Terms and Conditions

This SaaS Services Agreement ("Agreement") is entered into as of ___________________, between Findd Inc, with a place of business at 180 N. University Avenue, Suite 270, Provo, Utah, 84601 ("Company"), and the Client listed above ("Client"). Company and Client may be referred to herein individually as a "Party" and collectively as the "Parties." This Agreement includes and incorporates the above Order Form, as well as the attached Terms and Conditions and contains, among other things, warranty disclaimers, liability limitations and use limitations. There shall be no force or effect to any different terms of any related purchase order or similar

TERMS AND CONDITIONS

1. SAAS SERVICES AND SUPPORT

Subject to the terms of this Agreement, Company will use commercially reasonable efforts to provide Client the Services in accordance with the Service Level Terms attached hereto as Exhibit A. As part of the registration process, Client will identify an administrative user name and password for Client's Company account. Company reserves the right to refuse registration of, or cancel passwords it deems inappropriate.

Subject to the terms hereof, Company will provide Client with reasonable technical support services in accordance with the Company's standard practice.

2. RESTRICTIONS AND RESPONSIBILITIES

Client will not, directly or indirectly: reverse engineer, decompile, disassemble or otherwise attempt to discover the source code, object code or underlying structure, ideas, know-how or algorithms relevant to the Services or any software, documentation or data related to the Services ("Software"); modify, translate, or create derivative works based on the Services or any Software (except to the extent expressly permitted by Company or authorized within the Services); use the Services or any Software for timesharing or service bureau purposes or otherwise for the benefit of a third party; or remove any proprietary notices or labels. With respect to any Software that is distributed or provided to Client for use on Client premises or devices, Company hereby grants Client a non-exclusive, non-transferable, non-sublicensable license to use such Software during the Term only in connection with the Services.

Client represents, covenants, and warrants that Client will use the Services only in compliance with Company's standard published policies then in effect (the "Policy") and all applicable laws and regulations. Client hereby agrees to indemnify and hold harmless Company against any damages, losses, liabilities, settlements and expenses (including without limitation costs and attorneys' fees) in connection with any claim or action that arises from an alleged violation of the foregoing or otherwise from Client's use of Services. Although Company has no obligation to monitor Client's use of the Services, Company may do so and may prohibit any use of the Services it believes may be (or alleged to be) in violation of the foregoing.

Company strongly advises Client to consult with their own legal counsel and HR specialists to confirm that their use of the system aligns with legal and regulatory requirements. Company does not provide legal or compliance advice. By signing this Agreement, the Client acknowledges that Company is not responsible for ensuring compliance and that the Client has been advised to seek independent legal and HR guidance.

Client shall be responsible for obtaining and maintaining any equipment and ancillary services needed to connect to, access or otherwise use the Services, including, without limitation, modems, hardware, servers, software, operating systems, networking, web servers and the like (collectively, "Equipment"). Client shall also be responsible for maintaining the security of the Equipment, Client account, passwords (including but not limited to administrative and user passwords) and files, and for all uses of Client account or the Equipment with or without Client's knowledge or consent.

3. CONFIDENTIALITY; PROPRIETARY RIGHTS

Each party (the "Receiving Party") understands that the other party (the "Disclosing Party") has disclosed or may disclose business, technical or financial information relating to the Disclosing Party's business (hereinafter referred to as "Proprietary Information" of the Disclosing Party). Proprietary Information of Company includes non-public information regarding features, functionality and performance of the Service. Proprietary Information of Client includes non-public data provided by Client to Company to enable the provision of the Services ("Client Data"). The Receiving Party agrees: (i) to take reasonable precautions to protect such Proprietary Information, and (ii) not to use (except in performance of the Services or as otherwise permitted herein) or divulge to any third person any such Proprietary Information. The Disclosing Party agrees that the foregoing shall not apply with respect to any information after five (5) years following the disclosure thereof or any information that the Receiving Party can document (a) is or becomes generally available to the public, or (b) was in its possession or known by it prior to receipt from the Disclosing Party, or (c) was rightfully disclosed to it without restriction by a third party, or (d) was independently developed without use of any Proprietary Information of the Disclosing Party or (e) is required to be disclosed by law.

Client shall own all right, title and interest in and to the Client Data. Company shall own and retain all right, title and interest in and to (a) the Services and Software, all improvements, enhancements or modifications thereto, (b) any software, applications, inventions or other technology developed in connection with Implementation Services or support, (c) all intellectual property rights related to any of the foregoing and (d) any data that is based on or derived from the Client Data and provided to Client as part of the Services.

Notwithstanding anything to the contrary, Company shall have the right to collect and analyze data and other information relating to the provision, use and performance of various aspects of the Services and related systems and technologies (including, without limitation, information concerning Client Data and data derived therefrom), and Company will be free (during and after the term hereof) to (i) use such information and data to improve and enhance the Services and for other development, diagnostic and corrective purposes in connection with the Services and other Company offerings, and (ii) disclose such data solely in aggregate or other de-identified form in connection with its business. No rights or licenses are granted except as expressly set forth herein.

4. PAYMENT OF FEES

Client will pay Company the then applicable fees described in the Order Form for the Services and Implementation Services in accordance with the terms therein (the "Fees"). Company reserves the right to change the Fees or applicable charges and to institute new charges and Fees at the end of the Initial Service Term or then-current renewal term, upon thirty (30) days prior notice to Client (which may be sent by email). If Client believes that Company has billed Client incorrectly, Client must contact Company no later than 60 days after the closing date on the first billing statement in which the error or problem appeared, in order to receive an adjustment or credit. Inquiries should be directed to Company's client support department.

Company may choose to bill through an invoice, in which case, full payment for invoices issued in any given month must be received by Company thirty (30) days after the mailing or transmission date of the invoice. Unpaid amounts are subject to a finance charge of 1.5% per month on any outstanding balance, or the maximum permitted by law, whichever is lower, plus all expenses of collection and may result in immediate termination of Service. Client shall be responsible for all taxes associated with Services other than U.S. taxes based on Company's net income.

5. TERM AND TERMINATION

Subject to earlier termination as provided below, this Agreement is for the Initial Service Term as specified in the Order Form, and shall be automatically renewed for additional periods of the same duration as the Initial Service Term (collectively, the "Term"), unless either party requests termination at least thirty (30) days prior to the end of the then-current term.

In addition to any other remedies it may have, either party may also terminate this Agreement upon thirty (30) days' notice (or without notice in the case of nonpayment), if the other party materially breaches any of the terms or conditions of this Agreement. Client will pay in full for the Services up to and including the last day on which the Services are provided. Upon any termination, Company will make all Client Data available to Client for electronic retrieval for a period of thirty (30) days, but thereafter Company may, but is not obligated to, delete stored Client Data. All sections of this Agreement which by their nature should survive termination will survive termination, including, without limitation, accrued rights to payment, confidentiality obligations, warranty disclaimers, and limitations of liability.

6. PRIVACY REGULATIONS

The terms of the Data Processing Addendum set forth in Exhibit B are incorporated into these SaaS Services Agreement Terms and Conditions.

7. WARRANTY AND DISCLAIMER

Company shall use reasonable efforts consistent with prevailing industry standards to maintain the Services in a manner which minimizes errors and interruptions in the Services and shall perform the Implementation Services in a professional and workmanlike manner. Services may be temporarily unavailable for scheduled maintenance or for unscheduled emergency maintenance, either by Company or by third-party providers, or because of other causes beyond Company's reasonable control, but Company shall use reasonable efforts to provide advance notice in writing or by e-mail of any scheduled service disruption. HOWEVER, COMPANY DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR FREE; NOR DOES IT MAKE ANY WARRANTY AS TO THE RESULTS THAT MAY BE OBTAINED FROM USE OF THE SERVICES. EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION, THE SERVICES AND IMPLEMENTATION SERVICES ARE PROVIDED "AS IS" AND COMPANY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.

8. LIMITATION OF LIABILITY

NOTWITHSTANDING ANYTHING TO THE CONTRARY, EXCEPT FOR BODILY INJURY OF A PERSON, COMPANY AND ITS SUPPLIERS (INCLUDING BUT NOT LIMITED TO ALL EQUIPMENT AND TECHNOLOGY SUPPLIERS), OFFICERS, AFFILIATES, REPRESENTATIVES, CONTRACTORS AND EMPLOYEES SHALL NOT BE RESPONSIBLE OR LIABLE WITH RESPECT TO ANY SUBJECT MATTER OF THIS AGREEMENT OR TERMS AND CONDITIONS RELATED THERETO UNDER ANY CONTRACT, NEGLIGENCE, STRICT LIABILITY OR OTHER THEORY: (A) FOR ERROR OR INTERRUPTION OF USE OR FOR LOSS OR INACCURACY OR CORRUPTION OF DATA OR COST OF PROCUREMENT OF SUBSTITUTE GOODS, SERVICES OR TECHNOLOGY OR LOSS OF BUSINESS; (B) FOR ANY INDIRECT, EXEMPLARY, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES; (C) FOR ANY MATTER BEYOND COMPANY'S REASONABLE CONTROL; OR (D) FOR ANY AMOUNTS THAT, TOGETHER WITH AMOUNTS ASSOCIATED WITH ALL OTHER CLAIMS, EXCEED THE FEES PAID BY CLIENT TO COMPANY FOR THE SERVICES UNDER THIS AGREEMENT IN THE 12 MONTHS PRIOR TO THE ACT THAT GAVE RISE TO THE LIABILITY, IN EACH CASE, WHETHER OR NOT COMPANY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

9. MISCELLANEOUS

If any provision of this Agreement is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that this Agreement will otherwise remain in full force and effect and enforceable. This Agreement is not assignable, transferable or sublicensable by Client except with Company's prior written consent. Company may transfer and assign any of its rights and obligations under this Agreement without consent. This Agreement is the complete and exclusive statement of the mutual understanding of the parties and supersedes and cancels all previous written and oral agreements, communications and other understandings relating to the subject matter of this Agreement, and that all waivers and modifications must be in a writing signed by both parties, except as otherwise provided herein. No agency, partnership, joint venture, or employment is created as a result of this Agreement and Client does not have any authority of any kind to bind Company in any respect whatsoever. In any action or proceeding to enforce rights under this Agreement, the prevailing party will be entitled to recover costs and attorneys' fees. All notices under this Agreement will be in writing and will be deemed to have been duly given when received, if personally delivered; when receipt is electronically confirmed, if transmitted by facsimile or e-mail; the day after it is sent, if sent for next day delivery by recognized overnight delivery service; and upon receipt, if sent by certified or registered mail, return receipt requested. This Agreement shall be governed by the laws of the State of Utah without regard to its conflict of laws provisions. The parties shall work together in good faith to issue at least one mutually agreed upon press release within 90 days of the Effective Date, and Client otherwise agrees to reasonably cooperate with Company to serve as a reference account upon request.

EXHIBIT A

Service Level Terms

The Services shall be available 99.9%, measured monthly, excluding scheduled maintenance. If Client requests maintenance during these hours, any uptime or downtime calculation will exclude periods affected by such maintenance. Further, any downtime resulting from outages of third party connections or utilities or other reasons beyond Company's control will also be excluded from any such calculation. Client's sole and exclusive remedy, and Company's entire liability, in connection with Service availability shall be that for each period of downtime lasting longer than one hour, Company will credit Client 5% of Service fees for each period of 30 or more consecutive minutes of downtime; provided that no more than one such credit will accrue per day. Downtime shall begin to accrue as soon as Client (with notice to Company) recognizes that downtime is taking place, and continues until the availability of the Services is restored. In order to receive downtime credit, Client must notify Company in writing within 24 hours from the time of downtime, and failure to provide such notice will forfeit the right to receive downtime credit. Such credits may not be redeemed for cash and shall not be cumulative beyond a total of credits for one (1) week of Service Fees in any one (1) calendar month in any event. Company will only apply a credit to the month in which the incident occurred. Company's blocking of data communications or other Service in accordance with its policies shall not be deemed to be a failure of Company to provide adequate service levels under this Agreement.

EXHIBIT B

DATA PROCESSING ADDENDUM

This Data Processing Addendum ("DPA") is incorporated into, and is subject to the terms and conditions of, the SaaS Services Agreement Terms and Conditions (the "Agreement") between Client and Findd, Inc. ("Company") (collectively, "the parties") applicable to the Client's use of the Services. This DPA shall be effective for the term of the Agreement. To the extent there are any inconsistencies between the Agreement and this DPA, the terms of this DPA shall apply.

1. Definitions

1.1. In this DPA:

a) "Biometric Identifiers" means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color.

b) "Biometric Information" means any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.

c) "Client Personal Data" means Personal Data provided to Company in connection with the Services by (i) Client or (ii) Authorized Users.

d) "Data Protection Law" means all laws that apply to the Processing of Client Personal Data under the Agreement, including the California Consumer Privacy Act (as amended by the California Privacy Rights Act) and any binding regulations promulgated thereunder, the Illinois Biometric Information Privacy Act ("BIPA"), and other laws and regulations of the United States and its states, as amended from time to time.

e) "Data Subject" means the individual to whom Client Personal Data relates.

f) "Personal Data" has the meaning given to it in the Data Protection Law, and includes "Personal Data," "personally identifiable information," "Biometric Information" and equivalent terms as such terms may be defined by the Data Protection Law.

g) "Processing" (including its cognate "Process") means any operation or set of operations that is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

h) "Security Incident" means a breach of Company's security leading to the unauthorized or unlawful access by a third party, or confirmed accidental or unlawful destruction, loss or alteration, of Client Personal Data in Company's possession, custody or control. "Security Incidents" will not include unsuccessful attempts or activities that do not compromise the security of Client Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

1.2. Capitalized terms used but not defined herein have the meaning given to them in the Agreement.

2. Client's Instructions

2.1. Company will Process Client Personal Data only in accordance with Client's lawful instructions. By entering into this DPA, Client instructs Company to Process Client Personal Data to provide the Services and to perform its other obligations and exercise its rights under the Agreement, including without limitation to (a) carry out Services or the business of which the Services are a part, (b) carry out any benefits, rights, and obligations relating to the Services, (c) maintain records relating to the Services, and (d) comply with any legal or self-regulatory obligations relating to the Services.

3. Processing of Client Personal Data

3.1. Company serves as a service provider or processor, meaning that Company Processes Client Personal Data at the direction of and on behalf of Client.

3.2. The extent of Client Personal Data Processed by Company is determined and controlled by Client and may include names, email addresses, and other Personal Data that Client or Authorized Users may elect to upload to the Services.

3.3. Each party will comply with the obligations applicable to it under the Data Protection Law with respect to the Processing of Client Personal Data. Client represents and warrants that it has the necessary rights, consents and permissions to use Client Personal Data and to enable Company to Process Client Personal Data as intended by the parties under the Agreement. For the avoidance of doubt, prior to allowing Authorized Users to provide digital photographs or other Personal Data to Company in order for the Company to process or derive Biometric Information, Client represents and warrants that it has obtained informed, written consent from each Authorized User to allow Company to Process their Biometric Information consistent with the purposes described in the Agreement.

3.4. Client acknowledges and agrees that Company may create and derive from Processing related to the Services anonymized and/or aggregated data that does not identify Client or any individual ("Analytics Data"), and use, publicize, or share with third parties such Analytics Data to improve the Services and for Company's other legitimate business purposes in accordance with the Data Protection Law.

3.5. When Company Processes Client Personal Data, it will:

a) Require Company's personnel who access Client Personal Data to commit to protect the confidentiality of Client Personal Data;

b) Provide reasonable assistance necessary for Client to comply with its obligations under the Data Protection Law;

c) Promptly notify the Client of any request made by a Data Subject in relation to Client Personal Data. Company will, at the Client's written request, provide the Client with reasonable assistance necessary for the fulfilment of the Client's obligation to respond to requests for the exercise of Data Subjects' rights under applicable Data Protection Law. Company shall not respond to such requests other than confirming with the Data Subject that the request relates to the Client and Client Personal Data. Client shall be solely responsible for responding to such requests;

d) Unless prohibited by law, inform Client if Company receives a request, complaint or other inquiry regarding the Processing of Client Personal Data;

e) Inform Client if it can no longer comply with its obligations under this DPA. Upon notice to Company, Client may take reasonable and appropriate steps to remediate Company's use of Client Personal Data in violation of this DPA; and

f) Upon termination of the Agreement, as instructed by Client, delete or return Client Personal Data, except where continued retention of Client Personal Data is in accordance with applicable law or the Company's policies, in which case Company shall retain such Client Personal Data in accordance with this DPA. Client shall instruct Company to delete Biometric Identifiers associated with Authorized Users upon the earlier of: (i) when the initial purpose for collecting or obtaining Biometric Identifiers has been satisfied; or (ii) within twelve (12) months of the Authorized User's last interaction with Client. Notwithstanding the foregoing, if Client fails to provide a deletion request on a timely basis, Company, in its sole discretion, may delete Biometric Identifiers in order to comply with requirements under Data Protection Law. Client agrees that it will hold Company harmless from any losses incurred as a result of such deletion.

4. Subprocessing

4.1. Client agrees that Company may use third-party suppliers to Process Client Personal Data on its behalf for the provision of the Services (each a "Subprocessor").

4.2. When engaging any Subprocessor, Company will enter into a written contract with such Subprocessor containing data protection obligations consistent with those in this DPA with respect to the protection of Client Personal Data to the extent applicable to the nature of the services provided by such Subprocessor.

5. Data Security

5.1. Company will implement and maintain technical and organizational measures designed to protect Client Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Client Personal Data. Company may update the security measures from time to time, provided the updated measures do not decrease the overall protection of Client Personal Data.

5.2. Client agrees that, without limitation of Company's obligations under Section 5.1 of this DPA, Client is solely responsible for its use of the Services, including (a) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of Client Personal Data; (b) securing the account authentication credentials, systems and devices Client uses to access the Services; (c) securing Client's systems and devices that Company uses to provide the Services; and (d) backing up Client Personal Data. Client agrees that the Services and Company's security commitments under this DPA are adequate to meet Client's needs, including with respect to any security obligations of Client under the Data Protection Law, and provide a level of security appropriate to the risk in respect of Client Personal Data.

6. Security Incidents

6.1. If Company becomes aware of a Security Incident, Company will: (a) notify Client of the Security Incident without undue delay after becoming aware of it; and (b) take reasonable steps to identify the cause of such Security Incident, minimize harm and prevent a recurrence.

6.2. Client is solely responsible for complying with incident notification requirements applicable to Client. Company's notification of or response to a Security Incident under this Section will not be construed as an acknowledgement by Company of any fault or liability with respect to the Security Incident.

7. Audit

7.1. Company will make available to Client, at Client's reasonable request, reasonable information as necessary to demonstrate compliance with this DPA.

7.2. To the extent Company makes available to Client confidential summary reports ("Audit Report") prepared by third-party security professionals, upon request from Client, Company may provide such Audit Report in satisfaction of any audit rights accorded to Client pursuant to the Data Protection Law. The Audit Report shall be considered Company's confidential information.

7.3. If Client can demonstrate that it requires additional information, beyond the Audit Report, then Client may request, at Client's cost, Company to provide for an audit subject to reasonable confidentiality procedures. Such audit shall: (i) not include access to any information that could compromise confidential information relating to other Company's customers or suppliers, Company's technical and organizational measures, or any trade secrets; and (ii) be performed upon not less than thirty (30) days' notice, during regular business hours, and in such a manner as not to unreasonably interfere with Company's normal business activities.

7.4. Company will make available to Client, at Client's reasonable request, reasonable information as necessary to demonstrate Company's compliance with its obligations under BIPA, including maintaining appropriate records evidencing informed consent of its Authorized Users, and Company's written retention schedule and destruction guidelines in connection with Company's and Client's Processing of Biometric Identifiers. Such informed consent shall expressly disclose, in each case, that Client is the Controller of the Biometric Information of Authorized Users which is Processed by Company on behalf of Client.

8. Indemnification

8.1. Mutual Indemnification. Each Party (as "Indemnifying Party") shall indemnify and defend the other Party and its managers, officers, directors, and employees (collectively, "Indemnified Party") against any and all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs, or expenses of whatever kind, including professional fees and reasonable attorneys' fees, that are awarded against Indemnified Party in a final judgment or administrative proceeding, (collectively, "Losses"), arising out of any third-party claim alleging any failure by Indemnifying Party to comply with this DPA in the performance of its obligations under this Agreement.

8.2. Notwithstanding anything to the contrary in Section 8.1, Client agrees to indemnify and defend Company against any and all Losses arising out of any third-party claim alleging any violation of BIPA as a result of Company's compliance with Client's written instructions pursuant to its Processing of Biometric Identifiers of Client's Authorized Users. For the avoidance of doubt, any indemnity by Client of Company based on the foregoing shall not be subject to the limitation of liability set out in the Agreement.

9. General

9.1. If any provision of this DPA is found by any court or administrative body of competent jurisdiction to be invalid or unenforceable, then the invalidity or unenforceability of such provision does not affect any other provision of this DPA, and all provisions not affected by such invalidity or unenforceability will remain in full force and effect.

9.2. Notwithstanding anything to the contrary in the Agreement or this DPA, except for all losses, liabilities and costs incurred by Client in connection with Client's indemnification obligations set forth in Section 8.2 herein (which shall not be subject to any caps or limitations), the liability of each party under this DPA is subject to the limitations of liability set out in the Agreement. Client acknowledges that Company is reliant on Client for direction as to the extent to which Company is entitled to Process Client Personal Data on behalf of Client in the provision of the Services. Consequently, Company will not be liable under the Agreement for any claim brought by individuals to whom Client Personal Data relates arising from (a) any action or omission by Company in compliance with Client's instructions, or (b) from Client's failure to comply with its obligations under the Data Protection Law.

9.3. This DPA will be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement.