Terms of Service & Data Use Agreement

1 · Introduction and Acceptance of Terms

1. These Terms of Service, Privacy Policy and Data Use Agreement (collectively, the “Agreement”) govern access to and use of the ASGARD identity verification and participation monitoring platform (the “Platform” or the “Service”).

2. This Agreement is entered into between Asgard Authenticate OÜ, an Estonian private limited company with registry code 17270073, whose registered office is at Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145, Estonia (“Company,” “we,” “us,” or “our”), and the organization that has engaged the Company’s services (“Client”). Where the subscription accepted by the Client designates an affiliate of the Company as the contracting party, that affiliate shall be the Company for the purposes of this Agreement.

3. The Company’s addresses at London (Westend) Office, 85 Great Portland Street, First Floor, London W1W 7LT, United Kingdom and 8 The Green #17248, Dover, DE 19901, United States are service addresses only — the London address being a provisioned registered office and the Delaware address being a registered-agent address. Neither constitutes a place of business, branch or establishment of the Company.

4. Individuals accessing or using the Platform through a Client deployment (“Participants” or “Users”) are also subject to the terms and conditions set forth in this Agreement. The Client is responsible for ensuring that its Participants are informed of and consent to the applicable provisions of this Agreement where required by law.

5. Order of precedence. This Agreement is a single document comprising these Terms of Service, the Privacy Policy and the Data Use Agreement, and it is to be read as one instrument. Where any provision appears to conflict with another provision of this Agreement, the more specific provision prevails over the more general. The subscription as recorded in the Account Settings prevails over this Agreement only in respect of the term, fees, licence quantities and service tiers, and only to the extent of any inconsistency. Any elected governing law is governed by clause 18.

6. This Agreement is designed to comply with applicable privacy and data protection laws globally, including but not limited to GDPR, PIPEDA, CCPA/CPRA, BIPA, FERPA, HIPAA and other applicable privacy laws.

2 · Description of the Platform and Services

7. The Platform is a browser-based Software-as-a-Service (SaaS) application that provides identity verification and participation monitoring for online training/assessment sessions.

8. The Platform verifies Participant identity, monitors participation during training/assessment sessions, creates a digital affidavit of their participation and training/assessment completion information, and restricts access to training/assessment content in the event of detected non-compliance.

9. The Services are provided on a subscription basis for the subscription term, in accordance with clause 10.

3 · Definitions

10. “Subscription” means the subscription selected and accepted by the Client when purchasing access to the Platform. The term, licence quantity, service tier, fees, billing frequency, currency and payment method are set and adjusted in the Account Settings. The Client’s election of governing law, where made, is recorded by the Company at the point of purchase and is governed by clause 18.

11. “Account Settings” means the settings pages made available to the Client within the Platform, which the Client may amend at its discretion, and which the Company may amend or extend from time to time.

12. “Effective Change Date” means the date on which an amendment to the Account Settings takes effect, as recorded by the Company.

13. “Personal Data” means any information relating to an identified or identifiable natural person processed under this Agreement, and includes Biometric Data.

14. “Biometric Data” means personal data resulting from specific technical processing of a natural person’s physical or behavioural characteristics, where that processing allows or confirms the unique identification or authentication of that person (and, for the avoidance of doubt, where the Company creates a biometric template it does so as a proprietary, one-way derived representation rather than a stored image or raw biometric sample; the template is stored only within the Company’s system, is not exportable, is not interoperable with any third-party biometric reader or matching engine, and cannot be reverse-engineered to reconstruct the underlying biometric characteristic).

15. “Client Data” means all data submitted to or processed through the Platform by or on behalf of the Client or its Participants, including Personal Data.

16. “Service Credit” means a credit issued under clause 7.4.

4 · Data Collection and Use

17. The Platform may collect and process: full name; email address; participation timestamps; training/assessment completion information; a digital affidavit of participation; proprietary biometric matching data; and a photograph of the Participant’s face.

18. Government-issued identification images are processed in real time and are not retained after verification processing is complete, and raw biometric measurements are not retained at any point.

19. Data is collected solely for: identity verification; participation monitoring; training/assessment completion verification; and the Client’s compliance and recordkeeping obligations.

20. Verification results are provided to the Client for the purposes set out in this clause 4.

21. The Company does not sell, trade or commercially exploit Participant and/or Personal Data.

22. The Client (or the Participant, as applicable) owns all Client Data, as provided in clause 13.3.

23. Data may only be disclosed upon Client instruction, to contracted infrastructure providers, or where legally required.

24. Roles and control. The Client requires the use of the Platform and is in directive control of the data collected by the Company. The Company collects and processes Client Data as processor on the Client’s instructions. All data collected by the Company is provided to the Client, and the Client has access to it and control over its future use and deletion.

25. Privacy Policy and intended use. The Company’s Privacy Policy states the items collected, the method of collection and the intended use of those items. The Client shall not use, or direct the Company to use, Client Data for any purpose beyond the intended use stated in the Privacy Policy. Where the Client wishes to use Client Data for a purpose beyond that stated use, the Client is responsible for obtaining any additional consents or establishing any further lawful basis required, and the Company shall have no obligation to facilitate a use that exceeds the stated intended use.

5 · Data Storage, Security and Retention

26. All data is stored within Amazon Web Services (AWS) infrastructure in regions selected by the Client in the Account Settings. The regions available to the Client are those listed in the Account Settings. The Company may add to, remove from or modify that list operationally, and doing so does not amend this Agreement.

27. The Company utilises commercially reasonable security measures, including encryption in transit and at rest, access controls, security monitoring and incident response procedures.

28. Data is retained in accordance with the Client’s instructions as recorded in the Account Settings, the retention periods set in the Account Settings, and applicable law.

29. On termination, Client Data is handled in accordance with clause 8.6.

6 · Acceptable and Lawful Use

30. The Platform may only be used for lawful purposes.

31. The Company may suspend or terminate access where use violates applicable laws, compromises Platform security or integrity, or involves fraudulent or unlawful activity, in accordance with clause 8.3.

32. The Client shall not use the Platform in any manner prohibited by clause 15.2.

7 · Service Availability, Support Commitments and Service Credits

9.1 · Service Availability Commitment

33. The Company shall use commercially reasonable efforts to maintain Platform availability of 99.99% uptime, measured on a monthly basis.

34. The Company maintains redundant infrastructure, failover systems and operational safeguards designed to minimise or eliminate disruption to Client operations.

9.2 · Maintenance and Operational Architecture

35. The Company utilises redundant systems, failover infrastructure, rolling deployment methodologies and operational redundancies intended to permit maintenance and operational changes to be performed while the Platform remains operational.

9.3 · Exclusions from Uptime Calculations

36. Uptime calculations exclude force majeure events, AWS or third-party infrastructure outages, internet service provider failures, Client-caused interruptions, cybersecurity attacks or denial-of-service events, security preservation activities, and beta or testing environments.

37. The events excluded under this clause 7.3 are force majeure events for the purposes of clause 19.4.

9.4 · Service Credits for Downtime

38. If the Company fails to meet the Availability Commitment during a calendar month, the Client shall receive Service Credits in the form of additional licences.

39. Credits are calculated using the Client’s rolling twelve (12) month average licence consumption and the duration of verified downtime.

40. Where the Client has ceased purchasing licences, Service Credits shall instead be refunded in cash to the Client. No invoice is issued in respect of a Service Credit, and the refund is paid to the payment method held in the Account Settings.

9.5 · Support Response Expectations

41. Severity Level 1 — Critical Service Impact: target initial response within one (1) hour.

42. Severity Level 2 — Major Functional Impact: target initial response within four (4) business hours.

43. Severity Level 3 — Minor Functional Impact: target initial response within one (1) business day.

44. Response times are targets and do not constitute a service level commitment unless expressly stated in the Subscription.

8 · Term and Termination

45. The term is set in the Account Settings, as provided in clause 11. Every term recorded in the Account Settings begins on the date access to the Platform is first granted, and runs for the period stipulated in the Account Settings for that subscription. Where the Account Settings stipulate no period, the term is twelve (12) months from that date.

46. Renewal. Unless the Client has set the Account Settings so that the subscription ends at the end of the term, the term renews automatically for successive periods of the same length as the term in force, on the rates then applying under clause 11. Either party may prevent renewal by giving written notice of non-renewal not less than thirty (30) days before the end of the then-current term, or by changing the Account Settings so that the subscription does not renew.

47. Change of settings during a term. Where the Client changes its settings during a term, the new settings take effect immediately under clause 9.2.

48. Either party may terminate this Agreement for material breach on thirty (30) days’ written notice, provided that termination is ineffective if the breach is cured within that period. Termination under this clause does not relieve the Client of accrued payment obligations, and does not entitle the Client to any refund of amounts already paid.

49. The Company may suspend or terminate access immediately under clause 8 (Acceptable and Lawful Use), or where required by law or to prevent harm to the Platform or its users.

50. Either party may terminate immediately if the other becomes insolvent, enters administration, or ceases to carry on business.

51. The Client may terminate on thirty (30) days’ written notice if the Company makes a material adverse change to this Agreement under clause 17, and receive a pro-rata refund of prepaid fees for the unexpired portion of the term. This is the only circumstance in which prepaid amounts are refunded, and it does not apply to a change of settings made through the Account Settings.

52. On termination the Company shall make Client Data available for export for thirty (30) days and thereafter delete it, subject to clause 6 retention obligations and applicable law.

53. The provisions of clauses 15, 16, 17, 18, 19, 20 and 21 survive termination, together with any other provision that by its nature is intended to survive.

9 · Fees, Billing and Payment

54. The Subscription — comprising fees, currency, payment method, licence quantities, service tiers and the term — is set and adjusted in the Account Settings. The Account Settings are the authoritative and controlling record of the amount payable and the term of the Client’s subscription as they stand at any time.

55. Client amendments. The Client may amend the Account Settings at its discretion. Where the Client changes its settings, the rates in force on the Effective Change Date apply to the new settings, the term is as then recorded, and the Client shall pay in accordance with those rates from that date. Amounts already paid by the Client are applied immediately on the change of settings to the subscription as it then stands, and the Client shall pay any difference between the amount already paid and the amount payable for the new settings. The Client is responsible for reviewing the rates and terms displayed in the Account Settings before confirming any change.

56. No adjustment during a term. Once the Client has set its rates in the Account Settings for a term, the Company shall not adjust those rates during that term. The Company’s right to adjust rates under this clause 9.3 takes effect only at the end of the term in force and applies to the subscription as it then stands. Where the Client changes its own settings under clause 9.2 during a term, clause 9.2 applies and the rates then in force for the new settings apply from the Effective Change Date.

57. Company rate adjustments. Subject to clause 9.3, the Company may adjust the rates applicable to any setting from time to time. On the Effective Change Date of a Company adjustment, the adjusted rate applies to the subscription as it then stands. Amounts already paid by the Client are applied immediately on the adjustment to the subscription as it then stands, and no refund, credit, pro-rata adjustment or carry-forward is provided in respect of any change to a setting, whether made by the Client or by the Company.

58. Immediate payment before access. Payment is made through the Platform and is required in full and in advance before any functionality of the Platform is made available. The Company does not issue invoices for subscriptions purchased through the Account Settings. Access to the Platform’s functionality is not granted, and is not maintained, unless and until payment for the applicable subscription has been received in cleared funds.

59. Payment for a subscription is a condition of the Services being provided, and the absence of payment is a material breach of this Agreement. The Company is not obliged to grant, maintain or restore access to any functionality of the Platform unless and until the amount due has been received in full. Where a payment is reversed, charged back or otherwise not honoured, the Company may withdraw access immediately and without notice.

60. Fees are payable without set-off or deduction. All fees are exclusive of value added tax, sales tax, withholding and any other applicable taxes, which are the Client’s responsibility, save for taxes on the Company’s net income. Where a transaction tax is required to be collected at the point of payment, it is added to the amount payable and is payable at the same time.

61. The Company may suspend or withdraw access to the Platform where any amount due remains unpaid, and shall restore access promptly once payment has been received in full. Where payment has been received in full for the subscription in force, suspension under this clause does not apply.

62. The Client is responsible for keeping its payment method and billing details in the Account Settings accurate and current. Failure to do so, and consequent failure of a payment, is a failure to pay for the purposes of this clause 9.

63. All amounts paid under this Agreement are non-refundable and non-transferable, except as expressly provided in clauses 7.4 and 8.7. This clause prevails over any other provision of this Agreement that might otherwise give rise to a refund or credit on a change of settings. No refund or credit is available for any period during which access was withheld or suspended under this clause 9.

64. Where the Company has issued an invoice to a Client under a separately negotiated arrangement rather than through the Account Settings, payment and any applicable interest are governed by the terms of that arrangement, and clauses 9.5 and 9.6 do not apply to it.

10 · Educational Records and FERPA

65. Where deployed within educational environments, the Company acts as a school official with legitimate educational interest under FERPA.

66. Client institutions remain responsible for their own FERPA compliance obligations, including any notice or consent requirements applicable to their students.

11 · Healthcare Contexts and HIPAA

67. The Company does not intentionally collect Protected Health Information (PHI).

68. Healthcare-sector Clients remain responsible for ensuring HIPAA-compliant deployment and use.

69. Where a Client requires a business associate agreement, the parties shall execute one separately, and its terms prevail over this Agreement to the extent of any conflict.

12 · Data Protection Roles and International Transfers

70. Where the Company processes Personal Data on the Client’s behalf, the Client acts as controller and the Company as processor. The Company shall process Personal Data only on the Client’s documented instructions, including those set out in this Agreement and those recorded in the Account Settings. The Company shall not process Personal Data for any purpose beyond what is necessary to provide the Services and to meet the service requirements set out in this Agreement and the Account Settings.

71. The Company shall implement appropriate technical and organisational measures, assist the Client in responding to data subject requests, notify the Client without undue delay on becoming aware of a personal data breach, and make available the information necessary to demonstrate compliance with this clause.

72. Where Personal Data is transferred outside the EEA or the United Kingdom, the parties shall rely on an appropriate transfer mechanism, including standard contractual clauses or an international data transfer addendum, which are incorporated by reference.

73. The Company shall assist the Client with data protection impact assessments to the extent reasonably required.

13 · Intellectual Property

74. The Company and its licensors own all right, title and interest in the Platform, including software, models, interfaces, documentation and all improvements, whether or not developed at the Client’s request. The Client is granted a non-exclusive, non-transferable, non-sublicensable licence to access and use the Platform during the term, solely for the Client’s internal training, verification and compliance purposes and by its Participants through the Client’s deployment.

75. The Client shall not reverse engineer, decompile, resell, white-label, or use the Platform to build a competing product.

76. Client Data ownership. As between the parties, the Client (or the Participant, as applicable) owns all Client Data. The Client grants the Company a limited, non-exclusive licence to process Client Data solely to provide the Platform, comply with the Client’s instructions and meet legal obligations.

77. Outputs and derivatives. The Company owns the Platform and all non-client-specific materials, models and de-identified or aggregated statistics. Training/assessment completion records, digital affidavits of participation, verification results and reports specific to the Client are provided to the Client for its use.

78. Where the Company uses de-identified or aggregated data for product improvement or benchmarking, it shall ensure the data cannot be re-associated with any individual or Client.

14 · Liability and Indemnities

16.1 · Limitation of Liability

79. To the maximum extent permitted by applicable law, neither party shall be liable for indirect, incidental, special, consequential or punitive damages, or for loss of profit, revenue, data, goodwill or business opportunity, however arising.

80. Subject to clause 14.1.3, each party’s total cumulative liability shall not exceed the amounts paid by the Client during the twelve (12) months preceding the event giving rise to the claim.

81. Carve-outs. The cap in clause 14.1.2 does not apply to: breach of confidentiality; the indemnities in clauses 16.2 and 16.3; intellectual property infringement; gross negligence or wilful misconduct; death or personal injury caused by negligence; unpaid fees; or fraud or fraudulent misrepresentation.

82. Data protection liability. Liability arising from breach of data protection obligations shall not be limited by clauses 16.1.1 or 16.1.2 but shall be capped at two (2) times the amounts paid by the Client during the twelve (12) months preceding the event giving rise to the claim. This clause does not cover fines or penalties imposed on the Client for its own non-compliance.

83. Nothing in this Agreement limits liability that cannot be limited under applicable law.

16.2 · Company Indemnity

84. The Company shall defend and indemnify the Client against third-party claims that the Platform infringes intellectual property rights, and against claims arising from the Company’s breach of its security or data protection obligations under this Agreement, provided the Client notifies the Company promptly and grants control of the defence.

16.3 · Client Indemnity and Participant Consent

85. The Client shall defend and indemnify the Company against claims arising from Client Data submitted without the consents or lawful basis required by applicable law, the Client’s breach of its own regulatory or compliance obligations, or processing the Company performs at the Client’s specific written instruction.

86. The Client is responsible for obtaining and maintaining all notices and consents required under GDPR, BIPA, PIPEDA, CCPA/CPRA and other applicable law for the processing of Participant identity and Biometric Data, and for notifying Participants as required by clause 1.4. This indemnity does not extend to a failure arising from the Company collecting Client Data in a manner that exceeds the items, method or intended use stated in its Privacy Policy.

15 · Changes to This Agreement

87. The Company may modify this Agreement. Material changes take effect not less than thirty (30) days after written notice to the Client, and the Client may terminate under clause 10.5 before the effective date.

88. Changes required by law take effect on the date required by that law.

16 · Governing Law and Dispute Resolution

89. This Agreement is governed by the laws of the Republic of Estonia, save that where the Client has elected a jurisdiction from the list of permitted jurisdictions in Schedule A at the point of purchase, the law of that jurisdiction governs.

90. Where the Client has not elected a jurisdiction, the governing law is determined at the start of the term by reference to the AWS region then selected by the Client in the Account Settings: regions within the European Union or EEA — Estonian law; regions within North America — the laws of the Province of Ontario; regions within Australia — the laws of New South Wales; all other regions — Estonian law. The Client may elect an alternative jurisdiction from Schedule A at any time on written notice.

91. Data residency is separate and operational. The AWS region selected in the Account Settings governs where Client Data is stored and processed, and the Client may change that selection through the Account Settings. Such a change does not amend this Agreement and does not alter the governing law determined under clause 16.2. A change to the governing law requires the written agreement of both parties.

92. Subject to clause 16.5, the parties submit to the exclusive jurisdiction of the courts of the governing law elected or determined under clauses 18.1 and 18.2.

93. Preserved rights. Either party may seek injunctive or other equitable relief in any court of competent jurisdiction. Nothing in this Agreement excludes or limits any right or remedy that the Client or a Participant has under mandatory provisions of the law of their own jurisdiction, including consumer and employment protections.

17 · Notices

94. Formal notices shall be in writing to: for the Company, Asgard Authenticate OÜ, Tornimäe tn 5, Tallinn, 10145, Estonia, with a copy to sales@asgard1.com, and with a courtesy copy to the London (Westend) Office, 85 Great Portland Street, First Floor, London W1W 7LT, United Kingdom; for the Client, the address and email recorded for the Client’s account.

95. Email notice is effective on the next business day where sent to the designated address.

96. The Company shall not use a personal email address for contractual notices.

18 · Assignment and Change of Control

97. Neither party may assign this Agreement without the other’s written consent, save that the Company may assign to an affiliate or in connection with a merger or sale of substantially all its assets, on written notice to the Client.

19 · Confidentiality, Subcontracting and Force Majeure

98. Confidentiality. Each party shall keep the other’s confidential information confidential, use it only to perform this Agreement and protect it with at least reasonable care. This obligation survives termination for five (5) years, and indefinitely for trade secrets and Client Data.

99. Confidential information does not include information that is public through no breach, independently developed, or lawfully received from a third party without restriction.

100. Subcontracting. The Company may engage subcontractors, including the infrastructure providers referred to in clause 7, provided it remains liable for their performance and imposes data protection obligations no less protective than those in this Agreement. The Company shall give the Client notice of any change to subcontractors that process Personal Data.

101. Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, provided it gives prompt notice. The events excluded from uptime calculations under clause 7.3 are force majeure for the purposes of this clause.

Schedule A — Permitted Jurisdictions

The list is closed, so that the Company only ever accepts law it has reviewed. The Client may elect a jurisdiction at the point of purchase; where no election is made, the region-linked defaults in clause 16.2 apply.