Quorum Services Terms and Conditions: These terms and conditions (the “Terms”) apply to any services performed by QUORUM CYBER SECURITY LIMITED, a company registered under the Companies Act (company number SC510322) and having its registered office at 5th Floor 125 Princes Street, Edinburgh, United Kingdom, EH2 4AD (“Quorum”) for you (the “Customer”). Quorum’s Obligations - Quorum shall provide the Services during Term for the Charges, subject to the provisions of the Contract. Quorum undertakes to perform the Services with reasonable skill and care. This undertaking shall not apply to the extent of any non-conformance which is caused by use of the Services contrary to Quorum's recommendations, instructions, or modification or alteration of the Services by any party other than Quorum or our duly authorised contractors or agents. In the event Quorum breaches this undertaking, Quorum will, at its expense, use all reasonable commercial endeavours to correct any such non-conformance promptly, or provide the Customer with an alternative means of accomplishing the desired performance. Such correction or substitution constitutes the Customer's sole and exclusive remedy for any breach of the undertaking. Quorum shall use its reasonable endeavours to meet targets set out in the Service Level Agreement and any project milestones set out in the Proposal of services or mutually agreed with Customer, but these targets are estimates only and time shall not be of the essence of the Contract. Quorum shall ensure that it has and will maintain all necessary licences, consents, and permissions necessary for the provision of the Services. Customer Obligations - The Customer will co-operate with Quorum and provide it with all necessary assistance in relation to the Services, including access to such information, Customer Data, security access information and configuration services which Quorum may require to provide the Services. The Customer shall only use the Services for lawful purposes, in accordance with Quorum's recommendations, and in accordance with the Contract. Where the Customer breaches any of its obligations under the Contract, Quorum is not responsible if the Services fail to comply with the Service Level Agreement as a result (directly or indirectly) of such breach and no Service Credits will accrue. Where applicable to the Services, the Customer shall use the Services in accordance with this Contract and the applicable Service Level Agreement with regard to the Customer's expected average monthly Services consumption ("Service Consumption"). Quorum will inform the Customer of its Service Consumption where applicable in the Proposal. Where, and for so long as, the Customer’s usage of the Services exceeds the Service Consumption by 20% or more, then Quorum shall not be responsible for any failures to comply with the Service Level Agreement and shall be entitled to increase the Charges by a reasonable amount. The Customer shall not, without the prior written consent of Quorum, at any time from the date of the Contract to the expiry of twelve (12) months after the completion of the Services, solicit or entice away from Quorum or employ or attempt to employ any person who is, or has been, engaged as an employee or sub-contractor of Quorum. Any consent given by Quorum shall be subject to the Customer paying to Quorum a sum equivalent to 20% of the then current annual remuneration of Quorum employee or sub-contractor. Security - Each party recognises that it is impossible to maintain flawless security but (where relevant) Quorum shall take all reasonable steps to prevent security breaches in its interaction with the Customer and security breaches in any interaction with resources or users outside of any security that may be built into the Services. Charges and Payment - The Customer shall pay the Charges to Quorum for the Services. All Charges are as set in the Order Form. All charges are due and payable in accordance with the terms in the Order Form for the applicable billing period following receipt of the applicable invoice as set out in the Order Form, unless Quorum and the Customer have agreed otherwise. Without affecting the above, all pro-forma invoices are payable within 30 days after the date of such invoices, unless otherwise agreed between Quorum and the Customer. Time for payment of the Charges shall be of the essence of the Contract. If the Customer fails to pay any Charges when due, then without prejudice to any other rights and remedies of Quorum: • Quorum may, without liability to the Customer, disable the Customer's password, account and access to all or part of the Services and Quorum shall be under no obligation to provide any or all of the Services while the overdue Charges remain unpaid; and • interest shall accrue on a daily basis on the overdue Charges at an annual rate equal to 4% over the then current base lending rate of Barclays Bank plc from time to time, starting on the due date and continuing until fully paid, whether before or after judgment. Interest shall accrue daily and be compounded quarterly. Unless otherwise specified on an Order Form: • all Charges shall be payable in pounds Sterling and are exclusive of value added and any other applicable taxes, which shall be added to Quorum’s invoices at the appropriate rate Quorum shall have the right to increase any Charges once per year upon thirty (30) days’ notice to the Customer. In addition to the above rights and subject to any provisions set out in a Proposal,Quorum reserves the right to pass on to the Customer any price increase(s) (e.g. Microsoft services) imposed by third party suppliers of Quorum where variable-cost licensing agreements have been used for provision of Services to the Customer. Quorum will use reasonable endeavours to give the Customer 30 days advance written notice of any such increase, together with reasonable documentation received from the relevant third party supplier. Quorum may, without prejudice to any other rights it may have, set off any liability of Quorum to the Customer against any liability of the Customer to Quorum. Quorum will be entitled to charge the Customer additional charges for services outside the agreed scope, where applicable, as set out in the Service Specific Terms. If the Customer or the Customer's agents, sub-contractors or employees prevents or delays Quorum from performing any Services then Quorum, having used its reasonable efforts to mitigate the effect of such prevention or delay, shall be entitled to recover on demand from the Customer any reasonable costs, charges or losses it sustains or incurs as a result. All Charges payable to Quorum under the Contract shall become due immediately on termination of the Contract, despite any other provision. This paragraph is without prejudice to any right to claim for interest under the law, or any such right under the Contract. Intellectual Property Rights - The Customer agrees and acknowledges that Quorum has developed the Services in the course of its business and all Intellectual Property Rights in and to the Services and all documents, materials and deliverables it provides which relate to the Services. These have not been provided on a bespoke basis for the Customer. Quorum shall retain ownership of all Intellectual Property Rights in respect to the Services. Quorum hereby grants to the Customer a perpetual, irrevocable, non-transferable, non-exclusive, royalty-free licence to use Quorum’s Intellectual Property Rights to the extent necessary to obtain the benefit and use of the Services. The Customer shall not acquire any right, title, interest,or additional licence to Quorum’s Intellectual Property Rights, unless otherwise granted under the Service Specific Terms. The Customer shall own and retain all Intellectual Property Rights in the Customer Data. The Customer hereby grants to Quorum a perpetual, irrevocable, non-transferable, non-exclusive, royalty-free licence to use, copy, modify, improve, reproduce, manipulate, enhance and make derivative work from the Customer Data for the purposes of providing the Services. Confidentiality - Each party undertakes that it shall keep the Confidential Information of the other party confidential during the Term and for a period of two (2) years after termination and shall use such Confidential Information only for the purposes of providing or receiving the Services. Neither party shall disclose Confidential Information to any person, except as permitted under this paragraph. Each party may disclose the other party’s Confidential Information: •to its employees, Affiliates, officers, agents, consultants or subcontractors who need to know such Confidential Information for the purposes of receiving or supplying the Services provided that the disclosing party ensures that any such persons comply with the confidentiality obligations contained in the Contract as though they were a party to it; or •where disclosure may be required by law, a court of competent jurisdiction or any governmental or regulatory authority. Each party reserves all rights in its Confidential Information. No rights or obligations in respect of a party’s Confidential Information other than those expressly stated in the Contract are granted to the other party or to be implied from the Contract. The Customer acknowledges that details of the Services, and the results of any performance tests of the Services, constitute Quorum’s Confidential Information. Mutual Indemnities - Quorum shall indemnify the Customer, its officers, directors and employees against any losses, costs and expenses incurred as a result of any claim that the Customer’s receipt of the Services infringes any Intellectual Property Rights of a third party, provided that: • Quorum is given prompt notice of any such claim; • the Customer provides reasonable co-operation to Quorum in the defense and settlement of such claim, at Quorum’s expense; and • Quorum is given sole authority to defend or settle the claim.In the defense or settlement of any claim, Quorum may procure the right for the Customer to continue using the Services, replace or modify the Services so that they become non-infringing or, if such remedies are not reasonably available, terminate the supply of the affected Services without any additional liability or obligation to pay liquidated damages or other additional costs to the Customer. The foregoing state the Customer's sole and exclusive rights and remedies, and Quorum’s (including Quorum’employees', agents' and sub-contractors') entire obligations and liability, for infringement of any third party Intellectual Property Rights. The Customer shall indemnify Quorum against any losses, damages, costs (including legal fees) and expenses incurred by or claimed or awarded against Quorum as a result of the breach by the Customer of any of its obligations under the Contract or any negligent, delictual or wrongful act of the Customer, its officers, employees, contractors or agents. Limitation of Liability - Nothing in the Contract shall limit or exclude the liability of either party for: •death or personal injury resulting from negligence; •breach of the obligations implied by Section 12 Sale of Goods Act 1979 or Section 11B Supply of Goods and Services Act 1982; or •fraud or fraudulent misrepresentation. Subject to the above: •Quorum shall not be liable whether in delict (including for negligence or breach of statutory duty), contract, misrepresentation, restitution or otherwise for any special damage, even though Quorum was aware of the circumstances in which such special damage could arise, loss of profits, loss of business, depletion of goodwill or similar losses, loss of agreements or contracts, loss or corruption of software, data, or information, pure economic loss, and special, indirect or consequential loss, costs, damages, charges or expenses however arising under the Contract. •Quorum is not liable for any malware or other contaminants which enter the Customer's email system or computer network. •Quorum’s liability under the Contract for loss of or damage to the Customer’s property, caused by its negligence including on the part of its officers, employees, contractors or agents, shall not exceed: £10,000,000. •Quorum’s total aggregate liability in contract, delict (including negligence or breach of statutory duty), misrepresentation, restitution or otherwise, arising in connection with the performance or contemplated performance of the Contract shall be limited to the total Charges paid for the Services during the 12 months immediately before the date on which the claim arose. •Excluding where it is unlawful to do so, and in addition to the exclusions of liability in the Contract, Quorum, or any Third Party Subcontractor, is not liable to the Customer for any loss of profits or any special, indirect, economic or consequential loss, damage, cost or expense of any kind whatsoever and howsoever caused, whether arising under contract, delict (including for negligence or breach of statutory duty) misrepresentation or otherwise, including loss of or corruption to data, loss of contracts, loss of operation time and loss of goodwill. Data Protection - Both parties will comply with all applicable requirements of the Data Protection Legislation. This paragraph is in addition to, and does not relieve, remove or replace, a party's obligations or rights under the Data Protection Legislation. The parties acknowledge that for the purposes of the Data Protection Legislation, the Customer is the data controller and Quorum is the processor. Quorum will set out the scope, nature and purpose of the processing, the duration of the processing and the types of personal data and categories of data subject in the Contract. The Customer agrees and consents to Quorum having the right to access the Customer Data and to use, modify, reproduce, distribute, display and disclose Customer Data, including any personal data, to the extent necessary to provide the Services, including, without limitation, in response to support requests. The Customer shall ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the personal data to Quorum for the duration and purposes of the Contract. Quorum shall, in relation to any personal data processed by it for the Customer: •process that personal data only on the documented written instructions of the Customer unless Quorum is required by applicable laws to otherwise process that personal data; •ensure that it has in place appropriate technical and organisational measures, to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures;•ensure that all personnel who have access to and/or process personal data are obliged to keep the personal data confidential; •not transfer any personal data outside of the European Economic Area unless the appropriate safeguards are in place and the requirements of the Data Protection Legislation have been met;•assist the Customer in responding to any request from a data subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators; •notify the Customer without undue delay on becoming aware of a personal data breach; •at the written direction of the Customer, delete or return personal data,including copies, to the Customer on termination of the Contract unless required by applicable law to store the personal data; and •maintain complete and accurate records and information to demonstrate its compliance with this paragraph and allow for audits by the Customer or the Customer's designated auditor and immediately inform the Customer if, in the opinion of Quorum, an instruction infringes the Data Protection Legislation. As data processor, Quorum may appoint sub-processors provided however, that the sub-processor assumes the same obligations as are imposed on us as data processor and with the Customer’s written consent. Details of our current sub-processors are listed on Quorum’s website(www.quorumcyber.com/privacy-policy). We shall advise you of any changes in sub-processor used by us from time to time and you will be afforded a right to object to any such appointment. The Customer acknowledges that Quorum relies on it for direction as to the extent to which Quorum may use and process all personal data contained within Customer Data. Quorum shall not be liable for any claim brought by a data subject arising from any action or omission by Quorum, to the extent that such action or omission resulted from the Customer’s instructions. Term and Termination - The Contract shall, unless otherwise terminated as provided in this paragraph, commence on the Start Date and continue for the Term unless: •either party notifies the other party in writing of termination, at least 30 days before the end of the Term; or •otherwise terminated in accordance with the provisions of the Contract.Without affecting any other right or remedy available to it, either party may terminate the Contract with immediate effect by giving written notice to the other party if: •the other party commits a material breach of the Contract which (in the case of a breach capable of remedy) has not been remedied within thirty (30)days of the receipt by the other of a notice specifying the breach and requiring its remedy, save where the breach is of a payment obligation in which case the period shall be five (5) days; or •a winding-up order or bankruptcy order is made against the other party; or •the other party passes a resolution or makes a determination for it to be wound up (without a declaration of solvency/except for the purposes of amalgamation or reconstruction, the terms of which have been previously approved in writing by the other party); or •the other party has appointed to it an administrator or an administrative receiver; or •being a partnership, in addition to the above, suffers bankruptcy orders being made against all of its partners; or •a receiver, manager or administrative receiver is appointed, of the whole or any part of the other party's assets; •the other party ceases or suspends payment of any of its debts, or is unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986; or •any arrangement, compromise or composition in satisfaction of its debts is proposed or entered into; or •the other party ceases, or threatens to cease, to carry on business; or •any event similar to those described above occurs in relation to the other party in any jurisdiction in which that other party is incorporated, resident or carries on business. On termination of the Contract for any reason: •all licences granted under the Contract shall immediately terminate and the Customer shall immediately cease all use of the Services; and •each party shall return and make no further use of any equipment, property, Customer Data and other items (and all copies of them) belonging to the other party. Other important terms Neither party shall be in breach of the Contract nor liable for delay in performing, or failure to perform, any of its obligations under the Contract if such delay or failure result from events, circumstances or causes beyond its reasonable control. In such circumstances the time for performance shall be extended by a period equivalent to the period of delay of any affected Services. If the period of delay or non-performance continues for 6 months, either party may terminate the Contract by giving 30 days' written notice to the affected party. The Contract constitutes the entire agreement between the parties. The Customer acknowledges it has not relied on any statement, promise, representation, assurance or warranty made or given by or on behalf of Quorum which is not set out in the Contract and that it shall have no claim for innocent or negligent misrepresentation or negligent misstatement based on any statement in the Contract. Nothing in the Contract establishes any partnership or joint venture between any of the parties, constitute any party the agent of another party, or authorise any party to make or enter into any commitments for or on behalf of any other party. Each party confirms it is acting on its own behalf and not for the benefit of any other person. The Customer may only transfer its rights or its obligations under the Contract to another person if Quorum agrees to this in writing. Quorum may transfer its rights and obligations under the Contract to another organisation. Quorum and the Customer can vary the Contract in writing. Any variation must be signed by both parties (or their authorised representatives).Failure by a party to insist immediately that the other party do anything it is required to do under the Contract, or delays in taking steps against the other party relating to any breach of the Contract shall not prevent that party taking steps at a later date. Any waiver of a party’s rights under the Contract can only be given in writing. No person who is not party to the Contract shall have any right to enforce any term of the Contract. Each of the paragraphs of the Contract operates separately. If any court or relevant authority decides that any of them are unlawful, the remaining paragraphs will remain in full force and effect. Corrupt Gifts - Quorum will not offer or give, or otherwise, any gift of consideration of any kind to any person employed by the Customer as an inducement or reward for doing any act in relation to obtaining or execution of the Contract, or for showing any favour or disfavour to any person in relation to the Contract, or any other contract for the Customer for any reason. Notices - Any notice given to a party under or in connection with the Contract shall be in writing and shall be: •delivered by hand or by pre-paid first-class post or other next working day delivery service at its registered office (if a company) or its principal place of business (in any other case); or •sent by email (with a read receipt requested) to the email address in the Order Form. Any notice shall be deemed to have been received: •if delivered by hand, on signature of a delivery receipt; •if sent by pre-paid first-class post or other next working day delivery service, at 9.00 am GMT on the second Business Day after posting or at the time recorded by the delivery service; or •if sent by email, at 9.00 am on the next Business Day after transmission. This paragraph does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution. Governing Law and Jurisdiction The Contract and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation shall be governed by and construed in accordance with the laws of Scotland. Each party irrevocably agrees that the courts of Scotland shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with the Contractor its subject matter or formation. Glossary and Interpretation - Affiliate means each and any Subsidiary or Holding Company of a party and each and any Subsidiary of a Holding Company of a party; Business Day means a day other than a Saturday, Sunday or public holiday in Scotland when banks in Edinburgh are open for business. Charges means the fees payable by the Customer to Quorum for the Services as set out in the Order Form; Confidential Information means information in whatever form (including in written, oral, visual or electronic form or on any magnetic or optical disk or memory and wherever located) relating to the business, customers, products, affairs and finances of either party and trade secrets, technical data and know-how, whether or not such information (if in anything other than oral form) is marked confidential but excluding: information which is already lawfully in a party’s possession and not subject to confidentiality restrictions; information in the public domain; or information which is independently developed by a party; Contract means these Terms, the Service Specific Terms, (where applicable) the Proposal, and the Order Form; Critical Hours means 24 hours per day, 7 days per week including United Kingdom bank and public holidays. Customer Data means all data: (i) which the Customer supplies or makes available to Quorum under the Contract; and (ii) the Customer generates or creates through its use of the Services; Customer Portal means a secure online web portal made available by Quorum to the Customer’s personnel for the purposes of interacting with the Services including procuring services and placing orders for Services; Data Protection Legislation means the UK Data Protection Legislation and any other European Union legislation relating to personal data and all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of personal data (including, without limitation, the privacy of electronic communications) and the guidance and codes of practice issued by the relevant data protection or supervisory authority and applicable to a party; Intellectual Property Rights means all patents, utility models, rights to inventions, copyright and neighbouring and related rights, moral rights, trade marks and service marks, business names and domain names, rights in get-up and trade dress, goodwill and the right to sue for passing off or unfair competition, rights in designs, rights in computer software, database rights, rights to use, and protect the confidentiality of, confidential information (including know-how and trade secrets) and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted, renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world; Month means a calendar month; Order Form means the document of that name incorporating these terms and conditions which has been signed (physically or electronically) by Quorum and the Customer; Proposal means the separate document which Quorum provides to the Customer, if applicable to the Services, in accordance with the Contract; Service Specific Terms means the applicable service specific terms; Services means all Services being provided by Quorum; Service Credits means the service credits as set out in the applicable Service Level Agreement; Service Hours means the hours during which the Services are to be provided as set out in the Service Level Agreement, as applicable; Service Level Agreement means the separate document that describes the service level agreement, the Service Credits ,and Service Hours and can be downloaded from the Customer Portal or in the Service Specific Terms (as applicable); Start Date means the start date set out in the Order Form; Term means the term defined in the applicable Order Form; and UK Data Protection Legislation means all applicable data protection and privacy legislation in force from time to time in the UK including the General Data Protection Regulation ((EU) 2016/679); the Data Protection Act 2018; the Privacy and Electronic Communications Directive 2002/58/EC (as updated by Directive 2009/136/EC) and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended. Working Hours means [9.00am to 5.00pm] London time on weekdays (excluding United Kingdom bank and public holidays).Any words following the terms including, include, in particular, for example or any similar expression shall be construed as illustrative and shall not limit the sense of the words, description, definition, phrase or term preceding those terms. Holding company shall be construed in accordance with sections 1159 and Schedule 6A of the Companies Act 2006.Subsidiary shall be construed in accordance with sections 1159 and Schedule 6A of the Companies Act 2006.In the event of any conflict between the documents which form the Contract, the Contract documents apply in the below order of preference. 1 .The Order Form 2 .The Proposal 3. Service Specific Terms 4. The Terms