ISV Platform Terms

THESE ISV PLATFORM TERMS are dated the date on which the Customer accepts them in accordance with paragraph 2 (the "Agreement").

Between:

1 Bitlync, Inc., a Delaware registered corporation with offices located at c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713 ("Bitlync"), and

2 The independent software vendor identified in the ISV console account or in an Order Form which references these terms ("Customer"),

(each a "Party" and together, the "Parties").

Recitals

(A) Bitlync has developed and operates a hosted integration platform through which independent software vendors may integrate once against a canonical data model and receive scoped, revocable access to the business systems of managed service providers which have authorized such access.

(B) The Customer supplies a software product to managed service providers and wishes to use the Service so that its product may interoperate with those providers' systems.

(C) Bitlync has agreed to provide, and the Customer has agreed to take and pay for, the Service, subject to the terms and conditions of this Agreement.

AGREED TERMS

Interpretation:

1. The definitions and rules of interpretation in this paragraph apply in this Agreement.

Affiliate: means, in relation to a Party, any entity that directly or indirectly Controls, is Controlled by, or is under common Control with, that Party from time to time, where "Control" means the ownership of more than fifty percent (50%) of the voting securities of an entity or the power to direct its management and policies.

AI Assistant: means the optional assistant feature of the MSP Service which, where enabled for the MSP, answers questions from MSP Data on a read-only basis.

API: means Bitlync's REST application programming interface and MCP tool interface, as described in the Documentation.

API Key: means each key issued by Bitlync to the Customer for the purpose of authenticating to the API.

Applicable Laws: means all applicable laws, statutes, regulations and binding codes of practice from time to time in force which relate to the business of the applicable Party, including Data Protection Laws.

Audit Log: means the append-only record maintained by Bitlync of API calls touching a Connection, writes, logins, acceptances and Grant changes.

Business Day: means a day other than a Saturday, Sunday or public holiday on which banks are open for business in the State of Delaware.

Confidential Information: means all confidential information (however recorded or preserved) disclosed by a Party or its Representatives to the other Party or its Representatives in connection with this Agreement which is either labelled as such or should reasonably be considered as confidential because of its nature and the manner of its disclosure, including the non-public Documentation, pricing, roadmap and security information, API Keys, webhook secrets and MSP Data.

Connect: means the act of linking a Connected System to the MSP Service through the Connect Flow, and "Connected" shall be construed accordingly.

Connect Flow: means the process, hosted by Bitlync and which may be co-branded with an ISV's name and marks, by which an MSP authorizes an ISV's integration to access the MSP's Connected Systems (such as its professional services automation, remote monitoring and management and similar systems), enters any Credential required for a Connection, reviews and approves the permissions which the ISV requests, and may later change or revoke those permissions in the MSP Portal.

Connected MSP: means an MSP which has established a Connection through the MSP Service and has approved a live Grant in favor of the Customer. End customers of an MSP recorded within that MSP's Connected System are not Connected MSPs.

Connected System: means a professional services automation, remote monitoring and management, documentation, distribution or other business system operated for the MSP by a third party, which the MSP connects to the Service. Supported systems are listed in the Documentation.

Connection: means the link established between a Connected System and the MSP Service by means of a Credential.

Credential: means any API key, username, password, token, client identifier, client secret or similar secret which the MSP enters into the MSP Service for the purpose of establishing a Connection.

Customer Data: means data relating to the Customer's account, including the names and e-mail addresses of its personnel, API Keys, webhook configuration, requested permissions, company mappings and the Customer's use of the API.

Customer Content: means any data, including Personal Data, which the Customer submits to or transmits through the Service on its own initiative, including the content of writes committed through the API, webhook payloads, company mappings, support requests and any other content originated by the Customer or the Customer Product, but excluding Customer Data and MSP Data.

Customer Product: means the software product or service supplied by the Customer to MSPs which the Customer integrates with the Service.

Data Protection Laws: means all Applicable Laws relating to the processing of personal information, including (to the extent applicable) the California Consumer Privacy Act as amended, other United States state privacy laws, the EU General Data Protection Regulation 2016/679 and the UK General Data Protection Regulation.

Design Partner Plan: means the plan on which Bitlync provides the Service to each customer which enters into an Order Form during Bitlync's private beta or pre-launch period, before Bitlync announces the general availability of the Service. Unless an Order Form states otherwise, the Fees for the Design Partner Plan are: (a) nil for up to five (5) connected MSP Tenants; (b) a flat fee of US$1,500 per month for six (6) to fifty (50) connected MSP Tenants; and (c) US$30 per MSP Tenant per month, in addition to that flat fee, for each connected MSP Tenant above fifty (50). The Design Partner Plan is a pre-release offering, but the reduced liability cap in paragraph 8.1 applies only as stated in that paragraph and not merely because a customer is on the Design Partner Plan.

Documentation: means the developer documentation, OpenAPI specification, Connect checklist and concept guides published by Bitlync at docs.bitlync.com, as updated from time to time.

Fees: means the fees payable by the Customer for the Service as set out in the applicable Order Form or, in the absence of an Order Form, in Bitlync's then-current standard pricing notified to the Customer in writing.

Grant: means the scoped, revocable entitlement approved by an MSP under the MSP Terms which permits the Customer to access specified categories of MSP Data through a Connection on the terms of the applicable Permission Summary.

Initial Term: means the initial term of an Order Form as stated in that Order Form.

Intellectual Property Rights: means any and all intellectual property rights of any nature, whether registered, registerable or otherwise, including patents, utility models, trademarks, registered designs and domain names, applications for any of the foregoing, trade or business names, goodwill, copyright and rights in the nature of copyright, design rights, rights in databases, moral rights, know-how and any other intellectual property rights that subsist in computer software, computer programs, websites, documents, information, techniques, business methods, drawings, logos and data, in each case in any part of the world and whether or not registered, together with all applications, renewals and extensions.

ISV Analytics: means statistics made available by Bitlync solely to an ISV which holds a Grant, concerning that ISV’s commercial relationship with one or more MSPs which have each approved a Grant to that ISV, limited to: (a) seat, license, device or unit quantities; (b) charges and billing amounts; and (c) purchase, renewal and consumption trends over time, in each case derived solely from that ISV’s ISV-Supplied Data, containing no personal information, and identifying no MSP which has not approved a Grant to that ISV.

ISV-Supplied Data: means data which an ISV submits to the Service, including billing quantities, charges, findings and the other content of any write requested by that ISV, but excluding (a) MSP Data received by that ISV through a Grant and (b) Personal Data relating to the personnel or clients of any MSP.

MSP: means a managed service provider or other organization which uses the Customer Product and connects a Connected System to the Service.

MSP Data: means all data retrieved from a Connected System through a Connection (including tickets, companies, contacts, devices, agreements, time entries and installed applications), all data entered into the MSP Service by the MSP, and all data written to a Connected System through the MSP Service, but excluding Credentials and Usage Data.

MSP Portal: means the web console made available by Bitlync to the MSP for the management of Connections and Grants and the review of the Audit Log.

MSP Terms: means the Bitlync MSP Connect Terms accepted by each MSP in the Connect Flow, as amended from time to time in accordance with their terms.

MSP Service: means the Bitlync platform, comprising the Connect Flow, the Vault, the sync store, the MSP Portal, the Audit Log, connection health and incident features, the AI Assistant (where enabled) and the related documentation published at docs.bitlync.com.

Order Form: means an ordering document issued by Bitlync and accepted by the Customer in accordance with its terms which references this Agreement and sets out the Fees, Term and any negotiated exceptions.

Permission Summary: means the plain-language summary presented to the MSP in the MSP Service which identifies a proposed Grant and lists every permission requested by the ISV, showing for each permission whether it is a read or a write, whether it is enabled or disabled by default in accordance with the MSP Terms, and whether the ISV has marked it as Required.

Personal Data: means any information relating to an identified or identifiable natural person, and includes "personal data" and "personal information" as defined in Data Protection Laws.

Pre-Release Features: means the Service or any feature of it identified in the Documentation or an Order Form as beta, sandbox, design partner, staged, parked or pre-release.

Privacy Policy: means the Bitlync Privacy Policy published at https://www.bitlync.com/legal/privacy, as amended from time to time.

Renewal Term: means each successive period of the same length as the Initial Term commencing on the day immediately following the expiry of the Initial Term or the previous Renewal Term (as applicable).

Representatives: means a Party's employees, officers, representatives, advisers and subcontractors.

Sandbox: means the non-production environment and fixture tenants made available by Bitlync for testing, responses from which are marked sandbox: true.

Service: means the Bitlync platform as made available to independent software vendors, comprising the API, the ISV console, the co-branded Connect Flow, the Vault and Grant model, the sync store, write delivery, events and webhooks, the Sandbox and the Documentation.

Term: has the meaning given in paragraph 14.1.

Usage Data: means logs, metrics, telemetry and audit records generated by the operation of the Service, including the Audit Log.

Vault: means the credential store operated by Bitlync in which Credentials are held encrypted at rest.

1.2 Paragraph and Schedule headings shall not affect the interpretation of this Agreement. A reference to a company shall include any company, corporation or other body corporate, wherever and however incorporated or established. Unless the context otherwise requires, words in the singular shall include the plural and in the plural shall include the singular, and a reference to one gender shall include a reference to the other genders.

1.3 A reference to a statute or statutory provision is a reference to it as amended, extended or re-enacted from time to time and shall include all subordinate legislation made from time to time under that statute or statutory provision.

1.4 A reference to writing or written includes e-mail and any record made or accepted by electronic means, including a checkbox or button in the Service. Any phrase introduced by the words including, includes, in particular or for example, or any similar phrase, shall be construed as illustrative and shall not limit the generality of the related general words. References to paragraphs and Schedules are to the paragraphs and Schedules of this Agreement. A person includes a natural person, corporate or unincorporated body (whether or not having separate legal personality).

1.5 In the event of any conflict or inconsistency between this Agreement, an Order Form and the Documentation, the following order of precedence shall apply (in decreasing order) to the extent of such conflict or inconsistency: (a) the Order Form, in respect of the matters it expressly addresses; (b) this Agreement (including Schedule 1); and (c) the Documentation. Any terms and conditions contained in or referred to in any purchase order or other document issued by the Customer shall have no effect.

2. ACCEPTANCE AND FORMATION

2.1 This Agreement is accepted electronically. The Customer accepts this Agreement by: (a) checking the box on the Contact us form at www.bitlync.com, or on any subsequent screen in the Service at which Bitlync issues an API Key, which states that the Customer agrees to these ISV Platform Terms and the Privacy Policy; (b) accepting an Order Form which references this Agreement; or (c) generating or using an API Key, whichever occurs first. The form cannot be submitted, and no API Key shall be issued, unless the box has been checked. Bitlync shall record each acceptance.

2.2 The individual who accepts this Agreement represents and warrants that he or she is duly authorized to bind the Customer, and the Customer shall be bound accordingly.

2.3 No signature, countersignature or further formality is required for this Agreement or any Order Form to be binding. A record of acceptance made and stored by electronic means shall have the same legal effect, validity and enforceability as a manually executed signature to the fullest extent permitted by Applicable Laws.

3. PROVISION OF THE SERVICE

3.1 Subject to the Customer's compliance with this Agreement and payment of the Fees, Bitlync grants to the Customer a non-exclusive, non-transferable, non-sublicensable and revocable right during the Term to access and use the Service and the Documentation for the sole purpose of integrating the Customer Product with the Connected Systems of Connected MSPs and receiving and using MSP Data within the scope of the applicable Grants in order to provide the Customer Product to those MSPs.

3.2 The Customer's access to any Connected System shall be by means of a Grant only. The Customer shall not receive, and shall not request, solicit, infer, extract or attempt to obtain by any means, any Credential, whether through the Service or otherwise, and shall not require any MSP to disclose a Credential to the Customer as a condition of using an integration connected through the Service. Bitlync obtains Credentials only from the MSP through the Connect Flow; Bitlync does not promise never to request a Credential from an MSP for that purpose. Bitlync shall not infer, derive or reconstruct any Credential belonging to one MSP or tenant from any Credential belonging to another.

3.3 The Customer shall define in the ISV console the permissions requested by its integration (categorized as read or write for each permission) and shall confine such request to the minimum necessary for the Customer Product to function. The Customer may mark a permission as Required for its integration, in which case that permission will start enabled on the Permission Summary, but the MSP may nevertheless switch it off (subject to a warning that the Customer Product may not function correctly). Bitlync shall present the request to the MSP as a Permission Summary and shall test each permission before the Grant becomes live. The Customer shall design the Customer Product so that it operates correctly, or fails gracefully, where a Grant is partial, narrowed or revoked or where a requested permission is not enabled by the MSP.

3.4 The Customer shall give immediate effect to any narrowing or revocation of a Grant by an MSP and shall not access, or attempt to access, MSP Data outside the live scope of a Grant, whether by caching, replay, use of another tenant's Grant or otherwise. Following revocation, the Customer shall deal with MSP Data already in its possession in accordance with its agreement with the relevant MSP and Applicable Laws.

3.5 The Customer shall access data only in respect of Connected MSPs which have approved a Grant in its favor. Any attempt to enumerate, access or infer the existence of tenants which have not granted access to the Customer shall constitute a material breach of this Agreement which is not capable of remedy.

3.6 Bitlync shall host the Connect Flow for the Customer's MSP customers and may display the Customer's name and logo within it. Each Party grants to the other a non-exclusive, royalty-free license during the Term to use its name, logo and marks solely for the purposes of the co-branded Connect Flow and of accurately describing the integration, subject to any brand guidelines notified by the licensing Party. Neither Party shall use the other's marks in a manner which suggests endorsement beyond the integration. The Customer shall not state or imply that the vendor of any Connected System has certified or approved the Customer Product through Bitlync. Bitlync shall not display the Customer's name or logo on its public website without the Customer's prior written consent.

3.7 The Connected Systems, objects, reads, writes and event families supported by the Service are those listed in the Documentation from time to time. Certain capabilities are identified in the Documentation as sandbox-only, dry-run only, parked or in staged rollout, and certain operations are refused by policy. Bitlync does not warrant that any connector, write or event is or will become available in production, and the Customer acknowledges that the production posture of individual connectors may lag that of others.

3.8 The MSP alone decides which write permissions are enabled for the Customer's integration, either when it approves the Grant in the Connect Flow or later in the MSP Portal. Ordinary writes (creating and updating tickets, creating notes, closing tickets and creating time entries) are enabled by default. Billing quantity updates, where the Customer has enabled billing and the MSP has not opted out, are enabled by default, subject to any review the MSP sets, and are limited to updating the quantity on a billing record which the MSP has matched to the Customer. Closing a ticket with a resolution (close-with-resolution) is disabled by default, and the MSP may enable it. Updating companies and agreements, creating or updating contacts, projects and custom fields, and changes to devices and documentation, are disabled unless the MSP expressly enables them, and the MSP may enable any of them. The Service currently does not create companies or customers, agreements or contracts, or billing records in the MSP's professional services automation system. Any additional write types will be available only with the MSP's explicit authorization. The Customer may mark a permission as Required for its integration, in which case it starts enabled, but the MSP may still switch it off. Whatever any Grant or MSP setting says, the Service shall never delete records in a Connected System and shall never synchronize or disclose passwords, credentials or credential objects held in a Connected System.

3.9 Bitlync may modify the Service and the API from time to time. Bitlync shall use reasonable endeavors to give the Customer not less than sixty (60) days' written notice of any change which is incompatible with the published API contract, save where a shorter period is required for security or legal reasons, and may retire deprecated versions following the expiry of the notice period.

3.10 Bitlync may use AI services, through its sub-processors, to help the Customer configure the Service, including by reading publicly available content about the Customer and its products. The Customer shall review any configuration suggested in this way before relying on it.

4. FEES AND PAYMENT

4.1 The Customer shall pay the Fees in accordance with the applicable Order Form. Unless the Order Form provides otherwise, Fees shall be calculated monthly by reference to the number of Connected MSPs recorded in the ISV console at any time during the relevant month.

4.2 Bitlync shall invoice the Fees monthly in arrears (or in advance where the Order Form so provides) in United States dollars, and the Customer shall pay each invoice within thirty (30) days of the invoice date by card or bank transfer through Bitlync's payment processor.

4.3 All Fees are exclusive of sales, use, value added, goods and services, withholding and similar taxes, which the Customer shall pay in addition at the applicable rate, other than taxes on Bitlync's net income. Where the Customer is required by law to withhold any amount, the Customer shall gross up the payment so that Bitlync receives the full amount invoiced.

4.4 In the event that the Customer is in breach of its payment obligations, Bitlync shall provide written notice of such breach and ten (10) days' notice to remedy it. If the Customer fails to remedy the breach, Bitlync shall be entitled to suspend the Customer's API Keys or terminate this Agreement without prejudice to any pre-existing rights and obligations of either Party. Overdue amounts shall bear interest from the due date until payment at the lesser of one percent (1%) per month and the maximum rate permitted by Applicable Laws.

4.5 Free tenant allowances, extended free periods, pilots and service-for-service arrangements shall be binding on Bitlync only where recorded in an Order Form or in a written exception (including by e-mail) issued by an authorized representative of Bitlync, and shall not otherwise vary this Agreement.

4.6 Bitlync may increase its standard Fees upon not less than sixty (60) days' written notice, such increase to take effect from the commencement of the next Renewal Term. Fees fixed in an Order Form for a committed term shall not be increased during that term.

5. API USE AND TECHNICAL OBLIGATIONS

5.1 The Customer shall be responsible for all activity conducted under its API Keys and webhook secrets. The Customer shall store API Keys and webhook secrets securely, shall not embed them in client-side code or disclose them to any third party, and shall rotate them promptly upon any actual or suspected compromise. API Key access and human console sessions are separate, and the Customer shall not merge them.

5.2 The Customer's commercial API limit shall be the greater of six hundred (600) requests per minute and six hundred (600) requests per minute multiplied by the number of Connected MSPs, or such other limit as is stated in the Order Form. Requests in excess of that limit shall receive an HTTP 429 response with a Retry-After header, which the Customer shall honor. Bitlync separately paces its own calls to vendors' APIs and may throttle or defer live reads and writes in order to protect an MSP's shared vendor API budget; a throttled write shall be returned as a 429 response and not as a delayed success.

5.3 Where Bitlync serves a synced tenant record from its per-tenant sync store, that read shall include a staleness time (the time of last synchronization). Reference data may be read live where supported, and a live read shall be indicated as live. This is the rule and is not a fixed list of objects. The Customer shall surface data staleness to MSPs within the Customer Product where material and shall not represent store-served data as real-time.

5.4 The Customer shall use the preview (dry_run) then commit pattern for all writes, shall supply idempotency keys where supported, and shall handle partial multi-target outcomes and 501 unsupported responses explicitly. The Customer shall not attempt by any means to perform through the Service any operation which is refused by policy or which the MSP has not enabled for the applicable Grant, including the deletion of records and the synchronization or disclosure of any documentation password or credential object, and any write type which the Service does not currently perform as described in paragraph 3.8.

5.5 Where the Customer registers a webhook endpoint to receive deliveries from Bitlync, the Customer shall serve it over HTTPS, verify the Bitlync-Signature HMAC on every such delivery, keep the signing secret confidential and respond promptly. Bitlync shall sign the webhook payloads it sends to the Customer. This paragraph does not require Bitlync to authenticate inbound webhooks from Connected System vendors by HMAC where those vendors use a different authentication scheme (for example HTTP Basic). Bitlync may disable an endpoint which returns HTTP 410 or fails persistently.

5.6 Where the Customer accesses the Service through the MCP tool interface or connects it to any automated or artificial intelligence agent, the Customer shall remain fully responsible for the actions of that agent, which shall be subject to the same Grants, rate limits and Audit Log as any other API call.

5.7 The Sandbox contains seeded demonstration data only. The Customer shall not load any real MSP Data, personal information or production credentials into the Sandbox. Sandbox behavior may differ from production, may be reset or changed without notice, and is provided without any service level.

5.8 The Customer shall not: (a) resell, sublicense, rent or otherwise make the Service available to any third party other than as embedded in the Customer Product, operate the Service as a bureau for organizations which are not its MSP customers, or resell Bitlync as Bitlync; (b) use the Service, or any MSP Data received through it, to build, train or benchmark a competing credential vault, synchronization or integration platform, or use MSP Data for any purpose other than providing the Customer Product to the relevant MSP; (c) circumvent, probe or test rate limits, tenant isolation, authorization or audit controls; (d) conduct penetration testing of the Service without Bitlync's prior written consent; (e) copy, adapt, reverse engineer, decompile or disassemble the Service, save to the extent expressly permitted by Applicable Laws; or (f) use the Service in breach of Applicable Laws.

6. CUSTOMER'S RELATIONSHIP WITH MSPS

6.1 The Customer's agreement with each MSP shall govern the Customer Product, its pricing and support, and the Customer's use of MSP Data. Bitlync is not a party to any such agreement, is not a reseller of the Customer Product and makes no commitment to any MSP on the Customer's behalf.

6.2 Before any MSP enters a Credential, the Customer shall inform that MSP, in its onboarding materials and in the co-branded Connect Flow, that Bitlync will hold the MSP's credentials in the Vault and process the MSP's tenant data in order that the Customer Product may function, and that the MSP must accept the MSP Terms in the Connect Flow. The Customer shall connect only those MSPs which have accepted the MSP Terms.

6.3 The Customer shall own and be responsible for all messaging to MSPs concerning the Customer Product and its integration with the Service, including any integration-specific terms, notices and updates thereto, and shall ensure that such messaging is accurate and consistent with the Permission Summary and the Documentation. The Customer shall not state or imply that Bitlync holds any Credential on the Customer's behalf, that the Customer holds any MSP's Credential, or that Bitlync has verified or endorses the Customer Product.

6.4 Bitlync shall provide the consent, custody, visibility and audit layer, comprising the Connect Flow, the Permission Summary, the permission test, the Vault, the sync store and the Audit Log made visible to the MSP. Bitlync shall make the MSP Terms available to each MSP and shall not vary the consent model described therein in a manner which affects the Customer's Grants without notice to the Customer.

6.5 The Customer shall ensure that nothing in its agreement with any MSP purports to: (a) require the MSP to disclose a Credential to the Customer; (b) override or restrict the MSP's right to narrow or revoke a Grant; or (c) impose any obligation upon Bitlync.

6.6 The Customer shall provide first-line support to MSPs in respect of the Customer Product and its integration. Bitlync shall provide support to the Customer as described in the Order Form and shall publish connection health and incident information to MSPs. Bitlync's support personnel may read logs for the purpose of diagnosing an issue but shall not change an MSP's configuration or use the Vault to act as the MSP. Where an MSP revokes a Grant or requests Bitlync to cease, Bitlync shall cease serving that MSP's data to the Customer notwithstanding that the Customer's API Key remains active.

7. DATA PROTECTION AND SECURITY

7.1 MSP Data received by the Customer through a Grant is disclosed to the Customer at the direction of the relevant MSP. From the moment of receipt, the Customer shall be responsible for such MSP Data as an independent controller, processor or service provider (as applicable under its agreement with the MSP and Data Protection Laws) and not as a sub-processor of Bitlync. The Customer shall enter into such data processing terms with each MSP as Data Protection Laws require.

7.2 Bitlync shall process Customer Data as an independent controller (or, under US State Privacy Laws, as a business) for the purposes described in the Privacy Policy, and the Privacy Policy sets out the information required to be given to the Customer's personnel in respect of that processing. The Customer shall ensure that its personnel whose Personal Data is contained in Customer Data have been informed of that processing.

7.3 The Customer shall implement and maintain an information security program comprising administrative, technical and physical safeguards appropriate to the sensitivity of MSP Data, including encryption in transit and at rest, access controls, logging and vulnerability management. Upon Bitlync's reasonable written request, not more than once in any twelve (12) month period, the Customer shall provide a summary of its security program or a current third-party attestation (such as a SOC 2 Type II report or ISO/IEC 27001 certificate).

7.4 The Customer shall notify Bitlync without undue delay, and in any event within seventy-two (72) hours, after becoming aware of any unauthorized access to MSP Data received through the Service, any compromise of an API Key or webhook secret, or any attempt to obtain a Credential through the Customer's integration, and shall co-operate fully with Bitlync and the affected MSPs in responding thereto.

7.5 Bitlync shall maintain the safeguards described in the MSP Terms, including per-tenant AES-256-GCM encryption of Credentials, structural tenant isolation, read-only support access and the Audit Log, and shall notify the Customer without undue delay of any security incident affecting the Customer's API Keys or the Grants made in its favor. Bitlync's SOC 2 examination is in progress; Bitlync does not claim a completed SOC 2 report or any other certification unless and until it confirms the same in writing.

7.6 Bitlync shall record the Customer's API calls, writes and Grant changes in the Audit Log and shall make them visible to the relevant MSP. The Customer consents to such visibility and to Bitlync's use of Usage Data for the purposes of operating, securing and improving the Service, calculating the Fees and enforcing this Agreement.

7.7 Where the Customer or any MSP is located outside the United States, the Customer shall be responsible for ensuring that its receipt and onward processing of MSP Data complies with all applicable cross-border transfer requirements under Data Protection Laws.

7.8 To the extent that Bitlync processes Personal Data contained in Customer Content on behalf of the Customer, Bitlync shall do so as the Customer's processor or service provider, and Schedule 1 (Customer Content Processing Terms) shall apply to such processing. Schedule 1 does not apply to Customer Data (which is governed by paragraph 7.2) or to MSP Data (which is governed by paragraph 7.1 and the MSP Terms).

7.9 Bitlync may use the Customer’s ISV-Supplied Data to produce ISV Analytics and may make ISV Analytics available to the Customer. ISV Analytics are derived solely from the Customer’s ISV-Supplied Data, contain no personal information and identify no MSP which has not approved a Grant to the Customer.

7.10 The Service is not designed or intended for the receipt, storage, processing or transmission of protected health information (“PHI”) or for any use subject to the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations (“HIPAA”). Bitlync is not a business associate of the Customer, does not act in any HIPAA capacity, and does not offer, enter into or operate under any business associate agreement. The Customer shall not submit PHI to the Service or use the Service to process PHI, and the Customer shall be solely responsible for any PHI or HIPAA-regulated data it introduces to the Service in breach of this paragraph 7.10. Nothing in this Agreement, including Schedule 1, shall be construed as a commitment by Bitlync to comply with HIPAA.

8. PRE-RELEASE FEATURES AND DESIGN PARTNERS

8.1 The Customer acknowledges that Pre-Release Features may be incomplete, may change materially and may be withdrawn at any time. Pre-Release Features are provided without warranty or service level of any kind. Where the Customer has paid no Fees under this Agreement, or accesses or uses a Pre-Release Feature in the Sandbox or otherwise on a non-production, test, evaluation or free-of-charge basis, Bitlync’s total liability in respect of Pre-Release Features shall not exceed one hundred United States dollars (US$100). In all other cases, Bitlync’s liability in respect of Pre-Release Features shall be subject to the limits set out in paragraph 13.3.

8.2 Where the Customer is designated a design partner in an Order Form, the Customer shall participate in reasonable feedback sessions and shall permit Bitlync to refer to the Customer as a design partner, subject to the Customer's prior written approval of each public use of its name or logo.

8.3 The Customer hereby grants to Bitlync a perpetual, irrevocable, worldwide, royalty-free license to use and exploit any feedback, suggestions or ideas provided by the Customer in relation to the Service, without restriction or obligation to the Customer.

9. INTELLECTUAL PROPERTY RIGHTS

9.1 Bitlync and its licensors shall retain ownership of all Intellectual Property Rights in and to the Service, the canonical data model, the Documentation and Usage Data. The Customer shall retain ownership of all Intellectual Property Rights in and to the Customer Product and its marks. Save as expressly granted in this Agreement, neither Party acquires any right, title or interest in the Intellectual Property Rights of the other, whether by implication, estoppel or otherwise.

9.2 The Customer shall not use Bitlync's name or marks in any manner which implies that Bitlync built, verified or endorses the Customer Product.

9.3 As between the Parties, ISV-Supplied Data remains the Customer’s data, notwithstanding that a copy of it is written to a Connected System through the Service. The record so written to the Connected System is MSP Data.

10. CONFIDENTIALITY

10.1 Each Party agrees and undertakes that it will treat all Confidential Information disclosed to it by the other Party in connection with this Agreement as strictly confidential, shall use it solely for the purposes of this Agreement, and shall not, without the prior written consent of the other Party, publish or otherwise disclose to any third party any such Confidential Information. As applicable, each Party shall be referred to as the receiving Party or the disclosing Party.

10.2 To the extent necessary to perform this Agreement, each Party may disclose Confidential Information to its Representatives, in each case under the same conditions of confidentiality as set out in paragraph 10.1, and shall be responsible for any breach by its Representatives.

10.3 The obligations of confidentiality set out in this paragraph 10 shall not apply to any information which: (a) is in the public domain other than as a result of a breach of this Agreement; (b) was in the possession of the receiving Party prior to the date of receipt from the disclosing Party or was rightfully acquired by the receiving Party from sources other than the disclosing Party; (c) is required to be disclosed by law, or by a competent court, tribunal or regulatory or governmental body having jurisdiction over it, provided that the receiving Party gives the disclosing Party reasonable prior notice where lawful to do so; or (d) was independently developed by the receiving Party without use of or reference to the Confidential Information.

10.4 Upon termination of this Agreement, the receiving Party shall continue to maintain the confidentiality of the disclosing Party's Confidential Information and, upon request, shall return or (at the disclosing Party's election) destroy all materials containing such Confidential Information, save that the receiving Party may retain archival copies for legal, regulatory or compliance purposes and shall not be required to erase backup media made in accordance with its document-retention procedures. The obligations in this paragraph 10 shall survive termination for a period of three (3) years, and indefinitely in respect of API Keys, webhook secrets, MSP Data and trade secrets.

10.5 Each Party acknowledges that a breach of this paragraph 10 may cause the other Party irreparable harm for which damages would not be an adequate remedy, and that the non-breaching Party shall be entitled to seek injunctive or other equitable relief to restrain any actual or threatened breach, without prejudice to any other rights or remedies.

10.6 Nothing in this paragraph 10 shall prevent Bitlync from using the Customer’s ISV-Supplied Data to produce ISV Analytics, or from making ISV Analytics available to the Customer, in accordance with paragraphs 7.9 and 9.3. ISV Analytics are derived solely from the Customer’s ISV-Supplied Data, contain no personal information and do not identify any MSP which has not approved a Grant to the Customer.

11. WARRANTIES

11.1 Each Party warrants that it has full capacity and authority to enter into and perform this Agreement and that it shall comply with Applicable Laws in its performance of this Agreement.

11.2 The Customer warrants and represents that: (a) the Customer Product and the Customer's use of MSP Data comply and will comply with its agreements with MSPs and with Applicable Laws; (b) it has the right to submit Customer Data to Bitlync and to invite each MSP to establish a Connection; and (c) the Customer Product will not introduce any virus, malicious code or harmful component into the Service or any Connected System.

11.3 Bitlync warrants that during the Term the production Service will perform materially in accordance with the Documentation. The Customer's sole and exclusive remedy, and Bitlync's entire liability, for breach of this warranty shall be for Bitlync to use commercially reasonable endeavors to correct the non-conformity or, where Bitlync is unable to do so within a reasonable period, for either Party to terminate the affected Order Form, whereupon Bitlync shall refund any Fees paid in advance in respect of the period following termination.

11.4 EXCEPT AS EXPRESSLY AND SPECIFICALLY PROVIDED IN THIS AGREEMENT, THE SERVICE, THE SANDBOX, THE DOCUMENTATION AND ALL PRE-RELEASE FEATURES ARE PROVIDED "AS IS", AND ALL WARRANTIES, CONDITIONS AND OTHER TERMS IMPLIED BY STATUTE OR COMMON LAW, INCLUDING ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE OR NON-INFRINGEMENT, AND ANY WARRANTY AS TO THE ACCURACY OR TIMELINESS OF STORE-SERVED DATA, THE AVAILABILITY OF ANY CONNECTED SYSTEM OR VENDOR API, OR THE CONDUCT OF ANY MSP, ARE, TO THE FULLEST EXTENT PERMITTED BY LAW, EXCLUDED FROM THIS AGREEMENT.

12. INDEMNITIES

12.1 Customer Indemnification. The Customer shall defend and hold harmless Bitlync and its officers, directors, employees, Affiliates, stockholders, agents, successors and assigns (collectively, the "Bitlync Indemnitees") in and against all third-party actions and claims (including any claim by an MSP, an MSP's end customer, the vendor of a Connected System or a regulator), and indemnify the Bitlync Indemnitees from and against any and all losses, claims, damages, liabilities, expenses, reasonable attorneys' fees and court costs ("Losses") incurred by or imposed upon any Bitlync Indemnitee arising from such actions and claims and related to: (a) the Customer Product; (b) the Customer's use of MSP Data; (c) the Customer's breach of paragraph 3.2, 3.4, 3.5, 5.8, 6 or 7; (d) any instruction given by the Customer to Bitlync (including any write) which violates Applicable Laws; or (e) the Customer's partner messaging or integration terms.

12.2 Bitlync Indemnification. Subject to paragraph 13, Bitlync shall defend and hold harmless the Customer and its officers, directors, employees and Affiliates in and against any third-party action or claim alleging that the Service, as provided by Bitlync and used by the Customer in accordance with this Agreement and the Documentation, infringes a United States patent, copyright or trademark or misappropriates a trade secret, and indemnify the Customer from and against any Losses finally awarded by a court of competent jurisdiction or agreed in a settlement approved by Bitlync in respect of such claim. Bitlync shall have no obligation under this paragraph 12.2 in respect of any claim arising from the Customer Product, MSP Data, any combination of the Service with items not supplied by Bitlync, or any modification of the Service not made by Bitlync. If the Service becomes, or in Bitlync's reasonable opinion is likely to become, the subject of an infringement claim, Bitlync may at its option and expense procure the right for the Customer to continue using the Service, modify the Service so that it becomes non-infringing, or terminate the affected Order Form and refund any Fees paid in advance in respect of the period following termination. Notwithstanding paragraph 13.5(b), Bitlync’s total, cumulative liability under this paragraph 12.2 shall not exceed the greater of (i) three (3) times the amount calculated under paragraph 13.3 and (ii) one thousand United States dollars (US$1,000). This paragraph 12.2 states Bitlync's entire liability in respect of infringement of third-party Intellectual Property Rights.

12.3 Any indemnity set out in this Agreement shall not apply unless the Party claiming indemnification notifies the other in writing promptly of any matter in respect of which the indemnity may apply and gives the other Party full opportunity to control the response to and the defense of such claim, including the right to accept or reject settlement offers, provided that no settlement which imposes any liability or admission upon the indemnified Party shall be made without its prior written consent (not to be unreasonably withheld or delayed). The indemnified Party shall provide reasonable co-operation at the indemnifying Party's expense.

13. LIMITATION OF LIABILITY

13.1 This paragraph 13 sets out the entire financial liability of each Party (including any liability for the acts or omissions of its employees, agents and subcontractors) in respect of: (a) any breach of this Agreement; and (b) any representation, misrepresentation (whether innocent or negligent), statement or tortious act or omission (including negligence) arising under or in connection with this Agreement.

13.2 IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR ANY BUSINESS INTERRUPTION, LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF ANTICIPATED SAVINGS, LOSS OF GOODWILL OR REPUTATION, OR LOSS OR CORRUPTION OF DATA, HOWSOEVER CAUSED, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT AND WHETHER OR NOT THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

13.3 SUBJECT TO PARAGRAPHS 13.4, 13.5, AND 8.1, THE TOTAL, CUMULATIVE LIABILITY OF EITHER PARTY AND ITS AFFILIATES UNDER OR IN CONNECTION WITH THIS AGREEMENT AND ANY ORDER FORM, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE) OR OTHERWISE, SHALL BE LIMITED TO THE GREATER OF: (A) ONE HUNDRED PERCENT (100%) OF THE TOTAL FEES PAID OR PAYABLE BY THE CUSTOMER UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM; AND (B) ONE THOUSAND UNITED STATES DOLLARS (US$1,000).

13.4 IN RESPECT OF ANY BREACH BY EITHER PARTY OF PARAGRAPH 7 (DATA PROTECTION AND SECURITY) OR PARAGRAPH 10 (CONFIDENTIALITY) WHICH IS NOT OTHERWISE EXCLUDED FROM LIMITATION BY PARAGRAPH 13.5, THE TOTAL, CUMULATIVE LIABILITY OF THAT PARTY SHALL BE LIMITED TO THREE (3) TIMES THE AMOUNT CALCULATED UNDER PARAGRAPH 13.3.

13.5 THE LIMITATIONS OF LIABILITY SET FORTH IN THIS PARAGRAPH 13 ARE A MATERIAL PART OF THE BARGAIN AGREED BETWEEN THE PARTIES, AND EACH PARTY ACKNOWLEDGES THAT THE OTHER WOULD NOT BE WILLING TO ENTER INTO THIS AGREEMENT WITHOUT SUCH PROVISIONS. NOTWITHSTANDING THE FOREGOING, NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE: (A) THE CUSTOMER'S OBLIGATION TO PAY THE FEES AND OTHER SUMS PROPERLY DUE UNDER THIS AGREEMENT; (B) THE CUSTOMER'S INDEMNIFICATION OBLIGATIONS UNDER PARAGRAPH 12 (BITLYNC’S INDEMNIFICATION OBLIGATIONS UNDER PARAGRAPH 12.2 BEING SUBJECT TO THE CAP SET OUT IN THAT PARAGRAPH); (C) THE CUSTOMER'S LIABILITY FOR BREACH OF PARAGRAPH 3.2, 3.5 OR 5.8; (D) EITHER PARTY'S LIABILITY FOR ITS OWN FRAUD, GROSS NEGLIGENCE OR WILLFUL MISCONDUCT; OR (E) ANY LIABILITY THAT CANNOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAWS.

13.6 Each Party's liability to the other is reduced to the extent (if any) that the other Party causes or contributes to the relevant loss or fails to act reasonably to mitigate its loss.

14. TERM, SUSPENSION AND TERMINATION

14.1 This Agreement shall commence on the date of acceptance in accordance with paragraph 2 and shall continue for so long as any Order Form remains in effect or the Customer holds an active API Key (the "Term"), unless terminated earlier in accordance with this paragraph 14. Each Order Form shall continue for its Initial Term and shall thereafter renew automatically for successive Renewal Terms unless either Party gives written notice of non-renewal not less than thirty (30) days before the expiry of the then-current term.

14.2 In the event that either Party is in breach of its obligations under this Agreement (excluding payment obligations, which are governed by paragraph 4.4), the other Party shall provide written notice of such breach, specifying in detail the nature of the breach and providing fifteen (15) days' notice to remedy such breach if capable of remedy. If the breaching Party fails to remedy the breach within that period, the other Party shall be entitled to terminate this Agreement or the affected Order Form without prejudice to any pre-existing rights and obligations of either Party.

14.3 Either Party may terminate this Agreement immediately by written notice if the other Party becomes insolvent, makes an assignment for the benefit of creditors, has a receiver or trustee appointed over any of its assets, or is the subject of any bankruptcy, insolvency or analogous proceeding. Bitlync may terminate this Agreement immediately by written notice if the Customer breaches paragraph 3.2, 3.5 or 5.8.

14.4 Bitlync may suspend the Customer's API Keys, webhooks or any Grant with immediate effect where Bitlync reasonably considers suspension necessary to protect the security or integrity of the Service, a Connected System, an MSP or other customers, where an MSP or the vendor of a Connected System so requires, or for non-payment in accordance with paragraph 4.4. Bitlync shall notify the Customer of any suspension and shall restore access as soon as reasonably practicable after the reason for suspension has ceased.

14.5 Upon termination of this Agreement for any reason: (a) all Grants in favor of the Customer shall terminate and the Customer's API Keys shall be revoked; (b) the Customer shall immediately cease all use of the Service and of Bitlync's marks; (c) the Customer shall pay all Fees accrued to the date of termination; (d) Bitlync shall delete Customer Data within ninety (90) days, subject to the retention of the Audit Log and of encrypted backups in accordance with the Privacy Policy; and (e) MSP Data held by the Customer shall remain governed by its agreements with MSPs. Paragraphs 1, 3.2, 3.4, 4 (in respect of accrued amounts), 5.8, 6.1, 7, 8.3, 9, 10, 11.4, 12, 13, 14.5, 16 to 25 and Schedule 1 shall survive termination.

15. CHANGES TO THIS AGREEMENT

15.1 Bitlync may amend this Agreement by posting the amended version in the ISV console and at https://www.bitlync.com/legal/isv-terms and, in the case of a material amendment, giving the Customer not less than thirty (30) days' notice by e-mail. Amendments shall take effect at the commencement of the next Renewal Term or, where the Customer has no committed term, on the date stated in the notice. The Customer must accept each amendment in the same manner as described in paragraph 2, by checking a box or clicking a button in the Service or the ISV console which states that the Customer agrees to the amended terms, and no such acceptance shall be deemed to arise merely from the Customer’s continued use of the Service. Where an amendment materially and adversely affects the Customer, the Customer may terminate the affected Order Form by written notice given before the effective date, whereupon Bitlync shall refund any Fees paid in advance in respect of the period following termination. If the Customer does not accept an amendment by the effective date, Bitlync may suspend or terminate the Customer’s API Keys and access to the Service in accordance with paragraphs 14.4 and 14.5. Amendments required by Applicable Laws or to address a security risk may take effect immediately.

16. FORCE MAJEURE

16.1 Neither Party shall be liable to the other for any failure or delay in performing its obligations under this Agreement (other than an obligation to pay money) to the extent that such failure or delay is caused by events beyond its reasonable control, including acts of God, war, riot, civil commotion, terrorism, epidemic, fire, flood, storm, failure of public utilities or telecommunications networks, or the failure or unavailability of any Connected System or vendor API (a "Force Majeure Event"), provided that the affected Party notifies the other of the Force Majeure Event and its expected duration and uses all reasonable endeavors to mitigate its effects. If a Force Majeure Event continues for sixty (60) days or more, the Party not affected may terminate this Agreement by giving thirty (30) days' written notice to the other Party.

17. ANTI-BRIBERY AND ANTI-CORRUPTION

17.1 Each Party shall comply with all applicable laws, regulations and sanctions relating to anti-bribery and anti-corruption, including the U.S. Foreign Corrupt Practices Act, and shall promptly report to the other Party any request or demand for any undue financial or other advantage of any kind received by it in connection with the performance of this Agreement.

18. EXPORT CONTROL AND SANCTIONS

18.1 Each Party shall comply with all applicable export control and sanctions laws in connection with this Agreement. The Customer represents and warrants that it is not located in, organized under the laws of, or ordinarily resident in any country or territory that is the subject of comprehensive United States sanctions, and that neither it nor any of its owners is identified on any United States government restricted-party list.

19. WAIVER

19.1 No failure or delay by a Party to exercise any right or remedy provided under this Agreement or by law shall constitute a waiver of that or any other right or remedy, nor shall it preclude or restrict the further exercise of that or any other right or remedy. No single or partial exercise of such right or remedy shall preclude or restrict the further exercise of that or any other right or remedy.

20. SEVERABILITY

20.1 If any court or competent authority finds that any provision of this Agreement (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision shall, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this Agreement shall not be affected. If any invalid, unenforceable or illegal provision would be valid, enforceable and legal if some part of it were deleted, the Parties shall negotiate in good faith to amend such provision so that, as amended, it is legal, valid and enforceable and achieves the intended commercial result of the original provision.

21. ENTIRE AGREEMENT AND AMENDMENT

21.1 This Agreement, together with each Order Form, Schedule 1 and the Privacy Policy, constitutes the entire agreement between the Parties in respect of its subject matter and supersedes all prior agreements, representations and understandings between them, whether written or oral. Each Party acknowledges that in entering into this Agreement it has not relied on any statement, representation or warranty not expressly set out in this Agreement. Save as provided in paragraph 15, no amendment of this Agreement shall be effective unless it is in writing and accepted by both Parties.

22. ASSIGNMENT

22.1 Neither Party shall assign, transfer, novate or otherwise deal with any of its rights or obligations under this Agreement without the prior written consent of the other Party (not to be unreasonably withheld), save that either Party may assign or novate this Agreement to an Affiliate or to any successor in interest in connection with a merger, acquisition, reorganization or sale of all or substantially all of its assets or of the business to which this Agreement relates, upon written notice to the other Party.

23. NO PARTNERSHIP OR AGENCY; THIRD PARTY RIGHTS

23.1 Nothing in this Agreement is intended to, or shall be deemed to, establish any partnership or joint venture between the Parties, constitute either Party the agent of the other, or authorize either Party to make or enter into any commitments for or on behalf of the other.

23.2 Save that each MSP may enforce paragraphs 3.2, 3.4 and 3.5 in respect of its own Connection and Grant, no person who is not a Party to this Agreement shall have any right to enforce any of its terms.

24. NOTICES

24.1 All demands, notices and communications under this Agreement shall be in writing and shall be deemed to have been duly given if sent by e-mail or by overnight courier, addressed as follows (or to such other address as may hereafter be furnished by like notice): (a) if to Bitlync: Bitlync, Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, e-mail ryan@bitlync.com (or such other address as Bitlync publishes for legal notices), Attn: Legal; and (b) if to the Customer: the postal address stated in the Order Form and the administrator e-mail address registered on the Customer's ISV console account.

24.2 Any such notice shall be deemed to have been received: (a) if sent by e-mail, at the time of transmission (or, if sent outside normal business hours, when normal business hours next resume), provided that no delivery-failure notification is received; and (b) if sent by overnight courier, on the next Business Day after deposit with the courier.

25. GOVERNING LAW AND JURISDICTION

25.1 This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be exclusively governed by and construed in accordance with the law of the State of Delaware, without giving effect to any conflict of laws rules or principles that would require the application of the laws of another jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods shall not apply.

25.2 The Parties irrevocably agree that the state and federal courts located in the State of Delaware (including, where applicable, the Court of Chancery) shall have exclusive jurisdiction to settle any dispute or claim that arises out of or in connection with this Agreement or its subject matter or formation (including non-contractual disputes or claims), save that either Party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its Intellectual Property Rights or Confidential Information.

25.3 To the fullest extent permitted by Applicable Laws, each Party agrees that any claim shall be brought only in its individual capacity and not as a plaintiff or class member in any purported class, collective or representative proceeding.

SCHEDULE 1

CUSTOMER CONTENT PROCESSING TERMS

This Schedule forms part of the Agreement and applies to the extent that Bitlync processes Personal Data contained in Customer Content on behalf of the Customer. Capitalized terms not defined in this Schedule have the meanings given in the Agreement.

1. ROLES OF THE PARTIES

1.1 The Parties acknowledge that Personal Data is processed under the Agreement in three distinct capacities, as follows:

1.2 Where the Customer acts as a processor for its own customer in respect of Customer Content, the Customer warrants that its instructions to Bitlync are authorized by the relevant controller and that this Schedule is consistent with the Customer's obligations to that controller.

2. DESCRIPTION OF PROCESSING

2.1 The subject matter of the processing is the receipt, validation, delivery and logging of Customer Content in the course of providing the Service. The duration is the Term and the deletion period in paragraph 9 of this Schedule. The nature and purpose is the delivery of writes and other Customer Content to Connected Systems within the scope of the applicable Grant, the operation of webhooks and company mapping, the provision of support, and the maintenance of the Audit Log. The categories of data subjects are personnel of the Customer, of MSPs and of MSPs' clients whose Personal Data is contained in Customer Content. The types of Personal Data are names, business contact details, user identifiers and the contents of tickets, notes, time entries and similar records. No special categories of Personal Data are intended to be processed, and the Customer shall not submit any.

3. PROCESSING ON INSTRUCTIONS

3.1 Bitlync shall process Personal Data contained in Customer Content only on the documented instructions of the Customer, which are the Agreement, this Schedule and each API call, webhook registration, mapping or support request submitted by the Customer through the Service, save where Bitlync is required to process such Personal Data by Applicable Laws, in which case Bitlync shall inform the Customer of that legal requirement before processing unless the law prohibits such information on important grounds of public interest.

3.2 Bitlync shall immediately inform the Customer if, in Bitlync's opinion, an instruction infringes Data Protection Laws, and may suspend performance of that instruction until the Customer confirms or modifies it. For the avoidance of doubt, an instruction to write to a Connected System outside the scope of the applicable Grant is not a valid instruction and shall be refused.

4. SERVICE PROVIDER TERMS (US STATE PRIVACY LAWS)

4.1 To the extent that US State Privacy Laws apply to Customer Content, Bitlync is a service provider or processor to the Customer, and Bitlync shall not: (a) sell or share such Personal Data; (b) retain, use or disclose such Personal Data for any purpose (including any commercial purpose) other than the business purposes specified in the Agreement and this Schedule, or as otherwise permitted by US State Privacy Laws; (c) retain, use or disclose such Personal Data outside the direct business relationship between Bitlync and the Customer; or (d) combine such Personal Data with Personal Data received from or on behalf of any other person, save as permitted by US State Privacy Laws. Bitlync certifies that it understands and shall comply with these restrictions, shall notify the Customer if it determines that it can no longer meet them, and shall permit the Customer to take reasonable and appropriate steps to stop and remediate any unauthorized use. "US State Privacy Laws" means the California Consumer Privacy Act as amended and all other comprehensive state consumer privacy laws of the United States in force from time to time.

4.2 The delivery of Customer Content to a Connected System within the scope of a Grant is a disclosure made at the direction of the Customer and the MSP and does not constitute a sale or share by Bitlync.

5. CONFIDENTIALITY, SECURITY AND PERSONNEL

5.1 Bitlync shall ensure that all persons authorized by it to process Personal Data contained in Customer Content are bound by written obligations of confidentiality or are under an appropriate statutory obligation of confidentiality.

5.2 Bitlync shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, being as a minimum the measures described in paragraph 7.5 of the Agreement and in the Bitlync Security Overview published at https://www.bitlync.com/legal/security, as updated from time to time, provided that such updates do not materially reduce the overall level of security.

6. SUB-PROCESSORS

6.1 The Customer grants Bitlync general written authorization to engage sub-processors in accordance with this paragraph 6. The sub-processors engaged at the date of the Agreement are those listed in the Bitlync Sub-processor List published at https://www.bitlync.com/legal/subprocessors. Bitlync shall give the Customer not less than thirty (30) days' prior notice of the addition or replacement of any sub-processor by updating that list and notifying the administrator e-mail address registered on the Customer's ISV console account. The Customer may object on reasonable grounds relating to data protection by written notice within that period, and if the Parties are unable to resolve the objection in good faith within thirty (30) days the Customer may terminate the affected Order Form by written notice without penalty.

6.2 Bitlync shall enter into a written agreement with each sub-processor imposing data protection obligations no less protective than those in this Schedule, to the extent applicable to the services provided by that sub-processor, and shall remain fully liable to the Customer for the performance of each sub-processor's obligations. For the avoidance of doubt, MSPs and their Connected Systems are not sub-processors of Bitlync.

7. DATA SUBJECT REQUESTS AND ASSISTANCE

7.1 Bitlync shall, taking into account the nature of the processing, assist the Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests by data subjects to exercise their rights under Data Protection Laws. If Bitlync receives such a request relating to Customer Content, Bitlync shall not respond except to acknowledge receipt and to refer the individual to the Customer, and shall notify the Customer within five (5) Business Days.

7.2 Bitlync shall provide reasonable assistance to the Customer with any data protection impact assessment and prior consultation with a supervisory authority which the Customer is required to carry out under Data Protection Laws in relation to the processing of Customer Content, taking into account the nature of the processing and the information available to Bitlync.

8. PERSONAL DATA BREACH

8.1 Bitlync shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data contained in Customer Content, and shall provide the information and co-operation described in paragraph 7.5 of the Agreement. Bitlync shall not notify any supervisory authority or data subject on the Customer's behalf without the Customer's prior written consent unless required by Applicable Laws.

9. DELETION AND RETURN

9.1 Customer Content is transient in nature: once delivered to a Connected System it is held in that system under the MSP's control, and Bitlync retains only the Audit Log record of the delivery. Bitlync shall delete any Customer Content remaining in its systems within ninety (90) days after the earlier of (a) the end of the Connection or Grant through which it was submitted and (b) termination of the Agreement, subject to the retention of the Audit Log in accordance with the Privacy Policy, and copies held in encrypted backups shall be overwritten in the ordinary course of backup rotation, unless Applicable Laws require its retention, in which case Bitlync shall isolate and protect it from further processing.

10. AUDIT

10.1 Bitlync shall make available to the Customer all information reasonably necessary to demonstrate compliance with this Schedule, including the Audit Log relating to the Customer's API calls, the Security Overview and (when available) Bitlync's SOC 2 report or other third-party attestation, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer, provided that the Customer shall first rely on the information so provided and may conduct an audit only where that information is insufficient, not more than once in any twelve (12) month period (save where required by a supervisory authority or following a Personal Data breach), on not less than thirty (30) days' written notice, during normal business hours, without unreasonable disruption to Bitlync's business, subject to reasonable confidentiality obligations and at the Customer's own cost.

11. INTERNATIONAL TRANSFERS

11.1 Where the Customer transfers Personal Data contained in Customer Content to Bitlync from the European Economic Area, the United Kingdom or Switzerland, the standard contractual clauses adopted by the European Commission by Implementing Decision (EU) 2021/914 (Module Two or Module Three, as applicable), the UK International Data Transfer Addendum and the Swiss modifications shall apply, completed in the manner set out in Schedule 3 to the Bitlync MSP Data Processing Addendum published at https://www.bitlync.com/legal/dpa, with the Customer as data exporter and Bitlync as data importer and with this Schedule serving as the description of processing and the technical and organizational measures. The Parties agree that by accepting the Agreement they are deemed to have executed those clauses.

12. LIABILITY

12.1 Each Party's liability arising out of or in connection with this Schedule, including under the standard contractual clauses referred to in paragraph 11, shall be subject to the exclusions and limitations of liability set out in paragraph 13 of the Agreement, save that nothing in this paragraph shall limit either Party's liability to data subjects under Clause 12 of those clauses or any liability which cannot be limited under Data Protection Laws.