THESE GENERAL TERMS AND CONDITIONS DO NOT FORM AN AGREEMENT BETWEEN KBS ANALYTICS LLC AND CUSTOMER WITHOUT A SIGNED ORDER FORM AND CERTAIN OTHER DOCUMENTS DESCRIBED IN SECTION 1.1. KLARIVIS GENERAL TERMS AND CONDITIONS 1. 1. GRANT OF RIGHTS. 1.1 Agreement. These KlariVis General Terms and Conditions (the "General Terms") apply to KlariVis and all services and products related to KlariVis provided by KBS Analytics and referenced in the applicable order form or statement of work identifying the specific products or services purchased ("Order Form") executed by the customer signing such Order Form ("Customer") and KBS Analytics LLC ("KBS Analytics"). No access to KlariVis (or any associated services or products) shall be provided to Customer without its first entering into an Order Form with KBS Analytics referencing and incorporating by reference these General Terms. The Order Form, these General Terms, any Exhibits to the General Terms (or an Order Form), and any SOW (as defined below) are hereby referred to collectively as the "Agreement". The various documents comprising the Agreement are meant to be read in harmony, but in case of conflict or disagreement among the various documents, the following order of precedence shall apply: (a) first, the Data Processing Amendment attached as Exhibit A (to the extent applicable to this Agreement in accordance with Section 8.2); (b) second, the Order Form; (c) third, any SOW; (d) fourth, any other Exhibit; and (e) fifth, these General Terms. Certain capitalized terms used in these General Terms have the meanings given to them in Section 16. 1.2 Access and Use. Subject to the terms and conditions of this Agreement, KBS Analytics hereby grants Customer during the Term, a limited, nonexclusive, non-transferrable (except in compliance with Section 15.5), non-sublicensable right to access KlariVis during the Term solely for Customer’s internal business purposes to (a) permit Authorized Users to access and use KlariVis in accordance with the Documentation, and (b) reproduce and provide to Authorized Users the Documentation solely in connection with Authorized Users’ access and use of KlariVis. Authorized Users may access and use KlariVis and Documentation only in accordance with the terms and conditions of this Agreement. KlariVis may be accessed and used only by Authorized Users through access credentials provided by KBS Analytics and only in connection with processing and using Customer Data as set forth in an Order Form (collectively, the "Access Right"). 1.3 Customer Data. Customer grants to KBS Analytics a perpetual, non-exclusive right and license to reproduce, distribute, transmit, display, reformat, modify, create derivative works of, and otherwise use any (a) Customer Data in order to perform KBS Analytics’ obligations under this Agreement and (b) metadata in order to improve KBS Analytics’ products and services. Customer shall obtain, at its sole expense, all consents, rights, licenses, permissions and clearances required under applicable laws for KBS Analytics to use the Customer Data for the purposes contemplated by this Agreement. Customer represents and warrants to KBS Analytics that: (i) Customer has all rights in Customer Data necessary to grant the license to KBS Analytics set forth in this Section 1.3; and (ii) none of Customer Data or Customer’s or any Authorized Users’ use of Customer Data in connection with KlariVis will violate (1) any agreement, contract or commitment of Customer, or (2) the intellectual property rights or other rights of any third party. 1.4 Anonymized Data. In addition to Section 1.3, Customer hereby grants to KBS Analytics a worldwide, royalty-free, irrevocable, non-exclusive license to anonymize, aggregate, and create the Anonymized Data. Customer hereby unconditionally and irrevocably grants to KBS Analytics an assignment of all right, title, and interest in and to the Anonymized Data, including all intellectual property rights relating thereto. 1.5 Third-Party Materials. KBS Analytics may from time to time make Third-Party Materials available to Customer or use services within Third-Party Materials to provide KlariVis. Customer acknowledges that such Third-Party Materials are subject to their own terms and conditions. 2. AVAILABILITY, CONTROL & SERVICE MANAGEMENT. 2.1 Availability. KBS Analytics will use commercially reasonable efforts to make KlariVis accessible and capable of operation between the hours of 8AM to 8PM Eastern Time Monday through Friday during the Term excluding any Scheduled Downtime (as defined in Section 2.5), force majeure events, and bank holidays. 2.2 Service and System Control. Except as otherwise expressly provided in this Agreement, as between the Parties: (a) KBS Analytics has and will retain sole control over the operation, provision, maintenance, and management of KlariVis and the KBS Analytics Materials; and (b) Customer has and will retain sole control over the operation, maintenance, and management of, and all access to and use of, the Customer Systems, and sole responsibility for all access to and use of the KBS Analytics Materials by any person or entity by or through the Customer Systems or any other means controlled by Customer or any Authorized User, including any: (i) information, instructions, or materials provided by any of them to KlariVis or KBS Analytics; (ii) results obtained from any use of KlariVis or KBS Analytics Materials; and (iii) conclusions, decisions, or actions based on such use. KBS Analytics reserves the right, from time to time, to modify, add to, or replace the KBS Analytics System and will provide Customer notice of any modifications during the Term that will have a material effect on Customer’s use of KlariVis. 2.3 Service Management. Customer shall, throughout the Term, maintain within its organization a single point of contact to: (a) serve as its primary contact for day-to-day communications, consultation, consents, approvals, and decision-making regarding KlariVis; (b) assist KBS Analytics with administrative, user and role assignment as well as ongoing support needs; and (c) ensure that Customer has provided to KBS Analytics all Customer Data necessary for use of KlariVis. Customer shall ensure its primary contact has the requisite organizational authority, skill, experience, and other qualifications to perform in such capacity. 2.4 Updates; Changes. KlariVis will be maintained, tested, and undergo regular development and improvements, and KBS Analytics anticipates that it will test, demonstrate and create modifications, enhancements, new releases and other updates for KlariVis (each an "Update") during the Term. If such Updates are provided to or purchased by Customer, such Updates will be deemed to be part of KlariVis and shall be subject to the terms and conditions of this Agreement. KBS Analytics reserves the right, in its sole discretion, to make any changes to KlariVis and KBS Analytics Materials that it deems necessary or useful to: (a) maintain or enhance: (i) the quality or delivery of KBS Analytics’ services (including KlariVis) to its customers; (ii) the competitive strength of or market for KlariVis and KBS Analytics’ services; or (iii) KlariVis' cost efficiency or performance; or (b) comply with applicable law. 2.5 Scheduled Downtime. KBS Analytics will use commercially reasonable efforts to: (a) schedule downtime for routine maintenance of KlariVis after business hours on the weekend or between the hours of 11 PM and 5 AM Eastern Time between Monday and Friday; and (b) give Customer at least twenty-four (24) hours prior notice of all scheduled outages of KlariVis ("Scheduled Downtime"). 2.6 Suspension or Termination of KlariVis. In addition to any other remedies, KBS Analytics may suspend, terminate, or otherwise deny Customer's or any Authorized User's use of all or any part of KlariVis or KBS Analytics Materials, without incurring any resulting obligation or liability, if: (a) KBS Analytics receives a judicial or other governmental demand or order, subpoena, or law enforcement request that expressly or by reasonable implication requires KBS Analytics to do so; or (b) KBS Analytics believes, in its good faith and reasonable discretion, that: (i) Customer or any Authorized User has failed to comply with any material term of this Agreement, or has accessed or used KlariVis beyond the scope of the rights granted or for a purpose not authorized under this Agreement or in any manner that does not comply with any instruction or requirement of the Documentation; or (ii) Customer or any Authorized User is, has been, or is likely to be involved in any fraudulent, misleading, or unlawful activities; or (c) this Agreement expires or is terminated. 3. RESTRICTIONS. 3.1 KBS Analytics Restrictions. KBS Analytics agrees: (a) not to disclose, or make available or accessible, the Customer Data to any third party or other unauthorized person or entity, except as permitted under this Agreement; (b) not to access the Customer Data for any use other than as permitted hereunder; (c) to restrict use of the Customer Data only to authorized personnel, to take reasonable precautions to protect the Customer Data from unauthorized disclosure, and to abide by all applicable laws; (d) to anonymize the NPI to produce the Anonymized Data; (e) to notify Customer promptly if it learns of any unauthorized use or breach of security of the KBS Analytics operating environment; and (f) to restrict the access to, and use of, NPI in the Customer Data provided by Customer only to authorized personnel within KBS Analytics’ organization. 3.2 By Customer. Customer shall not, and shall not permit any other person or entity to, access or use KlariVis or KBS Analytics Materials except as expressly permitted by this Agreement and, in the case of Third-Party Materials, the applicable third-party license agreement. For purposes of clarity and without limiting the generality of the foregoing, Customer shall not, except as this Agreement expressly permits: (a) copy, modify, or create derivative works or improvements of KBS Analytics Materials; (b) rent, lease, lend, sell, sublicense, assign, distribute, publish, transfer, or otherwise make available any KBS Analytics Materials; (c) reverse engineer, disassemble, decompile, decode, adapt, or otherwise attempt to derive or gain access to the source code of any KBS Analytics Materials; (d) bypass or breach any security device or protection used by KlariVis; (e) input, upload, transmit, or otherwise provide to or through KlariVis or KBS Analytics Systems, any information or materials that are unlawful or injurious, or contain, transmit, or activate any harmful code; (f) access or use KBS Analytics Materials in any manner or for any purpose that infringes, misappropriates, or otherwise violates any third-party intellectual property right or applicable law; (g) access or use KBS Analytics Materials for purposes of competitive analysis of KBS Analytics Materials, the development, provision, or use of a competing software service or product or any other purpose that is to KBS Analytics’ detriment or commercial disadvantage; or (h) otherwise access or use KBS Analytics Materials beyond the scope of the authorization granted under this Agreement. 4. PARTY OBLIGATIONS. 4.1 Customer Systems and Cooperation. Customer shall at all times during the Term: (a) set up, maintain, and operate in good repair and in accordance with the Documentation all Customer Systems on or through which KlariVis is accessed or used; (b) provide all cooperation and assistance as KBS Analytics may reasonably need to provide KlariVis including providing KBS Analytics personnel with such access to Customer's premises (for Training purposes only) and Customer Systems as is necessary for KBS Analytics (through its subcontractors and affiliates) to provide KlariVis in accordance with the Documentation; (c) ensure that Customer’s and its Authorized User’s use of KlariVis and all Customer Data is at all times compliant with Customer’s privacy policies and all applicable local, state, federal and international law, regulations and conventions; (d) provide the KBS Analytics implementation team a virtual private network tunnel and access to all relevant Customer Systems; (e) create a dedicated folder on Customer’s network for storage of all KBS Analytics implementation reports, which may be issued from time to time; (f) work with the KBS Analytics implementation team on validation tasks as assigned by KBS Analytics; and (g) provide Feedback to the KBS Analytics implementation team. KBS Analytics is not responsible or liable for any delay or failure of performance caused in whole or in part by Customer's delay in performing, or failure to perform, any of its obligations under this Agreement (each, a "Customer Failure"). 4.2 KBS Analytics Obligations. KBS Analytics shall: (a) provide a project implementation plan and non-binding timeline within three (3) days after the Kick-Off Date; (b) designate a data implementation specialist who will work with Customer’s primary point of contact to implement KlariVis; (c) hold scheduled calls with Customer’s implementation team once implementation has begun; (d) write all reports needed for implementation or when necessary provide Customer with the fields required to produce necessary reports for implementation; (e) work with Customer’s IT department to manage the automated transfer of files and reports; and (f) deliver the platform with a unique .url and end user access credentials for Customer’s end users. 5. SUPPORT & TRAINING. 5.1 Technical Support; Training. KBS Analytics agrees to provide the technical and administrative support package for KlariVis during the Term that is selected by Customer and included in an Order Form. Such support will be provided between the hours of 8 AM and 6 PM Eastern Time, excluding weekends and holidays; provided, however, that this shall only extend to the functionality of KlariVis and does not substitute KBS Analytics for Customer’s internal IT capabilities. KBS Analytics will use commercially reasonable efforts to resolve basic issues relating to KlariVis including usage, how-to questions and quality problems. Collectively, this Section 5.1 constitutes "Technical Support," which Customer acknowledges and agrees may be provided by subcontractors, affiliates, and/or vendors of KBS Analytics. KBS Analytics will also provide the training package selected by Customer and identified in an Order Form ("Training"). 5.2 Additional Training & Support. Additional Training or Technical Support requested by Customer exceeding the amounts provided in the Order Form shall, in the case of Training, be agreed upon in advance by the Parties and provided at KBS Analytics’ then standard fees for similar services and products, and in the case of Technical Support, be invoiced at KBS Analytics’ then standard fees in arrears for payment pursuant to the terms and conditions of this Agreement. 6. PROFESSIONAL SERVICES. During the Term, Customer may request KBS Analytics to provide certain professional services, which may include provision of certain deliverables, and other services, in each case in connection with KlariVis (collectively, the "Professional Services"). The scope of Professional Services will be specified in one or more statements of work ("SOW") executed by the Parties. When executed by the Parties, each SOW shall form a part of this Agreement and be subject to the terms and conditions set forth herein. Each SOW will describe (a) the Professional Services to be performed and any related deliverables, documentation or other material to be provided by KBS Analytics, and (b) the anticipated delivery date(s) and Fees for the Professional Services. 7. TERM AND TERMINATION. 7.1 Term. This Agreement shall continue from the date of execution of the Order Form (the "Effective Date") through the end of the term identified on the Order Form (the "Term") unless earlier terminated pursuant to this Agreement's express provisions. 7.2 Termination for Cause. Either Party shall have the right to terminate this Agreement if the other Party commits a material breach of this Agreement and any such breach remains uncured thirty (30) days after written notice thereof. Either Party may terminate this Agreement, effective immediately upon written notice to the other Party, if the other Party: (a) becomes insolvent or is generally unable to pay, or fails to pay, its debts as they become due; (b) files or has filed against it, a petition for voluntary or involuntary bankruptcy or otherwise becomes subject, voluntarily or involuntarily, to any proceeding under any domestic or foreign bankruptcy or insolvency law; (c) makes or seeks to make a general assignment for the benefit of its creditors; or (d) applies for or has appointed a receiver, trustee, custodian, or similar agent appointed by order of any court of competent jurisdiction to take charge of or sell any material portion of its property or business. 7.3 Termination for Convenience. Customer may terminate this Agreement for convenience upon thirty (30) days’ written notice to KBS Analytics; provided, however, that if Customer terminates under this Section, no Fees shall be refunded and all Fees for the remainder of the Term remain due and owing. 7.4 Effect of Termination. Upon termination or expiration of this Agreement: (a) all rights, licenses, consents, and authorizations granted by either Party to the other hereunder will immediately terminate; (b) KBS Analytics shall immediately cease all use of any Customer Data or Customer's Confidential Information and (i) within thirty (30) days return to Customer, or at Customer's written request destroy, all documents and tangible materials to the extent containing, reflecting, incorporating, or based on Customer Data or Customer's Confidential Information; and (ii) within fourteen (14) days of KBS Analytics’ delivery or destruction required in Section 7.4(b)(1), permanently erase all Customer Data and Customer's Confidential Information from all KBS Analytics Systems and certify the same in writing; provided, however, that KBS Analytics' obligations under this Section do not apply to any Anonymized Data; (c) Customer shall immediately cease all use of KlariVis and KBS Analytics Materials and (i) within thirty (30) days return to KBS Analytics, or at KBS Analytics' written request destroy, all documents and tangible materials to the extent containing, reflecting, incorporating, or based on any KBS Analytics Materials or KBS Analytics' Confidential Information and (ii) certify the same in writing; (d) KBS Analytics may disable all Customer and Authorized User access to the KBS Analytics Materials; (e) if Customer terminates this Agreement for cause, Customer will be relieved of any obligation to pay any Fees attributable to the period after the effective date of such termination and KBS Analytics will refund to Customer Fees paid in advance for Services or products that KBS Analytics has not performed as of the effective date of termination; (f) if KBS Analytics terminates this Agreement for cause, all Fees that would have become payable had the Agreement remained in effect until expiration of the Term will become immediately due and payable, and Customer shall pay such Fees, together with all previously-accrued but not yet paid Fees, on receipt of KBS Analytics’ invoice therefor; and 7.5 Surviving Terms. The provisions set forth in the following sections, and any other right or obligation of the Parties in this Agreement that, by its nature, should survive termination or expiration of this Agreement, will survive any expiration or termination of this Agreement: Sections 7.4, 7.5, 9, 10, 11, 12, 13, 14, and 15. 8. SECURITY. 8.1 Security. KBS Analytics shall employ reasonable administrative, physical and technical safeguards to prevent access and disclosure of Customer Data in breach of this Agreement. KBS Analytics will, during the Term, maintain and comply with a commercially reasonable data breach plan and shall implement the procedures requires under such plan on the occurrence of a data breach (as defined in that plan). KBS Analytics may use contractors and consultants in performance of its obligations under this Agreement. 8.2 Data Security for EU clients of Customer. The Parties agree that the provisions of the Data Processing Agreement ("DPA") attached as Exhibit A shall apply to the extent that Customer’s use of KlariVis or any Services provided by KBS Analytics under this Agreement involve the Processing of Personal Data (as defined in the DPA) relating to the provision of KlariVis or Services to individuals in the EEA or the United Kingdom, in which case the DPA shall be incorporated in its entirety into the terms of this Agreement. For the sake of clarity, the DPA shall only apply if Customer supplies information related to any customers or clients that are EEA or United Kingdom residents or are otherwise protected by the General Data Protection Regulation (as implemented in the applicable countries). 8.3 Data Backup; Disclaimer. Subject to the terms and conditions herein, KlariVis may elect to retain and store Customer Data during the Term for any period of time it deems necessary to provide KlariVis. KBS Analytics shall maintain, throughout the Term, a commercially reasonable business continuity/disaster recovery plan and implement such plan in the event of any unplanned interruption of KlariVis. KBS Analytics shall actively test, review, and update such plan on at least an annual basis. KBS Analytics shall provide Customer with the results of such tests within thirty (30) days of completion of the tests. However, Customer acknowledges and agrees that KlariVis does not replace the need for Customer to maintain regular data backups or redundant data archives. 9. FEES AND PAYMENT. 9.1 Fees. Customer shall pay KBS Analytics the fees charged for KlariVis access and implementation pursuant to an Order Form ("Access Fees" and "Implementation Fees," respectively), Overage Fees (as defined below), and any other agreed-upon fees set forth in an Order Form and this Section ("Fees") in accordance with this Section. After the initial implementation of KlariVis, any additional implementation that may be required to accommodate subsequent changes, additions, or Updates to the Customer System not due to KlariVis or KBS Analytics (and outside of a Customer’s standard Technical Support package) will be charged on a time and materials basis at KBS Analytics’ then-standard hourly rates. Customer shall reimburse KBS Analytics for pre-approved out-of-pocket expenses incurred by KBS Analytics in connection with providing KlariVis ("Reimbursable Expenses"). 9.2 Overages. KlariVis is hosted and built on Microsoft Azure and Microsoft Power BI, fees for which are charged on a usage basis to KBS Analytics for each of its customers ("Platform Charges"). Fees are calculated by and based on, in part, the projected actual usage of the underlying platform and Platform Charges associated therewith for a customer in a given asset and offering tier. KBS Analytics will pay for Platform Charges up to the amount listed in the Order Form (the "Usage Fees") with no additional cost to Customer per contract year. If Customer’s use exceeds 100% of this projected capacity, KBS Analytics will invoice Customer monthly, in arrears, for any such overages at then-current Platform Charges plus 5% of those costs for additional infrastructure and engineering support required to be provided by KBS Analytics to accommodate increased usage (the "Overage Fees"). 9.3 Fee Increases. KBS Analytics may increase Fees no more than once annually for any contract year after the first contract year of the Term by providing written notice to Customer at least sixty (60) calendar days prior to the commencement of that contract year and this Agreement will be deemed amended accordingly. 9.4 Asset-Based Fee Increases. Customer acknowledges that the Fees charged pursuant to this Agreement are calculated based on Customer asset size as reflected in the table below and the offerings Customer makes to its customers as of the Effective Date, which include, but may not be limited to commercial and retail banking, insurance, wealth management, mortgage, or similar ancillary products and services identified in the Order Form (collectively "Offerings"). Notwithstanding anything in the Agreement to the contrary, if, at any time during the Term, Customer’s asset size exceeds its then-current asset size tier for any reason, including, without limitation, growth or acquisition (or if Customer adds a line of business that adds to its Offerings), Customer shall notify KBS Analytics promptly of the increase in asset size or addition to its Offerings, and: (a) if the increase was due to a merger or acquisition, the Access Fee will automatically increase (on the date of closing of such merger or acquisition) to the amount KBS Analytics charges similarly situated Customers in Customer’s new asset tier or with similar Offerings; or, (b) if the increase was due to growth other than through a merger or acquisition, the Access Fee increase will be based on the asset size in the calendar quarter immediately prior to Customer’s next annual payment due date. For any increase pursuant to Section 9.4(a), Customer shall pay, within thirty (30) days of notice from KBS Analytics, the difference between the Access Fee and the new tier or rate on a prorated basis from the effective date on which Customer’s asset size increase to a higher tier or the new Offering was added. Under either Section 9.4(a) or Section 9.4(b), the Customer will pay fees associated with the new tier going forward, as applicable.  Asset Size $50 million to less than $500 million $500 million to less than $1 billion $1 billion to less than $3 billion $3 billion to less than $5 billion $5 billion and greater 9.5 Taxes. All Fees and other amounts payable by Customer under this Agreement are exclusive of taxes and similar assessments. Without limiting the foregoing, Customer is responsible for all sales, use, and excise taxes, and any other similar taxes, duties, and charges of any kind imposed by any federal, state, or local governmental or regulatory authority on any amounts payable by Customer hereunder, other than any taxes imposed on KBS Analytics’ income. 9.6 Payment. Customer shall pay all Fees and Reimbursable Expenses on or prior to the due date set forth in the Order Form (if prepaid), or in the case of Reimbursable Expenses or amounts billed in arrears (or if not stated in the Order Form) within thirty (30) days after the date of the invoice therefor. Customer shall make all payments hereunder via ACH transfer to an account number to be provided by KBS Analytics. Failure to make payments when due under this Agreement constitutes a material breach of this Agreement. 9.7 Late Payment. If Customer fails to make any payment when due then, in addition to all other remedies that may be available (including those under Section 7.2): (a) KBS Analytics may charge interest on the past due amount at the rate of 1.5% per month calculated daily and compounded monthly or, if lower, the highest rate permitted under applicable law; (b) Customer shall reimburse KBS Analytics for all reasonable costs incurred by KBS Analytics in collecting any late payments or interest, including attorneys' fees, court costs, and collection agency fees; and (c) if such failure continues for thirty (30) days following written notice thereof, KBS Analytics may suspend performance of KlariVis until all past due amounts and interest thereon have been paid, without incurring any obligation or liability to Customer or any other person or entity by reason of such suspension. 9.8 No Deductions or Setoffs. All amounts payable to KBS Analytics under this Agreement shall be paid by Customer in full without any setoff, recoupment, counterclaim, deduction, debit, or withholding for any reason (other than any deduction or withholding of tax as may be required by applicable law). 10. CONFIDENTIALITY. 10.1 Definitions. From time to time during the Term, either Party may disclose or make available to the other Party information about its business affairs, products, confidential intellectual property, trade secrets, third-party confidential information, and other sensitive or proprietary information, whether orally or in written, electronic, or other form or media, whether or not marked, designated or otherwise identified as "confidential" (collectively, "Confidential Information"). Confidential Information does not include information that is: (a) in the public domain at the time of disclosure or subsequently falls into the public domain through no fault of the receiving Party; (b) known to the receiving Party at the time of disclosure; (c) rightfully obtained by the receiving Party on a non-confidential basis from a third party without confidentiality obligations to the other Party; (d) Anonymized Data; or (e) independently developed by the receiving Party. Without limiting the foregoing: all non-anonymized Customer Data is the Confidential Information of Customer and the financial terms and existence of this Agreement are the Confidential Information of each of the Parties. 10.2 Obligations. The receiving Party shall not disclose the disclosing Party's Confidential Information to any person or entity, except to the receiving Party's employees, agents, affiliates, or subcontractors who have a need to know the Confidential Information for the receiving Party to exercise its rights or perform its obligations hereunder. Notwithstanding the foregoing, each Party may disclose Confidential Information to the limited extent required (a) in order to comply with the order of a court or other governmental body, or as otherwise necessary to comply with applicable law, provided that the Party making the disclosure pursuant to the order or applicable law shall first (to the extent permitted by law) have given written notice to the other Party and, at the request and expense of the other Party, have made a reasonable effort to obtain a protective order; or (b) to establish a Party's rights under this Agreement, including to make required court filings. Except as otherwise provided herein, on the expiration or termination of the Agreement, the receiving Party shall promptly return to the disclosing Party all copies, whether in written, electronic, or other form or media, of the disclosing Party's Confidential Information, or destroy all such copies and certify in writing to the disclosing Party that such Confidential Information has been destroyed. Each Party's obligations of non-disclosure with regard to Confidential Information are effective as of the date of disclosure of such Confidential Information and will expire five (5) years from the termination or expiration of this Agreement; provided, however, with respect to any Confidential Information that constitutes NPI in the Customer Data that for any reason has not been destroyed by KBS Analytics, then such obligations of non-disclosure will survive the termination or expiration of this Agreement until it is destroyed and provided, further, that with respect to any Confidential Information of either Party that constitutes a trade secret under applicable law, such obligations of the other Party shall continue for as long as such item of Confidential Information constitutes a trade secret under applicable law. 11. INTELLECTUAL PROPERTY RIGHTS. 11.1 KBS Analytics Materials. As between Customer and KBS Analytics, all right, title, and interest in and to the KBS Analytics Materials, including all intellectual property rights therein, are and will remain with KBS Analytics. The applicable third-party providers own all right, title, and interest, including all intellectual property rights, in and to the Third-Party Materials. Customer has no right, license, or authorization with respect to any of the KBS Analytics Materials except as expressly set forth in Section 1.2 or the applicable third-party license, in each case subject to Section 3. 11.2 Feedback. If Customer or any of its employees or contractors sends or transmits any communications or materials to KBS Analytics by mail, email, telephone, or otherwise, suggesting or recommending changes to the KBS Analytics Materials, including without limitation, new features or functionality relating thereto, or any comments, questions, suggestions, or the like ("Feedback"), KBS Analytics is free to use such Feedback irrespective of any other obligation or limitation between the Parties governing such Feedback. Customer hereby assigns to KBS Analytics on Customer's behalf, and on behalf of its employees, contractors and/or agents, all right, title, and interest in, and KBS Analytics is free to use, without any attribution or compensation to any party, any ideas, know-how, concepts, techniques, or other intellectual property rights contained in the Feedback, for any purpose whatsoever, although KBS Analytics is not required to use any Feedback. 11.3 Customer Data. As between Customer and KBS Analytics, Customer is and will remain the sole and exclusive owner of all right, title, and interest in and to all Customer Data, including all intellectual property rights relating thereto, subject to the rights and permissions granted herein. 11.4 Trademark License. Subject to the terms and conditions of this Agreement and during the Term, Customer grants to KBS Analytics a non-exclusive, non-transferable (except in compliance with Section 15.5) license to use Customer’s trademarks, service marks and logos ("Trademarks") for the sole and limited purpose of use on the KBS Analytics website on a splash page identifying KBS Analytics’ customers, and in connection with its marketing efforts, provided, however, that such Trademarks shall be placed alongside other customer logos and/or trademarks and the Trademarks used shall be no larger and receive no more prominent placement than the logos or trademarks of such other customers. Such use shall be in accordance with Customer’s then-current trademark usage guidelines that Customer provides in writing to KBS Analytics. KBS Analytics acknowledges and agrees that Customer owns the Trademarks and that any and all goodwill derived from the use of the Trademarks pursuant to this Agreement inures solely to the benefit of Customer. Customer shall retain all rights to its Trademarks not expressly granted to KBS Analytics in this Agreement. 11.5 References. KBS Analytics may request from time to time that Customer act as a reference for public relations purposes, which shall be subject to Customer’s consent. 12. REPRESENTATIONS AND WARRANTIES. 12.1 Limited Warranty. KBS Analytics represents, warrants, and covenants to Customer that: (a) KlariVis is and will remain free of viruses and harmful code; (b) KlariVis shall perform substantially in accordance with the then-current applicable Documentation; and (c) KBS Analytics will provide Training and Services in a professional, workmanlike manner consistent with standard industry practices for similar services, using personnel with requisite skill, experience, and qualifications. As Customer’s exclusive remedy and KBS Analytics’ sole liability for breach of the warranty set forth in this Section 12.1, KBS Analytics shall use commercially reasonable efforts to correct the non-conforming portion of KlariVis or re-perform the Training or Services at no additional charge to Customer. If KBS Analytics is unable to correct such deficiencies after commercially reasonable efforts, KBS Analytics may, upon written notice to Customer, terminate this Agreement and refund to Customer any unused and prepaid Fees. 12.2 DISCLAIMER OF WARRANTIES. EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN SECTION 12.1, KLARIVIS AND ALL TRAINING, SERVICES, AND KBS ANALYTICS MATERIALS ARE PROVIDED "AS IS." KBS ANALYTICS SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ALL WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE. ALL THIRD-PARTY MATERIALS ARE PROVIDED "AS IS" WITHOUT ANY REPRESENTATION OR WARRANTY WHATSOEVER. 13. INDEMNIFICATION. 13.1 KBS Analytics Indemnification. KBS Analytics shall indemnify, defend, and hold harmless Customer from and against any and all losses, damages, liabilities, and costs (including reasonable attorneys’ fees) ("Losses") incurred by Customer resulting from any third-party claim, suit, action, or proceeding ("Third-Party Claim") based on allegations that unmodified KlariVis, or any use of KlariVis in accordance with this Agreement and the Documentation, infringes or misappropriates such third-party's U.S. patent or copyright, in each case provided that Customer promptly notifies KBS Analytics in writing of the claim, cooperates with KBS Analytics, and allows KBS Analytics sole authority to control the defense and settlement of such claim. If such a claim is made or appears possible, Customer agrees to permit KBS Analytics, at KBS Analytics' sole discretion, to (a) modify or replace KlariVis or the affected component or part to make it non-infringing, or (b) obtain the right for Customer to continue use. If KBS Analytics determines that neither of those alternatives is reasonably available, KBS Analytics may terminate this Agreement, in its entirety or with respect to the affected component or part, effective immediately on written notice to Customer and with a refund of Fees paid under this Agreement for any of the affected products Services that KBS Analytics has not yet rendered. THIS SECTION SETS FORTH CUSTOMER'S SOLE REMEDY AND KBS ANALYTICS’ SOLE LIABILITY AND OBLIGATION FOR ANY ACTUAL, THREATENED, OR ALLEGED CLAIMS THAT THE KBS ANALYTICS MATERIALS OR ANY SUBJECT MATTER OF THIS AGREEMENT VIOLATES, INFRINGES OR MISAPPROPRIATES ANY INTELLECTUAL PROPERTY RIGHTS OF ANY THIRD PARTY. 13.2 Exclusions. The foregoing obligation does not apply to the extent that the alleged infringement or misappropriation arises from: (a) Third-Party Materials or Customer Data; (b) access to or use of the KBS Analytics Materials in combination with any hardware, system, software, network, or other materials or service not approved or recommended by KBS Analytics; or (c) access to or use of the KBS Analytics Materials in a manner inconsistent with this Agreement or the Documentation. 13.3 Customer Indemnification. Customer shall indemnify, hold harmless, and, at KBS Analytics’ option, defend KBS Analytics from and against any Losses resulting from any Third-Party Claim based on: (a) Customer Data, including any processing of Customer Data by or on behalf of KBS Analytics in accordance with this Agreement; (b) Customer’s use of KlariVis in a manner not authorized or contemplated by this Agreement; or (c) Customer’s violation of any applicable laws; in each case provided that KBS Analytics promptly notifies Customer in writing of the claim, cooperates with Customer, and allows Customer sole authority to control the defense and settlement of such claim, provided that Customer shall obtain the consent of KBS Analytics to any settlement that imposes any liability or obligation on KBS Analytics. 14. LIMITATIONS OF LIABILITY. TO THE EXTENT ALLOWED BY APPLICABLE LAWS AND EXCEPT IN CONNECTION WITH PERFORMANCE OF EITHER PARTY’S INDEMNIFICATION OBLIGATIONS IN SECTION 13, IN NO EVENT WILL EITHER PARTY BE LIABLE UNDER OR IN CONNECTION WITH THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, AND OTHERWISE, FOR ANY: (a) CONSEQUENTIAL, INCIDENTAL, INDIRECT, EXEMPLARY, SPECIAL, ENHANCED, OR PUNITIVE DAMAGES; (b) INCREASED COSTS, DIMINUTION IN VALUE OR LOST BUSINESS, PRODUCTION, REVENUES, OR PROFITS; (c) LOSS OF GOODWILL OR REPUTATION; (d) USE, INABILITY TO USE, LOSS, INTERRUPTION, DELAY OR RECOVERY OF ANY DATA, OR BREACH OF DATA OR SYSTEM SECURITY; OR (e) COST OF REPLACEMENT GOODS OR SERVICES, IN EACH CASE REGARDLESS OF WHETHER THE PARTY WAS ADVISED OF THE POSSIBILITY OF SUCH LOSSES OR DAMAGES OR SUCH LOSSES OR DAMAGES WERE OTHERWISE FORESEEABLE, AND NOTWITHSTANDING THE FAILURE OF ANY AGREED OR OTHER REMEDY OF ITS ESSENTIAL PURPOSE. EXCEPT AS PROVIDED IN SECTION 13, IN NO EVENT WILL EITHER PARTY’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, AND OTHERWISE EXCEED THE TOTAL AMOUNTS PAID BY CUSTOMER TO KBS ANALYTICS UNDER THIS AGREEMENT. 15. MISCELLANEOUS. 15.1 Further Assurances. On a Party's reasonable request, the other Party shall, at the requesting Party's sole cost and expense, execute and deliver all such documents and instruments, and take all such further actions, as may be necessary to give full effect to this Agreement. 15.2 Relationship of the Parties. Nothing contained in this Agreement shall be deemed or construed as creating a joint venture, partnership, agency, employment or fiduciary relationship between the Parties. Neither Party nor its agents have any authority of any kind to bind the other Party in any respect whatsoever, and the relationship of the Parties is, and at all times shall continue to be, that of independent contractors. 15.3 Notices. Each Party shall deliver all notices, requests, consents, claims, demands, waivers, and other communications under this Agreement (each, a "Notice") in writing and addressed to the other Party at the addresses set forth on the Order Form (or to such other address that the receiving Party may designate from time to time in accordance with this Section). Each Party shall deliver all Notices by personal delivery, nationally recognized overnight courier (with all fees prepaid), or certified or registered mail (in each case, return receipt requested, postage prepaid). Except as otherwise provided in this Agreement, a Notice is effective only (a) upon receipt by the receiving Party and (b) if the Party giving the Notice has complied with the requirements of this Section. 15.4 Entire Agreement. This Agreement, including the Order Form, SOW, the Exhibits and any other documents incorporated herein by reference, constitutes the sole and entire agreement of the Parties with respect to the subject matter of this Agreement, and supersedes all prior and contemporaneous understandings, agreements, representations, and warranties, both written and oral, with respect to the subject matter of this Agreement. 15.5 Assignment. Neither Party may assign any of its rights or obligations hereunder, whether by operation of law or otherwise, without the prior written consent of the other Party (not to be unreasonably withheld). Notwithstanding the foregoing, either Party may assign this Agreement in its entirety, without consent of the other Party, to its affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets not involving a direct competitor of the other Party; provided, however, that the assigning Party shall provide notice to the non-assigning Party promptly, and if applicable, Section 9.4 shall apply. Subject to the foregoing, this Agreement shall bind and inure to the benefit of the Parties, their respective successors and permitted assigns. Any attempted assignment other than in accordance with this Section shall be null and void. 15.6 Force Majeure. Neither Party shall be liable for any failure to perform any of its obligations under this Agreement due to unforeseen circumstances or causes beyond the Party’s reasonable control, including acts of God, riot, embargoes, acts of governmental authorities, fire, earthquake, pandemics, epidemics, flood, acts of terror, computer attacks or malicious acts (such as attacks on or through the Internet, any Internet service provider, telecommunications or hosting facility) and accidents. 15.7 No Third-Party Beneficiaries. This Agreement is not intended to confer any benefit on any person or entity not a Party to this Agreement. 15.8 Amendment and Modification; Waiver. No amendment or modification of any provision of this Agreement shall be effective unless in writing and signed by a duly authorized signatory of KBS Analytics and Customer. The waiver by either Party of a breach of or a default under any provision of this Agreement, must be in writing and shall not be construed as a waiver of any subsequent breach of or default under the same or any other provision of this Agreement, nor shall any delay or omission on the part of either Party to exercise or avail itself of any right or remedy that it has or may have hereunder operate as a waiver of any right or remedy. 15.9 Severability. If any term or provision of this Agreement is invalid, illegal or unenforceable in any jurisdiction, such invalidity, illegality or unenforceability shall not affect any other term or provision of this Agreement or invalidate or render unenforceable such term or provision in any other jurisdiction. Upon a determination that any term or provision is invalid, illegal or unenforceable, the court may modify this Agreement to effect the original intent of the Parties as closely as possible in order that the transactions contemplated hereby be consummated as originally contemplated to the greatest extent possible. 15.10 Governing Law; Submission to Jurisdiction. This Agreement is governed by and construed in accordance with the internal laws of the Commonwealth of Virginia without giving effect to any choice or conflict of law provision or rule that would require or permit the application of the laws of any jurisdiction other than those of Virginia. Any claim or action arising out of or related to this Agreement or the licenses granted hereunder shall be instituted exclusively in the federal courts of the United States or the courts of the Commonwealth of Virginia in each case with jurisdiction over the city of Roanoke, Virginia, and each Party irrevocably submits to the exclusive jurisdiction of such courts in any such claim or action. Service of process, summons, notice, or other document by mail to such Party's address set forth on the Order Form (or to such other address as such Party may have designated in accordance with Section 15.3) shall be effective service of process for any claim or action brought in any such court. 15.11 Attorneys' Fees. In the event that any action, suit, or other legal or administrative proceeding is instituted or commenced by either Party against the other Party arising out of or related to this Agreement, the prevailing Party is entitled to recover its reasonable attorneys’ fees and court costs from the non-prevailing Party. 15.12 Counterparts. This Agreement may be executed in counterparts, each of which is deemed an original, but all of which together are deemed to be one and the same Agreement. A signed copy of this Agreement delivered by facsimile, email, or other means of electronic transmission is deemed to have the same legal effect as delivery of an original signed copy of this Agreement. 16. DEFINITIONS. "Anonymized Data" means Customer Data collected by KBS Analytics from Customer from which all NPI and Customer-identifying information has been anonymized to provide a generic aggregate database for KBS Analytics’ use in its future testing, development, improvement, sales, and marketing efforts. "Authorized Users" means Customer's employees, consultants, contractors, and agents (a) who are authorized by Customer to access and use KlariVis under the rights granted to Customer pursuant to this Agreement; and (b) for whom access to KlariVis has been purchased hereunder. "Customer Data" means proprietary data made available to KBS Analytics by Customer and licensed to KBS Analytics or otherwise uploaded, provided, or deposited by Customer into the KBS Analytics operating environment, which may include NPI. For the avoidance of doubt, Customer Data does not include Anonymized Data, or any other information reflecting the access or use of KlariVis by or on behalf of Customer or any Authorized User. "Customer Systems" means the Customer's information technology infrastructure, including computers, software, hardware, databases, electronic systems (including database management systems), and networks, whether operated directly by Customer or through the use of third-party service. "Documentation" means the KlariVis technical specification documentation generally made available by KBS Analytics to its customers with regard to KlariVis. "Go-Live Date" means the mutually agreed date on which KlariVis will be implemented and ready for use by Customer. "KBS Analytics Materials" means KlariVis, Documentation, and KBS Analytics Systems and any and all other information, data, documents, materials, works, and other content, devices, methods, processes, hardware, software, and other technologies and inventions, including any deliverables, technical or functional descriptions, requirements, plans, or reports, that are provided or used by KBS Analytics or any subcontractor in connection with KlariVis or otherwise comprise or relate to KlariVis or KBS Analytics Systems. For the avoidance of doubt, KBS Analytics Materials include Anonymized Data and any information, data, or other content derived from KBS Analytics' monitoring of Customer's access to or use of KlariVis, but do not include Customer Data. "KBS Analytics Systems" means the information technology infrastructure used by or on behalf of KBS Analytics in performing KlariVis, including all computers, software, hardware, databases, electronic systems (including database management systems), and networks, whether operated directly by KBS Analytics or through the use of third-party services. "Kick-Off Date" shall mean the date identified on the Order Form, on which the Parties meet in person or telephonically to identify a mutually agreeable project timeline and Go-Live Date. "KlariVis" means the business analytics software application provided by KBS Analytics to Customers into which Customer Data is uploaded and presented. KlariVis is offered in a software-as-a-service model. "NPI" means non-public personal information that personally identifies an individual customer of Customer, or such an individual customer’s identifiable financial information, and which is not otherwise available to the public that is stored in or accessible using a Customer System or is otherwise made available to KlariVis by Customer in connection with this Agreement. "Party" or "Parties" shall mean KBS Analytics and Customer individually and collectively, respectively. "Services" means the Technical Support and Professional Services, collectively. "Third-Party Materials" means materials, products, services, and information, in any form or medium, including any open-source or other software, software-based services, documents, data, content, specifications, products, equipment, or components of or relating to KlariVis that are not proprietary to KBS Analytics. EXHIBIT A DATA PROCESSING AGREEMENT 1. 1. INTRODUCTION. The Parties acknowledge and agree that this Data Processing Agreement ("DPA"): (a) forms part of the Agreement entered into between KBS Analytics and Customer and all documents, schedules and exhibits incorporated therein (the "Agreement"); (b) sets out: (i) the data protection terms that are required under the GDPR (defined below) in relation to the Processing of Personal Data that KBS Analytics undertakes as Processor; and (ii) all other terms governing the Parties’ Processing of Personal Data in connection with the Agreement; (c) applies solely to the extent that the use of KlariVis Services involve KBS Analytics processing Personal Data relating to the provision of KlariVis Services to Data Subjects in the EEA or the United Kingdom or to the monitoring of their behavior as far as such behavior takes place within the EEA or the United Kingdom; and (d) to the extent that Section 1.1(c) is satisfied, this DPA sets out the agreement of the Parties with respect to the processing of Personal Data in connection with the KlariVis Services in addition to the terms set out in the Agreement with respect to the use of Customer Data (as such term is defined in the Agreement). Unless expressly stated otherwise in this DPA, nothing in this DPA shall change either party’s exclusions and limitations of liability under the Agreement and all provisions relating to liability and indemnities set out in the remainder of the Agreement shall continue to apply notwithstanding this DPA coming into effect. For the avoidance of doubt, the existing provisions in the Agreement that relate to the use of Customer Data (as such term is defined in the Agreement) shall apply between the Parties to the extent that Section 1.1(c) above does not apply. 2. DEFINITIONS 2.1 Capitalized terms used but not defined herein shall have the meaning set out in the Agreement. The following terms have the following meanings when used in this DPA: "Controller" means the natural or legal person which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. "Data Protection Laws" means the GDPR and all other mandatory laws and regulations of the European Union, the European Economic Area and their member states and the United Kingdom applicable to the Parties’ Processing of Personal Data. "Data Subject" means the individual to whom Personal Data relates. "Data Subject Request" means a Data Subject's request to access, correct, amend, transfer or delete that person's Personal Data consistent with that person’s rights under Data Protection Laws. "EEA" means the European Economic Area. "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), as amended from time to time. "KlariVis Services" means all the services performed under the Agreement, including the provision of KlariVis. "Personal Data" means any information relating to an identified or identifiable natural person provided by or on behalf of Customer to KBS Analytics as part of KlariVis Services; an identifiable natural person, is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to the physical, physiological, mental, economic, cultural or social identity of that natural person. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data, transmitted, stored or otherwise Processed. "Processing, Processed or Process" means any operation or set of operations which is performed by either party as part of, or in connection with, KlariVis Services upon Personal Data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction. "Processor" has the meaning given in the GDPR. "Regulator" means any supervisory authority with authority under Data Protection Laws over the Processing of Personal Data. "Standard Contractual Clauses" means the agreement in the form annexed to the European Commission's decision of 5 February 2010 on Standard Contractual Clauses for the transfer of Personal Data to processors established in third countries. "Sub-processor" means a subcontractor engaged by KBS Analytics that will Process Personal Data as part of the performance of the KlariVis Services where KBS Analytics acts as a Processor. 3. RELATIONSHIP WITH THE AGREEMENT. Subject to Section 1.1(d), in the event of a conflict between the terms of the Agreement and the terms of this DPA with respect to the subject matter of the DPA, the terms of this DPA shall prevail. In the event of a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail. 4. PROCESSING OF PERSONAL DATA 4.1 Roles of the Parties. The Parties acknowledge and agree that KBS Analytics acts as a Processor with respect to Personal Data and Customer has engaged KBS Analytics to provide the KlariVis Services as detailed in the Agreement. 4.2 Customer's Processing of Personal Data – General Obligations. (a) In respect of the Parties’ Processing, Customer shall: (i) comply with Data Protection Laws and ensure that any instructions it issues to KBS Analytics shall comply with Data Protection Laws; and (ii) have sole responsibility for the accuracy, quality, and legality of Personal Data, and the means by which Customer acquired Personal Data and shall establish the legal basis for Processing under Data Protection Laws. (b) Customer warrants that: (i) the disclosure of Personal Data to KBS Analytics is limited to what is necessary for KBS Analytics to perform the KlariVis Services; and (ii) such Personal Data is accurate and up-to-date at the time that it is provided to KBS Analytics. (c) Customer shall: (i) collect Personal Data in a manner compliant with Data Protection Laws, including by providing all notices and obtaining all consents as may be required under Data Protection Laws in order for KBS Analytics to lawfully and fairly Process Personal Data in connection with the provision of the KlariVis Services and as otherwise contemplated by this DPA; and (ii) notify KBS Analytics upon becoming aware that Personal Data has become inaccurate or out of date. 4.3 KBS Analytics' Processing of Personal Data – General Obligations. (a) Where KBS Analytics Processes Personal Data as a Processor, it shall comply with the Data Protection Laws as they apply to KBS Analytics as a Processor and only Process Personal Data in accordance with Customer's instructions or as required by law. Customer instructs KBS Analytics to Process Personal Data to perform the KlariVis Services and as described in the DPA and the Agreement. (b) This DPA and the Agreement are Customer’s complete and final instructions to KBS Analytics for the Processing of Personal Data. KBS Analytics shall not be bound by additional or alternate instructions except where the Parties mutually agree in writing. (c) Without prejudice to Customer’s obligations under Section 4.2(a)(i) of the DPA, KBS Analytics shall inform Customer if, in its reasonable opinion, an instruction issued by Customer infringes Data Protection Laws and shall, without liability, be entitled to stop Processing Personal Data in accordance with such infringing instruction. 4.4 Purpose; Categories of Personal Data and Data Subjects. The purpose of Processing of Personal Data by KBS Analytics is the performance of the KlariVis Services pursuant to the Agreement. The types of Personal Data and categories of Data Subjects Processed by KBS Analytics, when acting as a Processor, under this DPA are further specified in Attachment 1 (Data Processing Details Addendum) to this DPA. 4.5 Limitation on Disclosure. KBS Analytics shall not disclose Personal Data to any third parties without Customer’s prior consent, except as required by law or permitted by the Agreement. Without limiting the generality of the foregoing, KBS Analytics may disclose Personal Data to Processors and Sub-processors engaged as described in Section 10 of the DPA. 4.6 Confidentiality. KBS Analytics shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data and are subject to binding confidentiality obligations. 5. DATA SUBJECT RIGHTS; OTHER COMPLAINTS AND REQUESTS 5.1 Data Subject Requests. If KBS Analytics receives a Data Subject Request: (a) KBS Analytics shall, to the extent permitted by law, promptly notify Customer upon receipt of a Data Subject Request. Following receipt of a Data Subject Request, KBS Analytics may contact the relevant Data Subject to acknowledge receipt of the Data Subject Request and to notify the Data Subject that it has referred the Data Subject Request to Customer, but KBS Analytics shall otherwise not respond to any Data Subject Request without Customer’s prior written instructions; (b) Customer shall handle the Data Subject Request in accordance with Data Protection Laws; and (c) KBS Analytics shall provide such commercially reasonable assistance as Customer may reasonably request to help Customer fulfil its obligations under Data Protection Laws to respond to Data Subject Requests. Customer shall be responsible for any reasonable costs arising from KBS Analytics’ provision of such assistance. 5.2 Other Complaints and Requests. KBS Analytics shall, to the extent permitted by law, promptly notify Customer upon receipt of any complaint or request (other than Data Subject Requests or enquiries of Regulators described in Section 6 of the DPA) relating to: (a) Customer’s obligations under Data Protection Laws; or (b) Personal Data. Unless otherwise agreed between the Parties, Customer shall handle the relevant request or complaint in accordance with Data Protection Laws. KBS Analytics shall provide such commercially reasonable assistance as Customer may reasonably request in relation to such complaint or request. Customer shall be responsible for any reasonable costs arising from KBS Analytics’ provision of such assistance. 6. COOPERATION WITH REGULATORS AND CONDUCT OF CLAIMS. KBS Analytics shall notify Customer of all enquiries from a Regulator that KBS Analytics receives which relate to the Processing of Personal Data, unless prohibited from doing so at law or by the Regulator. Customer shall: (a) be responsible for all communications or correspondence with the Regulator in relation to the Processing of Personal Data; and (b) keep KBS Analytics informed of such communications or correspondence to the extent permitted by law. 7. SECURITY. KBS Analytics shall take such technical and organisational measures as are necessary to ensure a level of security appropriate to the risk of Processing Personal Data in connection with the KlariVis Services to protect the confidentiality, integrity, availability and resilience of KBS Analytics systems which are involved in Processing Personal Data. Customer has assessed the level of security appropriate to the Processing in the context of its obligations under Data Protection Laws and agrees that KBS Analytics’ security measures are consistent with such assessment. 8. SECURITY BREACH MANAGEMENT AND NOTIFICATION 8.1 Breach Notification Procedure. KBS Analytics shall promptly notify Customer upon becoming aware of the occurrence of a Personal Data Breach and provide Customer with the following information as it becomes available: (a) a description of the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects concerned; (b) the name and contact details of the KBS Analytics contact from whom more information can be obtained; and (c) a description of the measures taken or proposed to be taken to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects. 8.2 Public Statements. The Parties agree to coordinate in good faith on developing the content of any related public statements and any required notices to the affected Data Subjects and/or the relevant Regulators in connection with a Personal Data Breach, provided, however, that nothing in this Section 8.2 shall prevent either party from complying with its obligations under Data Protection Laws. 9. RETURN AND DELETION OF CUSTOMER DATA. Subject to Section 13 of the DPA, on termination of the Agreement for any reason, or upon written request from Customer at any time, KBS Analytics shall cease Processing any Personal Data, and (at Customer's direction) return to Customer or delete, any Personal Data in KBS Analytics' possession or control, except as required by law or as required in order to defend any actual or possible legal claims. 10. SUB-PROCESSORS. Customer acknowledges and agrees that KBS Analytics may engage Sub-processors in connection with the provision of the KlariVis Services provided that it ensures that its contract with any Sub-processor imposes on the Sub-processor obligations that are equivalent to the obligations to which KBS Analytics is subject under this DPA. KBS Analytics shall be responsible and liable for the acts, omissions or defaults of its Sub-processors in the performance of obligations under this DPA or otherwise as if they were its own acts, omissions or defaults. 11. AUDITS AND REQUESTS FOR INFORMATION AND ASSISTANCE. Customer may audit KBS Analytics’ compliance with its obligations under this DPA, subject to the following requirements: (a) Customer may perform such audits once per year; (b) audits must be conducted during regular business hours and may not unreasonably interfere with KBS Analytics’ business activities; and (c) all audits are at Customer’s sole cost and expense. Any request for KBS Analytics audit assistance requiring the use of resources different from or in addition to those required for provision of the KlariVis Services will be considered an additional service for which reasonable additional fees may be charged. 12. TRANSFERS OUTSIDE OF THE EUROPEAN ECONOMIC AREA 12.1 Consent. Subject to the remainder of this Section 12, Customer consents to transfers of Personal Data to KBS Analytics based outside the EEA. 12.2 Applicable Legal Framework. Where Personal Data is transferred, either directly or via onward transfer, from the EEA to a recipient outside the EEA in a country not recognised by the European Commission as providing an adequate level of protection for Personal Data, such transfer shall be covered by a framework recognised by the relevant authorities or courts as providing an adequate level of protection for Personal Data, including Standard Contractual Clauses, ("Data Transfer Mechanism"). 12.3 Standard Clauses. The Parties agree: (a) to apply the Standard Contractual Clauses as the applicable Data Transfer Mechanism; (b) the Standard Contractual Clauses applicable to processors available at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&from=en shall be deemed to be incorporated into this DPA as the applicable Data Transfer Mechanism; and (c) to amend the Standard Contractual Clauses if required in accordance with a relevant European Commission decision or Data Protection Laws. 13. TERMINATION AND GENERAL 13.1 Termination. This DPA and the Standard Contractual Clauses will terminate when KBS Analytics ceases to Process Personal Data, unless otherwise agreed in writing between the Parties. 13.2 Liability. The Parties agree that all liabilities between them under this DPA and the Standard Contractual Clauses will be subject to the limitations and exclusions of liability and other terms of the Agreement, except that such limitations and exclusions of liability will not apply to any party’s liability to Data Subjects under the third-party beneficiary provisions of the Standard Contractual Clauses to the extent limitation of such rights is prohibited by Data Protection Laws. 13.3 Governing Law. To the extent required by applicable Data Protection Laws (e.g., in relation to the governing law of the Standard Contractual Clauses), this DPA shall be governed by the law of the applicable jurisdiction. In all other cases, this DPA shall be governed by the laws of the jurisdiction specified in the Agreement. ATTACHMENT 1 TO DPA DATA PROCESSING DETAILS ADDENDUM Controller Customer that Processes Personal Data for its own business purposes. Processor The Processor is KBS Analytics. Data subjects The Personal Data Processed may concern the following categories of Data Subjects: * Current, former and potential employees, agents, directors, officers, self-employed contractors of the Customer; or * Any individual with whom the Customer has a business relationship in the context of carrying out the purposes of its business. Categories of data The Personal Data Processed may concern the following categories of data: details such as a Data Subject’s name, date of birth, gender, address, email address, telephone number, employer name, employee ID, employment, marital status, bank details, social security number, and driver’s license number. Special categories of data (if appropriate) N/A Processing operations The Personal Data Processed will be subject to the following basic Processing activities: KBS Analytics, acting as a Processor, will Process the Personal Data to perform the KlariVis Services.