Services and the technology, assets, and other resources utilized by Supplier in the performance of the Services (other than Customer Materials) shall be held exclusively by Supplier. All right, title, and interest in and to the Customer Materials shall be held exclusively by Customer. Except as expressly stated otherwise in this Agreement, nothing in this Agreement shall be deemed to transfer or otherwise grant any of a Party’s Intellectual Property Rights to the other Party or any other party, and the owner of such Intellectual Property Rights exclusively retains all such Intellectual Property Rights, rights in such Party’s Confidential Information and such Party’s Technology. Furthermore, except as expressly granted in writing by an authorized representative of the owner of the applicable Intellectual Property Rights, the other Party shall not acquire any Intellectual Property Rights in or to, nor have any right to use, any trademark, trade name, service mark, or other proprietary designation of the owner of such Intellectual Property Rights other than as strictly necessary to perform its obligations in connection with the applicable Service Order or this Agreement.
9. Indemnity
a. SUPPLIER WILL INDEMNIFY, DEFEND, AND HOLD CUSTOMER AND ITS AFFILIATES, AGENTS, OFFICERS, DIRECTORS, AND EMPLOYEES HARMLESS FROM AND AGAINST ALL CLAIMS, DAMAGES, LIABILITIES, LOSSES AND REASONABLE EXPENSES (INCLUDING BUT NOT LIMITED TO REASONABLE ATTORNEYS’ FEES, COSTS AND EXPENSES OF CONSULTANTS AND EXPERT WITNESSES, AND COSTS OF APPEAL), TO THE EXTENT ARISING OUT OF OR RESULTING IN WHOLE OR IN PART FROM A CLAIM BY A THIRD PARTY THAT IS NOT AN AFFILIATE OF CUSTOMER THAT THE SERVICES OR ANY DELIVERABLE PROVIDED BY SUPPLIER HEREUNDER INFRINGE ANY INTELLECTUAL PROPERTY RIGHTS OF A THIRD PARTY (IN EACH CASE EXCEPT TO THE EXTENT THE INFRINGEMENT ARISES OUT OF SERVICES, PRODUCTS, PROCESSES, OR ANY OTHER RESOURCE PROVIDED BY OR PROCURED FROM, DIRECTLY OR INDIRECTLY, CUSTOMER OR ITS AFFILIATES). IF THE SERVICES AND/OR DELIVERABLE ARE BELIEVED BY SUPPLIER TO INFRINGE IN SUCH A MANNER, SUPPLIER WILL, AT ITS OPTION: (A) AT SUPPLIER’S EXPENSE, MODIFY THE SERVICES AND/OR DELIVERABLE TO BE NON-INFRINGING; (B) AT SUPPLIER’S EXPENSE, OBTAIN FOR CUSTOMER A LICENSE TO CONTINUE USING THE SERVICES AND/OR DELIVERABLE IN THE MANNER DESCRIBED IN THIS AGREEMENT; OR (C) TERMINATE THE SERVICES; PROVIDED, HOWEVER, IF SUPPLIER TERMINATES THE SERVICES, THEN SUPPLIER SHALL REFUND TO CUSTOMER ALL SERVICE FEES PREPAID BY CUSTOMER FOR THOSE SERVICES TO THE EXTENT SUCH AMOUNTS RELATE TO THE PERFORMANCE OF SERVICES AFTER THE EFFECTIVE DATE OF SUCH TERMINATION; PROVIDED, FURTHER, HOWEVER, THAT CUSTOMER WILL PAY FOR SERVICES INVOICED BEFORE THE DATE OF TERMINATION AT A PRO-RATA AMOUNT BASED ON THE SERVICES ACTUALLY USED.
b. CUSTOMER WILL INDEMNIFY, DEFEND, AND HOLD SUPPLIER AND ITS AFFILIATES, AGENTS, OFFICERS, DIRECTORS, AND EMPLOYEES HARMLESS FROM AND AGAINST ALL CLAIMS, DAMAGES, LIABILITIES, LOSSES AND REASONABLE EXPENSES (INCLUDING BUT NOT LIMITED TO REASONABLE ATTORNEYS’ FEES, COSTS AND EXPENSES OF CONSULTANTS AND EXPERT WITNESSES, AND COSTS OF APPEAL), TO THE EXTENT ARISING OUT OF OR RESULTING IN WHOLE OR IN PART FROM: (i) ANY VIOLATION BY CUSTOMER OF APPLICABLE LAWS (INCLUDING APPLICABLE SANCTIONS AND EXPORT CONTROLS); OR (ii) A CLAIM BY A THIRD PARTY THAT IS NOT AN AFFILIATE OF SUPPLIER (x) THAT THE DATA OR INFORMATION, PROCEDURES, OR OTHER RESOURCES (A) PROVIDED BY CUSTOMER AND IN THE FORM PROVIDED BY CUSTOMER (OR ANYONE AUTHORIZED TO ACT ON CUSTOMER’S BEHALF) AS PART OF ITS USE OF THE SERVICES OR (B) PROCESSED, MODIFIED, OR PRODUCED BY OR ON BEHALF OF CUSTOMER AS PART OF ITS USE OF THE SERVICES (THE “CUSTOMER MATERIALS”) HEREUNDER INFRINGE ANY INTELLECTUAL PROPERTY RIGHTS OF A THIRD PARTY (IN EACH CASE EXCEPT TO THE EXTENT THE INFRINGEMENT ARISES OUT OF SERVICES, PRODUCTS, PROCESSES, OR ANY OTHER RESOURCE PROVIDED BY OR PROCURED FROM, DIRECTLY OR INDIRECTLY, SUPPLIER OR ITS AFFILIATES), (y) ARISING OUT OF THE GROSS NEGLIGENCE OR WILLFUL MISCONDUCT OF CUSTOMER OR ANY OF ITS AFFILIATES, OR THEIR RESPECTIVE EMPLOYEES, CONTRACTORS, OR SUPPLIERS, OR (z) ARISING OUT OF USE OF THE SERVICE BY OR ON BEHALF OF CUSTOMER OR CUSTOMER’S END USERS.
c. In the event that a Party is seeking indemnification from the other Party (for the benefit of itself or the other indemnitees with which it is associated), the Party seeking indemnification shall:
(i) promptly notify the indemnifying Party of the claim in writing; provided, however, that (A) if such prompt notice is provided and the indemnitor fails to assume the defense of any claim, the indemnitee may assume the defense and settlement at the indemnitor’s expense and (B) the failure to provide prompt notice shall not relieve indemnitor of its indemnification obligations, provided that such failure does not unfairly prejudice the indemnitor;
(ii) reasonably cooperate with the other Party in the defense of the claim, at the indemnitor’s expense; and
(iii) give the indemnitor sole control of the defense and settlement of the claim.
The indemnitor will pay all defense costs, negotiated settlement amounts, and court-awarded damages. Either Party as indemnitor may settle any indemnified claim hereunder without the consent of the other only if: (A) the settlement does not impose any financial or other obligation on or impair any right of the non-consenting Party, and (B) the settling Party procures the release of the indemnified Party from any liability pursuant to this Section 9 for the settled third-party claim, other than for amounts paid or to be paid by the indemnitor in connection with the settlement. Neither Party shall settle any third-party claim for which the settling Party is seeking indemnification from the other Party without the consent of such other Party (which shall not be unreasonably withheld).
10. Limitation of Liability
a. SUBJECT TO SECTION 10(c), IN NO EVENT WILL EITHER PARTY BE LIABLE UNDER ANY THEORY OF RECOVERY (INCLUDING, WITHOUT LIMITATION, BREACH OF CONTRACT, BREACH OF WARRANTY, NEGLIGENCE, TORT, AND STRICT LIABILITY) FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, CONSEQUENTIAL (INCLUDING, WITHOUT LIMITATION LOSS OF USE, INCOME, PROFIT, OR SAVINGS) OR PUNITIVE DAMAGES ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, ANY SERVICE ORDER, OR ANY PRODUCT, SERVICE, OR DELIVERABLE PROVIDED BY SUPPLIER UNDER THIS AGREEMENT OR ANY SERVICE ORDER, OR CUSTOMER MATERIALS PROVIDED BY CUSTOMER UNDER THIS AGREEMENT OR ANY SERVICE ORDER, EVEN IF THE RESPONSIBLE PARTY HAD BEEN ADVISED OF THE POSSIBILITY OF THOSE TYPES OF DAMAGES OR EVEN IF THOSE TYPES OF DAMAGES WERE REASONABLY FORESEEABLE.
b. SUBJECT TO SECTION 10(c), IN NO EVENT WILL THE AGGREGATE LIABILITY OF EITHER PARTY IN AGGREGATE WITH RESPECT TO A SERVICE ORDER (INCLUDING THIS AGREEMENT AS IT RELATES TO THE APPLICABLE SERVICE ORDER), EXCEED ONE HUNDRED PERCENT (100%) OF THE AGGREGATE FEES PAID OR PAYABLE BY CUSTOMER DURING THE SIX (6) MONTHS IMMEDIATELY PRECEDING THE LATEST DATE THE BASIS FOR A CLAIM OR CAUSE OF ACTION AGAINST SUCH PARTY AROSE UNDER THE APPLICABLE SERVICE ORDER (SUCH LIMITATION OF LIABILITY AS IT RELATES TO THE APPLICABLE SERVICE ORDER, THE “GENERAL LIABILITY CAP”); PROVIDED, HOWEVER, THAT WITH RESPECT TO SUPPLIER’S LIABILITY ARISING OUT OF SUPPLIER’S (I) BREACH OF CONFIDENTIALITY OBLIGATIONS UNDER SECTION 7; (II) BREACH OF APPLICABLE DATA PROTECTION LAWS OR EXHIBIT B, IN NO EVENT WILL THE AGGREGATE LIABILITY OF SUPPLIER IN AGGREGATE WITH RESPECT TO A SERVICE ORDER (INCLUDING THIS AGREEMENT AS IT RELATES TO THE APPLICABLE SERVICE ORDER) EXCEED AN AMOUNT EQUAL TO TWO (2) TIMES THE APPLICABLE GENERAL LIABILITY CAP (SUCH LIMITATION OF LIABILITY WITH RESPECT TO SUCH CLAIMS AS IT RELATES TO THE APPLICABLE SERVICE ORDER, THE “DATA-RELATED LIABILITY CAP”). AMOUNTS WHICH ACCRUE AGAINST THE GENERAL LIABILITY CAP SHALL NOT ACCRUE AGAINST THE DATA-RELATED LIABILITY CAP, AND VICE-VERSA.
c. NOTWITHSTANDING THE FOREGOING, NOTHING IN THIS AGREEMENT OR ANY SERVICE ORDER WILL LIMIT OR EXCLUDE A PARTY’S LIABILITY WITH RESPECT TO THE APPLICABLE SERVICE ORDER ARISING FROM OR AS A RESULT OF: (I) CLAIMS FOR PERSONAL INJURY, DEATH OR DAMAGE TO TANGIBLE PROPERTY TO THE EXTENT ARISING OUT OF THE NEGLIGENCE OR WILLFUL MISCONDUCT OF THE LIABLE PARTY; (II) GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR FRAUD OF THE LIABLE PARTY OR ANY PERSON ACTING ON SUCH PARTY’S BEHALF; (III) EACH PARTY’S INDEMNIFICATION OBLIGATIONS AS SET OUT IN SECTION 9; (IV) CUSTOMER’S OBLIGATION TO PAY AMOUNTS TO SUPPLIER HEREUNDER, INCLUDING FEES FOR SERVICES; OR (V) ANY LIABILITY THAT CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW. LIABILITY OF THE SORT SET OUT IN THIS SECTION 10(c) AS NOT BEING SUBJECT TO LIMITATION OR EXCLUSION SHALL NOT ACCRUE AGAINST THE APPLICABLE LIMITATION OF THE APPLICABLE PARTY’S LIABILITY AS SET OUT IN SECTION 10(b).
11. Termination
a. Termination for Cause – Material Breach.
If either Party commits a material breach of a Service Order (including a material breach of a provision of this Agreement, as it applies with respect to such Service Order), then the non-breaching Party may terminate such Service Order upon written notice to the breaching Party, if such breach is capable of cure and the breaching Party fails to cure the breach within thirty (30) days after receiving written notice of such material breach, it being understood that a breach of Section 15(b)(ii)-(iv) shall constitute a material breach not subject to cure. For the avoidance of doubt, while the Parties shall work together in good faith to resolve such objection, Supplier shall at all times retain control of and discretion relating to its operations and its performance of the Services.
b. Termination for Cause – Customer Failure to Pay.
If Customer fails to pay any charges or other amounts due and payable to Supplier under a Service Order when due, Supplier may terminate such Service Order upon written notice to Customer if Customer fails to pay the overdue amount within five (5) business days after receiving written notice of such nonpayment.
c. Termination of a Service Order for Convenience.
Except to the extent otherwise expressly provided for in a Service Order, neither Party shall be permitted to terminate such Service Order for convenience.
d. Termination for Insolvency.
Should either Party to this Agreement: (i) be adjudged or become insolvent; (ii) have any proceedings instituted by or against it in bankruptcy, under insolvency laws, or for the Party’s reorganization, receivership, dissolution, or liquidation; (iii) make an assignment for the benefit of creditors or any general arrangement with creditors; or (iv) discontinue business or adopt a resolution calling for same; the other Party may terminate any Service Order for cause upon twenty-four (24) hours written notice.
e. Termination for Legal Prohibition.
In the event that a change in applicable Sanctions, Export Controls or other applicable law results in the legal prohibition of Supplier’s continued performance of its obligations hereunder (as determined by Supplier in its sole discretion), Supplier shall be entitled to terminate this Agreement and any applicable Service Orders hereunder.
f. Effect of Termination.
i. In addition to any other remedies available to Customer at law or under this Agreement, if Customer terminates this Agreement in accordance with this Section 11, then Supplier shall promptly reimburse Customer for any and all Prepaid Fees that have not yet been credited against Fees payable (if any); provided, that Customer will pay for Services invoiced before the date of termination at a pro-rata amount based on the Services actually used; provided, further, however, that in the event Customer wrongfully terminates this Agreement, Supplier may withhold any and all Customer prepaid fees. Additionally, Customer shall be relieved of any payment obligations otherwise accruing after the effective date of termination.
ii. In addition to any other remedies available to Supplier at law or under this Agreement, if Supplier terminates this Agreement in accordance with the terms of this Agreement for any reason, Supplier may withhold any and all Customer prepaid fees.
12. Choice of Law; Forum and Dispute Resolution
This Agreement shall be governed by, subject to, and construed in accordance with the internal laws of New York State, excluding the conflict of law rules thereof. The Parties specifically exclude from application to this Agreement the United Nations Convention on Contracts for the International Sale of Goods. All disputes and litigation arising out of or related to this Agreement, including, without limitation, matters connected with its performance, will be subject to the exclusive jurisdiction of the state or federal courts seated in New York County, New York State. Each Party hereby irrevocably submits to the personal jurisdiction of such courts and irrevocably waives all objections to such venue. Each Party hereby irrevocably waives its right to a jury trial.
13. Feedback; Forums & Messaging; Statistical Data
a. Feedback. If Customer or any Customer end user uses any “rating” feature of the Services or sends or transmits any communications, comments, questions, suggestions, or related materials to Supplier, whether by letter, email, telephone, or otherwise suggesting or recommending changes to the Services, including, without limitation, new features or functionality relating thereto (collectively, “Feedback”), then Customer provides such Feedback without any warranty, express or implied, and expressly disclaims, without limitation, any warranty of suitability for any purpose, merchantability, or non-infringement. Supplier makes use of any Feedback at its own risk and without any liability to Customer. Subject to the foregoing, Supplier, without any attribution or compensation to Customer, is free to use any ratings submitted within the Services and any ideas, know-how, concepts, techniques, or other intellectual property and proprietary rights contained in the Feedback, whether or not patentable, for any purpose whatsoever, including but not limited to, developing, manufacturing, having manufactured, licensing, marketing, and selling, directly or indirectly, products and services using such Feedback. Customer understands and agrees that Supplier may use any Feedback in aggregated or non-aggregated form; however, Supplier is not obligated to use, display, reproduce, or distribute any such ratings, ideas, know-how, concepts, or techniques contained in the Feedback, and Customer has no right to compel such use, display, reproduction, or distribution. Supplier shall not identify Customer as the provider of Feedback except to the extent authorized by Customer in writing to do so.
b. Forums and Messaging. Supplier may offer various forums where Customer or Customer end users can post their observations and comments on designated topics. By offering this feature, Customer acknowledges that Supplier is acting as an intermediary and is not responsible and shall not be liable for such communications. Customer further acknowledges that ideas or information that Customer or Customer end users post or share may be seen and used by other users, and that Supplier cannot guarantee that other users will not use the ideas and information that Customer or Customer end users share on the Services. Therefore, if Customer or its end users have an idea or information that Customer would like to keep confidential or that Customer does not want others to use, or that is subject to third-party rights that may be infringed by sharing it, Customer is responsible for the sharing of any such information, including decisions and actions not to post, and to cause Customer end users not to post, such information on the public forums of the Services. SUPPLIER SHALL NOT BE RESPONSIBLE FOR A CUSTOMER END USER’S MISUSE OR MISAPPROPRIATION OF ANY CONTENT OR INFORMATION POSTED IN ANY SUPPLIER COMMUNITY FORUM.
c. Statistical Data. Subject to Supplier’s obligations of confidentiality under Section 7, Supplier shall be entitled to collect, compile, analyze, or otherwise use and exploit: (i) statistical data related to the use of the Supplier Platform; (ii) metadata that Supplier collects in connection with Customer’s or each Customer end user’s use of the Supplier Platform, including, without limitation, usage data collected for the purpose of billing, maintaining the security of the Supplier Platform, or optimizing the Supplier Platform or any other Supplier product, service, or offering; and (iii) other data that qualifies as De-Identified Data (collectively, the “Statistical Data”). No compensation shall be owed by Supplier with respect to its use of the Statistical Data.
14. Third-Party Services, Software and Links
a. Third-Party Services. Supplier may incorporate, embed, bundle with, or otherwise make available to Customer with the Services certain third-party products, software, components, technology, and/or services (each, a “Third-Party Service”) that are owned by one or more third parties, including, but not limited to, through one or more marketplaces maintained or offered by Supplier. With respect to Customer’s use of any Third-Party Service in connection with the Services, Customer acknowledges that (i) Customer is solely responsible for complying with the terms and conditions applicable to any Third-Party Service (“Third-Party Terms”) and to cause each of Customer’s end users to comply with the Third-Party Terms, including those terms and conditions applicable to purchasing or licensing any such Third-Party Service; (ii) no Third-Party Service shall be considered Services, and any Third-Party Terms are in addition to this Agreement and the applicable Service Order; (iii) Customer shall pay all fees charged by the provider of any such Third-Party Service in accordance with the applicable Third Party Terms, and Customer recognizes that the Third-Party Terms governing such fees (including any price adjustments) are not in Supplier’s control, even if payment is facilitated through the Services; (iv) Customer is solely responsible for obtaining and maintaining any Third-Party Service at Customer’s expense; and (v) EACH THIRD-PARTY SERVICE IS PROVIDED BY SUPPLIER “AS-IS” WITHOUT ANY REPRESENTATION OR WARRANTY OF ANY KIND AND SUPPLIER SHALL NOT BE LIABLE FOR ANY CLAIM, LOSS, DAMAGE, OR LIABILITY, OR IN ANY OTHER MANNER, RELATED TO ANY THIRD-PARTY SERVICE, regardless of any assistance or information provided by Supplier in connection with any Third-Party Service. For the avoidance of doubt, Customer agrees and understands that Customer, and not Supplier, is solely responsible for Customer’s and each Customer end user’s compliance with the Third-Party Terms. Supplier will not and does not monitor Customer’s compliance or reporting with respect to Third-Party Terms and shall have no obligation to do so. If the provider of a Third-Party Service reasonably determines that Customer is non-compliant with any Third-Party Terms, then Supplier reserves the right to immediately suspend or terminate the applicable Third-Party Services provided to Customer. In such case, Supplier will use reasonable efforts to provide Customer with advance notice of such suspension or termination and the reasons for such suspension or termination. In all cases, Supplier will use reasonable commercial efforts to suspend, rather than to terminate the Third-Party Services. Customer agrees and understands that Supplier shall be entitled to request Customer to share or report Customer’s content or usage information with any provider of a Third-Party Service if Supplier is contractually obligated to do so, provided further that any such content or usage information shall be Customer Confidential Information.
b. Third-Party Sites and Links. The Services may also be linked to third-party websites which are not Affiliates of Supplier (each, a “Third-Party Site”). Customer acknowledges and agrees that any Third-Party Site may have different privacy practices, terms and conditions, or user guides and business practices than Supplier, and Customer’s use and each Customer’s end user’s use of any such Third-Party Site is governed by the privacy policy, terms and conditions, or user guides applicable to such Third-Party Site (collectively, “Third-Party Site TCs”). Customer agrees to comply with any and all Third-Party Site TCs and to cause each of Customer’s end users to comply with the Third-Party Site TCs. EACH THIRD-PARTY SITE IS PROVIDED BY SUPPLIER “AS-IS” WITHOUT ANY REPRESENTATION OR WARRANTY OF ANY KIND AND SUPPLIER SHALL NOT BE LIABLE FOR ANY CLAIM, LOSS, DAMAGE, OR LIABILITY, OR IN ANY OTHER MANNER, RELATED TO ANY THIRD-PARTY SITE. Supplier does not verify, make any representations, or take responsibility for any Third-Party Site, including, without limitation, the truthfulness, accuracy, quality or completeness of the content, services, links displayed and/or any other activities conducted on or through such Third-Party Sites. CUSTOMER AGREES THAT SUPPLIER WILL NOT, UNDER ANY CIRCUMSTANCES, BE RESPONSIBLE OR LIABLE, DIRECTLY OR INDIRECTLY, FOR ANY GOODS, SERVICES, INFORMATION, RESOURCES AND/OR CONTENT AVAILABLE ON OR THROUGH ANY THIRD-PARTY SITES AND/OR THIRD-PARTY DEALINGS OR COMMUNICATIONS, OR FOR ANY HARM RELATED THERETO, OR FOR ANY DAMAGES OR LOSS CAUSED OR ALLEGED TO BE CAUSED BY OR IN CONNECTION WITH CUSTOMER’S OR ANY OF CUSTOMER’S END USERS’ USE OR RELIANCE ON THE CONTENT ON OR AVAILABLE THROUGH A THIRD-PARTY SITE OR BUSINESS PRACTICES OF ANY THIRD PARTY. Any reference to the Services on any third-party product, service, or publication (including a Third-Party Site) or by any third-party entity or individual will not constitute or imply an endorsement or recommendation by Supplier.
15. Compliance
a. Laws & Regulations.
Each Party will at all times comply with all applicable governmental laws, statutes, ordinances, rules, regulations, orders, and other requirements applicable to it or its performance of its obligations pursuant to this Agreement or any Service Order, regardless of whether such law, statute, ordinance, rule, regulation, order, or legal requirement had taken effect on the Effective Date or on some later date, including without limitation such governmental requirements applicable to environmental protection, labor and employment practices (including without limitation health, safety, wages, benefits, hours, equal employment opportunity, nondiscrimination and working conditions and the prohibition of forced, indentured, bonded (including debt bondage), trafficked or slave labor), Sanctions and Export Controls (as more specifically stated below), customs, transportation, protection of Personal Data, and Anti-Corruption Laws (as more specifically stated below). If a Party requires the assistance of the other Party to achieve compliance with any applicable laws, regulations or other requirements, the first Party shall promptly notify the other Party in writing. The foregoing covenant also includes, but is not limited, to complying with all applicable laws with respect to the health and safety of persons and property, and each Party shall take all reasonable precautions to prevent the occurrence of injury to persons or property during the conduct of its obligations pursuant to this Agreement or any Service Order. Each of Customer and Supplier will maintain an injury and illness prevention program where required by law.
b. Export Controls; Sanctions.
(i) Customer represents and warrants that none of Customer or any of its subsidiaries, or any of the respective directors, officers, employees, agents or affiliates of Customer or any of its subsidiaries: (A) is a Prohibited Person; (B) has been, since April 24, 2019, or is currently, in violation of applicable Sanctions or Export Controls; or (C) has been, since April 24, 2019, or is currently, engaged in any dealings or transactions with or involving any Prohibited Person, or in, with or involving any Sanctioned Jurisdiction.
(ii) Customer shall, in connection with this Agreement and any Service Order, comply with applicable Export Controls and Sanctions.
(iii) Neither Customer nor any parent, director, officer or end-user of Customer shall become a Prohibited Person.
(iv) Customer shall not, and shall procure that Customer’s end-users shall not, in connection with this Agreement or any Service Order, use any Services or make such Services available for use: (A) for, by or on behalf of any Prohibited Person; (B) for weapons of mass destruction, military or military intelligence end-uses (or by or on behalf of any weapons of mass destruction, military or military intelligence end-user); or (C) in any other manner that would constitute or give rise to a violation of Sanctions or Export Controls by Supplier or Customer.
(v) Customer shall, and shall procure that Customer’s customers and end-users shall, upon request of Supplier, provide any and all cooperation, documentation or certification as may be necessary for Supplier’s compliance with applicable Export Controls and Sanctions.
c. Anti-Corruption Laws.
Customer represents and warrants that it has not, in the past five (5) years, made, offered, or authorized, and will not make, offer, or authorize, any payment, gift, promise, or other advantage, whether directly or indirectly or through any other person or entity, to or for the use or benefit of any government official (including officers of state-owned enterprises and seconded government officials) or any other person, in violation of applicable Anti-Corruption Laws. Each Party undertakes that, in connection with this Agreement, it will comply with applicable Anti-Corruption Laws.
d. Governmental Permits.
Each Party, as applicable, will investigate the need for and will procure in its own name to the extent allowed by law, all governmental permits, certifications, notifications, approvals, and inspections required for the performance of its obligations hereunder. Each Party will promptly notify the other Party if any such permit, certification, or approval lapses, or is modified or revoked. If, under applicable law, any permits, certifications, or approvals must be procured in a particular Party’s name, the Parties shall discuss the matter in good faith and shall coordinate regarding the obtaining of such permits, certifications or approvals.
e. Liens.
To the maximum extent allowed by law, each Party hereby waives and releases any and all lien rights that it may acquire in the other Party’s owned or leased property as a result of performing its obligations pursuant to this Agreement or any Service Order. Each of Customer and Supplier, as applicable, will take steps as necessary to obtain a waiver and release of lien rights that such Party’s suppliers, subcontractors, or customers may have with regard to the owned or leased property of the other Party.
f. Books and Records.
Each Party, as applicable, shall keep records in a reasonable manner evidencing that such Party has discharged its obligations with respect to compliance pursuant to this Agreement and each Service Order. Each Party will provide the other Party with information requested via questionnaires and/or oral interviews to substantiate amounts that are payable by one Party to the other in connection with this Agreement or any Service Order. All records and information provided by a Party pursuant to this Section 15(f), including such Party’s responses to questionnaires or oral interviews, shall be the Confidential Information of the disclosing Party.
16. Miscellaneous
a. Notices. Unless otherwise specifically stated in this Agreement or the applicable Service Order, all notices, requests, consents and other communications, which are required or permitted under this Agreement or such Service Order, must be in writing and will be effective: (i) upon receipt if by personal delivery; (ii) upon receipt if by certified or registered mail (return receipt requested); or (iii) one day after it is sent if by next day delivery by a major commercial delivery service. Notices to Supplier must be sent to Dapple Cloud, Inc., 228 Park Ave. S PMB 899506, New York, NY 10003, Attention: Legal, with a copy by email to legal@dapple.co. Notices to Customer will be sent to the postal or email address then associated with Customer’s account. If a Party changes its address for notices, it will provide notice of its new address to the other Party as set forth in this Section 16(a).
b. Modification; Amendment.
Supplier may update this Agreement from time to time by posting the updated Agreement at the location where these Cloud Compute Services Terms of Service are made available and revising the “Last Updated” date above. Supplier will provide notice of any material update at least thirty (30) days before it takes effect, by email to the address then associated with Customer’s account or by notice within the Services. An update takes effect on the date stated in the notice or, if no date is stated, thirty (30) days after posting. Notwithstanding the foregoing, the version of this Agreement in effect on the date a Service Order is executed will continue to govern that Service Order for its term, and no update will apply to a Service Order executed before the update takes effect unless the Parties agree otherwise in writing. Customer’s continued access to or use of the Services after an update takes effect constitutes Customer’s acceptance of the updated Agreement; if Customer does not agree to an update, Customer must cease all access to and use of the Services. Each Service Order may be modified or amended only in writing signed by a duly authorized representative of each Party; no other act, document, usage, or custom shall be deemed to amend or modify a Service Order. The Parties agree that an email does not constitute a signed writing for purposes of this Section 16(b).
c. Assignment.
Except as otherwise provided in this Section 16(c), neither Party shall have the right to assign this Agreement or any Service Order without the other Party’s prior written consent, not to be unreasonably withheld, conditioned, or delayed; provided, however, that (i) Supplier shall have the right, with prior written notice to Customer, to assign this Agreement or any Service Order to an Affiliate of Supplier and (ii) Supplier shall be entitled, upon written notice to Customer, to assign its rights in this Agreement or any Service Order (via pledge, collateral assignment, or otherwise) for financing purposes to one or more Financing Parties (including a collateral assignment to any Financing Party and/or entering into a Financing Document).
d. No Third-Party Beneficiaries.
This Agreement is for the sole benefit of the Parties hereto and their respective successors and permitted assigns and nothing herein, express or implied, is intended to or shall confer upon any other person any legal or equitable right, benefit, or remedy of any nature whatsoever, under or by reason of this Agreement.
e. Independent Contractor.
In the performance of this Agreement, each Party is acting as an independent contractor. Neither Party, nor their respective Affiliates, respective employees, contractors, or suppliers, is the servant, agent, or employee of the other Party, and none of the foregoing shall make any representations otherwise. In no event shall this Agreement or any Service Order be considered or construed in any manner to be an employment contract, or otherwise impose any liability on either Party, as applicable, that would arise from any employer-employee relationship. Each Party will not interfere in the other Party’s engagement of personnel and suppliers, or in the other Party’s assignment of personnel and supplies in connection with the other Party’s performance of its obligations under this Agreement or any Service Order. Each Party will have no supervision, control, or disciplinary authority over the employees, contractors, and suppliers of the other Party. Neither Party has the right nor the ability to bind the other Party to any agreement with a third-party or incur any obligation or liability on behalf of the other Party without the other Party’s prior written consent. Each Party is solely responsible for managing its employees, contractors, and suppliers, and is solely responsible for compliance with all the applicable laws regarding labor, wages, unemployment insurance, social insurance, employee income tax withholding, and provision of employee benefits, including but not limited to health insurance, worker’s compensation (or comparable) insurance, and leave time.
f. Delegation and Subcontracting.
Supplier may in its discretion delegate its duties or subcontract any portion of the Services or this Agreement or any Service Order to any Supplier Affiliate, subsidiary or franchisee, any subcontractor, or any other third-party (each a “Delegate”). For any such delegation or subcontract, Supplier remains fully responsible and liable for all Services provided under this Agreement and for any and all acts, omissions, and liabilities of Supplier’s Delegates in respect of this Agreement or the applicable Service Order.
g. Advertising & Marketing.
Each Party agrees that it shall not publish or cause to be disseminated through any press release, public statement, or marketing or selling effort any information that relates to the other Party or the terms of any Service Order without the prior written approval of the other Party. Nothing in this Section 16(g) restricts Supplier from publishing, updating, or otherwise making this Agreement publicly available.
h. Records Available.
Each Party must keep detailed accounting records relating to Supplier’s performance under this Agreement that are prepared and maintained on the basis of generally accepted accounting principles, for a period of six (6) years after the creation of the record.
i. No Waiver of Rights.
The failure of either Party to this Agreement to object to or to take affirmative action with respect to any conduct of the other Party that is in violation of the terms of this Agreement shall not be construed as a waiver thereof, or as waiver of any future breach or subsequent wrongful conduct. Acceptance of Deliverables and/or Services will not constitute a waiver of any applicable warranties.
j. Remedies Not Exclusive.
Except as specifically agreed to herein to the contrary, all remedies stated in this Agreement are not exclusive, and Customer shall have the right to seek any additional remedies that may be available at law or in equity.
k. Similar Development.
Each Party understands and acknowledges that the other Party may currently or in the future be developing, or otherwise acquiring or receiving, products, information, concepts, systems, or techniques similar to or competing with products, information, concepts, systems, or techniques embodied in the Services. Nothing in this Agreement or any Documentation will prohibit such other Party from doing the foregoing or be construed as a representation that such other Party will not be involved in the development, receipt or acquisition of such products, information, concepts, systems, or techniques, provided that such other Party does not violate any of its obligations under this Agreement.
l. Continuity Plan.
Supplier shall maintain a continuity plan, consistent with Supplier’s then current policies and procedures, designed to mitigate the adverse effects on the GPUaaS Services in the event of any Business Interruption. Upon the occurrence of a Business Interruption, Supplier shall: (i) promptly notify Customer in writing; and (ii) implement Supplier’s continuity plan in accordance with the timeframes set out in such continuity plan.
m. Exhibits.
The terms of this Agreement also include those additional terms described in any exhibit, appendix, addendum, or attachment referenced below:
• Exhibit A – Service Levels and Service Credits
• Exhibit B – Data Security Exhibit
• Data Processing Agreement, available at https://dapple.co/legal/dpa/
n. Entire Agreement.
This Agreement and any exhibits or other documents incorporated or referenced herein, and the terms and conditions in each Service Order, constitute the complete agreement between the Parties and supersede all prior or contemporaneous agreements or representations, written or oral, concerning the subject matter of this Agreement or the given Service Order, as applicable. Where there is any conflict or inconsistency with the express terms in this Agreement, the terms of this Agreement shall supersede such conflicting or inconsistent terms and conditions in the applicable Service Order to the extent necessary to resolve such conflict; notwithstanding the foregoing, certain exhibits to this Agreement may specify that the terms and conditions in such exhibits supersede any conflicting or inconsistent terms and conditions in this Agreement or the applicable Service Order to the extent necessary to resolve such conflict. This Agreement may be executed in one or more identical counterparts, each of which shall be deemed an original and together constitute one and the same instrument; provided that no counterpart shall be effective until paired with the corresponding counterpart required by the other Party. Each Service Order may be executed in one or more identical counterparts, each of which shall be deemed an original and together constitute one and the same instrument; provided that no counterpart shall be effective until paired with the corresponding counterpart required by the other Party. The Parties also consent to the use of electronic or digital signatures through the use of software programs designed to facilitate electronic signatures, including but not limited to Adobe Sign or other similar software. Delivery of a signed Service Order as a scanned attachment to an email is deemed equivalent in all respects to delivery of an original document, provided that such attachment is complete and legible.
o. Severability.
Each term of this Agreement shall be interpreted in such a manner as to be effective and valid under applicable law. However, in the event that any of the terms of this Agreement becomes or is declared illegal by any court or tribunal of competent jurisdiction, or becomes otherwise unenforceable, such term shall be deemed deleted from this Agreement, and all the remaining terms of this Agreement shall remain in full force and effect.
p. Survivability.
Except for termination of the obligations to perform further Services and to compensate for such Services, the terms and conditions of this Agreement shall continue and survive any expiration or termination of this Agreement.
q. Separate Agreements.
Each Service Order (including the manner in which this Agreement applies with respect to the applicable Service Order) covers in full each and every agreement of every kind or nature whatsoever between the Parties concerning such Service Order and shall be construed as a separate agreement. For the avoidance of doubt, to the extent there are multiple Service Orders (or other agreements) between the Parties, regardless of whether relating to the same or similar services and other matters, each Service Order (or other agreement) and this Agreement shall be construed as separate agreements, and there shall be no cross-defaults, rights of setoff, or other rights or remedies that span across such agreements or that are contingent upon, or triggered by, any provision or circumstance occurring with respect to a different Service Order or agreement and any right, remedy, obligation, or liability, as applicable, arising under or relating to a Service Order or other agreement shall be limited to the provisions of such Service Order or other agreement (including this Agreement as it relates to such Service Order or other agreement), and references therein or in this Agreement to the “Service Order” shall refer to such Service Order or other agreement together with the provisions of this Agreement as they apply solely with respect to such Service Order. For the avoidance of doubt, default under a Service Order or other agreement by either party shall not be construed as, or give rise to, default under any other Service Order or other agreement.
Exhibit A
SERVICE LEVELS AND SERVICE CREDITS
Unless as otherwise agreed in a Service Order, this SLA applies at the system level for each individual GPU System made available to Customer. Supplier commits to maintain a Monthly Uptime Percentage (MUP) of ≥ 99.9% for each covered GPU System during a given calendar month, excluding Permitted Unavailability.
Definitions
a) Available / Availability: A GPU System is considered “Available” when:
(i) The system is able to be powered on
(ii) The system is booted into an operating system and reachable by SSH over the network
(iii) The system is able to run workload on all GPUs in the system
(iv) Each GPU within the system has interconnectivity to other GPUs within the same GPU System for interconnected systems
b) Downtime: The unavailability of a system based on the criteria above, excluding Permitted Unavailability.
c) Monthly Uptime Percentage (MUP): The total minutes in a calendar month minus minutes of Downtime, divided by the total minutes in the month on a per system basis.
RMA and Permitted Unavailability Exclusions
This SLA and any resulting Service Credits shall not apply to Downtime resulting from any of the following events (each, a “Permitted Unavailability”):
1. RMA and GPU Hardware Failures: Unavailability directly resulting from unhealthy hardware issues, component degradation, or isolated GPU failures that require Return Merchandise Authorization (RMA) or physical hardware replacement. This exclusion applies provided Supplier promptly replaces the failing components using its maintained onsite spares to mitigate the interruption.
2. Scheduled Maintenance: Hardware or software maintenance accompanied by at least 24 hours’ notice, not to exceed 48 hours per month.
3. Emergency Maintenance: Urgent maintenance not exceeding an aggregate of 4 hours per month.
4. Customer Actions: Acts or omissions of Customer, including requested shutdowns or suspensions caused by a breach of the Agreement.
5. Third-Party / Upstream Failures: Software/configuration issues within Customer-controlled operating systems, or network issues originating outside Supplier’s network.
Service Credit Schedule
If Supplier fails to meet the ≥ 99.9% MUP target for an individual GPU System in a given month, other than such failure caused by or as a result of Permitted Unavailability, Customer is eligible for a Service Credit for that GPU System equal to a percentage of the hours of GPUaaS Services, in excess of 0.1%, during which such individual GPU System is Unavailable.
The maximum aggregate number of Service Credits issued in a single billing month shall not exceed 25% of the amount of fees due for the affected system for that month.
Claim Procedure and Reporting
To claim a Service Credit, Customer must open a support ticket within 10 days of the applicable incident and specify the dates and times of Downtime, the affected region, the instance identifier, and the amount of credit requested. Eligible Service Credits will be applied to future use of the applicable Services within 60 days of being earned.
Sole Remedy
Service Credits shall be Customer’s sole and exclusive remedy with respect to any Supplier failure to achieve a Service Level.
Exhibit B
DATA SECURITY EXHIBIT
DESCRIPTION OF THE TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES IMPLEMENTED BY SUPPLIER.
A.BACKGROUND: This exhibit describing the technical and organizational security measures implemented by Supplier (as defined below) (the “Data Security Exhibit”) is subject to the terms and conditions of the Agreement. All terms and conditions in the Agreement shall apply to this Data Security Exhibit absent the express agreement of the Parties to the contrary in this Data Security Exhibit. Except as otherwise specified herein, terms used in this Data Security Exhibit shall have the same meaning as such terms have in the Agreement. For purposes of this Data Security Exhibit and subject to terms herein, any reference to “Supplier” shall be deemed to include Supplier’s affiliates and subsidiaries as applicable. Notwithstanding anything to the contrary in the Agreement, in the event of any conflict between the terms and conditions of the Agreement and the terms and conditions of this Data Security Exhibit, the terms and conditions of this Data Security Exhibit shall govern to the extent necessary to resolve the conflict.
DEFINITIONS: Capitalized terms used but not otherwise defined shall have the meanings ascribed to them in the Agreement.
“Data” means all information provided by or on behalf of Customer or created, collected or otherwise processed by Supplier or other Party for or on behalf of Customer that is stored in electronic format or media or otherwise handled or processed (i) at the premises of Supplier or Supplier’s subcontractors, including without limitation any cloud Environment (as defined below) operated by Supplier or Supplier’s subcontractors and/or (ii) on any Environment owned by Customer or any Environment (including without limitation any cloud Environment) owned and/or operated by another supplier or other third Party on behalf of Customer. Data includes but is not limited to (i) information about Customer’s business, products and other intellectual property (which may include Supplier’s deliverables provided pursuant to the Agreement), processes, facilities, employees, customers, and/or other suppliers or third parties and Personal Data (as defined in the Data Processing Agreement (“DPA”) located at https://dapple.co/legal/dpa/). For the avoidance of doubt, all Data is Customer Confidential Information.
“Environment” means an electronic information system that is used or may be used to store or otherwise handle Data.
B. PROCESSING AND HOSTING SERVICES:
This Section applies to the extent Supplier provides to Customer data processing and/or hosting services using a Supplier-owned or subcontracted Environment.
Supplier maintains the following security controls:
1. Supplier providing data processing will maintain and, upon Customer’s request, provide to Customer evidence, on behalf of itself and/or a Supplier’s Sub-processor (as defined in the DPA) who is providing data processing and/or hosting services, that each applicable Environment has received any of the following security audit certifications or reports within the twelve (12) months preceding the Effective Date:
| FOR PROCESSING SERVICES (IF APPLICABLE) | FOR HOSTING SERVICES (IF APPLICABLE) |
|---|---|
| System and Organizational Controls (SOC) 2 Type 2 report for all hosting/storage locations | |
| ISO 27001 certification. | Statement on Standards for Attestation Engagements (SSAE) No. 16 Type 2 report for all hosting locations within the U.S.A., or International Standard for Assurance Engagements (ISAE) No. 3402 for all storage locations outside the U.S.A. (collectively, the “SSAE/ISAE Certifications”). |
2. Each applicable third-party Environment shall receive updated certifications no less often than every twelve (12) months following the then-most recent certifications (including SSAE/ISAE Certifications for hosting services) except the audit cycle of the report is longer than twelve (12) months in which case the audit cycle period shall govern receipt of updated certifications for each applicable Environment.
3. Supplier shall provide Customer, via email, with evidence of such certifications (including SSAE/ISAE Certifications for hosting services) (i) initially, prior to the Effective Date, and in any event prior to Supplier’s storing or otherwise handling Data in any third-party Environments, and (ii) thereafter, upon request from Customer.
4. Supplier will notify Customer promptly upon expiration or revocation or if Supplier plans not to pursue re-certification of any provided certifications.
C. MINIMUM TECHNICAL AND SECURITY MEASURES TO BE IMPLEMENTED BY SUPPLIER:
To the extent Supplier is unable to provide the formal reports or certifications required under Section B of this Data Security Exhibit, after (i) taking in good faith all reasonable steps to do so and (ii) providing written notice to Customer, Supplier will at minimum provide the following evidence and implement the following technical and security measures:
1. Security measures: Supplier agrees to perform the following for the protection of Data in line with the then-current state of the art for such security measures:
a. Securing business facilities, data centers, paper files, servers, backup systems, and computing equipment, including, but not limited to, all mobile devices and other equipment with information storage capability.
b. Implementing network, application, database, and platform security.
c. Securing information transmission, storage, and disposal.
d. Implementing authentication and access controls within media, applications, operating systems, and equipment.
e. Encrypting Data when transmitting and/or storing using current industry-standard strong encryption, key management and related standards (e.g. AES256 / RSA2048 / SHA256 at the time of writing).
f. Strictly segregating (physically or virtually) Data from Supplier data or other data of customers of Supplier.
g. Conducting at a minimum annual risk assessment, annual penetration testing, and quarterly internal and external vulnerability scans. Supplier will also implement required remediation plans to correct any security issues that are reported to address critical issues within 30 days of finding.
h. Implementing appropriate personnel security and integrity procedures and practices, including, but not limited to, conducting background checks consistent with applicable law.
i. Providing appropriate privacy and information security training to Supplier’s employees.
2. Access Control - Supplier will control access to Data using the following methods:
a. Least privileged principle – only provide access to required individuals granting them the least privileges required to perform assigned tasks.
b. Users will be provided unique credentials to access data based on unique user identity or group membership. Users will not share credentials.
c. Access lists should be reviewed at least annually to ensure that access is still needed.
d. Implement and maintain termination process access to ensure immediate removal of access for an individual no longer employed or contracted with Supplier.
e. Logging of access of individuals.
3. Audit, assessment and certifications: Supplier will provide evidence of self-assessments or self-audits, as well as any scheduled certifications, assessments or audits of the hosting environment, network, infrastructure or platform used for the hosting or processing services. Customer will be provided evidence of these completed certifications, audits or assessments upon Customer’s request.
4. Data Transmission – Data will be encrypted when transmitting using current industry-standard strong encryption, key management and related standards (e.g. AES256 / RSA2048 / SHA256 at the time of writing).
5. Data Protection - Electronic or physical copies of Data should only be made as required to deliver services to Customer. All copies are to be protected at the same level of the original data. Data is not to be placed in non-production or testing environments unless one of the following conditions is met:
a. The data is desensitized or randomized prior to use.
b. The environment is secured to the same requirements as a production environment.
c. Customer approval is obtained for placing Data in a non-production or testing environment.
d. The use of the Data is not used for Supplier’s own purposes.
6. Removable Media – Data will only be placed on removable media that meet the following:
a. Encrypting Data when storing using current industry-standard strong encryption, key management and related standards (e.g. AES256 / RSA2048 / SHA256 at the time of writing).
b. Set to read only or write-protected when containing data.
7. Data Disposal - Supplier will use hardware and data disposal processes that are aligned with the National Institute of Standards and Technology Special Publication 800-88 (available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf).
D. BREACH, UNAUTHORIZED DISCLOSURE, INVESTIGATIONS AND EVIDENCE:
In the event of any confirmed breach of security leading to the accidental, unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Data transmitted, stored or otherwise processed (each, a “Data Breach”) on any Supplier-owned Environment or third-party Environment, or in the event Supplier detects a Data Breach on a Customer Environment while providing Services to Customer or otherwise performing Supplier’s obligations under this Agreement, Supplier shall, in addition to any obligation set out under the DPA, promptly notify Customer of such Data Breach via email and keep Customer informed of any related developments as they occur. In the event a Data Breach (a) occurs on a Supplier-owned Environment or third-party Environment, or (b) is otherwise associated with work performed for Customer by Supplier or Supplier’s subcontractor(s), Supplier will (y) work with Customer to mitigate any damages resulting from such Data Breach; and (z) promptly investigate each Data Breach and reasonably assist Customer, its affiliates and their respective agents in connection with any investigation that Customer may desire to conduct, including but not limited to providing log aggregation, correlation and access and any other evidence requested by Customer. Supplier will take reasonable steps as requested by Customer and agreed upon by Supplier (which agreement shall not be unreasonably withheld or unnecessarily delayed) to limit, stop or otherwise remedy any potential, actual or suspected Data Breach.
E. CONTINUITY, USER ACCESS AND DATA COMMINGLING:
1. Continuity. Supplier is not responsible for any loss, unwanted overwrite or destruction of Data. Customer is responsible for any disaster-recovery solution, if desired, that prevents any such loss, unwanted overwrite and destruction of the Data. In no event shall Supplier replicate Data for troubleshooting or any other reasons unless otherwise agreed to in writing by Customer (with email being an acceptable form of writing for purposes of this sentence).
2. User Access. Supplier will implement and maintain logical access controls designed to ensure that no users of any Supplier-owned Environment or third-party Environment (including, without limitation, other customers of Supplier) – other than employees of Supplier and/or any applicable subcontractor(s) authorized to handle Data can access Data in any Supplier-owned Environment or third-party Environment.
3. Data Commingling. Supplier will logically separate Data from the data of other Supplier customers using access controls, tenant isolation, and encryption consistent with Section C of this Data Security Exhibit. Supplier will not commingle Data with the data of other Supplier customers in any manner that permits another customer to access Data.