MASTER SUBSCRIPTION AND SERVICES AGREEMENT

Last Updated: January 1st, 2026

PLEASE READ THIS AGREEMENT CAREFULLY BEFORE USING THIS SERVICE.

BY SIGNING AN ORDER OR CLICKING AGREE OR OTHER FORM OF ASSENT, OR OTHERWISE ACCESSING OR USING THE SERVICES, YOU ARE AGREEING TO BE BOUND BY THIS AGREEMENT. IF YOU ARE AGREEING TO THIS AGREEMENT ON BEHALF OF OR FOR THE BENEFIT OF YOUR EMPLOYER OR A THIRD PARTY, THEN YOU REPRESENT AND WARRANT THAT YOU HAVE THE NECESSARY AUTHORITY TO AGREE TO THIS AGREEMENT ON THEIR BEHALF. This Agreement is between RedTeam and the Customer and is effective as of the Effective Date. Capitalized terms used in these Terms have their meaning set forth in Section 11. At any time and at its sole discretion, RedTeam reserves the right to change these Terms and to suspend, discontinue or modify any feature, function or aspect of the Services. Your continued access to or use of the Services constitutes your acceptance of such changes to these Terms, and they shall survive termination of your access to or use of the Services.

1. Definitions

"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where "control" means the ownership of at least fifty 5percent (50%) of the voting securities or other ownership interest of such entity.
"Aggregated Data" means the aggregate, anonymized and statistical data RedTeam collects related to Customer's use of the Services, provided that any such data must contain no reference to and may not be attributable to Customer, any individual, customer of Customer, contractor or project.
"Agreement" means these Terms and each Order, in either or both cases together with any exhibits, addenda, and attachments, and as amended from time to time.
"API" means RedTeam's application programming interface and any accompanying or related documentation, source code, executable applications, and other materials made available by or on behalf of RedTeam.
"Confidential Information" means all non-public information disclosed by a party (Discloser) to the other party (Recipient), whether orally, visually, or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Without limiting the generality of the foregoing, RedTeam's Confidential Information includes the non-public aspects of the Service and all pricing information. Customer's Confidential Information includes the Customer Content. Confidential Information excludes information that: (i) is or becomes generally known to the public without breach of any obligation owed to Discloser; (ii) was known to the Recipient before its disclosure by the Discloser without breach of any obligation owed to the Discloser; (iii) is received from a third party without breach of any obligation owed to Discloser; or (iv) is independently developed by the Recipient without use of or access to the Confidential Information.
"Customer" means the person or entity signing or accepting an Order.
"Customer Content" means all content, data, documents, and other materials submitted or uploaded to the Service by or on behalf of Customer.
"Discloser" means the party to this Agreement that is disclosing Confidential Information to the other party.
"Documentation" means the then-current online user guides, specifications, and technical documentation made available by RedTeam regarding the use of the Service.
"Effective Date" means the date on which Customer first accepts this Agreement by clicking to accept, signing an order, or using the Service.
"Implementation Services" means the configuration, onboarding, and related services provided by RedTeam to assist Customer in using the Service, as specified in an applicable order or statement of work.
"Mobile Software" means any RedTeam mobile application made available for download from third-party platforms such as the Apple App Store or Google Play, intended for use on a mobile device. "Order" means a document executed by the parties or agreed to electronically that references this Agreement and sets forth the specific products, services, fees, and other commercial terms. "Recipient" means the party to this Agreement that is receiving Confidential Information from the other party. "RedTeam" means Red Team Software, LLC, a Delaware limited liability company, with its principal place of business at 8623 Commodity Circle, Orlando, FL 32724. "Service" means the Internet-based software platform, including all features, functions, user interfaces, and underlying technology, provided by RedTeam to Customer under this Agreement, as identified in the applicable order. "Subscription Term" means the term during which Customer is authorized to access and use the Service, as set forth in the applicable order. "Third Party Service" means any software, service, or data provided by a third party that interoperates with the Service, which may include, without limitation, cloud storage providers, APIs, or integrations with third-party applications.

2. SOFTWARE SERVICE

These Terms and the applicable Order provide Customer and its Affiliates access to and usage of one or more Services. Implementation Services may also be provided by RedTeam if specified under an Order.

3. USE OF SERVICE

a. Customer Content. As between RedTeam and Customer, Customer Content remains the property of Customer. Customer represents and warrants to RedTeam that Customer has provided all required notices and has obtained all required licenses, permissions, and consents regarding Customer Content for use within the Service and as permitted by the Agreement. During a Subscription Term and as needed thereafter to permit RedTeam to comply with its obligations under the Agreement, Customer grants RedTeam the non-exclusive, worldwide, and royalty-free right to use the Customer Content for purposes of performing its obligations and exercising its rights granted under this Agreement, improving and modifying its products, services and technology, and the creation of Aggregated Data. Customer may encounter content or information that might be inaccurate, incomplete, delayed, misleading, illegal, offensive or otherwise harmful. RedTeam cannot always prevent misuse of its system, and Customer agrees that RedTeam is not responsible for any such misuse. Moreover, RedTeam is not responsible for products and services offered by others through its system or any activities or performance by third-parties.
b. Affiliates and Contractors. Customer, including its Affiliates, may enter into Orders with RedTeam and its Affiliates. An Affiliate entering into an Order agrees to be bound by this Agreement as if it were an original party hereto. Customer may allow its Affiliates and contractors to use the Service, provided Customer is responsible for their compliance with the terms of this Agreement, and use by its Affiliates and contractors is solely for Customer's or Affiliate's benefit. Affiliate means any company controlled by or under common control with the subject entity, directly or indirectly, with an ownership interest of at least 50%.
c. Customer Responsibilities. Customer: (i) must keep its passwords secure and confidential and use industry-standard password management practices; (ii) is responsible for its access control policies and administration of access rights to its account within the Service, the acts and omissions of its users, and the legality and accuracy of Customer Content; (iii) must use commercially reasonable efforts to prevent unauthorized access to its account, and notify RedTeam promptly of any such unauthorized access; (iv) may use the Service only in accordance with the Service's technical Knowledge Base and applicable law; (v) is responsible for providing its Internet access and the computing environment (computer, web browser, etc.) to access the Service, and (vi) agrees to use this Service for lawful purposes only and agree not to enter any information in any form that (a) infringes the rights of others or violates their privacy; (b) is unlawful, threatening, abusive, defamatory, libelous, vulgar, obscene, profane, indecent or otherwise objectionable; or (c) is protected by patent, copyright, trademark or other proprietary right without the permission of the owner of such right; (vii) Customer is solely responsible for the internal adoption, implementation, and training of its personnel in the use of the Service. While RedTeam may provide training resources and assistance as outlined in an Order, Customer acknowledges that full and successful implementation depends on Customer's efforts. RedTeam is not liable for delays, additional costs, or inefficiencies arising from Customer's failure to adequately train its personnel or manage internal implementation.
d. Free Trial. From time to time, RedTeam may permit access to the Services on a temporary, no charge basis ("Free Trials"). Access to or use of a Free Trial is solely within RedTeam's discretion and may be revoked at any time with or without notice. Free Trials are provided 'AS IS', with no warranty, indemnity, support or other obligations of RedTeam during the no-charge period, notwithstanding anything else in the Agreement to the contrary. All Customer Content will be deleted after the no-charge period ends, unless Customer converts its account to a paid Service.
e. Beta Versions. From time to time, RedTeam may make available certain features, functionalities, or versions of the Service on a beta, preview, or pre-release basis ("Beta Versions"). Access to and use of Beta Versions is at Customer's sole discretion and risk. Beta Versions are provided 'AS IS' and may be incomplete, contain errors, or be subject to change or discontinuation at any time without notice. RedTeam makes no representations or warranties regarding Beta Versions, and expressly disclaims any liability, indemnity, or support obligations with respect to Beta Versions, notwithstanding anything else in the Agreement to the contrary. Customer acknowledges that Beta Versions are not intended for production use and may not be fully supported. Customer's feedback regarding Beta Versions may be used by RedTeam to improve the Service, and Customer grants RedTeam a non-exclusive, royalty-free, worldwide license to use such feedback for any purpose.
f. Data Entry & Configuration Responsibility. Customer is responsible for entering, managing, and maintaining all Customer Content within the Service, including but not limited to vendor lists, estimating templates, and project data. While RedTeam may provide initial setup assistance as specified in an Order, all ongoing data entry, imports, and system configuration are solely the responsibility of Customer. RedTeam shall not be liable for time, costs, or efforts associated with Customer's data entry or migration activities.
g. Third Party Service. The Service interoperates with one or more Third Party Services, and it depends on continuing availability of and access to Third Party Service for full functionality of the Service. Customer is responsible for obtaining all rights and the payment of all fees associated with all Third Party Service for purposes of this Agreement. Customer acknowledges that such Third Party Services might access or use Customer Content and Customer permits the Third Party Services to access or use Customer Content. Customer is solely responsible for the use of such Third Party Services and any data loss or other losses it may suffer as a result of using any such Third Party Services, and Customer shall ensure that its use of any such integration or interoperability complies with the terms of use of those Third Party Services. RedTeam makes no warranty or guarantee with regards to any such interoperation, any Third Party Services, or the continued availability of such features, and may cease providing such features for any reason without incurring fault or liability, for example and without limitation if, the provider of the Third Party Services ceases to make the Third Party Services available for interoperation with the Services. Any cessation of such features will not entitle Customer to any refund of Services Fees or other compensation.
h. API Terms. If Customer is provided with access to an API as part of the Service, then subject to the other terms of this Agreement, RedTeam grants Customer a non-exclusive, nontransferable, terminable license to interact only with the Service as allowed by the API.
i. Customer may not use the API in a manner, as reasonably determined by RedTeam, that exceeds reasonable request volume, constitutes excessive or abusive usage, or fails to comply with any part of the API. If any of these occur, RedTeam may suspend or terminate Customer's access to the API on a temporary or permanent basis;
ii. RedTeam may change or remove existing endpoints or fields in API results upon at least 30 days' notice to Customer, but RedTeam will use commercially reasonable efforts to support the previous version of the API for at least 6 months. RedTeam may add new endpoints or fields in API results without prior notice to Customer; and
iii. The API is provided on an AS IS basis. RedTeam has no liability to Customer as a result of any change, temporary unavailability, suspension, or termination of access to the API.
i. Not System of Record. Customer is responsible for securing, protecting, and backup-up the Customer Content outside of the Service. The Service should not be considered the system of record for the Customer Content. Customer should contact Support if it needs help in exporting any Customer Content. RedTeam is not responsible or liable for any claims or damage resulting from an infrastructure as-a-service provider's wrongful acts or omissions (for example, AWS) with respect to the backup or storage of data or information.

4. SERVICE LEVEL AGREEMENT AND WARRANTY

a. General Warranty. Each Party represents and warrants that it has the necessary rights to enter into this Agreement and has the legal power to do so.
b. RedTeam Limited Warranties. RedTeam warrants that (a) the Services will perform substantially in accordance with the applicable Documentation in all material respects; and (b) RedTeam will not materially reduce the core functionality of the Services during the current Subscription Term. Customer's exclusive remedy and RedTeam's entire liability for a breach of the above warranties will be, at RedTeam's option, (x) the correction of the deficient Service that caused the breach of warranty, or (y) provision of comparable functionality. If RedTeam, as determined in its reasonable discretion, cannot accomplish (x) or (y), then RedTeam shall terminate the deficient Service and refund to Customer any prepaid Fees for the terminated Service, prorated to cover the remaining portion of the Subscription Term following notice of the breach of warranty. This warranty will not apply to the extent customer, its contractors, or agents have modified the Service or issues arising from a Third Party Service.
c. Implementation Services Warranty. RedTeam warrants that, for a period of 30 days from delivery, it has performed the Implementation Services in conformance with generally accepted practices within the software services industry and the statement of work. Customer must notify RedTeam of any breach of this warranty no later than 30 days after delivery of the Implementation Services. CUSTOMER'S EXCLUSIVE REMEDY AND REDTEAM'S ENTIRE LIABILITY UNDER THIS WARRANTY WILL BE FOR REDTEAM TO RE-PERFORM ANY NON-CONFORMING PORTION OF THE IMPLEMENTATION SERVICES, OR IF REDTEAM CANNOT REMEDY THE BREACH, THEN REFUND THE PORTION OF THE FEE ATTRIBUTABLE TO SUCH NON-CONFORMING PORTION OF THE IMPLEMENTATION SERVICES. THIS WARRANTY WILL NOT APPLY TO THE EXTENT CUSTOMER, ITS CONTRACTORS, OR AGENTS HAVE MODIFIED ANY ITEM.
d. DISCLAIMER. REDTEAM DISCLAIMS ALL OTHER WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE. WHILE REDTEAM TAKES REASONABLE MEASURES TO SECURE THE SERVICE AS SET FORTH IN THIS AGREEMENT, REDTEAM DOES NOT GUARANTEE THAT THE SERVICE CANNOT BE COMPROMISED OR THAT ALL DATA OR INFORMATION IS COMPLETELY SECURE. CUSTOMER UNDERSTANDS AND AGREES THAT (I) THE SERVICE MAY NOT BE ERROR-FREE AND THE USE MAY BE INTERRUPTED, AND (II) REDTEAM IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD-PARTY SERVICE ISSUES.

5. PAYMENT

a. Fees and Payment. Customer must pay all fees as specified on the Order, but if not specified, then within 30 days of receipt of an invoice. The fees are exclusive of sales, use, withholding, VAT and other similar taxes, and Customer is responsible for payment of such taxes at the rate and in the manner for the time being prescribed by law. If RedTeam has the legal obligation to pay or collect taxes for which Customer is responsible under this section, RedTeam will invoice Customer and Customer will pay that amount unless Customer provides RedTeam with a valid tax exemption certificate authorized by the appropriate taxing authority. This Agreement contemplates one or more Orders for the Service, which Orders are governed by the terms of this Agreement. Customer may not withhold or set-off any fees owed to RedTeam under this Agreement against any other amounts. All payment obligations are non-cancellable, and once paid are non-refundable
b. Payment Dispute Time Limit. Customer must notify RedTeam's accounting department in writing of any invoice dispute within thirty (30) days of receipt. Failure to dispute an invoice within this period constitutes acceptance of the charges, and no retroactive claims for non-payment will be accepted. Customer acknowledges that dissatisfaction with the Service does not constitute a valid basis for withholding payment or terminating this Agreement. Customer may withhold only the portion of the invoiced amount actually in dispute; all undisputed amounts must be paid on time. The parties will cooperate in good faith to resolve any such dispute within thirty (30) days of RedTeam's timely receipt of notice. If RedTeam determines in good faith that the dispute is not valid or the parties are unable to resolve the dispute within the thirty (30)-day resolution period, the disputed amount will become due and payable upon written notice from RedTeam.
c. Nonpayment. Any invoiced amount not received by RedTeam by the due date may accrue interest at the lower rate of 1.5% per month or the maximum rate permitted by law. In addition, if an invoiced amount is 30 days or more past due, RedTeam may suspend performance until the amount is paid in full, provided RedTeam has given Customer at least 30 days' prior written notice that its account is past due. Without limiting any other rights or remedies, RedTeam shall be entitled to an award of its reasonable attorney's fees and collection costs in connection with Customer's breach of its obligations under this Section 5.

6. MUTUAL CONFIDENTIALITY AND DATA SECURITY

a. Protection of Confidential Information. Recipient must use the same degree of care that it uses to protect the confidentiality of its own confidential information of like kind (but not less than reasonable care) to: (i) not use any Confidential Information of Discloser for any purpose outside the scope of this Agreement; and (ii) limit access to Confidential Information of Discloser to those of its and its Affiliates' employees and contractors who need that access for purposes consistent with this Agreement and who have signed confidentiality agreements with Recipient containing protections not materially less protective of the Confidential Information than those in this Agreement.
b. Exclusions. The Recipient may disclose Confidential Information to the extent required by law or court order or to its prospective or actual bankers, lawyers, accountants, investors, or professional advisors provided they have professional or written obligations of confidentiality.
c. DPA. The Data Protection Addendum located at Exhibit A is incorporated into this Agreement for purposes of the processing Personal Data (as defined therein), to the extent Customer is required by applicable law to impose certain obligations on its service providers or processors as the case may be.

7. PROPERTY

a. Reservation of Rights. RedTeam and its licensors are the sole owners of the Service, including all associated intellectual property rights, and they remain only with RedTeam. Customer may not remove or modify any proprietary marking or restrictive legends in the Service. RedTeam reserves all rights that are not expressly granted in this Agreement.
b. Restrictions. Customer may not: (i) sell, resell, rent, or lease the Service or use it in a service-provider capacity; (ii) use the Service to store or transmit unsolicited marketing emails, libelous, or otherwise objectionable, unlawful, or tortious material, or to store or transmit infringing material in violation of third-party rights; (iii) interfere with or disrupt the integrity or performance of the Service; (iv) attempt to gain unauthorized access to the Service or its related systems or networks; (v) reverse engineer the Service except as allowed by applicable law despite this limitation; or (vi) access the Service to build a competitive service or product, or copy any feature, function, or graphic for competitive purposes. RedTeam may suspend Service to Customer if RedTeam believes in good faith that Customer's use of the Service poses an imminent threat to the security, availability or legality of the Service; in such event, RedTeam will work with Customer to address the issue and restore Service as quickly as possible.
c. Aggregate Data. RedTeam exclusively owns all right, title and interest in and to Aggregate Data. RedTeam retains all intellectual property rights in such Aggregate Data.

8. TERM AND TERMINATION.

a. Term. This Agreement continues until the 30th day after the date on which there is no active Subscription Term, unless earlier terminated as provided below.
b. Term of Orders. The Subscription Term of each Order must be specified in the Order.
c. Mutual Termination for Material Breach. If either party is in material breach of this Agreement including but not limited to non-payment of Fees, the other party may terminate this Agreement at the end of a written 30-day notice/cure period, if the breach has not been cured.
d. Return of Customer Content. i. Within 5 days after termination providing all fees have been paid, upon request RedTeam will make the Service available for Customer to export Customer Content as provided in Section 3(a) for no additional fee. ii. If Customer requests to export Customer Content between 5 days and 30 days, then a one-time $400 prepaid fee will apply. iii. After the 30-day period, RedTeam has no obligation to maintain the Customer Content and may destroy it.
e. Liquidated Damage for Early Termination. If Customer breaches an Order for non-payment and RedTeam terminates the Order, then as the damages sustained by RedTeam are difficult to ascertain Customer must pay the following as a liquidated damage. This fee is calculated as follows: the unpaid fees until termination of the Order, and any remaining fees for the time period from termination until the end of the original committed duration of the Order, multiplied by 95%. This fee is not a penalty and is a liquidated damage. The parties agree that this amount is a reasonable estimate of the damage sustained by RedTeam as a result of the breach of this Order by Customer.
f. Effect of Termination. If this Agreement is terminated for RedTeam's breach, RedTeam will refund Customer fees prepaid for the remainder of the term of all Orders after the termination effective date. If this Agreement is terminated for Customer's breach, Customer will pay any unpaid fees for the term of all Orders. Upon request, following any termination of this Agreement, each party will destroy or return all of the other party's property that it holds, subject to the "Return of Customer Content" section above.

9. LIABILITY LIMIT.

a. EXCLUSION OF INDIRECT DAMAGES. TO THE MAXIMUM EXTENT ALLOWED BY LAW, REDTEAM IS NOT LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT (INCLUDING, WITHOUT LIMITATION, COSTS OF DELAY; LOSS OF OR UNAUTHORIZED ACCESS TO DATA OR INFORMATION; AND LOST PROFITS, REVENUE, OR ANTICIPATED COST SAVINGS), EVEN IF IT KNOWS OF THE POSSIBILITY OR FORESEEABILITY OF SUCH DAMAGE OR LOSS.
b. TOTAL LIMIT ON LIABILITY. TO THE MAXIMUM EXTENT ALLOWED BY LAW, REDTEAM'S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT (WHETHER IN CONTRACT, TORT, OR OTHERWISE) DOES NOT EXCEED THE AMOUNT PAID BY CUSTOMER UNDER THE APPLICABLE ORDER IN EFFECT WHEN THE EVENT OCCURRED THAT GAVE RISE TO THE CLAIM.

10. INDEMNIFICATION FOR THIRD-PARTY CLAIMS.

a. By RedTeam. RedTeam will, at its expense, defend Customer and its Affiliates, and their respective officers, directors, employees, and agents (the "Customer Indemnitees") against any claim, action, suit or proceeding brought by an unaffiliated third party (each, a "Claim") alleging that the Services, when used by Customer in strict accordance with this Agreement and the Documentation, infringe or misappropriate a third party's intellectual property rights. RedTeam will indemnify and hold harmless the Customer Indemnitees from and pay: (i) all damages, judgments, settlements, liabilities, and costs (including reasonable attorneys' fees) finally awarded in connection with a Claim under this Section 10(a); and (ii) all amounts agreed by RedTeam to be paid to a third party in settlement of any such Claim. RedTeam shall have no obligation to indemnify, defend or hold harmless Customer in connection with any Claim, to the extent the Claim arises out of or relates to: (1) use of the Services in combination with any data, software, hardware or services not provided or authorized in writing by RedTeam, if the Claim would not have arisen but for such combination; (2) Customer Content, or any instructions, information, designs, or specifications provided by or on behalf of Customer; (3) use of the Services in a manner not authorized by this Agreement or the Documentation; (4) modification of the Services not made by RedTeam; or (v) use of a version of the Services other than the most current version made available to Customer, if the Claim would have been avoided by use of such current version. If the Services become, or in RedTeam's opinion are likely to become, the subject of a Claim covered by this Section 10(a), RedTeam may, at its option and expense: (A) procure the right for Customer to continue using the Services; (B) replace or modify the Services to make them non-infringing without materially reducing functionality; or (C) if neither (A) nor (B) is commercially reasonable, terminate the affected portion of the Services and refund any prepaid, unused fees for the remainder of the Subscription Term. This Section 10(a) sets forth RedTeam's sole and exclusive liability, and Customer's sole and exclusive remedy, for any actual or alleged infringement or misappropriation of intellectual property rights by the Services or otherwise licensed by RedTeam to Customer under this Agreement. b. By Customer. Customer will, at its expense, defend RedTeam and its Affiliates, and their respective officers, directors, employees, and agents (the "RedTeam Indemnitees"), from and against any Claims (including reasonable attorneys' fees) arising out of or relating to: (a) any breach of this Agreement by Customer, its Affiliate, or any party for whom either of them are responsible; (b) Customer Content, including any allegation that the provision, use, or processing of Customer Content (i) violates any applicable law or regulation, including data protection or privacy laws, or (ii) violates, infringes or misappropriates any third party right, including any intellectual property right, contract right, proprietary right or privacy right of a third party; (c) failure to properly manage access controls, including provision of access to unauthorized individuals or misuse of the Services; or (d) any death, bodily injury, or workplace accident. Customer will indemnify and hold harmless the RedTeam Indemnitees from and pay: (i) all damages, judgments, settlements, liabilities, and costs (including reasonable attorneys' fees) finally awarded in connection with a Claim under this Section 10(b); and (ii) all amounts agreed by Customer to be paid to a third party in settlement of any such Claim. c. Indemnification Procedures. An indemnified party seeking defense, indemnification or any other protection under this Section 10 must promptly notify the indemnifying party in writing of any Claim for which it seeks protection and grant the indemnifying party sole control over the defense and settlement of the Claim, including the selection of legal counsel. The indemnified party will provide reasonable cooperation and assistance in connection with the defense and settlement of the Claim. The indemnifying party may not settle any Claim without the indemnified party's prior written consent unless the settlement: (a) includes a full and unconditional release of the indemnified party from all liability; (b) does not include any admission of liability or fault by the indemnified party; and (c) does not impose any non-monetary obligations or injunctive relief on the indemnified party.

11. GOVERNING LAW, ARBITRATION AND CLASS ACTION WAIVER.

a. This Agreement is governed by the laws of the State of Delaware (without regard to conflicts of law principles) for any dispute between the parties or relating in any way to the subject matter of this Agreement. Any suit or legal proceeding must be exclusively resolved through final and binding arbitration in accordance with the then-current JAMS Comprehensive Arbitration Rules & Procedures. The location of the arbitration proceedings will be Atlanta, Georgia. The prevailing party in any arbitration or litigation is entitled to recover its attorneys' fees and costs from the other party. Nothing in this Agreement prevents either party from seeking injunctive relief in a court of competent jurisdiction. EACH PARTY MAY BRING CLAIMS AGAINST THE OTHER ONLY ON AN INDIVIDUAL PARTY BASIS, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE ACTION OR PROCEEDING. THE ARBITRATOR MAY NOT CONSOLIDATE OR JOIN MORE THAN ONE PARTY'S CLAIMS, AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A CONSOLIDATED, CLASS OR REPRESENTATIVE PROCEEDING. b. Arbitration Fee Responsibility. The party initiating arbitration must prepay all arbitration fees and costs. If the arbitrator finds in favor of RedTeam, the initiating party shall reimburse RedTeam for all legal costs, including arbitration fees and reasonable attorney's fees. Customer further agrees that arbitration will take place exclusively in Atlanta, Georgia.

12. OTHER TERMS.

a. Publicity Rights. Neither party shall use the name, logo, trademarks, or other identifying marks of the other party in any press release, marketing materials, public announcement, or other publicity without the prior written consent of the other party, except as may be required by law or regulation. Notwithstanding the foregoing, RedTeam may include Customer's name and logo in its customer lists, on its website, and marketing materials to identify Customer as a user of the Services. Any permitted use of a party's name, logo, or marks shall be subject to the other party's applicable usage guidelines and policies.
b. Entire Agreement and Changes. This Agreement constitute the entire agreement between the parties and supersede any prior or contemporaneous negotiations or agreements, whether oral or written, related to this subject matter. Customer is not relying on any representation concerning this subject matter, oral or written, not included in this Agreement. No representation, promise, or inducement not included in this Agreement is binding. No modification or waiver of any term of this Agreement is effective unless both parties sign it, however this Agreement may be modified through an online process provided by RedTeam.
c. Training and Education. In addition to any training provided by RedTeam under an SOW, Client shall cause Authorized Users to be educated and trained in the proper use and operation of the Services and ensure that the same is used in accordance with applicable manuals, instructions, specifications, and documentation provided by RedTeam from time to time.
d. No Assignment. Neither party may assign or transfer this Agreement to a third party, except that, the agreement and all Orders may be assigned by a party without the consent of the other party as part of a merger or sale of all or substantially all a party's businesses, assets not involving a competitor of the other party, or at any time to an Affiliate (collectively, "Corporate Event"). Each party must notify the other party in the event of any Corporate Event.
e. Export Compliance. Customer acknowledges that the Services, RedTeam's Confidential Information, and any software or technology provided in connection therewith, may be subject to U.S. and other applicable export control and economic sanctions laws and regulations, including the U.S. Export Administration Regulations and regulations administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (collectively, "Export Laws"). Customer represents and warrants that it, its Authorized Users, and its Affiliates are not: (a) located in, organized under the laws of, or ordinarily resident in a country or territory subject to comprehensive U.S. sanctions (including, as of the Effective Date, Cuba, Iran, North Korea, Syria, or the Crimea, Donetsk, or Luhansk regions of Ukraine); (b) identified on any U.S. government restricted party list; or (c) otherwise the subject of any restrictions under Export Laws. Customer agrees not to access, use, export, re-export, transfer, or make available the Services or any related technical data in violation of Export Laws, and shall be solely responsible for compliance with all such laws and regulations. RedTeam shall have no liability for Customer's or any user's failure to comply with Export Laws. RedTeam may suspend or terminate access to the Services if it reasonably determines that continued performance would violate applicable Export Laws.
f. Independent Contractors. The parties are independent contractors with respect to each other, and neither party is an agent, employee, or partner of the other party or the other party's Affiliates.
g. Enforceability and Force Majeure. If any term of this Agreement is invalid or unenforceable, the other terms remain in effect. Neither party is liable for its non-performance due to events beyond its reasonable control and whether foreseeable or not, including but not limited to natural weather events and disasters (such as floods, hurricanes, earthquakes, or fires), pandemics, epidemics, public health emergencies, labor disruptions or strikes, disruptions in the supply of utilities or essential services, supply chain interruptions, acts of war, terrorism, civil unrest, embargoes, government actions or orders (including changes in laws or regulations), ransomware attacks, cyberattacks, denial of service attacks, or other malicious acts affecting information systems or data, and any other events or circumstances beyond the reasonable control of RedTeam. RedTeam shall not be liable for any delay or failure to perform resulting from such events, and any deadlines or obligations affected by such events shall be extended for a period equal to the duration of the event plus a reasonable recovery period.
h. Money Damages Insufficient. Any violation of the other party's intellectual property rights could cause irreparable injury or harm to the other party. The other party may seek a court order to stop any breach or avoid any future breach of this Agreement.
i. No Additional Terms. RedTeam rejects additional or conflicting terms of a Customer's form-purchasing document. Customer acknowledges that no employee, contractor, representative or other personnel of RedTeam has authority to accept or agree to any agreement by performance or conduct.
j. Order of Precedence. If there is an inconsistency between this Agreement and an Order, the Order prevails.
k. Survival of Terms. All provisions of this Agreement regarding payment, confidentiality, indemnification, limitations of liability, proprietary rights and such other provisions that by fair implication require performance beyond the term of this Agreement must survive expiration or termination of this Agreement until fully performed or otherwise are inapplicable. The UN Convention on Contracts for the International Sale of Goods does not apply.
l. Mobile Software. RedTeam may make available mobile software to access the Service via Mobile Software. Additional terms and conditions apply to the Mobile Application. To use the Mobile Software, Customer must have a mobile device that is compatible with the Mobile Software. RedTeam does not warrant that the Mobile Software will be compatible with Customer's mobile device. Customer may use mobile data in connection with the Mobile Software and may incur additional charges from Customer's wireless provider for these services. Customer agrees that it is solely responsible for any such charges. Customer acknowledges that RedTeam may, from time to time, issue upgraded versions of the Mobile Software, and may automatically electronically upgrade the version of the Mobile Software that Customer is using on its mobile device. Customer consents to such automatic upgrading on its mobile device, and agrees that the terms and conditions of this Agreement will apply to all such upgrades.
m. Feedback. If Customer provides feedback or suggestions about the Service, RedTeam (and those it allows to use its technology) may, during a Subscription Term and any time thereafter, freely use such information on a non-confidential basis and without any obligation to Customer.

EXHIBIT A — US DATA PROCESSING ADDENDUM

This Data Processing Addendum ("DPA") forms part of, and is subject to, the Agreement by and between RedTeam and Customer. Notwithstanding anything in the Agreement to the contrary, to the extent RedTeam Processes Personal Data that is subject to Data Protection Laws, this DPA applies. Capitalized terms used but not defined in this DPA have the meanings given to them in the Agreement. In the event of a conflict between the Agreement and this DPA, this DPA shall control solely to the extent of the conflict.

Definitions.

1. "Data Protection Law(s)" means the laws, regulations, and requirements of regulatory guidance, in any jurisdiction, relating to data protection, privacy or confidentiality of personally identifiable information or personal data, and as amended, extended and re-enacted from time to time, as applicable to the Services.
2. "Personal Data" means any information provided by or on behalf of Customer to RedTeam in connection with the Services that is defined as "personal data," "personal information," or a similar term under applicable Data Protection Laws and that identifies or can reasonably be used to identify an individual person ("Data Subject"). A Data Subject may be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal Data does not include information that is (a) anonymized, de-identified, or aggregated such that it does not identify and cannot reasonably be used to identify an individual; (b) publicly available information from government records; (c) information independently derived by RedTeam without use of or reference to Customer Data; (d) system metadata, logs, or other diagnostic or technical data related to the operation and use of the Services; or (e) data generated or derived by RedTeam in connection with the performance or enhancement of the Services that does not identify a Data Subject.
3. "Process" or "Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, structuring, storage, modification, use, disclosure analysis or deletion by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
4. "Personal Data Breach" means a breach of RedTeam's security leading to the unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed under this DPA.

1. DESCRIPTION OF PROCESSING.

As applicable and where such concepts are recognized by Data Protection Law, Customer is the "controller" and RedTeam is the "processor" or "service provider" (in each case, or words of similar import under Data Protection Laws) in respect of all Personal Data made available to and Processed by RedTeam in connection with the provision of the Services for the term of the Agreement. For this purpose, RedTeam will Process Personal Data as contemplated in and in accordance with the Agreement.

2. Compliance with Data Protection Law.

During the term of the Agreement, RedTeam will comply with the Data Protection Laws that are applicable to RedTeam's Processing of Personal Data. RedTeam will make available all information reasonably requested by Customer to demonstrate RedTeam's compliance with Data Protection Laws. As required under Data Protection Laws, RedTeam will notify Customer in the event RedTeam makes a determination that RedTeam can no longer meet its obligations under Data Protection Laws, in which case Customer may take reasonable and appropriate steps in accordance with the Agreement to stop or remediate any unauthorized processing of Personal Data. RedTeam will cooperate with and provide reasonable assistance to Customer for: (a) Customer's performance of any data protection impact assessment of the processing of Personal Data by RedTeam, and (b) related consultation with supervisory authorities, either or both of which Customer reasonably considers to be required by Data Protection Laws.

3. RESTRICTIONS.

RedTeam will not: (a) retain, use, disclose, sell, or share (as those terms are defined in applicable Data Protection Laws) Personal Data for any purpose other than to provide the Services or as otherwise authorized in the Agreement; (b) retain, use or disclose Personal Data for a commercial purpose or otherwise beyond the context of the direct business relationship between RedTeam and Customer as set forth in the Agreement; or (c) combine Personal Data received from or on behalf of Customer with Personal Data RedTeam receives from or on behalf of another person or which RedTeam collects on its own except as permitted by Data Protection Laws and in accordance with Customer's documented instructions (including but not limited to as set out in the Agreement and this DPA); provided, however, that such restrictions in (a), (b) and (c) hereof, shall not apply (i) if RedTeam is required to perform such actions by any applicable law to which the RedTeam is subject, in which case RedTeam shall inform Customer of that legal requirement or (ii) to RedTeam's processing of de-identified, anonymized or aggregated data, or to the use of internal analytics that do not involve Personal Data. To the extent required under applicable Data Protection Laws, and solely where Customer reasonably determines, based on documented evidence, that RedTeam has materially failed to comply with its obligations under this DPA, Customer may take reasonable and appropriate steps to: (1) notify RedTeam of such alleged non-compliance and request that RedTeam remediate any material unauthorized use of Personal Data that is not in accordance with this DPA or the Agreement; and (2) verify, through documentation reasonably requested by Customer, that RedTeam continues to process Personal Data in a manner consistent with Data Protection Laws applicable to RedTeam.

4. DATA RETENTION AND DELETION.

RedTeam will retain non-anonymized and identifiable Personal Data only for as long as necessary to perform the Services, or for such other purposes as agreed to by the parties or as required by applicable law. In accordance with the terms of the Agreement, following the termination of the Agreement, RedTeam shall return or safely destroy all non-anonymized and identifiable Personal Data that RedTeam obtained in connection with performing the Services within ninety (90) days following such termination (excluding data retained in archival or backup systems in accordance with RedTeam's standard retention policies or data subject to legal hold or other legal requirements) and, upon request, RedTeam shall notify Customer in writing once all such information has been returned or destroyed, provided that where continued storage is required by applicable law, RedTeam shall inform Customer of those requirements and the provisions of this DPA shall continue to apply to such Personal Data concerned. For the avoidance of doubt, this Section 5 shall not apply to de-identified or aggregated data (regardless of whether derived from Personal Data) that RedTeam uses or generates in accordance with the Agreement provided that such data cannot be used to identify a Data Subject.

5. INFORMATION SECURITY PROGRAM.

RedTeam will implement appropriate physical, technical and administrative safeguards designed to protect Customer's Personal Data from unauthorized or unlawful destruction, loss, alteration, disclosure or access as provided in the Agreement, in each case as appropriate to the risk of the relevant Processing and as such safeguards may be updated from time to time.

6. BREACH NOTIFICATION AND INVESTIGATION.

To the extent required by Data Protection Laws, RedTeam will notify Customer without undue delay of the discovery of a Personal Data Breach impacting the Personal Data Processed under this DPA. Such notice will include (to the extent known) details of the nature of the Personal Data Breach, the number of records impacted, the category and number of affected individuals, the anticipated consequences of the Personal Data Breach and any actual or proposed remedies for mitigating its impact. RedTeam's notification of, or response to, a Personal Data Breach will not be construed as an acknowledgement by RedTeam of any fault or liability with respect to the Personal Data Breach.

7. DATA SUBJECT RIGHTS.

To the extent that Data Protection Laws require Customer to comply with requests from Data Subjects regarding the Processing of their Personal Data, such as rights to access, correct, or delete their personal data ("Data Subject Request"), RedTeam will promptly notify Customer of any Data Subject Requests directed to, and directly received by, RedTeam and to provide reasonable assistance necessary to fulfill Data Subject Requests, taking into account the nature of RedTeam's Processing of Personal Data under the Agreement. RedTeam will forward to Customer promptly any Data Subject Request received by RedTeam relating to Personal Data and may advise the applicable data subject to submit their request directly to Customer.

8. SUBPROCESSORS.

Customer grants RedTeam a general authorization to engage subprocessors in connection with the performance of RedTeam's obligations under the Agreement. To the extent RedTeam engages subprocessors to Process Personal Data, such entities or individuals shall be subject to an appropriate duty of confidentiality and the same level of data protection and security as RedTeam under this DPA. RedTeam is responsible for the performance of any subprocessor's obligations in compliance with the terms of this DPA and Data Protection Laws applicable to RedTeam.

9. AUDIT.

RedTeam will provide a copy of its then-current audit report once per each rolling 12-month period upon request of Customer and subject to the confidentiality obligations set out in the Agreement. Such audit report refers to any industry standard audit that may be deemed appropriate by RedTeam and will be conducted by an independent third-party auditor on an annual basis. Additionally, RedTeam will permit an independent Certified Public Accountant engaged by Customer to audit RedTeam's compliance with this DPA in the event Customer receives a written inquiry from a competent supervisory authority or regulator, in each case relating to the RedTeam's Processing of Personal Data under this DPA, provided that such audit will be restricted to relevant data processing activities and necessary documentation to confirm RedTeam's compliance with the terms of this DPA. Any audit under this Section 10 will be subject to reasonable scheduling, confidentiality obligations, and RedTeam's security policies and will not unreasonably interfere with RedTeam's business operations. Customer will pay any reasonably incurred costs and expenses incurred by RedTeam in the event Customer performs an audit under this Section 10 that is not (a) required by Data Protection Laws or (b) in response to a Personal Data Breach.

10. CROSS-BORDER TRANSFERS.

RedTeam will cooperate with Customer in complying with all Data Protection Laws applicable to RedTeam in regulating the cross-border transfer of information, including, as required and/or applicable, that (a) the transfer is to a jurisdiction deemed by a competent regulator to have an adequate level of protection; (b) the transfer is subject to contractual provisions approved by a competent regulator; or (c) the transfer is pursuant to a framework deemed adequate and approved by a competent regulator. The parties shall negotiate, in good faith, such additional agreements, terms and conditions as may be required by Data Protection Laws to effectuate such transfers.

11. Limitation of Liability.

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set forth in the Agreement.

12. No Third-Party Beneficiaries.

Nothing in this DPA shall be construed to create any duty or obligation on the part of either party to, or confer any rights, remedies, or benefits upon, any third party (including any Data Subject), except as expressly set forth herein or required under applicable Data Protection Laws.