HSM AS A SERVICE SUBSCRIPTION AGREEMENT between MYHSM LIMITED and [●]   MYHSM HSM AS A SERVICE SUBSCRIPTION AGREEMENT This agreement (“Agreement”) is made on [●] 2020 (“Effective Date”) BETWEEN (1) MYHSM LIMITED, a company incorporated and registered in England and Wales with company number 08163344 whose registered office is at 3 Assembly Square, Britannia Quay, Cardiff Bay, Cardiff, CF10 4PL (“Supplier”) (2) [FULL COMPANY NAME], a company incorporated and registered in [●] with company number [●] whose registered office is at [●] (“Customer”), each, a “Party”, together, the “Parties”. BACKGROUND (A) Supplier is a provider of payment hardware security modules as-a-Service (“Service” as more particularly described below). (B) Customer wishes to use Supplier’s Service in its business operations. (C) Supplier has agreed to provide and Customer has agreed to subscribe to Supplier’s Service and to receive the Onboarding Services subject to the terms and conditions of this Agreement. AGREED TERMS 1. INTERPRETATION 1.1. The definitions in this clause apply in this Agreement. “Authorised Users” means those employees, agents and independent contractors of Customer who are authorised by Customer to use the Services and the Documentation, as further described in Clause 2.2. “Business Day” means a day other than a Saturday, Sunday or public holiday anywhere in the United Kingdom. “Change of Control” means the beneficial ownership of more than 50% of the issued share capital of a company or the legal power to direct or cause the direction of the general management of the company, and controls, controlled and the expression change of control shall be construed accordingly. “Confidential Information” means information that is proprietary or confidential and is either clearly labelled as such or identified as Confidential Information in Clause 9. “Customer Data” means the data inputted by Customer, Authorised Users, or Supplier on Customer’s behalf for the purpose of using the Services or facilitating Customer’s use of the Services. “Documentation” means the documents made available to Customer by Supplier which sets out a description of the Service and the HSM and the user instructions and manual for the Service. “Exit Assistance Services” means the services to be provided by the Supplier to the Customer pursuant to Clause 7 in order to facilitate the transfer of the Services to the Customer or a Replacement Supplier. “Fees” means the fees set out in the Proposal and this Agreement including, but not limited to, the Subscription Fees. “HSM” means a payment hardware security module used in the provision of the Service. “Initial Subscription Term” means the initial term of this Agreement, being twelve (12) months. “Normal Business Hours” means 9:00am to 5:00pm local United Kingdom time, each Business Day. “Onboarding Services” means the provision by Supplier to Customer of services to transition Customer’s encryption keys to the HSMs, and other related transitioning services, provided on or before the commencement of the Subscription, as detailed in the Proposal and the Documentation. “Portal” means the MYHSM web portal as made available at https://portal.myhsm.com or such other website address as may be notified to Customer from time to time. “Replacement Services” means any services which are identical or substantially similar to the Services and which the Customer receives in substitution for the Services following the termination or expiry of this Agreement, whether those services are provided by the Customer internally or by any Replacement Supplier. “Replacement Supplier” means any third-party supplier of Replacement Services appointed by the Customer from time to time. “Service” means Supplier’s HSM as-a-Service as described in the Documentation. “SLA” means Supplier’s service level agreement as attached hereto in Exhibit A. “Software” means the online software applications provided by Supplier as part of the Services. “Subscription” means the subscription to the Services purchased by Customer pursuant to Clause 6, which entitles the Customer’s software applications to access and use the Services and the Authorised Users to access and use the Portal in accordance with this Agreement. “Subscription Fees” means the monthly subscription fees payable by Customer to Supplier for the Subscriptions, as set out in quotation provided to Customer and dated [●] (“Proposal”). “Subscription Term” has the meaning given in Clause 12.1 (being the Initial Subscription Term together with any subsequent Renewal Periods). 2. SUBSCRIPTIONS 2.1. Subject to Customer purchasing the Subscriptions in accordance with Clause 6.1, the restrictions set out in this Clause 2 and the other terms and conditions of this Agreement, Supplier hereby agrees to provide the Service to Customer and hereby grants to Customer a non-exclusive, non-transferable right, without the right to grant sublicences, to use and to permit the Authorised Users to use the Documentation and the Portal during the Subscription Term solely for Customer’s internal business operations. 2.2. In relation to the Authorised Users, Customer undertakes that each Authorised User shall keep a secure password for his/ her use of the Services and Documentation and that each Authorised User shall keep his/ her password confidential. 2.3. Customer shall not and shall not permit any third party to: a) except as may be allowed by any applicable law that is incapable of exclusion by agreement between the Parties and except to the extent expressly permitted under this Agreement: i. attempt to copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, display, transmit, or distribute all or any portion of the Software and/or Documentation (as applicable) in any form or media or by any means; or ii. attempt to de-compile, reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Software; or b) access all or any part of the Service or the Documentation in order to build a product or service that competes with the Service or Documentation; c) license, sell, rent, lease, transfer, assign, distribute, display, disclose, or otherwise commercially exploit, or otherwise make the Service and/or the Documentation available to any third party except the Authorised Users, or d) attempt to obtain, or assist third parties in obtaining, access to the Services and/or the Documentation, other than as provided under this Clause 2. 2.4. Customer shall prevent any unauthorised access to, or use of, the Services and the Documentation and in the event of any such unauthorised access or use, promptly notify Supplier. 2.5. The rights provided under this Clause 2 are granted to Customer only and shall not be considered granted to any subsidiary or holding company of Customer. 3. SUPPLIER’S OBLIGATIONS 3.1. Supplier shall, during the Subscription Term, provide the Services and make available the Documentation to Customer on and subject to the terms of this Agreement. 3.2. Supplier shall use commercially reasonable endeavours to make the Services available 24 hours a day, seven days a week. 3.3. Supplier will, as part of the Services and at no additional cost to Customer, provide Customer with customer support services in accordance with the Documentation in effect at the time that the Services are provided. 3.4. Notwithstanding the foregoing and subject to the SLA, Supplier: a) does not warrant that Customer’s use of the Services will be uninterrupted or error-free; or that the Services, Documentation and/or the information obtained by Customer through the Services will meet Customer’s requirements; and b) is not responsible for any delays, delivery failures, or any other loss or damage resulting from the transfer of data over communications networks and facilities, including the internet, and Customer acknowledges that the Services may be subject to limitations, delays and other problems inherent in the use of such communications facilities. 3.5. This Agreement shall not prevent Supplier from entering into similar Agreements with third parties, or from independently developing, using, selling or licensing documentation, products and/or services which are similar to those provided under this Agreement. 3.6. Supplier warrants that it has and will maintain all necessary licences, consents, and permissions necessary for the performance of its obligations under this Agreement. 4. CUSTOMER DATA 4.1. Supplier shall, in providing the Services, comply with its Privacy Policy relating to the privacy and security of Customer Data available at www.myhsm.com or such other website address as may be notified to Customer from time to time, as such document may be amended from time to time by Supplier in its sole discretion. 4.2. Both parties will comply with all applicable requirements of the Data Protection Legislation. This Clause 4.2 is in addition to, and does not relieve, remove or replace, a party’s obligations or rights under the Data Protection Legislation. 5. CUSTOMER’S OBLIGATIONS Customer shall: a) provide Supplier with all necessary co-operation in relation to this Agreement and all necessary access to such information as may be required by Supplier in order to provide the Services; b) without affecting its other obligations under this Agreement, comply with all applicable laws and regulations with respect to its activities under this Agreement; c) carry out all other Customer responsibilities set out in this Agreement in a timely and efficient manner. In the event of any delays in Customer’s provision of such assistance as agreed by the parties, Supplier may adjust any agreed timetable or delivery schedule as reasonably necessary; d) ensure that the Authorised Users use the Services and the Documentation in accordance with the terms and conditions of this Agreement and shall be responsible for any Authorised User’s breach of this Agreement; e) obtain and shall maintain all necessary licences, consents, and permissions necessary for Supplier, its contractors and agents to perform their obligations under this Agreement, including without limitation the Services; f) ensure that its network and systems comply with the relevant specifications provided by Supplier from time to time; and g) be, to the extent permitted by law and except as otherwise expressly provided in this Agreement, solely responsible for procuring, maintaining and securing its network connections and telecommunications links from its systems to Supplier’s data centres, and all problems, conditions, delays, delivery failures and all other loss or damage arising from or relating to Customer’s network connections or telecommunications links or caused by the internet; and h) disclose and allow access to the Portal and Documentation only to its personnel on a strictly need-to-know basis (“Approved Users”). Customer shall ensure that such Approved Users are personally bound by a duty of confidentiality in respect of such use and shall not disclose any part of the Documentation to any third party, including to any other employee, agent or subcontractor of Customer. Customer shall appoint an administrator to supervise all access to the Portal and Documentation by the Approved Users to ensure Customer’s compliance with the provisions of this Agreement. Approved Users shall set up passwords for access to the Portal and the administrator shall ensure such passwords are not disclosed to any other person. 6. CHARGES AND PAYMENT 6.1. In consideration of the Subscription and the provision of the Onboarding Services, Customer shall on or before the date specified in the Supplier’s invoice, in accordance with this Clause 6 and, where applicable, the Proposal, pay the applicable Fees, including, but not limited to, the Subscription Fees applicable to the data tier set forth in the Proposal selected by Customer on the Effective Date and adjusted in accordance with Clause 6.4. Such payment shall be in full and without set-off against any monies due to or claimed by Customer under this Agreement or any other agreement. 6.2. If any Fees are not paid in cleared funds by Customer to Supplier within fourteen (14) days of when due, without limiting any other rights it may have, Supplier is no longer obliged to provide the Services to Customer until such payment is paid. Customer expressly acknowledges that unless the Parties otherwise agree in writing, if the Subscription Fees are not paid within fourteen (14) days, Supplier reserves the right to suspend by notice the Service. 6.3. If Customer fails to pay in full on the due date any sum payable by it under or in connection with this Agreement, interest on the outstanding amount shall accrue on a daily basis from the due date until the date of payment (whether before or after judgment) at the rate of eight per cent (8%) per annum above the base rate of the Bank of England. The Supplier also reserves the right to invoice a compensation charge pursuant to the United Kingdom’s Late Payment of Commercial Debts (Interest) Act 1998. 6.4. If Supplier’s records reveal that Customer has sent more data to the Service than that defined in Customer’s current pricing tier in a calendar month, then without prejudice to Supplier’s other rights, Customer’s monthly Subscription Fee shall be increased to the next appropriate pricing tier as set out in the Proposal. 6.5. In the first month of service, the relevant pricing tier will be applied on a pro-rata basis starting from the date of commencement to the last day of the commencement month. Thereafter, invoices will be raised at the end of each month in arrears. 7. EXIT AND SERVICE TRANSFER In the event of the termination, notification of termination or expiry of this Agreement Supplier shall, if it is commercially reasonably for Supplier to do and upon Customer’s request, provide Customer with a commercial proposal regarding the provision of Exit Assistance Services to assist Customer with the facilitation of orderly migration of the Services from Supplier to Customer or Replacement Supplier, including any key extraction services. 8. PROPRIETARY RIGHTS 8.1. Customer acknowledges and agrees that Supplier and/or its licensors own all intellectual property rights in the Documentation. Except as expressly stated herein, this Agreement does not grant Customer any rights to, under or in, any patents, copyright, database right, trade secrets, trade names, trade marks (whether registered or unregistered), or any other rights or licences in respect of the Documentation. 8.2. Supplier confirms that it has all the rights in relation to the HSM and the Documentation that are necessary to grant all the rights it purports to grant under, and in accordance with, the terms of this Agreement. 9. CONFIDENTIALITY 9.1. Each party may be given access to Confidential Information from the other party in order to perform its obligations under this Agreement. A party’s Confidential Information shall not be deemed to include information that: a) is or becomes publicly known other than through any act or omission of the receiving party; b) was in the other party’s lawful possession before the disclosure; c) is lawfully disclosed to the receiving party by a third party without restriction on disclosure; or d) is independently developed by the receiving party, which independent development can be shown by written evidence. 9.2. Subject to Clauses 9.4, 9.7 and 9.8 each party shall hold the other’s Confidential Information in confidence and not make the other’s Confidential Information available to any third party, or use the other’s Confidential Information for any purpose other than the implementation of this Agreement. 9.3. Each party shall take all reasonable steps to ensure that the other’s Confidential Information to which it has access is not disclosed or distributed by its employees or agents in violation of the terms of this Agreement. 9.4. A party may disclose Confidential Information to the extent such Confidential Information is required to be disclosed by law, by any governmental or other regulatory authority or by a court or other authority of competent jurisdiction, provided that, to the extent it is legally permitted to do so, it gives the other party as much notice of such disclosure as possible and, where notice of disclosure is not prohibited and is given in accordance with this Clause 9.4, it takes into account the reasonable requests of the other party in relation to the content of such disclosure. 9.5. Neither party shall be responsible for any loss, destruction, alteration or disclosure of Confidential Information caused by any third party. 9.6. Customer acknowledges that details of the Services, and the results of any performance tests of the Services, constitute Supplier’s Confidential Information. 9.7. The Parties agree to collaborate in the creation and publication of media releases, case studies and to provide references in respect of each other’s services to their respective potential customers although neither Party shall make, or permit any person to make, any public announcement concerning this Agreement without the prior written consent of the other Party (such consent not to be unreasonably withheld or delayed), except as required by law, any governmental or regulatory authority (including, without limitation, any relevant securities exchange), any court or other authority of competent jurisdiction. 9.8. Notwithstanding anything to the contrary contained in this Agreement, the Customer hereby: a) grants to Supplier, a non-exclusive, non-transferable, revocable licence to display Customer’s trade marks, logos and name and trade name in Supplier’s customer list, which may be provided to its existing and potential customers; and b) permits Supplier to use the Customer’s name and trade name in the Suppliers promotional materials in respect of the Services and to disclose such names to its existing and potential customers. 10. INDEMNITY Customer shall defend, indemnify and hold harmless Supplier against claims, actions, proceedings, losses, damages, expenses and costs (including without limitation court costs and reasonable legal fees) arising out of or in connection with Customer’s use of the HSM and/or Documentation. 11. LIMITATION OF LIABILITY 11.1. Except as expressly and specifically provided in this Agreement: a) Customer assumes sole responsibility for results obtained from the use of the Services and the Documentation by Customer, and for conclusions drawn from such use. Supplier shall have no liability for any damage caused by errors or omissions in any information, instructions or scripts provided to Supplier by Customer in connection with the Services, or any actions taken by Supplier at Customer’s direction; b) all warranties, representations, conditions and all other terms of any kind whatsoever implied by statute or common law are, to the fullest extent permitted by applicable law, excluded from this Agreement; and c) the Services and the Documentation are provided to Customer on an “as is” basis. 11.2. Nothing in this Agreement excludes the liability of Supplier for death or personal injury caused by Supplier’s negligence; or for fraud or fraudulent misrepresentation. 11.3. Subject to Clauses 11.1 and 11.2: a) Supplier shall not be liable whether in tort (including for negligence or breach of statutory duty), contract, misrepresentation, restitution or otherwise for any loss of profits, loss of business, depletion of goodwill and/or similar losses or loss or corruption of data or information, or pure economic loss, or for any special, indirect or consequential loss, costs, damages, charges or expenses however arising under this Agreement; and b) Supplier’s total aggregate liability in contract and tort (including negligence or breach of statutory duty), misrepresentation, restitution or otherwise, arising in connection with the performance or contemplated performance of this Agreement shall be limited to the total Subscription Fees paid for the User Subscriptions during the twelve (12) months immediately preceding the date on which the claim arose. 12. TERM AND TERMINATION 12.1. This Agreement shall, unless otherwise terminated as provided in this Clause 12, commence on the Effective Date and shall continue for the Initial Subscription Term and, thereafter, this Agreement shall be automatically renewed for successive periods of twelve (12) months (each a Renewal Period), unless: a) either party notifies the other party of termination, in writing, at least 90 days before the end of the Initial Subscription Term or any Renewal Period, in which case this Agreement shall terminate upon the expiry of the applicable Initial Subscription Term or Renewal Period; or b) otherwise terminated in accordance with the provisions of this Agreement; and the Initial Subscription Term together with any subsequent Renewal Periods shall constitute the Subscription Term. 12.2. Without affecting any other right or remedy available to it, either party may terminate this Agreement with immediate effect by giving written notice to the other party if: a) the other party fails to pay any amount due under this Agreement on the due date for payment and remains in default not less than thirty (30) days after being notified in writing to make such payment; b) the other party commits a material breach of any other term of this Agreement which breach is irremediable or (if such breach is remediable) fails to remedy that breach within a period of fourteen (14) days after being notified in writing to do so; c) the other party suspends or ceases, or threatens to suspend or cease, carrying on all or a substantial part of its business; or d) there is a Change of Control of the other party. 13. TEMPORARY SUSPENSION 13.1. Supplier reserves the right to suspend Customer’s or any Authorised User’s right to access or use any portion or all of the Service and or the Portal immediately upon notice to Customer if Supplier determines: a) Customer’s or an Authorised User’s use of the Service or the Portal (i) poses a security risk to the Service or any third party, (ii) could adversely impact our systems, the Service or the systems or Content of any other Supplier customer, (iii) could subject Supplier, its affiliates, or any third party to liability, or (iv) could be fraudulent; b) Customer is in material breach of this Agreement; c) Customer has ceased to operate in the ordinary course, made an assignment for the benefit of creditors or similar disposition of Customer’s assets, or become the subject of any bankruptcy, reorganisation, liquidation, dissolution or similar proceeding. 13.2. If Supplier suspends Customer’s right to access or use any portion or all of the Service Customer remains responsible for all fees and charges Customer incurs during the period of suspension. 13.3. On termination of this Agreement for any reason: a) all licences granted under this Agreement shall immediately terminate and Customer shall immediately cease all use of the Services and/or the Documentation; b) each party shall return and make no further use of any equipment, property, Documentation and other items (and all copies of them) belonging to the other party; c) Supplier may destroy or otherwise dispose of any of Customer Data in its possession in accordance with its Privacy Policy; and d) any rights, remedies, obligations or liabilities of the parties that have accrued up to the date of termination, including the right to claim damages in respect of any breach of the agreement that existed at or before the date of termination shall not be affected or prejudiced. 14. FORCE MAJEURE Supplier shall have no liability to Customer under this Agreement if it is prevented from or delayed in performing its obligations under this Agreement, or from carrying on its business, by acts, events, omissions or accidents beyond its reasonable control, including, without limitation, strikes, lock-outs or other industrial disputes (whether involving the workforce of Supplier or any other party), failure of a utility service or transport or telecommunications network, act of God, war, riot, civil commotion, malicious damage, compliance with any law or governmental order, rule, regulation or direction, accident, breakdown of plant or machinery, fire, flood, storm or default of suppliers or sub-contractors, provided that Customer is notified of such an event and its expected duration. 15. VARIATION No variation of this Agreement shall be effective unless it is in writing and signed by the parties (or their authorised representatives). 16. WAIVER No failure or delay by a Party to exercise any right or remedy provided under this Agreement or by law shall constitute a waiver of that or any other right or remedy, nor shall it prevent or restrict the further exercise of that or any other right or remedy. No single or partial exercise of such right or remedy shall prevent or restrict the further exercise of that or any other right or remedy. 17. RIGHTS AND REMEDIES Except as expressly provided in this Agreement, the rights and remedies provided under this Agreement are in addition to, and not exclusive of, any rights or remedies provided by law. 18. SEVERANCE If any provision or part-provision of this Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed deleted, but that shall not affect the validity and enforceability of the rest of this Agreement. 19. ENTIRE AGREEMENT This Agreement constitutes the entire agreement between the Parties and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter. 20. SURVIVAL Notwithstanding any other provision of this Agreement, Clauses 1, 7, 8, 9, 10, 11, 17, 20, 22, 23, 24 and 25 shall survive termination of this Agreement. 21. ASSIGNMENT Customer shall not, without the prior written consent of Supplier, assign, transfer, charge, sub-contract or deal in any other manner with all or any of its rights or obligations under this Agreement. 22. NO PARTNERSHIP OR AGENCY Nothing in this Agreement is intended to or shall operate to create a partnership between the parties, or authorise either Party to act as agent for the other, and neither Party shall have the authority to act in the name or on behalf of or otherwise to bind the other in any way (including, but not limited to, the making of any representation or warranty, the assumption of any obligation or liability and the exercise of any right or power). 23. THIRD PARTY RIGHTS This agreement does not confer any rights on any person or party (other than the Parties to this Agreement and, where applicable, their successors and permitted assigns) pursuant to the Contracts (Rights of Third Parties) Act 1999. 24. NOTICES Any notice required to be given under this Agreement shall be in writing and shall be delivered by hand or sent by pre-paid first-class post or recorded delivery post to the other Party at its address set out in this Agreement, or such other address as may have been notified by that Party for such purposes. 25. GOVERNING LAW AND JURISDICTION This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the law of England and Wales. Each Party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Agreement or its subject matter or formation (including non-contractual disputes or claims). This Agreement has been entered into on the Effective Date. Signed by JOHN CRAGG for and on behalf of MYHSM LIMITED as its attorney under a power of attorney. ________________________________ Signature of attorney ________________________________ Date of signature Signed by [NAME OF AUTHORISED SIGNATORY] for and on behalf of [NAME OF CUSTOMER] ________________________________ Name of authorised signatory ________________________________ Date of signature   EXHIBIT A TO HSM AS A SERVICE SUBSCRIPTION AGREEMENT MYHSM SERVICE LEVEL AGREEMENT The purpose of this document is to define the measurable performance levels for the MYHSM Service and specify remedies available to the Customer if MYHSM fails to achieve these levels. The service credits listed in the tables below are the sole and exclusive remedy for any failure of the MYHSM service. "Unavailability" is defined as the duration of time in which all HSMs, to which the Customer has access, fail to provide a response to valid commands sent to them by the Customer. The period of Unavailability starts when MYHSM receives Customer notification of the incident and ends when it becomes available again as confirmed by MYHSM. Monthly Availability Consecutive Minutes Unavailable Monthly Service Credit 99.999% to 99.99% 26 seconds to <4 minutes 2% 99.99% to 99.90% 4 minutes to <44 minutes 5% 99.9% to 99.0% 44 minutes to <7 hours 10% 99% to 98% 7 hours to <14.4 hours 50% 98% to 97% 14.4 hours to <21.6 hours 75% <97% >21.6 hours 100% Customer will not be entitled to a credit if the event or condition that would have otherwise given rise to the credit was caused by any of the following: (i) Force Majeure Events; (ii) Customer’s equipment; or (iii) actions or inactions of Customer or its representatives. In order to be eligible for a credit, Customer must report the Unavailability to MYHSM within seven (7) days of the incident. In order to receive a credit from MYHSM, Customer must request the credit by notifying MYHSM in writing within fifteen (15) days of the last day of the month in which the Unavailability is remedied. For questions or support, please work with your MYHSM Sales Representative.