White-Label Platform Licence Terms

Version 2 — Effective 16 August 2026

These Terms are issued by IMG VENTURES LIMITED, a private company limited by shares incorporated in Ireland under company number 820947, whose registered office is at 77 Camden Street Lower, Dublin D02 XE80, Ireland, trading as "127box" (the "Licensor"). They apply to every business that accepts them in accordance with clause 0 (each, the "Licensee").

ABOUT THESE TERMS

A. The Licensor owns and operates a software platform known as "127box" (the "Platform"), which it makes available to business customers for deployment and operation under their own brand.

B. A business obtains a licence to operate the Platform by completing the acceptance steps in clause 0. Doing so forms a binding agreement between that business and the Licensor on these Terms (the "Agreement").

C. As part of accepting these Terms, the Licensee confirms that it does so wholly and exclusively in the course of its trade, business or profession, and not as a consumer.

0. FORMATION AND ACCEPTANCE

0.1 This Agreement — these Terms together with the Data Processing Agreement at Annex 1 — is formed between the Licensor and a Licensee when that Licensee completes checkout under clause 0.2. No printed, handwritten, or scanned signature is required or requested.

0.2 Checkout. When paying the Launch Fee, the prospective Licensee must submit the particulars listed in Schedule 1, and separately tick two boxes: (i) confirming it has read and agrees to this Agreement, including Annex 1; and (ii) confirming that it is entering into this Agreement in the course of its trade, business or profession, and not as a consumer. Payment is not accepted until both boxes are ticked. No further acceptance step is required from the Licensee: Handover under clause 4.3 is an automatic system event, not a second consent.

0.3 The Licensor will keep a record of the version of this Agreement accepted, and the date, time, account, and IP address recorded at checkout, as evidence that this Agreement was formed.

0.4 The Licensor may update this Agreement, including for legal or pricing reasons. Changes will be notified to the Licensee at least 30 days before they take effect and will apply from the Licensee's next Subscription period, save that changes required by law may take effect immediately. Continued use of the Platform after an update takes effect is acceptance of that update.

1. DEFINITIONS AND INTERPRETATION

1.1 In this Agreement, the following terms have the meanings set out below, unless the context requires otherwise:

"Agreement" means these 127box White-Label Platform Licence Terms, including the Schedules and the Data Processing Agreement at Annex 1, as accepted under clause 0.

"Business Day" means a day, other than a Saturday, Sunday or public holiday, on which banks are open for business in Dublin, Ireland.

"Business Hours" means 09:00 to 17:00 Irish time on a Business Day.

"Deployment" means the single production installation of the Platform provided to the Licensee under this Agreement.

"Deployment Model" means the deployment option selected by the Licensee at checkout and recorded in Schedule 1, being either a "Managed Deployment" (the Deployment runs on infrastructure procured and controlled by the Licensor, on the terms of Schedule 3) or a "Self-Hosted Deployment" (the Deployment runs on infrastructure procured and controlled by the Licensee, on the terms of Schedule 4).

"Documentation" means the user and administrator documentation for the Platform as it exists at the date of delivery under clause 4.5, as updated by the Licensor from time to time.

"Fees" means the Launch Fee, the Subscription Fee, and any additional fees charged under clause 5.1(c).

"GDPR" means Regulation (EU) 2016/679 (the General Data Protection Regulation).

"Handover" means the point at which the Licensor's system sends the Licensee an invitation link enabling it to set its own administrator credentials for the Deployment, automatically, on completion of Onboarding, in accordance with clause 4.3.

"Launch Fee" means the fee specified in clause 5.1(a).

"Licensee" means the business that accepts this Agreement in accordance with clause 0.

"Licensee Data" means all data input, uploaded, generated or collected via the Deployment by or on behalf of the Licensee or its customers, including personal data.

"Onboarding" means the process described in clause 6.

"Onboarding Period" means the 14-day period described in clause 6.1.

"Platform" means the 127box software platform, including the application, database, and associated documentation, but excluding the Third-Party Services.

"Subscription Fee" means the recurring fee specified in clause 5.1(b).

"Third-Party Services" means the third-party services listed in clause 10.1.

1.2 In this Agreement: (a) headings are for convenience only and do not affect interpretation; (b) the singular includes the plural and vice versa; (c) "including" and "includes" mean "including, without limitation"; and (d) a reference to a statute or statutory instrument includes that statute or instrument as amended or re-enacted from time to time.

2. BUSINESS-TO-BUSINESS NATURE OF THIS AGREEMENT

2.1 The Licensee confirms, by ticking the box referred to in clause 0.2(a)(ii), that it enters into this Agreement wholly and exclusively in the course of its trade, business or profession, and not as a consumer.

2.2 Accordingly, the statutory information and cancellation rights conferred on consumers by the European Union (Consumer Information, Cancellation and Other Rights) Regulations 2013 (S.I. No. 484/2013), including the 14-day right of withdrawal, do not apply to this Agreement.

2.3 The particulars supplied by the Licensee under clause 0.2 — its legal name, company registration number, VAT number (where applicable), registered address, and the name and capacity of the individual completing checkout on its behalf — are set out in Schedule 1 and form part of this Agreement.

3. GRANT OF LICENCE

3.1 Subject to payment of the Fees and compliance with this Agreement, the Licensor grants to the Licensee a non-exclusive, non-transferable, non-sublicensable licence to operate the Platform, under the Licensee's own branding, for the Licensee's own business, on one (1) Deployment.

3.2 This licence is worldwide and non-exclusive. No territorial restriction, and no exclusivity of any kind, is granted to the Licensee.

3.3 Nothing in this Agreement grants the Licensee any right to:

(a) resell, redistribute, publish, sub-license, or otherwise make available the source code or object code of the Platform, in whole or in part, whether or not modified;

(b) sublicense the Platform to any other operator;

(c) operate the Platform as a service on behalf of, or for the benefit of, any third-party operator; or

(d) acquire any ownership interest in the source code or other intellectual property in the Platform, which remains vested in the Licensor (or its licensors) at all times.

3.4 This licence covers the Licensee's Deployment as configured at Onboarding. Where the Licensee requires additional infrastructure supporting that same Deployment — for example, an additional server for redundancy or availability in another region — that work remains within the scope of this licence and is quoted and billed by the day at the rate in Schedule 2. A separate Deployment for a distinct brand or business requires a new licence and is priced separately.

3.5 As between the Parties, the Licensee owns: (a) the Licensee Data; (b) its customer relationships; (c) its trade marks, brand assets, and business goodwill; and (d) all content and material generated by its customers through the Deployment. Nothing in this Agreement transfers any of the foregoing to the Licensor.

4. DEPLOYMENT AND HANDOVER

4.1 The Licensor will deploy the Platform — application, database, mail relay, and TLS certificates — onto infrastructure determined by the Deployment Model selected by the Licensee at checkout and recorded in Schedule 1.

4.2 The Schedule corresponding to the selected Deployment Model — Schedule 3 for a Managed Deployment, Schedule 4 for a Self-Hosted Deployment — forms part of this Agreement and, to the extent of any conflict with the main body of these Terms, prevails. Responsibility for procuring the underlying infrastructure, and for the Third-Party Service accounts referred to in clause 10, is allocated by that Schedule.

4.3 As soon as Onboarding is complete, the Licensor's system will automatically send the Licensee an invitation link by which the Licensee sets its own administrator credentials ("Handover"). Sending that link is the operative Go-Live event: it marks the point the Deployment is live and starts the Subscription Fee under clause 5.3. The Licensor does not send passwords by email.

4.4 Configuration of branding, pricing margins, copy, and legal documents is carried out by the Licensee within the administrator panel and does not require server access by the Licensor.

4.5 The Licensor will make available the Documentation as it exists at the date of delivery.

4.6 The Licensee may move between Deployment Models after Handover. Such a move is a migration: it is quoted in advance and billed at the day rate in Schedule 2, with a minimum of one day, and Schedule 1 is updated to record the new Deployment Model from the date of the move.

5. FEES

5.1 The Licensee will pay the Licensor the following fees:

(a) Launch Fee: €4,900 (four thousand nine hundred euro), payable once at checkout, exclusive of VAT, as consideration for the Licensor's Onboarding service — deploying the Platform and effecting Handover under clause 4 — and not for access to a download or copy of software;

(b) Subscription Fee: €499 (four hundred ninety-nine euro) per month, exclusive of VAT, payable monthly in advance — the fee for the licence to use the Platform under clause 3, not a support fee — or, at the Licensee's election, €5,209.56 (five thousand two hundred and nine euro fifty-six cent) per year, exclusive of VAT, payable annually in advance, being a 13% discount to twelve monthly payments; and

(c) Additional work: any work requested by the Licensee beyond Ordinary Support (clause 8) will be quoted in advance and billed by the day, at the rate set out in Schedule 2.

5.2 All Fees are exclusive of value added tax. Where the Licensee is established and VAT-registered in Ireland, VAT will be added at the rate applicable at the time of invoicing. Where the Licensee is a taxable person established in another EU Member State and provides a valid VAT identification number, the Parties intend that the reverse charge mechanism applies and the Licensor will invoice accordingly.

5.3 Following Handover, the Licensee has 7 days to verify that the Deployment functions as expected, and up to 14 days from Handover to raise any dispute about the Deployment or the first Subscription Fee payment. The first Subscription Fee payment — monthly or, if elected, annual — falls due within that 14-day window, and is made through the Licensor's payment gateway.

5.4 If the first Subscription Fee payment has not been made by the 15th day after Handover, the Licensor will display a notice in the Licensee's administrator panel requiring payment for the Deployment to continue, and clause 16.2 (Non-Payment of the Subscription Fee) applies from that point, treating the 15th day after Handover as Day 1 for the purposes of clause 16.2.

5.5 After the first payment, the Licensee must maintain a valid payment method on file, and each renewal Subscription Fee payment — monthly or annual, as elected — is charged automatically in advance for the next period. If a renewal charge is not successfully collected, clause 16 (Non-Payment of the Subscription Fee) applies in the usual way.

5.6 The annual Subscription Fee is paid in advance for the full 12-month period and is not refundable, including on termination under clause 15.1, save as required by law.

5.7 The Launch Fee is not refundable once Onboarding has been completed. Where Onboarding is not completed within the Onboarding Period, clause 6.2 (credit, not forfeiture) applies instead of a refund.

5.8 Where the Licensor issues an invoice for additional work under clause 5.1(c), that invoice is payable within 14 days, and the Licensor may charge statutory interest on late payment in accordance with the European Communities (Late Payment in Commercial Transactions) Regulations 2012.

6. ONBOARDING

6.1 The Licensee must complete Onboarding — supplying the particulars in Schedule 1 and creating the Third-Party Service accounts referred to in clause 10 — within 14 days of payment of the Launch Fee (the "Onboarding Period").

6.2 If Onboarding is not completed within the Onboarding Period, the Launch Fee is not forfeited. It is retained by the Licensor as credit against deployment of the Platform, to be applied whenever the Licensee subsequently completes Onboarding.

6.3 If Onboarding remains incomplete after the Onboarding Period, the following escalation applies, without affecting the Licensee's credit under clause 6.2:

(a) a further 14-day reminder period, during which the Licensor will contact the Licensee to request completion;

(b) if Onboarding is still incomplete, a 2 Business Day final notice; and

(c) if Onboarding is still incomplete after the final notice, the matter is referred to support handling and the Licensee's account is placed on hold until Onboarding is completed.

7. SUPPORT ACCESS TO THE LICENSEE'S INSTALLATION

7.0 This clause 7 applies to a Self-Hosted Deployment. For a Managed Deployment the Licensor controls the infrastructure and paragraph 2 of Schedule 3 applies in place of this clause.

7.1 The Licensor will hold a single, named administrative account on the Licensee's Deployment. The Licensor will not use shared or generic credentials.

7.2 The Licensee may revoke the Licensor's access at any time, by any means available to it within the administrator panel or the infrastructure it controls.

7.3 All access to the Deployment by the Licensor's named account is logged.

7.4 The Licensor will access the Deployment only: (a) at the Licensee's request; or (b) to apply a security fix, in which case the Licensor will give the Licensee notice of such access.

7.5 The Licensee is not required to keep the Licensor's access open as a condition of the licence granted under clause 3 continuing. If the Licensee revokes access, the only consequence is that the Licensor cannot practically deliver support or updates for as long as access remains revoked.

7.6 On termination of this Agreement, the Licensor's access under this clause 7 ends, and the Licensor will confirm removal of its administrative account in writing.

8. ORDINARY SUPPORT AND ADDITIONAL WORK

8.1 "Ordinary Support" means reasonable-efforts email support for minor configuration questions, bug reports, and questions about use of the Platform, provided during Business Hours, with a target first response within 2 Business Days. Ordinary Support does not include a fixed bank of included hours.

8.2 Ordinary Support does not include custom development, data migration, infrastructure troubleshooting outside the Platform itself, or work outside Business Hours. Any such work is quoted in advance and billed by the day at the rate in Schedule 2.

9. DATA PROTECTION

9.1 The Deployment stores personal data relating to the Licensee's customers, including identity verification documents. As between the Parties, the Licensee is the controller of that personal data. The Licensor acts as a processor solely to the extent it accesses the Deployment under clause 7.

9.2 The Parties agree the terms of the Data Processing Agreement at Annex 1, which forms part of this Agreement and applies whenever the Licensor processes personal data on the Licensee's behalf.

9.3 Processing of personal data under this Agreement is governed by the GDPR and the Data Protection Act 2018, and the relevant supervisory authority is the Data Protection Commission.

10. THIRD-PARTY SERVICES

10.1 The Platform depends on the following third-party services: Hetzner (compute and DNS), Openprovider (domain registration), Stripe (payment processing and identity verification), and Let's Encrypt (TLS certificates) (together, the "Third-Party Services").

10.2 The Licensee must contract directly, and in its own name, with Stripe and Openprovider, and with any other provider of Third-Party Services required to operate its Deployment save as provided below. Under a Self-Hosted Deployment the Licensee also contracts directly with the hosting provider. Under a Managed Deployment the Licensor procures and contracts for the hosting infrastructure in its own name, on the terms of Schedule 3.

10.3 The Licensor is not responsible for the availability, pricing, policy changes, or termination of the Licensee's account with any provider of Third-Party Services, and none of the foregoing constitutes a breach of this Agreement by the Licensor.

11. INTELLECTUAL PROPERTY

11.1 The Licensor and its licensors retain all right, title and interest in and to the Platform, the Documentation, and all associated intellectual property rights, save for the licence expressly granted in clause 3.

11.2 This Agreement grants the Licensor no rights in the Licensee's brand, trade marks, or Licensee Data, other than as necessary for the Licensor to perform this Agreement.

12. WARRANTIES AND DISCLAIMERS

12.1 Except as expressly set out in this Agreement, the Platform is provided "as is". The Licensor gives no warranty that the Platform is fit for any particular purpose, and none is to be implied.

12.2 Under a Self-Hosted Deployment, no uptime service level applies, and the Licensee is responsible for the availability, security, and operation of the infrastructure hosting its Deployment. Under a Managed Deployment, the availability, backup and restoration commitments in paragraph 3 of Schedule 3 apply, and the disclaimer in this clause 12.2 does not.

12.3 Any legal document templates shipped within the Platform (including template terms of service, privacy policy, or acceptable use policy) are provided as a starting point only. They do not constitute legal advice, and the Licensee must obtain its own legal review, appropriate to its jurisdiction and business, before offering any service to its own customers. The Licensor will repeat this reminder in the Handover email sent under clause 4.3.

12.4 Each Party warrants that it has full power and authority to enter into this Agreement.

13. LIMITATION OF LIABILITY

13.1 Nothing in this Agreement limits or excludes either Party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot be limited or excluded under Irish law.

13.2 Subject to clause 13.1, the Licensor's total aggregate liability arising out of or in connection with this Agreement, whether in contract, tort (including negligence), or otherwise, will not exceed the total Fees paid by the Licensee in the twelve (12) months immediately preceding the event giving rise to the claim.

13.3 Subject to clause 13.1, neither Party is liable to the other for any indirect or consequential loss, or for loss of profit, revenue, business, or anticipated savings, whether or not such loss was foreseeable.

14. TERM

14.1 This Agreement commences when formed under clause 0, and the Subscription continues on a rolling monthly basis until terminated under clause 15 or clause 16.

15. TERMINATION

15.1 Either Party may terminate the Subscription for convenience by giving 30 days' written notice, to expire at the end of a monthly Subscription period.

15.2 The Licensor may terminate this Agreement immediately on written notice if the Licensee commits a material breach of this Agreement — including any attempt to resell, redistribute, or sublicense the Platform in breach of clause 3 — and, where the breach is capable of remedy, fails to remedy it within 14 days of notice. Non-payment of the Subscription Fee is dealt with separately under clause 16.

15.3 The Licensee may terminate this Agreement immediately on written notice if the Licensor commits a material breach of this Agreement and fails to remedy it within 14 days of notice.

16. NON-PAYMENT OF THE SUBSCRIPTION FEE

16.1 If a Subscription Fee charge is not successfully collected on its due date, the Licensee's right to use the Platform continues until the end of the period already paid for. The day after that period ends is "Day 1" of non-payment for the purposes of this clause.

16.2 If payment is still not made, the following escalation applies, all within the 30-day period running from Day 1:

(a) Days 1–7: a grace period, during which the Licensor will send a courtesy reminder with no fixed deadline;

(b) Day 7: a second notice giving the Licensee 2 days to pay (until Day 9), during which the Licensor may disable the Licensee's ability to onboard new customers or process new sales through the Deployment;

(c) Day 9: a third and final notice giving the Licensee a further 2 days to pay (until Day 11), warning that the Deployment will be suspended;

(d) Day 11: if payment has still not been made, the Licensor may suspend the provision of updates, security fixes and Ordinary Support, and may withdraw its own administrative access; and, under a Managed Deployment only, may suspend the Deployment itself in accordance with paragraph 5 of Schedule 3; and

(e) Day 30: if payment has still not been made within 30 days of Day 1, the Licensor may terminate this Agreement immediately on written notice, whereupon clause 17.2 applies. Deletion of the Deployment and the Licensee Data is governed by paragraph 5 of Schedule 3 (Managed Deployment) or paragraph 4 of Schedule 4 (Self-Hosted Deployment), and does not arise under this clause.

16.3 Payment at any point before termination under clause 16.2(e) lifts the restrictions in this clause 16, and the Licensor will restore the Deployment.

17. EFFECT OF TERMINATION

17.1 On termination under clause 15.1 (convenience) or clause 15.3 (the Licensor's breach), the Licensor grants the Licensee a perpetual, non-exclusive, non-transferable, non-sublicensable licence to continue operating the version of the Platform delivered to it as at the date of termination, on an "as is" basis, without updates and without the support or access described in clause 7. That licence is granted in place of, and is not a continuation of, the licence in clause 3.1, and is not conditional on payment of any further Fees. Clauses 2, 3.3, 9, 10, 11, 12, 13, 18 and 23 continue to apply to that continued use.

17.2 On termination under clause 15.2 (material breach, including attempted resale or sublicensing) or clause 16.2(e) (non-payment run to full term), no licence of continued use is granted, the licence in clause 3.1 ends, and any continued operation of the Platform by the Licensee is unlicensed. Deletion of the Deployment and the Licensee Data, where it arises at all, is governed by the applicable Schedule.

17.3 On termination, the Licensor's administrative access under clause 7 ends, and clause 7.6 applies.

17.4 Termination does not affect any rights or liabilities that accrued before termination.

18. CONFIDENTIALITY

18.1 Each Party will keep confidential the other Party's business, technical, and financial information disclosed under this Agreement, and will use it only to perform this Agreement, except information that is public, independently developed, or required to be disclosed by law.

19. ASSIGNMENT

19.1 The Licensee may not assign, transfer, or novate this Agreement, in whole or in part — including on a sale, merger, or change of control of the Licensee — without the Licensor's prior written consent, such consent not to be unreasonably withheld where the transferee is not a competitor of the Licensor and agrees in writing to be bound by this Agreement.

19.2 The Licensor may assign this Agreement to any person to whom it transfers its business or the Platform, on written notice to the Licensee.

20. NOTICES

20.1 Notices to the Licensor must be sent in writing to its registered office or another address it notifies for this purpose. Notices to the Licensee may be sent to the email address associated with its account, or given as an in-app notification. A notice is deemed received on the next Business Day after it is sent.

21. FORCE MAJEURE

21.1 Neither Party is liable for any delay or failure to perform its obligations under this Agreement (other than an obligation to pay money) caused by an event beyond its reasonable control.

22. GENERAL PROVISIONS

22.1 Entire agreement. This Agreement (including its Schedules and Annex 1) constitutes the entire agreement between the Parties regarding its subject matter and supersedes all prior agreements and understandings, written or oral.

22.2 Variation. Updates to this Agreement are made in accordance with clause 0.4. No other variation is effective unless agreed by the Licensor in writing.

22.3 Severability. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions continue in full force and effect.

22.4 No waiver. No failure or delay by either Party in exercising any right under this Agreement operates as a waiver of that right.

22.5 No partnership. Nothing in this Agreement creates a partnership, agency, or joint venture between the Parties.

22.6 Third-party rights. No person other than the Parties has any right to enforce any term of this Agreement.

22.7 Language. This Agreement is drawn up in English. If it is translated into any other language, the English version prevails.

23. GOVERNING LAW AND JURISDICTION

23.1 This Agreement, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it, is governed by the laws of Ireland.

23.2 The courts of Ireland have exclusive jurisdiction to settle any dispute arising out of or in connection with this Agreement.

SCHEDULE 1 — ONBOARDING PARTICULARS

The following particulars are collected from the Licensee through the online checkout and onboarding flow referred to in clause 0.2, and stored in the Licensee's account. They form part of this Agreement.

The Deployment Model selected by the Licensee at checkout — Managed Deployment or Self-Hosted Deployment — is recorded with these particulars and forms part of this Agreement.

SCHEDULE 2 — FEES, SUPPORT AND DAY RATE

The Launch Fee below applies to a Managed Deployment. A Self-Hosted Deployment is deployed into an environment the Licensor does not control and carries no recurring hosting element; it is offered on request and priced on quotation.

SCHEDULE 3 — MANAGED DEPLOYMENT TERMS

This Schedule applies where the Licensee has selected a Managed Deployment. It prevails over the main body of these Terms to the extent of any conflict.

1. Infrastructure. The Licensor procures, provides and controls the infrastructure on which the Deployment runs, in its own name and at its own cost, and contracts directly with the hosting provider. The Licensee receives administrator access to the Platform, not to the underlying server.

2. Access. Clause 7 of these Terms does not apply. The Licensor has full administrative access to the infrastructure because it owns it. The Licensor will access Licensee Data only as necessary to host, support, secure and maintain the Deployment, or on the Licensee's instructions, and Annex 1 governs that Processing.

3. Availability, backups and restoration. The Licensor will use reasonable endeavours to keep the Deployment available, and will take backups of the Deployment daily and retain them for 14 days, stored separately from the primary instance. No service credits apply and no fixed availability percentage is committed. The Licensee may request restoration from a backup; restoration is provided as part of Ordinary Support where the cause is within the Licensor's control, and is otherwise billed at the day rate in Schedule 2.

4. Data export. The Licensee may at any time request a full export of the Licensee Data in a commonly used, machine-readable format, and the Licensor will provide it within 10 days of the request. This right survives termination for the duration of the export window in paragraph 5.

5. Suspension and deletion. Because the infrastructure is the Licensor's, the Licensor may suspend the Deployment in the circumstances set out in clause 16.2(d). Where this Agreement terminates, the Licensor will retain the Deployment and the Licensee Data for an export window of at least 30 days from the date of suspension or termination, whichever is earlier, during which the Licensee may exercise its rights under paragraph 4. The Licensor may delete the Deployment and the Licensee Data only after that export window has expired. The Licensor will give the Licensee written notice before deletion.

6. Hosting cost and capacity. The Subscription Fee includes hosting of one Deployment on a server of up to 4 vCPU, 8 GB RAM and 80 GB storage, which is sufficient to run the Platform for a licensee building a customer base from a standing start. Where the Licensee requires more capacity — for performance, storage, or the size of its customer base — the additional capacity is provided at the Licensor's cost plus the Licensor's standard margin, quoted in advance and charged in addition to the Subscription Fee.

7. Migration of an existing customer base. Importing an existing book of business — customer records, existing services, domains, or billing arrangements carried over from another system or provider — is not part of the Onboarding service covered by the Launch Fee. It is scoped, quoted in advance and billed at the day rate in Schedule 2, and larger migrations are quoted as custom work.

8. Migration out. On termination, or at the Licensee's request at any time, the Licensor will assist the Licensee in migrating the Deployment to infrastructure of the Licensee's own. That assistance is quoted in advance and billed at the day rate in Schedule 2, and does not shorten the export window in paragraph 5.

SCHEDULE 4 — SELF-HOSTED DEPLOYMENT TERMS

This Schedule applies where the Licensee has selected a Self-Hosted Deployment. It prevails over the main body of these Terms to the extent of any conflict.

1. Infrastructure. The Licensee procures, owns, controls and pays for the infrastructure on which the Deployment runs, and contracts with every provider of Third-Party Services in its own name.

2. Licensee responsibility. The Licensee is solely responsible for the availability, security, backup, restoration and continuity of that infrastructure, for patching its operating system and for maintaining its own accounts with the Third-Party Services. The Licensor gives no warranty in respect of any of them, and no uptime service level applies.

3. Access. Clause 7 of these Terms applies in full: the Licensor holds a single named administrative account, revocable by the Licensee at any time, all access is logged, and access is used only at the Licensee's request or to apply a security fix with notice.

4. Remedies on non-payment and termination. The Licensor's remedies are those it holds: it may cease providing updates, security fixes and Ordinary Support, withdraw its own administrative access, terminate this Agreement in accordance with clause 16.2(e), and recover the debt with statutory interest under clause 5.8. For the avoidance of doubt, the Licensor has no right to access, suspend, modify or delete the Deployment, the Licensee Data, or the infrastructure on which they run, and nothing in this Agreement obliges the Licensee to grant such access for that purpose. Where this Agreement terminates under clause 15.2 or clause 16.2(e), the Licensee's licence to operate the Platform ends under clause 17.2 and any continued operation is unlicensed, whether or not the Deployment continues to run.

5. Limits of the disclaimer. Nothing in this Schedule excludes or limits the Licensor's liability for the Licensor's own performance of the deployment work under clause 4, for the acts or omissions of its named administrative account, or for any liability that cannot be excluded under Irish law.

6. Migration in. The Licensee may ask the Licensor to move the Deployment onto the Licensor's infrastructure as a Managed Deployment. Such a move is governed by clause 4.6.

ANNEX 1

DATA PROCESSING AGREEMENT

This Data Processing Agreement ("DPA") is entered into between the Licensor and the Licensee and forms part of, and is incorporated into, the Agreement to which it is annexed. It is accepted electronically as part of the Agreement under clause 0, and does not require separate signature. It applies whenever the Licensor Processes Personal Data on behalf of the Licensee in connection with the Agreement. Terms defined in the Agreement have the same meaning here unless defined below.

1. DEFINITIONS

"Controller" means has the meaning given in Article 4(7) GDPR; for the purposes of this DPA, the Licensee is the Controller.

"Data Protection Legislation" means the GDPR, the Data Protection Act 2018, and any other applicable law relating to the processing of Personal Data.

"Data Subject" means an identified or identifiable natural person to whom Personal Data relates.

"Personal Data" means any information Processed by the Licensor on behalf of the Licensee under the Agreement that relates to an identified or identifiable natural person, including the categories described in the Schedule to this DPA.

"Personal Data Breach" means has the meaning given in Article 4(12) GDPR.

"Processing" means has the meaning given in Article 4(2) GDPR, and "Process" and "Processed" are to be interpreted accordingly.

"Processor" means has the meaning given in Article 4(8) GDPR; for the purposes of this DPA, the Licensor is the Processor.

"Sub-processor" means any person appointed by or on behalf of the Licensor to Process Personal Data on behalf of the Licensee.

2. SUBJECT MATTER AND DURATION

2.1 The subject matter, duration, nature and purpose of the Processing, the types of Personal Data, and the categories of Data Subjects, are described in the Schedule to this DPA.

2.2 This DPA applies for as long as the Licensor Processes Personal Data on behalf of the Licensee in connection with the Agreement.

3. LICENSOR'S OBLIGATIONS AS PROCESSOR

3.1 The Licensor will:

(a) Process Personal Data only on the Licensee's documented instructions, including in relation to transfers of Personal Data to a third country, unless required to do otherwise by EU or Irish law, in which case the Licensor will inform the Licensee of that legal requirement before Processing, unless the law prohibits this;

(b) ensure that persons authorised to Process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

(c) implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR;

(d) not engage a Sub-processor without the Licensee's prior general or specific written authorisation, as set out in clause 4;

(e) taking into account the nature of the Processing, assist the Licensee by appropriate technical and organisational measures, insofar as reasonably possible, with the fulfilment of the Licensee's obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR;

(f) assist the Licensee in ensuring compliance with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of Processing and the information available to the Licensor;

(g) at the Licensee's election, delete or return all Personal Data to the Licensee after the end of the provision of services relating to Processing, and delete existing copies, in accordance with clause 7, unless EU or Irish law requires storage of the Personal Data; and

(h) make available to the Licensee all information reasonably necessary to demonstrate compliance with the obligations in Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by the Licensee or an auditor mandated by the Licensee, on reasonable prior notice and no more than once per year (or at any time following a Personal Data Breach).

4. SUB-PROCESSORS

4.1 Under a Managed Deployment, the Licensee authorises the Licensor to engage the Sub-processors listed in the Schedule to this DPA as at the date of the Agreement. Under a Self-Hosted Deployment the Licensor engages no Sub-processors: the infrastructure is procured and controlled by the Licensee, and the Licensor's Processing is limited to access through the named administrative account described in clause 7 of the Agreement.

4.2 The Licensor will give the Licensee at least 30 days' prior written notice of any intended change concerning the addition or replacement of a Sub-processor, giving the Licensee the opportunity to object to that change on reasonable data protection grounds. If the Licensee objects and the Parties cannot resolve the objection, either Party may terminate the Agreement in respect of the affected service on written notice.

4.3 The Licensor will impose, by way of a written contract, the same data protection obligations as set out in this DPA on any Sub-processor it engages, and remains fully liable to the Licensee for the performance of that Sub-processor's obligations.

5. INTERNATIONAL TRANSFERS

5.1 The Licensor will not transfer Personal Data outside the European Economic Area unless it first ensures that appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses, an adequacy decision, or another valid transfer mechanism recognised under the GDPR.

6. PERSONAL DATA BREACH

6.1 The Licensor will notify the Licensee without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting the Licensee's Personal Data, and will provide the Licensee with information reasonably required to enable it to meet any obligations to report or inform Data Subjects or supervisory authorities of the Personal Data Breach under the Data Protection Legislation.

7. RETURN OR DELETION OF DATA

7.1 On termination or expiry of the Agreement, the Licensor will, at the Licensee's written election, delete or return all Personal Data Processed on the Licensee's behalf within 30 days, and delete existing copies unless EU or Irish law requires their retention, in which case the Licensor will isolate and protect that Personal Data from further Processing except as required by that law. This is subject to clause 16 and clause 17.2 of the Agreement where the Agreement ends through non-payment or breach by the Licensee.

8. LIABILITY

8.1 Each Party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in clause 13 of the Agreement.

9. GOVERNING LAW

9.1 This DPA is governed by the laws of Ireland and is subject to the jurisdiction clause at clause 23 of the Agreement.

SCHEDULE TO THE DATA PROCESSING AGREEMENT

Description of Processing

Approved Sub-processors — Managed Deployment only

The following table applies only to a Managed Deployment, and lists only the Sub-processors engaged by the Licensor. Stripe and Openprovider are contracted by the Licensee in its own name under clause 10.2 and are therefore the Licensee's own processors, not Sub-processors of the Licensor; they are shown for completeness only. Under a Self-Hosted Deployment the Licensor engages no Sub-processors.