CHAINLOOP TERMS OF SERVICE

Last updated: October 8, 2026

These Terms of Service (“Agreement”) constitute a binding legal agreement between the entity identified on an Order Form or during the registration process (“Customer”, “you” or “your”), and Chainloop, Inc., a Delaware corporation (“Chainloop”, “Company”, “we”, “us”, or “our”).

This Agreement governs Customer’s access to and use of the Chainloop-hosted software-as-a-service (SaaS) offering made available via chainloop.dev, including related hosted applications, websites, documentation, and support services (collectively, the “Services”). This Agreement applies only to Chainloop’s hosted SaaS offerings and does not apply to any self-hosted, on-premises, community edition, or separately licensed software offerings, which are governed by separate terms.

BY CLICKING ACCEPT, SIGNING UP, EXECUTING AN ORDER FORM THAT INCORPORATES THIS AGREEMENT OR OTHERWISE ACCESSING OR USING THE SERVICES, YOU (A) CONFIRM THAT YOU HAVE READ AND UNDERSTOOD THIS AGREEMENT; (B) ACCEPT THIS AGREEMENT AND AGREE THAT YOU ARE LEGALLY BOUND BY ITS TERMS; AND (C) REPRESENT AND WARRANT THAT YOU HAVE THE LEGAL AUTHORITY TO BIND THE ENTITY IDENTIFIED AS A CUSTOMER ON AN ORDER FORM OR DURING THE REGISTRATION PROCESS TO THIS AGREEMENT. IF YOU DO NOT ACCEPT THESE TERMS OR DO NOT HAVE THE NECESSARY LEGAL AUTHORITY TO DO SO ON BEHALF OF THE CUSTOMER, YOU MUST NOT ACCEPT THE AGREEMENT AND MUST NOT ACCESS OR USE THE CHAINLOOP SERVICES.

PART 1: TERMS OF SERVICE

1. Definitions

1.1. The following capitalized terms have the meanings set out below. Additional defined terms used only in the Data Processing Addendum (Attachment 1) are defined in that Attachment.

(a) "Agreement" means these Terms of Service, together with all Order Forms, PS Order Forms, the Data Processing Addendum set out in Attachment 1, Professional Services Terms (where applicable), and any other Supplemental Terms incorporated by reference.

(b) "Authorized User" means an individual invited by Customer to access and use the Services within Customer's Organization, including Customer's employees, contractors, and other personnel granted access credentials by Customer. An Authorized User may participate in more than one Organization, including Organizations controlled by different Customers.

(c) "Beta Services" means any alpha, beta, trial, preview, early-access, or evaluation features or services made available by Chainloop on an optional basis.

(d) “Credits” means the units Chainloop uses to meter usage-based features of the Services, at the rates published at chainloop.dev/pricing or stated in an Order Form.

(e) "Customer Data" means all data, content, materials, records, files, software supply chain metadata, and other information submitted to, transmitted through, or stored within the Services by or on behalf of Customer or its Authorized Users in connection with Customer's Organization(s). Customer Data does not include personal data associated with an Authorized User's User Account to the extent processed by Chainloop as an independent controller under the DPA.

(f) "Documentation" means the technical and user documentation for the Services made available at https://docs.chainloop.dev/.

(g) "DPA" means the Data Processing Addendum set out in Attachment 1 of this Agreement, which governs the processing of personal data under applicable data protection laws.

(h) "Fees" means all amounts payable by Customer for the Services, as specified in the applicable Subscription Plan or Order Form.

(i) "Order Form" means a written ordering document executed by the parties that specifies the Services, Subscription Plan, Fees, and Subscription Term, and incorporates this Agreement by reference.

(j) "Organization" means the logically segregated environment within the Services provisioned for and controlled by a single Customer, within which Customer may invite Authorized Users and manage Customer Data. An Authorized User may be a member of multiple Organizations, including Organizations belonging to different Customers.

(k) "Professional Services" means implementation, configuration, software development, training, on-premises deployment assistance, or other professional or consulting services provided by Chainloop to Customer pursuant to a PS Order Form. Professional Services do not include the hosted SaaS Services and are governed by the Professional Services Terms set out in Exhibit B to this Agreement.

(l) "PS Deliverable" means any work product, software, configuration, documentation, or other output created by Chainloop specifically for Customer in the course of performing Professional Services, as described in a PS Order Form.

(m) "PS Fees" means the fees payable by Customer for Professional Services as set out in an applicable PS Order Form.

(n) "PS Order Form" means a written ordering document, statement of work, or similar instrument executed by the parties that describes the scope, timeline, PS Fees, and other terms of a specific Professional Services engagement, and incorporates this Agreement and Exhibit B by reference.

(o) "Services" means the Chainloop-hosted SaaS platform for software supply chain trust infrastructure, including continuous governance of the software development lifecycle, attestation-based evidence collection across CI/CD pipelines, a policy engine, artifact integrity verification and storage, delivery visibility, and related AI-enhanced features, together with Documentation and support services.

(p) "Subscription Plan" means a specific plan or tier for the Services as described at chainloop.dev/pricing or in an Order Form, including its features, included Credits, and included storage.

(q) "Subscription Term" means the period during which Customer is authorized to access and use the Services, as specified in an Order Form or selected during registration.

(r) "Supplemental Terms" means Order Forms, PS Order Forms, the DPA, Exhibit B (Professional Services Terms), support terms, service level commitments, and product-specific terms made available by Chainloop or expressly incorporated by reference.

(s) "User Account" means the individual platform-level account associated with an Authorized User's identity (typically an email address), which may persist on the Services independently of any particular Organization or Customer relationship. Chainloop processes personal data associated with a User Account as an independent controller, as further described in the DPA and Chainloop's Privacy Policy.

(t) "Usage Data" means de-identified and aggregated data relating to the performance, operation, and use of the Services that does not identify Customer, any Authorized User, or any natural person.

2. Chainloop Services

2.1. Chainloop provides a hosted software-as-a-service platform that serves as a software supply chain trust infrastructure platform. The Services include continuous governance of the software development lifecycle (SDLC), attestation-based evidence collection across CI/CD pipelines, a policy engine with a curated catalog of security and compliance policies, centralized management and prioritization of policy violations, artifact integrity verification and storage, and delivery visibility. Certain features of the Services incorporate AI capabilities. Chainloop does not provide legal, regulatory, or professional compliance advice. Customer is solely responsible for ensuring its own compliance with applicable laws and industry standards.

2.2. Documentation related to the Chainloop Services (“Documentation”) is available at https://docs.chainloop.dev/.

2.3. Discontinuation. Chainloop may modify, enhance, replace, or discontinue any part of the Services from time to time. Chainloop will use commercially reasonable efforts to provide prior notice of any material discontinuation of the Services. Except where required for security, legal, regulatory, or third-party dependency reasons, Chainloop will not materially reduce the core functionality of the Services purchased by Customer during the then-current prepaid Subscription Term. Chainloop shall have no liability for any change, suspension, or discontinuance of any free, trial, Beta Service, evaluation, or pre-release Services.

2.4. Subscription Plans. The Services are offered under different Subscription Plans or tiers with varying features, capacity, amount of Credits available and support levels, as described on Chainloop's website and in the Documentation. Chainloop may modify plan features and packaging from time to time; provided that during the then-current prepaid Subscription Term, Chainloop will not materially decrease the features expressly committed to Customer in an applicable Order Form, except where required for security, legal, or third-party dependency reasons.

2.5. Subscription process and Order Forms. Customer may subscribe to the Services through Chainloop's website, or through a third-party marketplace authorized by Chainloop, by completing the registration form, providing valid payment information, and accepting this Agreement. For the Enterprise Subscription Plan or where otherwise agreed, Customer may also subscribe by executing a written Order Form. Customer's subscription commences on the date Chainloop makes the Services available following receipt of payment, or on the start date specified in the applicable Order Form. Where Chainloop offers a free Subscription Plan or a free trial, Customer’s subscription commences when Chainloop makes the Services available following registration, and no payment is required unless and until Customer upgrades to a paid Subscription Plan.

2.6. Incorporated Documents and Order of Precedence. This Agreement may be supplemented by Supplemental Terms. In the event of a conflict, the order of precedence shall be: (a) the applicable Order Form or PS Order Form; (b) the DPA, solely with respect to the processing of personal data; (c) Exhibit B (Professional Services Terms), solely with respect to Professional Services; (d) any product-specific terms or service level commitments; and (e) this Agreement.

2.7. Professional Services. Chainloop may provide Professional Services to Customer pursuant to one or more PS Order Forms executed under this Agreement. Professional Services are subject to additional fees as set out in the applicable PS Order Form and are governed by the Professional Services Terms set out in Exhibit B. The hosted SaaS Services and Professional Services are distinct offerings; access to and use of the hosted SaaS Services is governed exclusively by Part 1 of this Agreement and is not contingent on, or expanded by, any Professional Services engagement.

3. Pricing

3.1. Fees. Customer will pay all Fees specified for the applicable Subscription Plan or in the applicable Order Form. Except as expressly stated in this Agreement or the applicable Order Form, all Fees are non-cancelable and non-refundable.

3.2. Subscription Plan change. Customer may upgrade their Subscription Plan at any time, effective immediately with fees prorated for the current billing period. Downgrades take effect at the next billing period, with no refund for the current billing period.

3.3. Credits. Each Subscription Plan includes a monthly allocation of Credits that resets each billing period and does not roll over. Customer can buy additional Credits, which do not expire while Customer's account is active. Credits are deducted based on actual usage at the rates in effect at the time of use, consuming included Credits first, then promotional Credits, then purchased Credits. Published cost estimates are for planning only. If Customer's balance is insufficient, usage-based features pause until Credits are replenished; Chainloop will not delete Customer Data for that reason during the Subscription Term. Unless stipulated otherwise in an Order Form, Credits are shared across the Organization, have no cash value, are non-transferable and non-refundable, and are forfeited when the Agreement ends.

3.4. Taxes. Fees are exclusive of all sales, use, value-added, withholding, GST, VAT, or similar taxes, levies, duties, or assessments imposed by any governmental authority, other than taxes based on Chainloop's net income. Customer is responsible for all such taxes. If Chainloop has a legal obligation to pay or collect taxes for which Customer is responsible, Chainloop may invoice Customer for such amounts and Customer will pay them unless Customer provides a valid tax exemption certificate.

3.5. Payment method. Authorization. If Customer purchases through Chainloop's website, Customer authorizes Chainloop and its third-party payment processors to charge Customer's designated payment method for all Fees due on the applicable billing cycle. If payment is not successfully settled, Chainloop may suspend or terminate access to the Services in accordance with Section 12.

3.6. Automatic Renewal. Unless otherwise stated in an applicable Order Form, each subscription will automatically renew for successive periods equal to the expiring Subscription Term unless Customer cancels through account settings or provides written notice of non-renewal at least 30 days before the end of the then-current Subscription Term.

3.7. Price changes. Chainloop may modify Fees upon at least 30 days' prior notice by email or account dashboard notification. Any price change will take effect at the start of the next renewal term and will not apply during the then-current prepaid Subscription Term, unless otherwise stated in an applicable Order Form.

3.8. Continued Use. By continuing to use the Services after the effective date of a price change, you agree to the new fees. If you do not agree to the price adjustment, you may cancel your subscription in accordance with the "Termination" section of this Agreement before the new pricing goes into effect.

3.9. Third-Party Marketplaces. If Customer purchases the Services through an authorized reseller or marketplace, the pricing, payment, renewal, and refund terms of that reseller or marketplace may apply to the extent not inconsistent with this Agreement, and Customer remains responsible for any unpaid amounts due for access to the Services.

4. Access and Use

4.1. Subscription Rights. Subject to Customer's compliance with this Agreement and payment of all applicable Fees, Chainloop grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the applicable Subscription Term to access and use the Services and Documentation solely for Customer's internal business purposes. No ownership rights are conveyed to Customer, and all rights not expressly granted are reserved by Chainloop and its licensors.

4.2. Accounts and Organizations. Customer is responsible for all activities occurring under its accounts and Organization(s) and for maintaining the confidentiality of account credentials. Customer will ensure that all information provided in connection with account creation and administration is accurate and current.

Customer acknowledges that: (a) each Organization is provisioned for and controlled by Customer; (b) Authorized Users invited by Customer into an Organization may also participate in Organizations controlled by other customers; and (c) a User Account belongs to the individual Authorized User and persists independently of any single Organization or Customer relationship — the implications for personal data processing are set out in the DPA.

4.3. Account suspension. Chainloop may suspend or restrict Customer's access to the Services, in whole or in part, immediately upon notice or, where reasonably necessary, without prior notice, if: (a) Customer breaches this Agreement; (b) Customer's use of the Services poses a security risk to the Services or any third party; (c) Customer's use may adversely impact other customers or Chainloop's systems; (d) Chainloop reasonably suspects fraud, abuse, unlawful conduct, or unauthorized access; (e) required by law, regulation, court order, or governmental request; or (f) Fees are overdue by more than 10 days. Where the basis for suspension is remediable and does not require immediate action, Chainloop will use commercially reasonable efforts to provide Customer with notice and an opportunity to cure before suspension.

4.4. Use Restrictions. Customer shall not, and shall not permit any third party to: (a) copy, modify, or create derivative works of the Services or Documentation; (b) rent, lease, sell, sublicense, assign, distribute, publish, or otherwise make the Services available to any third party except Authorized Users acting on Customer's behalf; (c) reverse engineer, decompile, disassemble, decode, or otherwise attempt to derive source code, underlying ideas, algorithms, or structure of the Services, except to the limited extent prohibited by applicable law; (d) access or use the Services to build, benchmark, train, improve, or operate a competing product or service; (e) publish or disclose any benchmark or performance information relating to the Services without Chainloop's prior written consent; (f) use any robot, scraper, crawler, data mining tool, or similar automated means to access the Services except through expressly authorized interfaces; (g) circumvent or attempt to circumvent any usage limits, security protections, authentication measures, or access controls; (h) use the Services for activities where use or failure of the Services could reasonably be expected to lead to death, personal injury, or significant property damage; or (i) use the Services in violation of applicable law or third-party rights.

4.5. Open Source Components. The Services may include software components subject to open source licenses ("Open Source Components"). Open source license terms apply only to the applicable Open Source Components and do not grant Customer any rights in the hosted Services except as expressly set forth in this Agreement. Chainloop disclaims all liability relating to Customer's use of Open Source Components.

4.6. APIs and integrations. Customer may use application programming interfaces, integrations, or interoperability features that Chainloop expressly makes available as part of the Services, subject to applicable Documentation and usage limits. Customer will not use any undocumented API, unsupported access method, or other unauthorized means to access, query, or interface with the Services. Chainloop may modify, limit, suspend, or discontinue any API or integration feature at any time.

4.7. Third-Party Services. The Services may interoperate with third-party applications, services, repositories, identity providers, or other products not provided by Chainloop ("Third-Party Services"). If Customer enables or uses any Third-Party Service with the Services, Customer authorizes Chainloop to permit the Third-Party Service and its provider to access Customer Data as required for interoperability. Chainloop does not control and is not responsible for any Third-Party Service, including its security, availability, or processing of data, and Customer's use of any Third-Party Service is subject solely to the terms between Customer and the applicable third-party provider.

4.8. Usage Data. Chainloop may collect and use Usage Data to operate, secure, support, improve, and analyze the Services and for other lawful business purposes. Usage Data will not identify Customer, any Authorized User, or include Customer Confidential Information.

5. Customer Data and privacy

5.1. Customer Ownership of Customer Data. As between the parties, Customer retains all right, title, and interest in and to all Customer Data. Except for the limited rights expressly granted in this Agreement and the DPA, no rights in Customer Data are granted to Chainloop.

5.2. License to Customer Data. Customer grants Chainloop a non-exclusive, worldwide, limited right during the Subscription Term to host, copy, process, transmit, display, and use Customer Data solely as necessary to provide, maintain, secure, support, and improve the Services, to prevent or address technical or security issues, and as otherwise required by applicable law.

5.3. Service-Generated Artifacts. To the extent the Services generate reports, dashboards, attestations, analyses, or similar outputs based on Customer Data, such outputs will be deemed Customer Data, excluding any underlying Services, software, models, algorithms, know-how, Usage Data, or Chainloop technology incorporated therein or used to generate them.

5.4. Customer Responsibilities for Customer Data. Customer is solely responsible for the accuracy, quality, legality, and means by which it acquired Customer Data, and for ensuring it has all rights, consents, and permissions necessary for Chainloop to process Customer Data in accordance with this Agreement and the DPA.

5.5. Privacy and Data Protection. To the extent Chainloop processes personal data in connection with the Services, such processing is governed by the DPA set out in Attachment 1 of this Agreement and by Chainloop's Privacy Policy available at https://chainloop.dev/privacy. The DPA sets out the respective roles of Customer as data controller and Chainloop as data processor, the basis for international data transfers, and applicable technical and organizational security measures.

Customer acknowledges the distinction between: (a) Customer Personal Data processed by Chainloop as data processor within Customer's Organization(s), which is governed by the DPA; and (b) personal data associated with individual Authorized Users' User Accounts, which Chainloop processes as an independent data controller in accordance with its Privacy Policy, and which persists independently of any single Customer's Organization.

5.6. Security. Chainloop will maintain commercially reasonable administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, use, alteration, or disclosure, as further described in Annex 2 of the DPA. Chainloop will notify Customer of confirmed security incidents affecting Customer Personal Data in accordance with Section 6 of the DPA.

5.7. No Marketing Use. Chainloop will not use Customer Data for marketing or promotional purposes without Customer's prior written consent.

5.8. Prohibited Data Categories. Unless otherwise expressly agreed in writing, Customer shall not submit to the Services any special categories of personal data, data relating to children under the age of 13, protected health information subject to HIPAA, payment card data subject to PCI DSS, government-issued identification numbers, or other sensitive personal data requiring heightened protections not expressly supported by the Services. Further detail is set out in Section 2.5 of the DPA.

6. Intellectual Property

6.1. Chainloop ownership. All rights, title, and interest in and to the Services, Documentation, and all related software, technology, data, algorithms, and materials, and all intellectual property rights therein, are and will remain with Chainloop and its licensors. No right, title, or interest in or to the Services or Documentation is transferred to Customer, and all rights not expressly granted are reserved by Chainloop.

6.2. Customer responsibility for Third-Party IP. Customer shall ensure it has appropriate permissions or licenses for any third-party software, content, or intellectual property that it uses in connection with the Services.

6.3. Feedback. If Customer or any Authorized User provides suggestions, ideas, enhancement requests, recommendations, or other feedback relating to the Services ("Feedback"), Chainloop may use and exploit such Feedback without restriction or obligation, provided that Feedback does not include Customer Confidential Information. Customer hereby assigns to Chainloop all right, title, and interest (including all intellectual property rights) in and to any Feedback.

7. Service Levels and Support.

7.1. Service Levels. Support services, response targets, and service level commitments, if any, are those expressly stated in the applicable Subscription Plan, support policy, or Order Form. Unless expressly stated otherwise in an applicable Order Form, the Services are provided on an as-available basis and no specific uptime, response time, or service credit commitment applies.

7.2. Maintenance. Chainloop may perform scheduled or emergency maintenance that may temporarily affect availability of the Services. Chainloop will use commercially reasonable efforts to provide advance notice of scheduled maintenance where practicable.

7.3. Beta Services. Beta Services are optional, may be discontinued at any time without notice, are provided "as is" and "as available," and are excluded from any service levels, indemnities, and any warranties or commitments under this Agreement to the maximum extent permitted by law.

8. DISCLAIMERS

8.1. GENERAL DISCLAIMER. EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT, THE SERVICES, DOCUMENTATION, BETA SERVICES, AND ALL RELATED MATERIALS ARE PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE MAXIMUM EXTENT PERMITTED BY LAW, CHAINLOOP DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING, BUT NOT LIMITED TO WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE (EVEN IF YOU HAVE BEEN INFORMED OF SUCH PURPOSE), AND ALL WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE. WITHOUT LIMITING THE FOREGOING, THE COMPANY MAKES NO WARRANTY OF ANY KIND THAT THE SERVICES OR DOCUMENTATION, OR ANY PRODUCTS OR RESULTS OF THE USE THEREOF, WILL MEET CUSTOMER’S OR OTHER PERSONS’ REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, ACHIEVE ANY INTENDED RESULT, BE COMPATIBLE OR WORK WITH ANY SOFTWARE, SYSTEMS, OR OTHER SERVICES, OR BE SECURE, ACCURATE, COMPLETE, FREE OF HARMFUL CODE AND DEFECT OR BE ERROR-FREE OR CONCERNING THE ACCURACY OF INSIGHTS, POLICY VIOLATION DETECTION, OR COMPLIANCE REPORTS GENERATED WITHIN THE SERVICES.

8.2. AI and machine learning features. To the extent the Services include machine learning, artificial intelligence, or automated analysis features, Customer acknowledges that outputs generated by such features may be probabilistic, incomplete, inaccurate, or unsuitable for Customer's intended use. Customer is solely responsible for reviewing and validating such outputs before relying on them. Chainloop is not liable for Customer’s reliance on, or decisions made on the basis of, outputs generated by such features, except where liability cannot be excluded under applicable law.

9. LIMITATION OF LIABILITY

9.1. EXCLUSION OF CERTAIN DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES, LICENSORS, OR SUPPLIERS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUES, GOODWILL, BUSINESS INTERRUPTION, LOSS OR CORRUPTION OF DATA, OR COST OF SUBSTITUTE SERVICES, ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT, OR OTHERWISE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

9.2. MASTER LIABILITY CAP. TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE TOTAL AGGREGATE LIABILITY OF CHAINLOOP AND ITS AFFILIATES, LICENSORS, AND SUPPLIERS FOR ANY CLAIMS, LOSSES, COSTS (INCLUDING ATTORNEY’S FEES) AND OTHER DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT WILL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER TO CHAINLOOP DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM OR IN CASE OF SERVICES OR SUBSCRIPTION PLANS OFFERED FREE OF CHARGE THE AMOUNT OF USD 100.

9.3. PROFESSIONAL SERVICES LIABILITY CAP. WHERE A CLAIM ARISES SOLELY FROM OR RELATES SOLELY TO PROFESSIONAL SERVICES DELIVERED UNDER A SPECIFIC PS ORDER FORM, THE CAP SHALL BE LIMITED TO THE PS FEES PAID OR PAYABLE UNDER THAT PS ORDER FORM DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, UNLESS A HIGHER CAP IS EXPRESSLY STATED IN THAT PS ORDER FORM. FOR THE AVOIDANCE OF DOUBT, ANY LIABILITY INCURRED IN CONNECTION WITH PROFESSIONAL SERVICES SHALL COUNT TOWARD, AND SHALL NOT INCREASE, THE AGGREGATE LIABILITY CAP SET FORTH IN SECTION 9.2. IN NO EVENT SHALL CHAINLOOP’S TOTAL, COMPREHENSIVE, AND AGGREGATE LIABILITY UNDER THIS AGREEMENT - INCLUDING FOR ALL SERVICES, PROFESSIONAL SERVICES, AND DELIVERABLES COMBINED - EXCEED THE MAXIMUM AMOUNT ESTABLISHED UNDER SECTION 9.2.

9.4. EXCEPTIONS. THE EXCLUSIONS AND LIMITATIONS IN THIS SECTION 9 WILL NOT APPLY TO: (A) CUSTOMER'S PAYMENT OBLIGATIONS; (B) CUSTOMER'S BREACH OF SECTION 4.4 (USE RESTRICTIONS); (C) CUSTOMER'S OBLIGATIONS UNDER SECTION 11 (CUSTOMER INDEMNIFICATION); OR (D) LIABILITY THAT CANNOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW.

9.5. BASIS OF THE BARGAIN. THE PARTIES ACKNOWLEDGE THAT THE FEES REFLECT THE ALLOCATION OF RISK SET FORTH IN THIS AGREEMENT AND THAT THIS SECTION 9 IS AN ESSENTIAL BASIS OF THE BARGAIN BETWEEN THE PARTIES.

10. INTELLECTUAL PROPERTY INDEMNIFICATION

10.1. Chainloop indemnity. Chainloop will defend Customer against any third-party claim alleging that Customer's authorized use of the Services infringes or misappropriates such third party's United States patent, copyright, trademark, or trade secret rights, and will pay any damages, costs, and reasonable attorneys' fees finally awarded against Customer by a court of competent jurisdiction, or agreed in settlement by Chainloop, as a result of such claim.

Notwithstanding the foregoing, Chainloop will have no obligation to indemnify or defend Customer to the extent any Claim is based upon or arises from Open Source Components utilized within Chainloop Platform, and your sole remedy with respect to such components will be governed by the applicable open source license terms.

10.2. Conditions of Indemnification. Chainloop's obligations under this Section 10 are conditioned on Customer: (a) promptly notifying Chainloop in writing of the claim (and in no event later than ten (10) days after first learning of it); (b) granting Chainloop sole control of the defense and settlement, except that Chainloop may not settle any claim that admits fault or imposes non-monetary obligations on Customer without Customer's prior written consent, not to be unreasonably withheld; and (c) providing reasonable cooperation at Chainloop's expense.

10.3. Exclusions. Chainloop will have no obligation under this Section 10 to the extent a claim arises from: (a) Customer Data; (b) Third-Party Services or third-party materials; (c) any modification of the Services not made by or for Chainloop; (d) use of the Services in combination with products or data not provided by Chainloop, if the claim would not have arisen but for such combination; (e) use of the Services outside the scope of this Agreement or contrary to the Documentation; (f) use of a superseded version of the Services after Chainloop has made a materially equivalent non-infringing replacement available; or (g) Open Source Components.

10.4. Remedies. If the Services are, or in Chainloop’s opinion are likely to become, subject to a claim under this Section 10, Chainloop may, at its option and expense: (a) procure for Customer the right to continue using the affected Services; (b) modify or replace the affected Services to make them non-infringing without materially reducing their functionality; or (c) terminate Customer’s right to use the affected Services and refund any prepaid, unused Fees for the terminated portion of the applicable Subscription Term.

10.5. SOLE AND EXCLUSIVE REMEDY. THIS SECTION 10 STATES THE ENTIRE LIABILITY OF CHAINLOOP, AND CUSTOMER’S SOLE AND EXCLUSIVE REMEDY, WITH RESPECT TO ANY THIRD-PARTY INTELLECTUAL PROPERTY INFRINGEMENT CLAIMS.

10.6. Exclusion of indemnity. Provisions of this Section 10 do not apply and Chainloop will not be obliged to indemnify the Customer in any way in case the Customer uses any Services or Subscription Plans offered free of charge.

11. Customer Indemnification

11.1. Customer Indemnity. Customer will defend, indemnify, and hold harmless Chainloop, its affiliates, and their respective officers, directors, employees, contractors, and agents from and against any third-party claims, actions, proceedings, damages, liabilities, losses, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) Customer Data, including any allegation that Customer Data infringes, misappropriates, or otherwise violates a third party's rights or applicable law; (b) Customer's or any Authorized User's use of the Services in violation of this Agreement, the Documentation, or applicable law; (c) Customer's configuration of, or combination of the Services with, any Third-Party Service, data, or materials not provided by Chainloop, to the extent giving rise to the claim; or (d) Customer's breach of Section 14 (Export Control).

11.2. Procedure. Chainloop will: (i) promptly notify Customer of any claim under this Section 11; (ii) give Customer sole control of the defense and settlement, except that Customer may not settle any claim that admits fault or imposes non-monetary obligations on Chainloop without Chainloop's prior written consent, not to be unreasonably withheld; and (iii) provide reasonable cooperation at Customer's expense.

12. Term and Termination

12.1. Term. This Agreement begins on the date Customer first accepts it and continues until all Subscription Terms have expired or been terminated.

12.2. Cancellation. For subscriptions purchased via Chainloop's website or a third-party marketplace, Customer may cancel through account settings at any time, effective at the end of the current billing cycle. No refunds will be issued for partial periods. For subscriptions governed by an Order Form, Customer may only cancel or elect not to renew as expressly permitted in that Order Form. Unless otherwise specified in an Order Form, either party may elect not to renew by providing written notice at least 30 days prior to the end of the then-current term.

12.3. Termination by Chainloop. Chainloop may terminate this Agreement or an affected Order Form upon written notice if: (i) Customer materially breaches this Agreement and fails to cure the breach within 14 days after receiving written notice; (ii) Customer becomes insolvent or bankrupt; or (iii) Fees payable under an Order Form or under this Agreement remain unpaid for more than 14 days following receipt of a demand for payment. Chainloop may terminate immediately upon notice if Customer materially breaches Section 4.4 (Use Restrictions) or Section 14 (Export Control), or if Customer's breach creates a material security, legal, or operational risk.

12.4. Termination by you. Customer may terminate this Agreement: (i) for convenience only if and to the extent expressly permitted in an applicable Order Form; or (ii) for material breach by Chainloop not cured within 30 days following Chainloop's receipt of Customer's written notice.

12.5. Suspension for Non-Payment. Chainloop reserves the right to suspend Customer's access to the Services immediately if any Fees are more than 10 days overdue. Suspension is not termination; Customer remains responsible for all Fees incurred during the suspension period.

12.6. Effect of Termination. Upon expiration or termination of this Agreement or an applicable Order Form: (a) Customer's rights to access and use the affected Services will immediately cease; (b) Customer will remain liable for all Fees and other amounts accrued through the effective date of termination; and (c) each party will return or destroy the other party's Confidential Information, except as otherwise permitted by this Agreement.

12.7. Customer Data retrieval and deletion. For 30 days following expiration or termination of the applicable Subscription Term, Chainloop may make Customer Data available to Customer for export or retrieval using the standard features of the Services, subject to Customer's payment of all outstanding Fees. Thereafter, Chainloop may delete Customer Data as set out in Section 10.2 of the DPA.

Termination of Customer's account or deletion of Customer's Organization affects only Customer Data within that Organization. It does not constitute an instruction to delete any Authorized User's User Account. If an Authorized User remains active in other Organization(s) on the Services, their User Account will persist and be handled in accordance with Chainloop's Privacy Policy.

12.8. Survival. Sections 1, 3 (accrued payment obligations), 5.1, 6, 8, 9, 10, 11, 12.6, 12.7, 13, 14, 15, 16, and 17, and any other provisions that by their nature should survive, will survive expiration or termination of this Agreement.

13. Modifications.

Chainloop may update this Agreement from time to time. Chainloop will provide reasonable advance notice of any material change by email, through the Services, or by other reasonable means, except that changes required by applicable law or to address a security risk may take effect on shorter notice. Changes take effect on the effective date stated in the notice. For subscriptions purchased through Chainloop’s website or a third-party marketplace, Customer’s continued use of the Services after the effective date constitutes acceptance of the revised Agreement. For subscriptions governed by an Order Form, the revised Agreement applies from the start of the next renewal term, and any terms individually agreed in the Order Form prevail over the revised Agreement.

14. Export Control.

You acknowledge and agree that the Chainloop Services may be subject to United States export control and sanctions laws and regulations, including sanctions regimes administered by the Office of Foreign Assets Control (OFAC). You shall not, directly or indirectly, sell, export, re-export, transfer, divert, or otherwise dispose of any software, technology, or product received from us to any destination, entity, or person prohibited by the laws or regulations of the United States, without obtaining prior authorization from the competent government authorities as required by those laws and regulations. You further warrant that you are not on any government list of prohibited or restricted parties or located in, under the control of, or a national or resident of any country to which the United States has embargoed goods or services as of the date of acceptance of this Agreement. If your status changes such that you are no longer eligible to use the Chainloop Services, you must notify us immediately of that and cease all further use of the Chainloop Services.

15. Governing Law. Jurisdiction.

15.1. Choice of law. This Agreement and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation will be governed by and construed in accordance with the laws of the State of Delaware, without regard to its choice of law principles.

15.2. Jurisdiction. The federal and state courts located in Wilmington, Delaware will have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with this Agreement or its subject matter or formation.

15.3. WAIVER OF TRIAL BY JURY. EACH PARTY HEREBY KNOWINGLY, VOLUNTARILY, AND INTENTIONALLY WAIVES, TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, ANY RIGHT IT MAY HAVE TO A TRIAL BY JURY IN RESPECT OF ANY LITIGATION (INCLUDING BUT NOT LIMITED TO ANY CLAIMS, COUNTERCLAIMS, CROSS-CLAIMS, OR THIRD-PARTY CLAIMS) ARISING OUT OF, UNDER, OR IN CONNECTION WITH THIS AGREEMENT.

15.4. CLASS ACTION WAIVER. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT ANY CLAIM ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL BE BROUGHT ONLY IN THAT PARTY'S INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, MASS, REPRESENTATIVE, OR PRIVATE ATTORNEY GENERAL PROCEEDING.

16. Confidentiality

16.1. Definition. "Confidential Information" means any non-public information disclosed by one party ("Discloser") to the other ("Recipient") that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure, including business plans, product plans, technical information, security information, pricing, and the terms of this Agreement. Customer Data is the Confidential Information of Customer.

16.2. Obligations. Recipient will use the same degree of care that it uses to protect its own confidential information of similar nature, and in no event less than reasonable care, to: (i) protect Discloser's Confidential Information from unauthorized use, access, or disclosure; and (ii) use Discloser's Confidential Information only as necessary to perform or exercise rights under this Agreement.

16.3. Exclusions. Confidential Information does not include information that Recipient can demonstrate: (i) is or becomes publicly available without breach of this Agreement; (ii) was known to Recipient without restriction before disclosure; (iii) is received from a third party without breach of any confidentiality obligation; or (iv) is independently developed without use of or reference to the Confidential Information.

16.4. Compelled Disclosure. Recipient may disclose Confidential Information to the extent required by law, regulation, or court order, provided that, unless legally prohibited, Recipient gives Discloser prompt notice and reasonable assistance to seek confidential treatment or a protective order.

16.5. Equitable Relief. Each party acknowledges that unauthorized disclosure of Confidential Information may cause irreparable harm for which monetary damages may be insufficient, and that the Discloser may seek equitable relief in addition to any other available remedies.

17. Miscellaneous.

17.1. Entire agreement. This Agreement (including all Order Forms, the DPA, Exhibit B, and Supplemental Terms) constitutes the entire agreement between Customer and Chainloop with respect to its subject matter and supersedes all prior and contemporaneous agreements, representations, and understandings.

17.2. Order Form Precedence. In the event of any conflict between the terms of this Agreement and the terms of an executed Order Form, the terms of the Order Form will prevail, subject to Section 2.6.

17.3. Force Majeure. If the performance of this Agreement or any obligation hereunder (other than payment obligations) is prevented or restricted by reasons beyond the reasonable control of a party, including acts of nature, labor disputes, electrical or telecommunications failures, earthquakes, storms, embargoes, riots, acts of government, acts of terrorism, war, or cyber-attacks, the affected party will be exempt from such performance and liability to the extent of such prevention or restriction, provided it notifies the other party within five (5) business days and uses commercially reasonable efforts to mitigate the effect.

17.4. Waiver and Severability. Any waiver or failure to enforce any provision of this Agreement on one occasion will not be deemed a waiver of any other provision or of such provision on any other occasion. If any provision of this Agreement is held unenforceable, such provision will be modified to the minimum extent necessary to make it enforceable and the remaining provisions will continue in full force.

17.5. Assignment. Customer may not assign or transfer this Agreement without Chainloop's prior written consent, except to an affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of Customer's assets, provided Customer gives prompt written notice and the assignee agrees in writing to be bound by this Agreement. Any prohibited assignment is null and void. Chainloop may assign this Agreement, in whole or in part, without Customer's consent to an affiliate or in connection with a merger, acquisition, or sale of all or substantially all of its assets.

17.6. Notices. All notices must be in writing and addressed to the parties at the addresses set forth on the Order Form or as otherwise designated. Notices must be delivered by personal delivery, nationally recognized overnight courier, or certified or registered mail. A notice is effective only upon receipt by the receiving party.

17.7. Publicity. By accepting this Agreement, you grant Chainloop the right to use your company name and logo as a reference for marketing or promotional purposes on our website and in other public or private communications, subject to your standard trademark usage guidelines. You may revoke this right at any time by emailing us at [email protected].

17.8. Interpretation. Section and subsection headings are for convenience only and do not affect interpretation of this Agreement.

ATTACHMENT 1 — DATA PROCESSING ADDENDUM

This Attachment 1 forms an integral part of the Agreement and is incorporated by reference into Part 1. Capitalized terms not defined herein have the meanings given in Part 1 of the Agreement. In the event of a conflict between this DPA and Part 1 on matters of data protection, this DPA shall control.

1. Definitions

(a) "Applicable Data Protection Law" means all worldwide data protection, privacy, and security laws and regulations applicable to the Processing of Personal Data under this DPA, including: (a) the GDPR; (b) the UK GDPR; (c) the Swiss FADP; and (d) United States State Privacy Laws.

(b) "Controller" means the natural or legal person that determines the purposes and means of the Processing of Personal Data. The equivalent term under the CCPA is "Business”.

(c) "Customer Personal Data" means any Personal Data submitted to, transmitted through, stored on, or otherwise Processed by Chainloop on behalf of Customer or its Authorized Users within Customer's Organization(s) in connection with the provision of the Services. Customer Personal Data does not include personal data associated with an Authorized User's User Account to the extent that such data relates to the User Account independently of Customer's Organization (e.g., account credentials, profile information, or membership in other Organizations controlled by third-party customers), which Chainloop Processes as an independent Controller.

(d) "Data Privacy Framework" or "DPF" means the EU-U.S. Data Privacy Framework, the UK Extension thereto, and/or the Swiss-U.S. Data Privacy Framework, as applicable, administered by the U.S. Department of Commerce

(e) "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.

(f) "EU SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission in Commission Implementing Decision (EU) 2021/914, as may be updated or replaced from time to time.

(g) "GDPR" means the General Data Protection Regulation (EU) 2016/679.

(h) "Personal Data" has the meaning given to it under Applicable Data Protection Law. Under the GDPR, this means any information relating to an identified or identifiable natural person. The equivalent term under the CCPA is "Personal Information."

(i) "Processing" / "Process" means any operation or set of operations performed on Personal Data, whether or not by automated means.

(j) "Processor" means a natural or legal person that Processes Personal Data on behalf of a Controller. The equivalent terms under the CCPA are "Service Provider" and "Contractor," as applicable.

(k) "Restricted Transfer" means any transfer of Customer Personal Data from the EEA, the United Kingdom, or Switzerland to a third country for which Applicable Data Protection Law requires a valid transfer mechanism.

(l) "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data Processed by Chainloop under this DPA. Security Incident excludes unsuccessful attempts that do not result in actual unauthorized access.

(m) "Subprocessor" means any third-party Processor engaged by Chainloop to Process Customer Personal Data on behalf of Customer in connection with the provision of the Services.

(n) "Supervisory Authority" means the competent data protection authority under Applicable Data Protection Law, including the relevant EU Member State authority, the UK ICO, and the Swiss FDPIC.

(o) "Swiss FADP" means the Swiss Federal Act on Data Protection.

(p) "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office (version B1.0, in force 21 March 2022), as may be updated or replaced by the ICO.

(q) "UK GDPR" means the UK Data Protection Act 2018 and the GDPR as retained and amended in UK law.

(r) "United States State Privacy Laws" means all applicable U.S. state comprehensive privacy laws, including the CCPA/CPRA, and the comprehensive privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Montana, Oregon, and any other applicable U.S. state privacy law.

2. Roles and scope of processing

2.1. Role of the Parties. As between the parties, Customer is the Controller (or Business) and Chainloop is the Processor (or Service Provider / Contractor, as applicable) of Customer Personal Data Processed by Chainloop on Customer's behalf within Customer's Organization(s).

Notwithstanding the foregoing, Chainloop acts as an independent Controller with respect to: (a) User Accounts — personal data associated with an Authorized User's User Account at the platform level (including account credentials, profile information, email address, and Organization membership records), because an Authorized User may participate in multiple Organizations controlled by different Customers and the User Account is not owned or controlled by any single Customer; and (b) other operational purposes — account administration, billing and invoicing, fraud prevention, security monitoring, abuse prevention, legal compliance, and corporate recordkeeping, only to the extent permitted by Applicable Data Protection Law. Customer's rights under this DPA do not extend to the personal data of a User Account where that User Account remains active in Organizations not controlled by Customer. Chainloop's Processing of User Account data is governed by Chainloop's Privacy Policy.

2.2. Scope and Purpose of Processing. Chainloop shall Process Customer Personal Data solely on behalf of, and in accordance with, the documented lawful instructions of Customer, including as set forth in the Agreement, this DPA, and Customer's configuration and use of the Services and Customer's Organization(s). The subject matter, duration, nature, purpose, categories of Personal Data, and categories of Data Subjects are described in Annex 1. Chainloop shall not Process Customer Personal Data for any purpose other than those specified unless required by applicable law.

2.3. Documented Instructions and Unlawful Instruction Handling. Customer’s instructions to Chainloop are set out in this DPA and the Agreement. If Chainloop determines that an instruction infringes Applicable Data Protection Law, Chainloop shall inform Customer without undue delay.

2.4. Customer Responsibilities. Customer warrants that: (a) it has provided all required notices and obtained all necessary rights, consents, permissions, and lawful bases required under Applicable Data Protection Law to enable Chainloop to Process Customer Personal Data in accordance with this DPA; (b) its instructions comply with Applicable Data Protection Law; (c) it is solely responsible for the accuracy, quality, legality, and means by which it acquired Customer Personal Data; and (d) it will not submit Customer Personal Data that it does not have the right to share with Chainloop for the purposes set out in this DPA.

2.5. Prohibited Data Categories. Unless otherwise expressly agreed in writing, Customer shall not submit to the Services: (a) special categories of personal data as defined in Article 9 GDPR; (b) personal data of children under the age of 13; (c) protected health information subject to HIPAA; (d) payment card data subject to PCI DSS; (e) government-issued identification numbers; or (f) other sensitive personal data requiring heightened protections not expressly supported by the Services. Customer assumes sole responsibility for any such data submitted in breach of this Section 2.5.

3. Security personnel

3.1. Technical and Organizational Measures. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk to the rights and freedoms of natural persons, Chainloop shall implement and maintain appropriate technical and organizational measures ("TOMs") designed to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR and equivalent requirements under Applicable Data Protection Law. A description of Chainloop's current TOMs is set out in Annex 2. Customer acknowledges that security measures evolve over time and Chainloop may update the TOMs from time to time, provided such updates do not materially reduce the overall security of the Services during the then-current Subscription Term.

3.2. Confidentiality of Personnel. Chainloop shall ensure that all personnel authorized to Process Customer Personal Data: (a) are subject to appropriate confidentiality obligations; (b) receive relevant data protection and security training appropriate to their role; and (c) Process Customer Personal Data only on Chainloop's instructions, except where required by applicable law.

3.3. Data Minimization and Retention. Chainloop shall Process only such Customer Personal Data as is necessary for the purposes set out in this DPA and the Agreement, and shall not retain Customer Personal Data longer than necessary for those purposes or as required by applicable law.

4. Subprocessors

4.1. General Authorization. Customer provides general written authorization for Chainloop to engage Subprocessors in connection with the provision of the Services. Chainloop's current list of Subprocessors is made available on Chainloop's website at https://trust.chainloop.dev/.

4.2. Notice of Changes. Chainloop shall notify Customer of any intended addition or replacement of a Subprocessor at least fourteen (14) days before the new or replacement Subprocessor begins Processing Customer Personal Data. Notice may be provided by email, in-product notification, or by updating the Subprocessor List. In exceptional and unforeseeable circumstances where the security of data and systems is at risk, and where adherence to the procedure outlined in point 4.2 would significantly impede the necessary safeguarding of such security, Chainloop reserves the right to engage a subprocessor without following the aforementioned procedure. In such cases, Chainloop will ensure that the engagement of the subprocessor is strictly necessary for the protection of the data and systems, Chainloop will adhere to obligations set forth in point 4.4 and will provide Customer with a relevant notice of engagement at the earliest possible opportunity.

4.3. Objections. Customer may object to Chainloop's use of a new or replacement Subprocessor on reasonable data protection grounds by written notice within fourteen (14) days of receipt of the notice under Section 4.2. The parties shall negotiate in good faith to address Customer's objection. If Chainloop cannot reasonably accommodate the objection within a further thirty (30) days, Chainloop may continue to use the Subprocessor, and Customer may terminate the affected Services by written notice, in which case Chainloop shall refund any prepaid, unused Fees for the terminated portion of the applicable Subscription Term on a pro-rated basis.

4.4. Downstream Obligations. Chainloop shall enter into a written agreement with each Subprocessor imposing data protection obligations materially no less protective than those set out in this DPA. Chainloop shall remain liable to the Customer for the performance of each Subprocessor's obligations to the extent required by Applicable Data Protection Law.

4.5. International Transfers by Subprocessors. Where a Subprocessor will Process Customer Personal Data in connection with a Restricted Transfer, Chainloop shall ensure that an appropriate transfer mechanism compliant with Applicable Data Protection Law is in place before the Subprocessor commences such Processing.

5. Data Subjects’ Rights and cooperation

5.1. Assistance with Data Subject Requests. Chainloop shall provide Customer with reasonable technical and organizational assistance to enable Customer to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law, to the extent such assistance relates to Customer Personal Data within Customer's Organization(s). Chainloop is responsible as an independent Controller for handling Data Subject requests that relate solely to a User Account, in accordance with Chainloop's Privacy Policy.

5.2. Direct Data Subject and Authority Requests. If Chainloop receives a request, complaint, or communication directly from a Data Subject or Supervisory Authority relating specifically to Customer Personal Data, Chainloop shall, unless prohibited by law: (a) promptly forward the request to Customer without acting on it; and (b) advise the Data Subject or authority to contact Customer directly. Chainloop shall not respond to any such request on Customer's behalf except on Customer's documented instructions or as required by applicable law.

5.3. DPIA, Prior Consultation, and Further Assistance. Chainloop shall, to the extent reasonably practicable and taking into account the nature of the Processing and the information reasonably available, provide Customer with reasonable assistance with: (a) security obligations under Article 32 GDPR or equivalent; (b) personal data breach notifications under Articles 33 and 34 GDPR or equivalent; (c) data protection impact assessments ("DPIAs") under Article 35 GDPR or equivalent; and (d) prior consultations with Supervisory Authorities under Article 36 GDPR or equivalent. Chainloop may charge Customer its reasonable costs for assistance that goes beyond Chainloop's standard obligations under this DPA.

6. Personal data breach notification

6.1. Notification Timeline. Chainloop shall notify Customer without undue delay and, where feasible, no later than forty-eight (48) hours after becoming aware of a Security Incident affecting Customer Personal Data.

6.2. Content of Notification. Such notification shall include, to the extent available at the time: (a) a description of the nature of the Security Incident, including the categories and approximate number of affected Data Subjects and categories and approximate volume of affected Customer Personal Data records; (b) the likely consequences of the Security Incident; (c) the measures taken or proposed by Chainloop to address and mitigate the Security Incident; and (d) a designated contact point at Chainloop for further information. Where not all information is available at initial notification, Chainloop shall provide material updates as additional information becomes available.

6.3. Mitigation and No Admission. Chainloop shall take commercially reasonable steps to contain, investigate, and mitigate any Security Incident. Notification of a Security Incident under this Section 6 does not constitute an admission of fault, negligence, or liability by Chainloop.

7. International data transfers

7.1. EU Standard Contractual Clauses. To the extent a Restricted Transfer is not covered by an adequacy decision or another valid transfer mechanism, the EU SCCs shall apply as follows: (a) Module Two (Controller to Processor) shall apply where Customer acts as a Controller and Chainloop acts as a Processor; (b) Module Three (Processor to Processor) shall apply where Customer acts as a Processor and Chainloop acts as a Subprocessor; (c) for Module Two and Module Three: Clause 7 (docking clause) shall apply; Clause 9 Option 2 (general written authorisation) shall apply with a notice period of fourteen (14) days; Clause 11 (optional redress) is not selected; Clause 17 governing law and Clause 18(b) forum shall be as specified in Annex 3; (d) the EU SCCs are deemed completed with the information set out in Annex 1, Annex 2, and Annex 3; and (e) in the event of a conflict between the EU SCCs and this DPA with respect to a Restricted Transfer, the EU SCCs shall prevail solely to the extent necessary to ensure the validity of the transfer mechanism.

7.2. UK Addendum. For Restricted Transfers originating in the United Kingdom, the UK Addendum shall apply to and modify the EU SCCs incorporated under Section 7.1. Table 1 shall be deemed completed with the party information in Annex 1; Table 2 shall reference the EU SCCs as completed under Section 7.1 and Annex 3; Table 3 shall be deemed completed with the information in Annex 1 and Annex 2; and either party may end the UK Addendum as set out in Section 19 of the UK Addendum (Table 4).

7.3. Swiss Transfers. For Restricted Transfers originating in Switzerland, the EU SCCs shall apply with the following modifications: (a) references to "Regulation (EU) 2016/679" shall include the Swiss FADP; (b) references to "EU," "Union," and "Member State law" shall be interpreted as references to Swiss law where required; (c) references to the "competent supervisory authority" shall include the FDPIC; and (d) references to "competent courts" shall permit the jurisdiction of the competent Swiss courts.

7.4. Supplementary Measures and Transfer Impact Assessments. Chainloop shall implement and maintain appropriate supplementary technical, organizational, and contractual safeguards for Restricted Transfers as required under Applicable Data Protection Law. Upon Customer's reasonable written request, Chainloop shall provide information reasonably available to assist Customer in conducting a transfer impact assessment ("TIA").

7.5. Government and Law Enforcement Access Requests. If Chainloop receives a legally binding request from a public authority or law enforcement agency for access to Customer Personal Data subject to a Restricted Transfer, Chainloop shall, to the maximum extent permitted by law: (a) promptly notify Customer before disclosing any Customer Personal Data; (b) review the legal validity of the request; and (c) use commercially reasonable efforts to challenge or limit the scope of the request where there are reasonable grounds to do so. Where legally prohibited from notifying Customer, Chainloop shall inform Customer of the existence of the prohibition as soon as legally permitted.

7.6. Replacement Transfer Mechanism. If any transfer mechanism relied upon under this DPA is modified, superseded, invalidated, or no longer legally sufficient, the parties shall cooperate in good faith to implement an alternative valid transfer mechanism without undue delay.

8. United States privacy laws addendum

8.1. Processor / Service Provider Status. To the extent Chainloop Processes Customer Personal Data subject to United States State Privacy Laws, Chainloop shall act as a Processor, Service Provider, or Contractor, as applicable, and shall Process Customer Personal Data only for the specific business purposes set out in the Agreement and this DPA, or as otherwise permitted under applicable United States State Privacy Laws.

8.2. Restrictions on Use. Chainloop certifies, represents, and warrants that it shall not: (a) Sell or Share Customer Personal Data as defined under applicable United States State Privacy Laws; (b) Process Customer Personal Data for purposes of targeted advertising, profiling producing legal or similarly significant effects, or for any commercial purpose unrelated to the business purposes in the Agreement and this DPA; (c) retain, use, or disclose Customer Personal Data outside the direct business relationship between Customer and Chainloop; or (d) combine Customer Personal Data received from Customer with Personal Data from any other source, except as permitted by applicable United States State Privacy Laws or as authorized by Customer.

8.3. Permitted Use Exceptions. Notwithstanding Section 8.2, Chainloop may Process Customer Personal Data for the following limited purposes to the extent permitted by applicable United States State Privacy Laws: (a) security, fraud prevention, and protecting against malicious, deceptive, fraudulent, or illegal actions; (b) debugging and repairing errors that impair intended functionality; (c) internal analytics and product improvement using only de-identified or aggregated data; (d) legal compliance; and (e) establishing, exercising, or defending legal claims.

8.4. Notice of Non-Compliance. Chainloop shall notify Customer without undue delay if Chainloop determines that it can no longer meet its obligations under applicable United States State Privacy Laws with respect to the Processing of Customer Personal Data. Upon such notice Customer reserves the right to take reasonable and appropriate steps to stop and remediate any unauthorized processing of Customer Personal Data by Chainloop.

8.5. Consumer Rights Assistance. Chainloop shall provide Customer with reasonable assistance to enable Customer to respond to verifiable consumer rights requests under applicable United States State Privacy Laws, using the administrative features of the Services where available.

8.6. Audit and Verification. Chainloop shall permit Customer to take reasonable and appropriate steps to verify that Chainloop's Processing of Customer Personal Data is consistent with Customer's obligations under applicable United States State Privacy Laws, in accordance with the audit rights set out in Section 9.

8.7. Privacy Risk Assessment Assistance. To the extent required by applicable United States State Privacy Laws, Chainloop shall provide Customer with reasonable cooperation and assistance in conducting privacy risk assessments or DPIAs relating to Chainloop's Processing of Customer Personal Data.

9. Audit rights

9.1. Reports and Certifications. Chainloop shall, upon Customer's reasonable written request and subject to appropriate confidentiality obligations, make available summaries or reports from its most recent independent third-party security audits and certifications relevant to the Services, including SOC 2 Type II reports or equivalent, to the extent relevant to Chainloop's compliance with this DPA.

9.2. On-Site and Independent Audits. To the extent information made available under Section 9.1 is insufficient to demonstrate Chainloop's compliance with this DPA, and only where specifically required by Applicable Data Protection Law, Customer may, no more than once per calendar year and upon at least thirty (30) days' prior written notice, request that Chainloop submit to an audit of Chainloop's relevant data processing procedures. Any such audit shall: (a) be conducted during normal business hours; (b) be subject to mutually agreed scope, timing, duration, and confidentiality restrictions; (c) not unreasonably interfere with Chainloop's operations; and (d) be conducted at Customer's sole expense, unless the audit reveals a material breach of this DPA by Chainloop.

9.3. Third-Party Auditors. Any third-party auditor used by Customer must be approved by Chainloop in advance (not to be unreasonably withheld or delayed) and must execute a non-disclosure agreement with Chainloop before commencing any audit activity.

9.4. Primacy of Audit Reports. If Chainloop's most recent audit report addresses the control objectives relevant to a requested audit, Customer agrees that such report shall satisfy the audit request for those control objectives, unless additional review is specifically required by Applicable Data Protection Law or a Supervisory Authority.

10. Term and data deletion / return

10.1. Term. This DPA shall remain in effect for the duration of the Agreement and until all Customer Personal Data in Chainloop's possession or control has been deleted or returned in accordance with this Section 10.

10.2. Return or Deletion. Upon termination or expiration of the Agreement, Chainloop shall, at Customer's written election made prior to the end of the applicable data retrieval period specified in the Agreement: (a) return all Customer Personal Data to Customer in a commonly used machine-readable format; or (b) securely delete all Customer Personal Data in Chainloop's possession or control. If Customer does not make an election within the applicable retrieval period, Chainloop shall delete Customer Personal Data in accordance with its standard data retention and deletion practices.

10.3. For the avoidance of doubt, Customer's termination, account closure, or deletion of an Organization affects only Customer Personal Data within that Organization. It does not constitute an instruction to delete a User Account or any personal data associated with an Authorized User's User Account to the extent that the Authorized User remains active in other Organizations on the Services. Chainloop will handle the deletion or deactivation of User Accounts in accordance with Chainloop's Privacy Policy and applicable law.

10.4. Retention Exceptions. Notwithstanding Section 10.2, Chainloop may retain Customer Personal Data: (a) in backup or archival systems until deleted in the ordinary course of Chainloop's backup schedule; (b) to the extent and for the period required by applicable law, regulation, or court order; or (c) as necessary to establish, exercise, or defend legal claims. In each case, Chainloop shall continue to protect the retained Customer Personal Data in accordance with this DPA.

10.5. Deletion Certification. Upon Customer's written request following deletion, Chainloop shall provide written certification confirming that Customer Personal Data has been deleted in accordance with this Section 10, to the extent technically feasible and subject to the retention exceptions in Section 10.4.

11. General provisions

11.1. Data Localization. Chainloop and its Subprocessors may Process Customer Personal Data in the jurisdictions in which they operate, subject to the international transfer mechanisms set out in Section 7. Chainloop's current processing locations are set out in the Subprocessor List referenced in Section 4.1.

11.2. Conflict. In the event of any conflict between this DPA and the Agreement on matters relating to data protection, this DPA shall control. In the event of any conflict between the EU SCCs or UK Addendum and this DPA with respect to Restricted Transfers, the EU SCCs or UK Addendum (as applicable) shall control solely to the extent of that conflict.

11.3. Governing Law. This DPA is governed by the laws stated in the Agreement, subject to any mandatory provisions of Applicable Data Protection Law. For matters arising solely under the EU SCCs or UK Addendum, the governing law and forum shall be as specified in those instruments and in Annex 3.

11.4. Updates to this DPA. Chainloop may update this DPA from time to time to reflect changes in Applicable Data Protection Law, regulatory guidance, or Chainloop's processing activities, provided that such updates do not materially diminish Customer's rights or protections under this DPA. Chainloop shall provide Customer with at least thirty (30) days' prior written notice of any material changes.

11.5. Acceptance. This DPA is incorporated into and forms part of the Agreement. By accepting the Agreement — whether by clicking "I agree," completing a registration or checkout flow, executing an Order Form that incorporates the Agreement, or otherwise accessing or using the Services — Customer agrees to be bound by this DPA. No handwritten or electronic signature is required for this DPA to take effect.

ANNEX 1 — DESCRIPTION OF PROCESSING ACTIVITIES

(Article 28(3) GDPR / EU SCCs Annex I / UK Addendum Table 3)

This Annex 1 forms part of this DPA and constitutes the information required by Article 28(3) GDPR, Annex I to the EU SCCs, and the equivalent requirements under the UK Addendum.

A. LIST OF PARTIES

Data Exporter (Controller / Processor):

Customer Name: As specified in the Order Form or during the registration process.

Address: As specified in the Order Form or during the registration process.

Contact / DPO: As specified in the Order Form or during the registration process.

Activities relevant to the transfer: Customer submits Customer Personal Data to the Services for software supply chain metadata management, continuous compliance monitoring, security attestation, and related workflows.

Role: Controller (or Processor, if Customer processes on behalf of a third-party controller).

Data Importer (Processor / Subprocessor):

Name: Chainloop, Inc.

Address: 1111B South Governors Avenue STE 7511 Dover, DE 19904 USA

Contact: [email protected]

Activities relevant to the transfer: Chainloop receives and Processes Customer Personal Data to provide, maintain, support, secure, and improve the Services.

Role: Processor (or Subprocessor, where Customer acts as Processor for a third-party controller).

B. DESCRIPTION OF TRANSFER

Subject matter: Provision of Chainloop's SaaS platform for software supply chain metadata management, continuous compliance monitoring, security attestation, and related workflows.

Duration: For the duration of the Agreement and as required for data deletion / return under Section 10 of this DPA.

Nature of processing: Collection, storage, access, use, analysis, display, transmission, and deletion of Customer Personal Data as necessary to provide, maintain, support, secure, and improve the Services.

Purpose(s) of processing: Delivery of the Services; provision of support; security monitoring and incident response; compliance with legal obligations; improvement of service quality (using de-identified / aggregated data only).

Categories of Personal Data:

(i) Within Customer's Organization(s) (Processed as processor for Customer): names, email addresses, job titles, IP addresses, usage logs, activity records within the Organization, and any other personal data Customer submits in connection with its software supply chain metadata and related workflows.

(ii) User Account data (Processed as independent Controller): email address, display name, account credentials (hashed), Organization membership records, login timestamps, and platform-level usage logs. This data is governed by Chainloop's Privacy Policy.

Categories of Data Subjects:

(i) As processor for Customer: Customer's employees, contractors, and Authorized Users acting within Customer's Organization(s); and any other individuals whose personal data Customer submits to the Services.

(ii) As independent Controller (User Accounts): Authorized Users at the platform level, whose personal data Chainloop Processes independently of Customer's instructions and in accordance with Chainloop's Privacy Policy.

Sensitive data transferred: None, unless Customer expressly agrees in writing to submit special categories of personal data in accordance with Section 2.5 of this DPA.

Frequency of transfer: Continuous, for the duration of the Agreement.

Retention period: For the duration of the Agreement and applicable Subscription Term, subject to the deletion / return obligations in Section 10 of this DPA.

C. COMPETENT SUPERVISORY AUTHORITY

EEA transfers: as specified in Annex 3.

UK transfers: UK Information Commissioner's Office.

Swiss transfers: Swiss Federal Data Protection and Information Commissioner (FDPIC).

ANNEX 2 — TECHNICAL AND ORGANIZATIONAL MEASURES

(Article 32 GDPR / EU SCCs Annex II)

This Annex 2 describes the TOMs implemented by Chainloop to protect Customer Personal Data in accordance with Section 3.1 of this DPA. These measures may be updated from time to time, provided the overall security of the Services is not materially diminished.

1. Encryption. Customer Personal Data is encrypted in transit using TLS 1.2 or higher. Customer Personal Data is encrypted at rest using AES-256 or equivalent industry-standard encryption. Encryption keys are managed using a recognized key management service and rotated periodically.

2. Access Controls. Access to Customer Personal Data is restricted on a least-privilege basis. Role-based access controls (RBAC) are implemented. Multi-factor authentication (MFA) is enforced for access to production systems and administrative consoles.

3. Authentication and Authorization. Strong authentication mechanisms are enforced for all internal systems. Password policies require minimum length and complexity standards. Session management controls are implemented and enforced.

4. Logging, Monitoring, and Alerting. Comprehensive logging of access to, and operations on, systems Processing Customer Personal Data is maintained. Logs are retained for a defined period and protected against unauthorized modification. Automated monitoring and alerting is in place to detect anomalous access or security events.

5. Vulnerability and Patch Management. Regular vulnerability scans and penetration tests of production systems are performed. Security patches are applied within defined timeframes based on severity. A responsible disclosure and vulnerability reporting program is maintained.

6. Incident Response. A documented incident response plan covering detection, containment, eradication, recovery, and post-incident review is maintained and tested periodically. Security Incidents are classified by severity with defined escalation procedures.

7. Business Continuity and Disaster Recovery. Documented business continuity and disaster recovery plans are maintained. Regular backups of Customer Personal Data are performed and stored securely. Recovery time and recovery point objectives are defined and tested.

8. Secure Software Development. Chainloop follows a secure software development lifecycle (SSDLC) incorporating security requirements analysis, threat modelling, code review, and pre-release security testing. Third-party components are tracked and assessed for known vulnerabilities.

9. Subprocessor and Vendor Risk Management. Subprocessors are subject to security due diligence before engagement and periodic review thereafter. Data processing agreements are in place with all Subprocessors as required by Section 4.4 of this DPA.

10. Physical Security. Chainloop's infrastructure is hosted in third-party data centers that maintain appropriate physical security controls, including perimeter security, access restrictions, CCTV monitoring, and environmental controls.

11. Personnel Measures. All personnel with access to Customer Personal Data are subject to confidentiality obligations and receive privacy and security training. Background checks are conducted for personnel with access to sensitive systems, to the extent permitted by applicable law.

12. Data Minimization, Pseudonymization, and Retention. Data minimization principles are applied. Where technically feasible and appropriate, pseudonymization is used. Data retention schedules are defined and enforced.

13. Logical Segregation. Customer Personal Data is logically segregated from data belonging to other customers at the application and storage layers.

14. Change Management. A formal change management process is in place for changes to production systems, including security impact assessment, testing, approval, and post-deployment monitoring.

15. Third-Party Security Certifications. Chainloop maintains SOC 2 Type II certification (or equivalent), reviewed and renewed periodically by an independent third-party auditor. Reports are made available to Customer on request under Section 9.1 of this DPA.

ANNEX 3 — EU SCCS COMPLETION DETAILS

(EU SCCs Annex III / UK Addendum Table Reference)

This Annex 3 sets out the completion details for the EU SCCs incorporated under Section 7.1 and the reference information for the UK Addendum under Section 7.2.

A. MODULE AND CLAUSE SELECTIONS

Applicable Modules: Module Two (Controller-to-Processor) and/or Module Three (Processor-to-Processor), as applicable to the roles of the parties described in Section 2.1 and Annex 1.

Clause 7 (Docking Clause): Applicable.

Clause 9 (Sub-processors): Option 2 — General written authorisation. Minimum notice period: fourteen (14) days.

Clause 11 (Redress — optional): Not selected.

Clause 17 (Governing law): The law of the Republic of Poland, which allows third-party beneficiary rights.

Clause 18(b) (Choice of forum): The courts of the Republic of Poland

B. LIST OF SUBPROCESSORS (EU SCCs Annex III)

Chainloop's current list of Subprocessors, including their names, countries of establishment, processing locations, and nature of Processing, is maintained and made available at: https://trust.chainloop.dev/, and is updated in accordance with Section 4.2 of this DPA.

C. UK ADDENDUM COMPLETION DETAILS

Selected SCCs (Table 2): The EU SCCs as completed under Section 7.1 and this Annex 3.

Appendix Information (Table 3): As set out in Annex 1 (party details and description of processing) and Annex 2 (TOMs) of this DPA.

Ending the UK Addendum (Table 4): Either party may end the UK Addendum as set out in Section 19 of the UK Addendum.

D. COMPETENT SUPERVISORY AUTHORITY

For EEA Restricted Transfers: the supervisory authority determined in accordance with Clause 13 of the EU SCCs, being the authority of the EU Member State in which the data exporter is established or, where the data exporter is not established in the EEA, the authority identified under Clause 13(a).

For UK Restricted Transfers: the UK Information Commissioner's Office.

For Swiss Restricted Transfers: the Swiss Federal Data Protection and Information Commissioner (FDPIC).

EXHIBIT B — PROFESSIONAL SERVICES TERMS

These Professional Services Terms ("Exhibit B") govern the provision of Professional Services by Chainloop to Customer and are incorporated into the Agreement. Capitalized terms not defined in this Exhibit B have the meanings given in Part 1 of the Agreement. In the event of a conflict between this Exhibit B and Part 1 of the Agreement with respect to Professional Services, this Exhibit B controls.

B1. Professional Services engagement

B1.1 Scope. Chainloop will perform the Professional Services described in each PS Order Form. Professional Services may include implementation and onboarding, platform configuration, software development and integration work, on-premises deployment assistance for the Chainloop Platform (which is separately governed by Chainloop's End User License Agreement ("EULA") for the applicable on-premises software), and training. Each PS Order Form is a separate engagement and does not modify the scope or pricing of the hosted SaaS Services.

B1.2 PS Order Forms. Professional Services will be performed only pursuant to a mutually executed PS Order Form. Each PS Order Form will specify, at minimum: (a) a description of the Professional Services to be performed; (b) applicable milestones or deliverables, if any; (c) the timeline or estimated completion date; (d) PS Fees and the payment schedule; (e) the personnel or team composition, if agreed; and (f) any additional terms specific to the engagement. In the event of a conflict between a PS Order Form and this Exhibit B, the PS Order Form controls.

B1.3 On-Premises Deployments. Where Professional Services include on-premises deployment of the Chainloop Platform, Customer acknowledges that the on-premises software is separately licensed under Chainloop's EULA and that Chainloop's professional assistance with deployment does not modify the EULA or transfer any additional rights in the on-premises software. Customer is responsible for ensuring its infrastructure meets Chainloop's system requirements as specified in the applicable Documentation or PS Order Form.

B1.4 Change Orders. Either party may request a change to the scope of a Professional Services engagement. Changes become effective only upon execution of a written change order signed by authorized representatives of both parties. Chainloop is not obligated to perform out-of-scope work pending execution of a change order.

B2. Fees and payment

B2.1 PS Fees. Customer will pay PS Fees as set out in the applicable PS Order Form. Unless otherwise specified in the PS Order Form, PS Fees are: (a) due and payable within thirty (30) days of invoice; (b) non-cancelable and non-refundable once work has commenced on the applicable milestone or deliverable, except as expressly stated in the PS Order Form; and (c) exclusive of taxes, which are governed by Section 3.4 of the Agreement.

B2.2 Expenses. Unless the PS Order Form specifies a fixed price inclusive of expenses, Customer will reimburse Chainloop for reasonable pre-approved out-of-pocket travel, accommodation, and similar expenses incurred in performing on-site Professional Services, upon presentation of reasonable supporting documentation.

B2.3 Time-and-Materials. Where a PS Order Form specifies time-and-materials pricing, Chainloop will invoice based on actual hours worked at the agreed rates. Chainloop will notify Customer if it reasonably expects the estimated hours to be materially exceeded and will obtain written approval before exceeding any agreed budget cap.

B2.4 Late Payments. Overdue PS Fees accrue interest at the lesser of 1.5% per month or the maximum rate permitted by applicable law, and Customer will reimburse Chainloop for reasonable costs of collection.

B3. Customer responsibilities

B3.1 Cooperation. Customer will provide Chainloop with timely access to Customer systems, environments, personnel, data, and information reasonably necessary for Chainloop to perform the Professional Services. Customer acknowledges that delays in providing required cooperation, approvals, or access may result in schedule changes or additional fees, which Chainloop will document in writing before incurring.

B3.2 Customer Environment. Customer is responsible for its own infrastructure, systems, software licenses (other than Chainloop's), network connectivity, and security controls. Chainloop is not responsible for failures or delays caused by Customer's infrastructure, third-party systems, or Customer's failure to meet agreed prerequisites.

B3.3 Customer Personnel. Customer will designate a project contact with authority to provide timely decisions and approvals required for the engagement. Customer is responsible for ensuring that its personnel cooperate with Chainloop's team in good faith.

B4. Intellectual property

B4.1 Chainloop Background IP. Chainloop retains all right, title, and interest in and to: (a) all Chainloop software, platforms, tools, methodologies, frameworks, know-how, and pre-existing intellectual property used in or made available in connection with the Professional Services ("Chainloop Background IP"); and (b) any improvements to Chainloop Background IP arising from the performance of Professional Services. Nothing in a PS Order Form or this Exhibit B transfers ownership of Chainloop Background IP to Customer.

B4.2 PS Deliverables. Unless otherwise expressly stated in a PS Order Form: (a) Chainloop grants Customer a non-exclusive, non-transferable, royalty-free license to use PS Deliverables for Customer's internal business purposes during the term of the Agreement; and (b) where a PS Order Form expressly provides for assignment of a PS Deliverable to Customer, such assignment takes effect upon full payment of all PS Fees due under that PS Order Form, and Chainloop retains a perpetual, irrevocable, royalty-free license to use any underlying methods, tools, or know-how embodied in the PS Deliverable.

B4.3 Customer Materials. Customer grants Chainloop a limited, non-exclusive license to use Customer Data, systems, and other materials provided by Customer solely as necessary to perform the Professional Services. Chainloop will not use Customer materials for any other purpose.

B5. Warranties. Disclaimer.

B5.1 PS Warranty. Chainloop warrants that Professional Services will be performed in a professional and workmanlike manner consistent with reasonable industry standards. Customer's sole remedy for a breach of this warranty is, at Chainloop's election, re-performance of the non-conforming Professional Services or a refund of the PS Fees paid for the non-conforming portion, provided Customer notifies Chainloop in writing within thirty (30) days of delivery of the non-conforming work.

B5.2 Disclaimer. EXCEPT AS SET OUT IN SECTION B5.1, PROFESSIONAL SERVICES AND PS DELIVERABLES ARE PROVIDED ON AN "AS IS" BASIS AND CHAINLOOP DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, WITH RESPECT TO PROFESSIONAL SERVICES AND PS DELIVERABLES, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. CHAINLOOP DOES NOT WARRANT THAT PROFESSIONAL SERVICES OR PS DELIVERABLES WILL MEET ALL OF CUSTOMER'S REQUIREMENTS OR THAT RESULTS WILL BE ERROR-FREE.

B6. Limitation of liability

B6.1 Application of Main Liability Provisions. The exclusions and limitations set out in Section 9 of the Agreement apply equally to Professional Services and PS Deliverables. For the avoidance of doubt, the aggregate liability cap in Section 9.2 applies to Professional Services as described therein: where a claim arises solely from or relates solely to a specific PS Order Form, the cap is limited to the PS Fees paid or payable under that PS Order Form during the twelve (12) months immediately preceding the event giving rise to the claim, unless a higher cap is expressly agreed in that PS Order Form.

B6.2 No Consequential Damages. IN NO EVENT WILL CHAINLOOP BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATED TO PROFESSIONAL SERVICES OR PS DELIVERABLES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

B7. Confidentiality and data protection

B7.1 Confidentiality. The confidentiality obligations in Section 16 of the Agreement apply to all information exchanged in connection with Professional Services, including PS Order Forms, engagement details, and PS Deliverables.

B7.2 Data Protection. To the extent Chainloop accesses or processes Customer Personal Data in the course of performing Professional Services, such processing is governed by the DPA set out in Attachment 1 of the Agreement.

B8. Term and termination.

B8.1 Term. Each PS Order Form commences on its effective date and continues until the Professional Services are completed or the PS Order Form is earlier terminated.

B8.2 Termination for Cause. Either party may terminate a PS Order Form upon written notice if the other party materially breaches its obligations under that PS Order Form or this Exhibit B and fails to cure the breach within thirty (30) days after receiving written notice describing the breach.

B8.3 Termination for Convenience. Unless otherwise stated in a PS Order Form, Customer may terminate a PS Order Form for convenience upon thirty (30) days' written notice, provided that Customer will pay Chainloop for all Professional Services performed and non-cancellable commitments incurred by Chainloop up to the effective date of termination, plus any applicable wind-down costs specified in the PS Order Form.

B8.4 Effect of Termination. Upon termination or expiration of a PS Order Form: (a) each party will return or destroy the other party's Confidential Information in its possession relating to that engagement, except as required by law; (b) Customer's license to use PS Deliverables delivered and paid for prior to termination survives; and (c) all accrued payment obligations survive termination.

B8.5 Survival. Sections B2, B4, B5.2, B6, B7, and B8.4 survive termination or expiration of any PS Order Form and of the Agreement.