SERVICE AGREEMENT FOR BRAIN CORPORATION'S SOFTWARE

‍

This Service Agreement (this "Agreement") is made by and between Brain Corporation, a California corporation ("Brain"), and the individual or legal entity licensing the Software under this Agreement (the "Customer"). This Agreement governs the use of Brain's software (the "Software") and associated services (the "Services") contained on or relating to any BrainOS® powered product (including any authorized add-ons or accessories to such products) provided under the "Brain" or "BrainOS" trademark (each, a "Robot") obtained by the Customer from an authorized manufacturer, reseller, or distributor (an "Authorized Seller").

1. Accepting this Agreement

By the Customer (a) using the Software or the Services, (b) clicking a box indicating acceptance, or (c) executing with Brain or an Authorized Seller a subscription agreement, order document, or other instrument that references this Agreement (a "Service Document"), the Customer agrees to be bound by this Agreement's terms and conditions. In addition, by accepting this Agreement, the Customer represents that he or she has the authority to bind the Customer (or its employer or other entity on whose behalf the Customer is agreeing) to the terms and conditions of this Agreement.

2. Services

During the subscription period specified in the respective Service Document for the particular Services purchased by the Customer, the Customer will receive such Services as set forth in the then-current applicable schedule for such Services described at https://www.braincorp.com/legal-page/service-specific-terms4324 (the "Service-Specific Terms"). The applicable Service-Specific Terms shall be considered part of this Agreement and incorporated herein by reference.

3. Use of the Software and Services by the Customer

The Customer agrees to be responsible for the operation and use of the Services by the Customer and its employees, agents, contractors, and any transferee or other entity that the Customer permits to use the Robot and/or Services (its "Permittees"). The Customer agrees to use the Robot, Software, or Services only in accordance with (collectively, the "Restrictions on Use"): (a) this Agreement; (b) any applicable law, regulation, or generally accepted practices or guidelines in the relevant jurisdictions (including any laws regarding the export of data or software to and from the United States, or such other country in which the Customer purchases or uses the Robot); (c) the then-current user manuals, guides, and instructions provided with the Robot, in the Software, or by Brain or by an Authorized Seller (the "Instructions"); and (d) the terms provided in the applicable Service-Specific Terms.

‍

4. License from Brain
   
   1. License Grant. Subject to the terms of this Agreement, Brain grants the Customer a royalty-free, non-sublicensable, and non-exclusive license, solely during the period when the Customer has access to the Services as provided in Section 2, solely for the Customer's (and its Permittees') Use of the Software in the country in which Brain or an Authorized Seller delivered the Robot to the Customer in conjunction with (a) the Robot pre-loaded with the Software that the Customer acquired and (b) the Services. "Use" in this Section 4 shall mean the ability to run or execute the Software through a user interface on the Robot or other interface as provided by Brain in accordance with the Restrictions on Use.
   2. Reservation of Rights. All rights not specifically granted under this Agreement are reserved by Brain and, as applicable, Brain's licensors. The Software is licensed, not sold. The Customer is permitted to Use the Software only in accordance with the terms of, and only as expressly allowed by, this Agreement. The Customer license confers no title or ownership in the Software and should not be construed as a sale of any rights in the Software. This Agreement also applies to any patches or updates the Customer may obtain for the Software, and to the Software on any Robot that is Used by the Customer.
   3. Intellectual Property. The Customer agrees that Brain, its affiliates, and its licensors own all legal right, title and interest in and to the Software (including any patches and updates to the Software and all copies), including any Intellectual Property Rights that subsist in the Software. "Intellectual Property Rights" means any and all rights under patent law, copyright law, moral rights, trade secret law, trademark law, and all other proprietary rights. Brain reserves all rights not expressly granted to the Customer. Brain's Software is protected by the copyright laws of the United States, international copyright treaties and conventions, and other laws of the country in which the Customer purchases or Uses the Robot. The Customer may not: (a) copy, modify, adapt, redistribute, decompile, reverse engineer, disassemble, or create derivative works of the Software or any part of the Software; (b) sell, rent, lease, license, distribute or otherwise transfer, commercialize, or offer or provide a service with any software or device (other than the Robot as provided to the Customer) incorporating the Software or any part of the Software; or (c) infringe the Software in any other manner pursuant to the copyright laws of the United States, international copyright treatises and conventions, EU copyright directives, and/or any other laws of the country in which the Customer purchases or Uses the Robot.
   4. Proprietary Notices. The Customer agrees not to remove, obscure, or alter any proprietary rights notices (including patent, copyright, and trademark notices) that may be affixed to or contained within the Software or the Robot. Nothing in this Agreement gives the Customer any right to any of Brain's trade names, trademarks, service marks, logos, domain names, or parts thereof, or other distinctive brand features.

5. Confidentiality and Data
   
   1. Confidentiality. "Confidential Information" means information that one party ("Disclosing Party") discloses to the other party ("Receiving Party") under the Agreement, and that is marked as confidential or would normally be considered confidential information under the circumstances. Confidential Information does not include information that is independently developed by the recipient, is shared with the recipient by a third party without confidentiality obligations, or is or becomes public through no fault of the recipient. The Receiving Party will only use the Disclosing Party's Confidential Information to exercise its rights and fulfill its obligations under this Agreement, and will use reasonable care to protect against the disclosure of the Disclosing Party's Confidential Information. Notwithstanding any other provision in this Agreement, the Receiving Party may disclose the Disclosing Party's Confidential Information: (a) to its employees, affiliates, agents, subcontractors, and professional advisors, who have a need to know and who are bound by confidentiality obligations at least as protective as those in this Section 5.1; (b) with the Disclosing Party's written consent; or (c) as strictly necessary to comply with any laws or regulations, including pursuant to any requests by a judicial or governmental order or investigative demand, subpoena, or similar process, provided the Receiving Party promptly notifies the Disclosing Party prior to such disclosure unless the Receiving Party is legally prohibited from doing so. The Receiving Party will comply with the Disclosing Party's reasonable requests to oppose disclosure of its Confidential Information.
   2. Operational Data. As between the Customer and Brain, and subject to the terms and conditions of this Agreement, the Customer owns and retains all right, title and interest in Operational Data. "Operational Data" means the data of the environment obtained by the sensors of a Robot during its operations and explicitly excludes all Personal Data. The Customer hereby grants to Brain a limited, perpetual, nonexclusive, transferable, irrevocable, worldwide license and right to store, use, sublicense, and copy Operational Data to: (a) fulfill Brain's obligations to the Customer under this Agreement, and (b) develop and improve Software, Services, Robots, and other products and services. Except as provided herein, Brain shall not use Operational Data for any other purpose without the Customer's prior written consent (email being sufficient). To the extent Operational Data is aggregated and not linked to the Customer, such data will not be considered Operational Data. The Customer acknowledges that it is neither practical nor useful for Brain to provide Operational Data to the Customer except as specified in the Service-Specific Terms for the particular Services to which the Customer has an active subscription.
   3. No Personal Data. The Customer acknowledges that Brain does not knowingly collect any Personal Data through the Robot, Software, or Services; provided, certain Personal Data may be collected by Brain or a third-party in the event notice is provided to a Permittee and such Permittee opts-in. "Personal Data" means personal data that (a) has the meaning given to it in (i) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("EU GDPR") or (ii) the EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018, if in force ("UK GDPR"), as applicable; and (b) would cause Brain to be subject to the EU GDPR or the UK GDPR (as applicable) as a data processor for the Customer.
   4. Additional Information. The Customer consents to Brain's then-current data privacy notice, described at www.braincorporation.com/data-privacy, detailing how Brain uses data collected under this Agreement. The Customer may be subject to, or have, additional country- or region-specific limitations, consents, responsibilities, or rights related to the collection, use, or transfer of information under this Agreement.

6. Terminating this Agreement. This Agreement will continue to apply until terminated by either the Customer or Brain as set out below:
   
   1. Termination by Customer. In the event that Brain has breached any provision of this Agreement and failed to cure such breach within 30 days' notice of such breach from the Customer, the Customer may terminate this Agreement by ceasing completely the use of the Software and the Services. The Customer may be required to separately terminate the Services under terms and conditions provided in the Customer's respective Service Document executed with Brain or an Authorized Seller.
      
   2. Termination by Brain. To the extent permitted under any applicable law, regulation, or directive, Brain may, at any time, immediately terminate this Agreement with the Customer if: (a) the Customer has breached any provision of this Agreement and failed to cure such breach within 30 days' notice of such breach from Brain; or (b) Brain is required to do so by law. Notwithstanding the foregoing, in the event the Customer makes any use of the Software, Services, or Services not expressly permitted by this Agreement, the Customer's license rights under this Agreement shall immediately and automatically be suspended, including the provision of Services. When this Agreement comes to an end, all legal rights, obligations, and liabilities that the Customer and Brain have benefited from, been subject to (or which have accrued over time while this Agreement has been in force) or which are expressed to continue indefinitely, shall not be affected and the provisions of Section 10.4 shall continue to apply to such rights, obligations, and liabilities indefinitely.

7. Warranties

Brain represents and warrants that the Software will: (a) materially conform to the Robot's then-current user manuals; and (b) provide Services as described in the Service's applicable Service-Specific Terms as reasonably verifiable by Brain for each Robot, subject to the Restrictions on Use, during the subscription term of such Services. Upon the Customer providing written notice of Brain's breach of the preceding warranties and Brain's failing to cure such breach within 30 days of receipt of such notice, the Customer's sole remedy for breach of this Section 7 for any Robot shall be termination of the Services for that Robot and a pro-rated refund of the fees paid by the Customer for the remaining time of the Customer's Services subscription for such Robot. Except as expressly provided in this Section 7, to the fullest extent permitted under any applicable law, regulation, or directive, Brain expressly disclaims all warranties and conditions of any kind, whether express or implied, including, but not limited to the implied warranties and conditions of merchantability and fitness for a particular purpose.

8. Limitation of Liability

The Customer expressly understands and agrees that Brain, its subsidiaries and affiliates, and its licensors shall not be liable to the Customer under any theory of liability for any indirect, incidental, special, consequential, or exemplary damages arising under this Agreement that may have been incurred by the Customer, whether or not Brain or its representatives have been advised of or should have been aware of the possibility of any such losses arising. In no event will the liability of Brain under this Agreement exceed the amount actually paid by the Customer (or with respect to claims for fees due, payable) for the Robotic Scrubber's Services during the then-current applicable subscription period in the Service Document giving rise to the claims. Such exclusion of liability shall not apply to any injury of life or body, arising from any grossly negligent or intentional conduct of Brain, or to other mandatory statutory liability or responsibility pursuant to the applicable law, regulation, or directive in the jurisdiction in which the Customer purchased the Robot.

9. Changes to this Agreement

Brain reserves the right, at any time and from time to time, to update, revise, supplement, and otherwise modify this Agreement and to impose new or additional rules, policies, terms, or conditions as required for safety, for compliance with laws or government regulations, and/or that do not materially impact the Customer's use of the Robot (collectively referred to in this Agreement as "Additional Terms") on the Customer's use of the Software and Services. The Additional Terms will be effective immediately and be considered incorporated into this Agreement. The Customer's continued use of the Software or Services following notice, at the mailing address or email address provided to Brain, of any Additional Terms will be deemed to constitute the Customer's acceptance of all such Additional Terms.

10. General Terms
    
    1. Agreement Documents. Any terms (other than those explicitly recognized in this Agreement) with respect to the Software or Services in a Service Document, purchase order, vendor agreement, extended service agreement, or any other instrument are void unless agreed upon in writing by Brain, and the terms and conditions of this Agreement shall control in the event of a conflict with any such instrument to the extent not expressly overwritten. This Agreement and any other instrument that references this Agreement that is signed by the Customer and Brain (together the Agreement and other instrument, the "Agreement Documents") constitutes the whole legal agreement between the Customer and Brain and governs the Customer's use of the Software or Services (excluding any services which Brain may provide to the Customer under a separate written agreement), and completely replaces any prior agreements between the Customer and Brain in relation to the Software and Services. The Customer agrees that if Brain does not exercise or enforce any legal right or remedy which is contained in the Agreement Documents (or which Brain has the benefit of under any applicable law), this will not be taken to be a formal waiver of Brain's rights and that those rights or remedies will still be available to Brain. If any court of law, having the jurisdiction to decide on this matter, rules that any provision of the Agreement Documents is invalid, then that provision will be removed from this Agreement without affecting the rest of the Agreement Documents. The remaining provisions of the Agreement Documents will continue to be valid and enforceable. This Agreement shall serve as the "Autonomous Navigation Software Customer License Agreement" or "EULA" as may be referenced by the Robot's user Instructions and other documents by Brain or any Authorized Seller. The Customer may also be referred to as the "End User."
       
    2. Export Control. The Software is subject to United States Export Laws. The Customer agrees to comply with all applicable domestic and international export and re-export restrictions and regulations, including those of the jurisdiction where the Robot was delivered, and not to transfer, or authorize the transfer, of the Software or Services to a prohibited country or otherwise in violation of any such restrictions or regulations.
       
    3. Assignment. The rights granted in the Agreement Documents may not be assigned or transferred by the Customer without the prior written approval of Brain. The Customer shall not be permitted to delegate the Customer's responsibilities or obligations under the Agreement Documents to any third party without Brain's prior written approval.
       
    4. Arbitration. The Agreement Documents shall be governed by the laws of the State of California without regard to its conflict of laws provisions. Any controversy or claim arising out of or relating to this contract, or the breach thereof, shall be settled by arbitration administered by the American Arbitration Association in accordance with its Commercial Arbitration Rules. Any judgment on the award rendered by the arbitrator(s) may be entered in any court having jurisdiction. Claims shall be heard by a single arbitrator, unless the claim amount exceeds $500,000, in which case the dispute shall be heard by a panel of three arbitrators. The place of arbitration shall be San Diego, California. The arbitration shall be governed by the laws of the State of California. Hearings will take place pursuant to the standard procedures of the Commercial Arbitration Rules that contemplate in person hearings. The standard provisions of the Commercial Rules shall apply. Arbitrators will have the authority to allocate the costs of the arbitration process among the parties but will only have the authority to allocate attorneys' fees if a particular law permits them to do so. Except as may be required by law, neither a party nor an arbitrator may disclose the existence, content, or results of any arbitration without the prior written consent of both parties. The parties agree that failure or refusal of a party to pay its required share of the deposits for arbitrator compensation or administrative charges shall constitute a waiver by that party to present evidence or cross-examine witness. In such event, the other party shall be required to present evidence and legal argument as the arbitrator(s) may require for the making of an award. Such waiver shall not allow for a default judgment against the non-paying party in the absence of evidence presented as provided for above. Notwithstanding the foregoing, the Customer agrees that Brain shall still be allowed to apply for injunctive remedies (or an equivalent type of urgent legal relief) in any jurisdiction.

11. Contact Us

Para cualquier pregunta, comentario o duda sobre este Acuerdo, o para cualquier notificación a Brain, póngase en contacto con Brain por correo postal o electrónico en:

Brain CorporationAttn: EULA10182 Telesis Court, Suite 100San Diego, CA 92121eula@braincorp.com

‍

‍

EXHIBIT A

Service-Specific Terms for

BrainOS Sense Suite

These Service-Specific Terms for BrainOS Sense Suite supplements and is incorporated into the Service Agreement between Brain and the Customer (the "Service Agreement"), and applies to the Customer's use of BrainOS Sense Suite (as defined below) associated with a Robot. All capitalized terms used herein and not otherwise defined herein shall have the respective meanings given to them in the Service Agreement, which the Customer acknowledges remains in full force and effect.

1. BrainOS Sense Suite: "BrainOS Sense Suite" is Brain's subscription service used in conjunction with a Dane AIR Scanner (the "Dane AIR"), which is a scanning Robot manufactured by Dane Technologies, Inc. ("Dane") that is configured to work with the BrainOS Sense Suite. Dane AIRs must be purchased separately and the terms and conditions of the hardware purchase and support are outside the scope of the Service Agreement and these Service-Specific Terms. The BrainOS Sense Suite features that will be part of Customer's subscription will be described in the Agreement Documents.
2. Use of the Software and BrainOS Sense Suite by the Customer: The Customer must comply with the additional Restrictions on Use established below that apply to BrainOS Sense Suite:
   
   1. Approved Uses. BrainOS Sense Suite is designed to image and analyze inventory, and the Customer and its Permittees shall only use BrainOS Sense Suite for this purpose. The Customer and its Permittees shall use the BrainOS Sense Suite only in accordance with the Instructions.
   2. Conduct Restrictions. The Customer, as well as its Permittees, shall not engage in any of the following conduct or activities: (a) operating BrainOS Sense Suite in any manner that constitutes a prohibited use under the Instructions; (b) intentionally tampering with, modifying, or damaging the Robot or any hardware or sensors containing or associated with the Software or BrainOS Sense Suite; (c) installing or modifying, or attempting to install or modify, any software other than the Software on the Robot (except solely as otherwise permitted pursuant to any open source licenses, if any, provided to the Customer by Brain, in connection with the Software licensed hereunder); (d) installing or attempting to install the Software on any hardware or device other than the Robot; or (e) attempting to deliberately damage or undermine the legitimate operation of BrainOS Sense Suite or the Software. The Robot, Software, and BrainOS Sense Suite are not designed or intended for use in environments where any failure of the Robot, Software, and BrainOS Sense Suite would reasonably likely lead directly to death, personal injury, or severe physical or property damage.
      
3. Service Levels
   
   1. System Availability. Each Robot with an active subscription to BrainOS Sense Suite connects to Brain's cloud instance for Support Services (the "Cloud"). With respect to the Cloud, Brain will provide 99% System Availability calculated on a per Robot basis over periods comprising each calendar month. The following definitions will apply with respect to System Availability:
      
      
      1. “Downtime” means the time (in minutes) following written notice by the Customer that the Cloud is not operational for connection to a Robot for BrainOS Sense Suite, as reasonably verifiable by Brain, while the Customer has an active subscription to BrainOS Sense Suite for that Robot. Downtime does not include unavailability of the Cloud relating to: (a) any Force Majeure Event or System Maintenance; (b) any modifications to the Robot, Software, BrainOS Sense Suite or Services that are unauthorized by Brain; (c) abuses or other behaviors that interfere with the legitimate operation of the Cloud; (d) usage that is inconsistent with the Instructions or in violation of the terms of the Service Agreement; or (e) failure of the Customer or its Permittees to provide information or perform actions in a timely manner as prompted by the Software of the Robot or Brain.
         
      2. “Force Majeure Event” means any failure or delay caused by or the result of causes beyond the reasonable control of a party and could not have been avoided or corrected through the exercise of reasonable diligence, including, but not limited to, acts of God, fire, flood, hurricane or other natural catastrophe, terrorist actions, laws, orders, regulations, directions or actions of governmental authorities having jurisdiction over the subject matter hereof, or any civil or military authority, national emergency, insurrection, riot or war, or other similar occurrence.
      3.  “System Availability” shall mean the percentage, for each Robot and expressed to one decimal point, resulting from the following calculation: [1-(Downtime/Total Time)] x 100.
      4.  “System Maintenance” means time (in minutes) that the Cloud is not accessible for connection to a Robot due to maintenance, including for maintenance and upgrading of the software and hardware used by Brain to provide the Support Services. System Maintenance includes scheduled maintenance and unscheduled, emergency maintenance. In the event Downtime is anticipated, Brain will provide the Customer with at least 72 hours' advance written notice of any scheduled maintenance or 60 minutes' advance written notice for unscheduled, emergency maintenance.
      5. “Total Time” means the totalnumber of minutes in a calendar month, excluding any Force Majeure Event(s) orSystem Maintenance, in which the Customer has an active subscription toAutonomy Services for a Robot.
   2.  WiFi Connection. During operation, if access to a Wi-Fi network meeting the requirements described in the Instructions is not available for a Robot, Brain may not be able to provide that Robot the applicable Services associated with BrainOS Sense Suite. For this reason, Brain is not responsible for any inability of a Robot to connect to a Wi-Fi network, and any calculation of Downtime expressly excludes any inability of a Robot to access an otherwise operational Cloud due to lack of Wi-Fi network connectivity.
   3. Credits. If the SystemAvailability for a Robot during any given month falls below 99%, Brain will provide the Customer with a credit to its future invoices for the BrainOS SenseSuite of that Robot (a “Service Credit”)as set forth in the chart below:

In order to receive a Service Credit, the Customer must notify Brain in writing, providing with specificity the circumstances giving rise to the Customer's request, within 30 days from the time the Customer becomes eligible to receive the Service Credit. If the Customer does not comply with the requirements of this paragraph, the Customer shall forfeit its right to receive a Service Credit.

EXHIBIT B

Corporación Brain

EULA Data Protection Addendum

This EULA Data Protection Addendum (the “Addendum”) is incorporated into and subject to the terms and conditions of the End User License Agreement between you (the “End User”) and Brain Corporation(“Brain”) (the “EULA”; together the EULA and theAddendum shall be referred to herein as the “Agreement”).

1. Defined Terms. Capitalized terms used in this Addendum that are not otherwise defined here in will have the same meaning ascribed to them as set forth in the EULA.
   
   1. “Affiliate” means any entity that directly or indirectly Controls, is controlled by, or is under common Control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50%of the voting interests of the subject entity.
   2. “BrainOS-enabledRobots” means any robot containing theSoftware and provided under an active subscription under the EULA.
   3. “End User Personal Data” means the Personal Data provided to Brain by the End User employees, contractors, or other designated agents when utilizing Software of BrainOS-enabled Robots.  
   4. “Controller” means the entity which determines the purposes and means of the Processing of Personal Data.
   5. “Data Laws” means data protection and privacy laws and regulations applicable to the processing of Personal Data in any relevant jurisdiction.
   6. “Data Subject” means the identified or identifiable person to whom End User Personal Data relates.
   7. “EEA” means the European Economic Area.
   8. “European Data Laws” means all applicable data protection and privacy laws and regulations in European jurisdictions, including, for EEA territories, the General Data ProtectionRegulation (EU) 2016/679 and any successor legislation and associated national implementations thereto (the “GDPR”) and, for the United Kingdom, the UnitedKingdom Data Protection Act 2018.
   9. “Non-European Data Laws” means all applicable data protection and privacy laws and regulations outside ofEuropean jurisdictions as described in Appendix IV.
   10. “Personal Data” means personal data under applicable Data Laws.
   11. “Process, Processed, and Processing” means any operation or set of operations which is performed on End User Personal Data or on sets of End User Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
   12. “Security Incident” means, in connection with the Services: (i) the loss or misuse (by any means) of End User Personal Data; (ii) the inadvertent, unauthorized, and/or unlawful disclosure, Processing, alteration, corruption, sale, rental, or destruction of End User Personal Data or other breach with respect to End User Personal Data; (iii) any compromise or exploit of a vulnerability of End User Personal Data within the Services; or (iv) any confirmed exposure or exploit of a vulnerability of the End User Personal Data (which may stem from an act or omission to act) that would result in any of the events described in this clause (1.k.i) or (1.k.iii).
   13. “Services” means services provided by Brain to the End User pursuant to the EULA.
   14. “Standard Contractual Clauses” or "SCC" means the agreement executed by and between the End User and Brain, and attached hereto as Appendix V, pursuant to the European Commission's implementing decision (EU) 2021/914 of 4 June 2021 on Standard Contractual Clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.
   15. “Sub-processor” means any third party that Brain engages in accordance with Appendix III of this Addendum in order to perform the Processing.
   16. “Term” means the duration of the active subscription under the EULA.
       ‍
2. Processing of Data.
   
   1. Roles of the Parties. The Parties acknowledge that with regard to the Processing of End User Personal Data in accordance with the Services, the End User is the Controller and Brain is the processor.
   2. Brain's Processing of Personal Data. Brain and its Affiliates shall process End User Personal Data in accordance with the End User's documented written instructions. Brain and the End User agree that Brain and its Affiliates shall process End User Personal Data for the purposes, duration and other details set forth in Appendix I.
   3. End UserCompliance Obligations. Without limiting the generality of this Section 2, (Processing of Data) the End User warrants that:
      ‍
      
      1. the End User shall have sole responsibility for the accuracy, quality, and legality of End User Personal Data and the means by which the End User acquired End User Personal Data
      2. the End User specifically acknowledges that its use of the Services will not violate the rights of any data subject that has opted-out from sales or other disclosures of End User Personal Data, to the extent applicable under Data Laws; and
      3. the End User has taken and further undertakes that throughout the Term it shall take all necessary steps (having regard to the nature of the circumstances in which End User Personal Data will be collected) to provide affected Data Subjects with an accurate, comprehensible, concise, conspicuous and easily accessible description of all processing of End User Personal Data carried out under and in connection with the Addendum, which are sufficient to meet the standards and requirements of Article 13/14 of the GDPR.
         ‍
         
3. Data Security
   
   1. Brain's Security Measures. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing (as set forth in Appendix I) as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Brain has implemented and maintains technical and organizational measures designed to protect End User Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, to End User Personal Data as further described in Appendix II. Brain may update or modify its security program from time to time, provided that such updates and modifications do not materially decrease the overall security of the End User Personal Data.
   2. Security Compliance by Brain Staff. Brain will grant access to End User Personal Data only to employees, contractors, and Sub-processors who need such access for the scope of their performance and are subject to appropriate confidentiality arrangements.
   3. Brain's Security Assistance. Taking into account the nature of the processing of End User Personal Data and the information available to Brain, Brain will provide the End User with reasonable assistance necessary for the End User to comply with its obligations in respect of End User Personal Data under European Data Protection Legislation, including Articles 32 to 34 (inclusive) of the GDPR, by:
      ‍
      
      1. ensuring Brain's Sub-processors are implementing and maintaining the security measures in accordance with Section 3(1) (Security Measures);
      2. complying with the terms of Section 4 (Security Incidents); and
      3. complying with the terms of Section 4 (Security Incidents); and
         
4. Security Incidents
   
   1. Brain’s Obligations. Brain shall notify the End User by email and/or phone of any actual Security Incident without undue delay after Brain becoming aware. Brain shall take reasonable steps to investigate the cause of such Security Incident, minimize harm to the End User, and prevent a recurrence of such Security Incident. Brain will investigate any such Security Incident and take necessary steps to eliminate or contain the exposures that led to such Security Incident in accordance with Brain's security program and applicable law. The Parties agree to coordinate in good faith on developing the content of any related public statements or any required notices for the affected Data Subjects and/or notices to the relevant data protection authorities.
   2. End User's Obligations. Other than agreeing on the content of related public statements or required notices, the End User is solely responsible for complying with incident notification laws applicable to the End User and fulfilling any third-party notification obligations related to any Security Incident(s). Brain's notification of or response to a Security Incident will not be construed as an acknowledgement by Brain of any fault or liability with respect to the Security Incident.
   3. The End User agrees that, without prejudice to Brain’s obligations underSection 4, (Security Incidents) the End User is solely responsible for its use of the Services, including:
      ‍
      
      1. making appropriate use of the Services to ensure a level of security appropriate tothe risk in respect of the End User Personal Data;
      2. securing the account authentication credentials, systems, and devices the End User uses to access the Services;
      3. securing the End User’s systems and devices that Brain uses to provide the Services; and
      4. backing up End User Personal Data.
         ‍
         
5. Audits. Brain evaluates, tests, and monitors the effectiveness of the Brain security program and adjusts and/or updates the Brain security program as reasonably warranted by the results of such evaluation, testing, and monitoring. Brain, from time to time, may conduct an assessment of the implementation and maintenance of Brain's End User Personal Data protection program and its related compliance with Data Laws ("Audit Report"). Upon the End User's reasonable request, Brain shall provide its then-current Audit Report; provided, however, that the End User agrees that any such Audit Report is the Confidential Information of Brain.
6. Legally Required Disclosures. Brain may disclose End User Personal Data and any other information about the End User to government or law enforcement officials or private parties if, in Brain's reasonable discretion, Brain believes it is necessary or appropriate in order to respond to legal requests, demands, and orders, including subpoena, judicial, administrative, or arbitral order of an executive or administrative agency, regulatory agency, or other governmental authority, to protect the safety, property, or rights of Brain or of any third party, to prevent or stop any illegal, unethical, or legally actionable activity, or to comply with applicable law. Except as otherwise required by applicable law, Brain will notify the End User of any legal requests, demands, and orders that Brain receives, and that relate to the processing of End User Personal Data.
7. Data Subject Rights.
   
   1. End User's Responsibility for Requests. If Brain receives a request from a data subject in relation to End User Personal Data, Brain will advise the data subject to submit its request to the End User and the End User will be responsible for responding to any such request.
   2. Brain's Data Subject Request Assistance. Taking into account the nature of the processing of End User Personal Data, Brain will require its Sub-processors to provide the End User with reasonable assistance as necessary for the End User to fulfill its obligation under applicable law to respond to requests by data subjects, including if applicable, the End User's obligation to respond to requests for exercising a data subject's rights set out in in Chapter III of the GDPR. The End User shall reimburse Brain for any such assistance beyond providing self-service features included as part of the Services at Brain's then-current professional services rates, which shall be made available to the End User upon request.
      ‍
      
8. Data Transfers Out of the EEA. If the storage and/or processing of End User Personal Data occurs within the EEA, involves transfers of End User Personal Data out of the EEA or Switzerland, and the European Data Protection Legislation applies to the transfers of such data, Brain and its Sub-processors will make such transfers in accordance with the SCCs, and make information available to the End User about such transfers upon request.
9. Sub-processors. The End User acknowledges and agrees that Brain may engage Sub-processors to process End User Personal Data on the End User's behalf. A list of approved Sub-processors is set forth in Appendix III. The End User agrees that all such approved Sub-processors are permitted to Process End User Personal Data for the nature and purposes set forth herein. Brain will maintain a list of Sub-processors as described in Appendix III. Brain will update its website to reflect new Sub-processors within ten (10) calendar days prior to a Sub-processor beginning to process End User Personal Data. The End User shall have ten (10) calendar days to reasonably object to the addition of any new Sub-processor.
10. Record Retention and Destruction. Brain shall maintain records related to its Processing activities performed on behalf of the End User relating to End User Personal Data for at least the Term. Upon termination of this Agreement, Brain shall delete any End User Personal Data in its possession, provided, however, that Brain may retain a copy of any such End User Personal Data to the extent required by applicable law.
11. Notices. Brain shall maintain records related to its Processing activities performed on behalf of the End User relating to End User Personal Data for at least the Term. Upon termination of this Agreement, Brain shall delete any End User Personal Data in its possession, provided, however, that Brain may retain a copy of any such End User Personal Data to the extent required by applicable law.
12. Jurisdiction Specific Terms. To the extent Brain Processes End User Personal Data originating from and protected by Non-European Data Laws, then the terms specified in Appendix IV with respect to those applicable jurisdictions further apply in addition to the terms set forth herein. In the event of any conflict between such jurisdiction-specific terms and this Addendum, such jurisdiction-specific terms shall control.
13. Effect of These Terms. Except as otherwise set forth herein, the terms and conditions of this Addendum, including the Appendices, are part of and incorporated into the Agreement, and the terms and conditions of this Addendum constitute the entire and exclusive agreement between the Parties with respect to its subject matter. To the extent of any conflict or inconsistency between this Addendum and the terms of the EULA, this Addendum will govern.

‍

Appendix II – Security Measures

Brain safeguards include appropriate technical, physical, and organizational measures, standards, requirements, specifications, or obligations designed to ensure a level of security appropriate to the risks presented by the Processing and the nature of the Personal Data to be protected, taking into account the state of the art; costs of implementation; the nature, scope, context, and purposes of Processing; and the risk of varying likelihood and severity for the rights and freedoms of natural persons. Further technical and organizational security measures implemented by the data importer are as described in the Addendum.

Appendix III – Approved Sub-processors

The End User may find the list of approved Brain Sub-processors available at: https://www.braincorp.com/brain-corp-data-sub-processors/.

Appendix IV – Jurisdiction Specific Terms

California:

1. The following additional terms apply related to the Processing of Personal Data of California resident
   
   1. Each of the Parties will comply with the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA") (collectively, "California Privacy Law")
   2. To the extent that Brain receives any End User Personal Data (for purposes of this Appendix, Personal Data as defined under California Privacy Law) of any "consumer" (as defined under California Privacy Law) for processing (as defined under California Privacy Law) on behalf of the End User pursuant to the Agreement, Brain shall:
      
      1. be a “Service Provider” to the End User under the CaliforniaPrivacy Law;
      2. not retain, use or disclose the Personal Data for any purpose other than for the specific purpose of the Services or as otherwise permitted by the California Privacy Law, including for any "business purpose" (as defined under California Privacy Law);
      3. confirm that any authorized subcontractor or third party to whom Service Provider discloses or provides access to Brain Personal Data is subject to these same obligations;
      4. not retain, use or disclose the Personal Data for a "commercial purpose" (as defined under California Privacy Law) other than providing the Services;
      5. not process any of the Personal Data for its own or for any other third party's purpose. For the avoidance of doubt, Service Provider shall not "sell" or "share" Personal Data, as those terms are defined by California Privacy Law. Service Provider will not take any action that would cause the Service Provider to cease being a "service provider," as defined under the California Privacy Law, with respect to Personal Data and certifies that it understands the restrictions under the Applicable Agreements and applicable privacy legislation. Any obligations required of a service provider in order to meet and maintain service provider status under the California Privacy Law, or other applicable privacy legislation, now or hereafter existing are deemed incorporated by reference as express obligations of the Service Provider hereunder;
      6. after the completion of Services, Service Provider shall, at your direction, delete all Personal Data processed on your behalf and certify that it has done so, or return to you all Personal Data processed on its behalf and delete existing copies;
      7. cooperate with and assist you in addressing its own California Privacy Law compliance, as stipulated by the Applicable Agreements, including but not limited to by providing requested Personal Data in response to consumer requests as well as correcting or deleting Personal Data or limiting the use of sensitive Personal Data, as defined by California Privacy Law, in response to such requests;
      8. grant you rights to take reasonable and appropriate steps, including reasonable assessments, to help ensure that the Service Provider is using the Personal Data transferred in a manner consistent with Brain's obligations under California Privacy Law. Service Provider must immediately notify you if it makes a determination that it can no longer comply with the requirements of California Privacy Law;
      9. comply with, and provide the same level of privacy protection as is required by California Privacy Laws, to the extent applicable to Service Provider's processing of your Personal Data. Further, Service Provider will also impose California Privacy Law requirements, to the extent applicable, on all subcontractors processing Personal Data; and
      10. promptly (and, in any case within seven days of receipt) comply with the End User's written instructions associated with responding to an individual's request to exercise their privacy rights with respect to their Personal Data. 
          
2. promptly (and, in any case within seven days of receipt) comply with the End User's written instructions associated with responding to an individual's request to exercise their privacy rights with respect to their Personal Data.

Canada:

1. The following additional terms apply related to the Processing of Personal Data of Canadian residents:
   
   1. To the extent any Sub-processor processes End User Personal Data associated with Canadian residents, such Sub-processor is a third party under the Personal Data Protection and Electronic Documents Act, with whom Brain has entered into a written contract with substantially similar protections as set forth in this Addendum. Further, Brain conducts appropriate due diligence on any such Sub-processor.

Appendix V Standard Contractual Clauses

STANDARD CONTRACTUAL CLAUSES

Having regard to theEuropean Commission’s implementing decision (EU) 2021/914 of 4 June 2021 onStandard Contractual Clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council

End User (as defined in the EULA)

The data exporting organization identified in the table above (the “data exporter”)

- And –

Corporación Brain

(the “data importer”)

each a “party”;together “the parties”,

HAVE AGREED on the Contractual Clauses for the transfer of personal data to third countries from a data controller in the European Economic Area to a data processor in the United States pursuant to the European Commission implementing decision of 4 June 2021 on Standard Contractual Clauses for the transfer of Personal Data to Processors established in third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.

The Clauses are attached hereto by reference with the options and optional modules selected as follows:

• All Sections: Module TWO
• Section II, Clause 9(a): OPTION 2, general written authorization for sub-processing.
• Section II, Clause 11(a): OPTION NOT INCLUDED
• Section IV, Clause 17: OPTION 1, the location of the data exporter.
• Section IV, Clause 18: the jurisdiction associated with the data exporter.

Annex I, II, III, and IV are attached to the Clauses hereto.

ANNEX I TO APPENDIX V

A. LIST OF PARTIES

Data exporter(s): EndUser, the Data Controller (as defined in the EULA)

Data importer(s):Brain Corporation, the Data Processor

B. DESCRIPTION OF THE TRANSFER

The parties agree that the details of Brain’s processing activities are set forth in Appendix I to the Addendum.

ANNEX II TO APPENDIX V

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA.

The parties agree that the technical and organization measures are set forth in Appendix II to the Addendum.

ANNEX III TO APPENDIX V

LIST OF SUB-PROCESSORS

The parties agree that the list of approved sub-processors is set forth inAppendix III to the Addendum.

ANNEX IV TO APPENDIX V

The parties agree that the Standard Contractual Clauses are an appropriate safeguard to ensure an adequate level of protection for End User Personal Data transferred from the EEA. The Data Processor has documented a transfer impact assessment supporting this determination which is available to Data Controller upon written request.