Agenda packet — Gardena City Council, March 11, 2025 (part 5 of 5)

1.8 “Offerings” means, collectively, Products, Subscriptions, Training, Professional Services and Support Services.

1.9 “Order” means a written purchase order or similar ordering document, signed or submitted to FireEye by Customer and approved by FireEye, under which Customer agrees to purchase Offerings.

1.10 “Products” means the FireEye software and hardware appliances (which may include embedded software or firmware components) as described in Exhibit A to this Agreement.

1.11 “Professional Services” means, collectively, those security consulting services provided by FireEye under a Statement of Work and/or set forth on an Order, which may consist of Product-related services such as deployment, configuration or installation services; proactive security consulting such as penetration testing, vulnerability assessments or compromise assessments; or incident response or other remediative services.

1.12 "Service" or "Services" means the Professional Services, Support Services and Training.

1.13 "Statement of Work" or “SOW” means a mutually agreed-upon document between FireEye and Customer, describing Professional Services, rates and timelines (if applicable) for those Professional Services, and incorporating this Agreement.

1.14 “Subscription” means a service provided by FireEye for a fixed term, under which FireEye provides access to certain features, functionality, and/or information, as described in the applicable Exhibit for each Subscription attached to this Agreement.

1.15 “Support Services” means the Product support and maintenance services provided by FireEye with respect to each Product, and that are described in the applicable Exhibit for each Product attached to this Agreement.

1.16 “Third Party Materials” means software or other components that are licensed to FireEye by third parties for use in FireEye’s Offerings.

1.17 “Training” means training in the use of Products, or on security-related topics in general, provided by FireEye.

2. ORDERS AND STATEMENTS OF WORK.

2.1. Orders. Customer may purchase Offerings by submitting an Order. If accepted by FireEye, the “Order Effective Date” will be the date of the Order. All Orders will be governed by this Agreement. For clarity, FireEye will not be obligated to ship any Product, or provide any Services, Training or Subscriptions until Customer has issued a valid Order for those Offerings.

2.2. Statements of Work. Each Statement of Work will incorporate and be governed by this Agreement. The “Statement of Work Effective Date” will be the date both Customer and FireEye have agreed to the Statement of Work, either by executing the Statement of Work or by issuing and accepting an Order for the Professional Services described on the Statement of Work. For clarity, FireEye will not be obligated to perform any Professional Services until a SOW describing those Professional Services has been agreed by both parties or an Order listing those Professional Services has been accepted by FireEye.

3. PAYMENT. Customer agrees to purchase the Offerings for the prices set forth in each Order and/or Statement of Work, as applicable (“Fees”). If Customer purchases through a FireEye partner (such as an authorized reseller or distributor, collectively, “FireEye Partners”), all fees and other procurement and delivery terms shall be agreed between Customer and the applicable partner. If Customer purchases directly from FireEye, Customer will make full payment in the currency specified in FireEye’s invoice, without set-off and in immediately available funds, within thirty (30) days of the date of each invoice. All Fees are non-cancelable and non-refundable. All Fees described on an Order will be fully invoiced in advance, unless otherwise agreed by FireEye. Unless otherwise specified in a Statement of Work, all Fees related to Professional Services will be invoiced Confidential FireEye Rev. 8/2016

Page 3 ends

fully in advance. Customer shall reimburse FireEye for any and all expenses incurred so long as such expenses are directly attributable to the Services or Subscriptions performed for or provided to Customer. FireEye will provide appropriate vouching documentation for all expenses exceeding $25. If any payment is more than fifteen (15) days late, FireEye may, without limiting any remedies available to FireEye, terminate the applicable Order or Statement of Work or suspend performance until payment is made current. Customer will pay interest on all delinquent amounts at the lesser of 1.5% per month or the maximum rate permitted by applicable law. All Fees are exclusive of all present and future sales, use, excise, value added, goods and services, withholding and other taxes, and all customs duties and tariffs now or hereafter claimed or imposed by any governmental authority upon the Offerings which shall be invoiced to and paid by the Customer. If Customer is required by law to make any deduction or withholding on any payments due to FireEye, Customer will notify FireEye and will pay FireEye any additional amounts necessary to ensure that the net amount FireEye receives, after any deduction or withholding, equals the amount FireEye would have received if no deduction or withholding had been required. Additionally, Customer will provide to FireEye evidence, to the reasonable satisfaction of FireEye, showing that the withheld or deducted amounts have been paid to the relevant governmental authority. For purposes of calculating sales and similar taxes, FireEye will use the address set forth on the Order or Statement of Work, as applicable, as the jurisdiction to which Offerings and shipments are delivered unless Customer has otherwise notified FireEye in writing as of the Order Effective Date or Statement of Work Effective Date, as applicable. Customer will provide tax exemption certificates or direct-pay letters to FireEye on or before the Order Effective Date or Statement of Work Effective Date, as applicable. FireEye reserves the right to increase Fees at any time, although increases in Fees for Subscriptions or Support Services will not go into effect until the next Renewal Subscription Term or Renewal Support Term, as applicable.

4. TITLE AND RISK OF LOSS; INSPECTION. All hardware, including Products and any hardware provided for use with Subscriptions and/or Services, is shipped FOB Origin (FCA) from FireEye’s designated manufacturing facility or point of origin, and title to such hardware and the risk of loss of or damage to the hardware shall pass to Customer at time of FireEye’s delivery of such hardware to the carrier. FireEye is authorized to designate a carrier pursuant to FireEye’s standard shipping practices unless otherwise specified in writing by Customer.

Customer must provide written notice to FireEye within five (5) days of delivery of the Products of any nonconformity with the Order, e.g., delivery of the wrong Product or incorrect quantities.

5. TERMS APPLICABLE TO OFFERINGS.

5.1. Products and Support Services. Customer’s purchase and use of each Product and Support Services for each Product will be subject to the licenses and terms specific to each Product set forth in Exhibit A.

5.2. Subscriptions. Customer’s purchase of and access to each Subscription will be subject to the terms specific to each Subscription set forth in Exhibit B.

5.3. Training. Customer’s purchase of Training will be subject to the terms in this Section 5.3. Training delivery dates and location for such Training will be mutually agreed upon by the parties. If an Order does not specify such dates and/or locations, then the parties will mutually agree upon the dates and locations for Training. Customer must request rescheduling of Training no less than two (2) weeks in advance of the scheduled start date. FireEye will use reasonable efforts to reschedule the Training, subject to availability, and Customer will pay any expenses associated with the rescheduling, including any expenses associated with cancelling or changing travel plans. If Customer cancels attendance at a public Training class, Customer must notify FireEye no later than two (2) business days before the date of the Training class. If Customer timely notifies FireEye of the cancellation, FireEye will issue Customer a credit for the amount paid for that public Training class, which Customer may apply toward another public Training class held within one (1) year of the date of the Order on which the cancelled Training class was included. Customer may substitute a named attendee at a public Training class, but Customer will notify FireEye in advance of any such substitution. FireEye reserves the right to refuse admittance to public Training classes to any person, for any reason, and if FireEye refuses admittance, FireEye will refund the amount paid for that person’s attendance at the public Training class. FireEye does not refund or credit Fees paid for attendees who do not attend Training classes or who leave before a Training class concludes. If Customer purchases a block of Training hours (for example, 10 hours of Training), then Customer must use those hours within one (1) year of the effective date of the applicable Order. All Training must be scheduled and conducted within one (1) year of the date of the applicable Order for that Training.

Confidential FireEye Rev. 8/2016

Page 4 ends

5.4. Professional Services.

5.4.1. Deliverables. Subject to Customer’s timely payment of applicable fees, and subject to this Agreement and each applicable SOW, Customer shall have a perpetual, non-exclusive, nontransferable, right and license to use, display and reproduce the Deliverables for its internal business purposes. Deliverables may not be shared with any third party other than law enforcement agencies. In no event may Deliverables be used for sales or marketing activities.

5.4.2. Customer-Owned Property. Customer will be and remain, at all times, the sole and exclusive owner of the Customer-Owned Property (including, without limitation, any modification, compilation, derivative work of, and all intellectual property and proprietary rights contained in or pertaining thereto). FireEye will promptly return to Customer all Customer-Owned Property upon the termination or expiration of the applicable Statement of Work or Order, or sooner at Customer’s request. “Customer-Owned Property” means any technology, software, algorithms, formulas, techniques or know-how and other tangible and intangible items that were owned by Customer, or developed by or for Customer prior to the SOW Effective Date that are provided by Customer to FireEye for incorporation into or used in connection with the development of the Deliverables or performance of Professional Services.

5.4.3. Customer Responsibilities. If the Services or Subscriptions require the installation and use of FireEye equipment or software, Customer will facilitate the installation and shall provide physical space, electrical power, Internet connectivity and physical access as reasonably determined and communicated by FireEye.

Notwithstanding anything to the contrary herein or in any Statement of Work, including confidentiality provisions, if Customer has hired FireEye to perform a PCI DSS Compliance Audit or a PCI investigation, FireEye may provide The Payment Card Industry Security Standards Council, LLC (PCI SSC), card companies and the relevant merchant bank with all Reports of Compliance (ROC) and all related assessment and investigative report documents generated in connection with such work, as required by PCI DSS rules.

5.4.4. Additional Assumptions. (a) estimated Fees for Professional Services do not include any hardware, software, licensing, maintenance or support costs of any FireEye or other third-party product or service suggested by FireEye in the course of performing Professional Services; (b) when FireEye’s personnel are performing Professional Services on site at Customer’s premises, Customer will allocate appropriate working space and physical access for all FireEye personnel; (c) Customer will make available key individuals within the security program that can best help plan and coordinate activities described in the SOW; (d) either party may elect to submit written change requests to the other party proposing changes to the Statement of Work. All changes to the requirements and Statement of Work will be made using agreed-to project change control procedures.

5.5 Evaluations. If Customer receives a Product or Subscription for evaluation purposes (“Evaluation Offerings”) then Customer may use the Evaluation Offerings for its own internal evaluation purposes for a period of up to thirty (30) days from the date of receipt of the Evaluation Offerings (the “Evaluation Period”). Customer and FireEye may, upon mutual written agreement (including via email), extend the Evaluation Period. If the Evaluation Offering includes hardware components, Customer will return the hardware within ten (10) days of the end of the Evaluation Period, and if Customer does not return the hardware within this period, Customer shall be invoiced for the then-current list price for the applicable Evaluation Offering. Customer acknowledges that title to hardware components of Evaluation Offerings remains with FireEye at all times, and that Evaluation Offerings may be used and/or refurbished units. If the Evaluation Offering does not include hardware components, Evaluator must delete all software and other components (including Documentation) related to the Evaluation Offering at the end of the Evaluation Period, and confirm those deletions in writing to FireEye, or the Evaluator shall be invoiced for the then-current list price for the Evaluation Offering. If the Evaluation Offering is a Subscription, Evaluator understands that FireEye may disable access to the Subscription automatically at the end of the Evaluation Period, without notice to Evaluator. EVALUATION OFFERINGS ARE PROVIDED “AS IS”, AND

TO THE EXTENT PERMITTED BY APPLICABLE LAW, FIREEYE DISCLAIMS ALL WARRANTIES RELATING TO THE EVALUATION

OFFERINGS, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTIES AGAINST INFRINGEMENT OF THIRD PARTY RIGHTS, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

6. INTELLECTUAL PROPERTY
Confidential FireEye Rev. 8/2016

Page 5 ends

6.1. Ownership of FireEye Materials; Restrictions. All Intellectual Property Rights in FireEye Materials, Products, Deliverables, Documentation, and Subscriptions belong exclusively to FireEye and its licensors.

Customer will not (and will not allow any third party to): (i) disassemble, decompile, reverse compile, reverse engineer or attempt to discover any source code or underlying ideas or algorithms of any FireEye Materials (except to the limited extent that applicable law prohibits reverse engineering restrictions); (ii) sell, resell, distribute, sublicense or otherwise transfer, the FireEye Materials, or make the functionality of the FireEye Materials available to any other party through any means (unless otherwise FireEye has provided prior written consent), (iii) without the express prior written consent of FireEye, conduct any benchmarking or comparative study or analysis involving the FireEye Materials (“Benchmarking”) for any reason or purpose except, to the limited extent absolutely necessary, to determine the suitability of Products or Subscriptions to interoperate with Customer’s internal computer systems; (iv) disclose or publish to any third party any Benchmarking or any other information related thereto; (v) use the FireEye Materials or any Benchmarking in connection with the development of products, services or subscriptions that compete with the FireEye Materials; or (vi) reproduce, alter, modify or create derivatives of the FireEye Materials. Between Customer and FireEye, FireEye shall retain all rights and title in and to any Indicators of Compromise FireEye developed by or for FireEye in the course of providing Subscriptions or performing Services.

6.2. Third Party Materials. Customer acknowledges that Products and Subscriptions may include Third Party Materials. FireEye represents that these Third Party Materials will not diminish the license rights provided herein or limit Customer’s ability to use the Products and Subscriptions in accordance with the applicable Documentation, and neither the inclusion of Third Party Materials in any Product or Subscription or use of Third Party Materials in performance of Services will create any obligation on the part of Customer to license Customer’s software or products under any open source or similar license.

7. WARRANTIES.

7.1. Product Warranty. FireEye warrants to Customer that during the one (1) year period following the shipment of the Products, the Products will perform substantially in accordance with the applicable Documentation. The warranty stated in this Section 7.1 shall not apply if the Product has: (i) been subjected to abuse, misuse, neglect, negligence, accident, improper testing, improper installation, improper storage, improper handling or use contrary to any instructions issued by FireEye; (ii) been repaired or altered by persons other than FireEye; (iii) not been installed, operated, repaired and maintained in accordance with the Documentation; or (iv) been used with any third party software or hardware which has not been previously approved in writing by FireEye. If during the one-year Product warranty period: (a) FireEye is notified promptly in writing upon discovery of any error in a Product, including a detailed description of such alleged error; (b) such Product is returned, transportation charges prepaid, to FireEye’s designated manufacturing facility in accordance with FireEye’s then-current return procedures, as set forth by FireEye from time to time; and (c) FireEye’s inspections and tests determine that the Product contains errors and has not been subjected to any of the conditions set forth in 7.1(i)-(iv) above, then, as Customer’s sole remedy and FireEye’s sole obligation under the foregoing warranty, FireEye shall, at FireEye’s option, repair or replace without charge such Product. Any Product that has either been repaired or replaced under this warranty shall have warranty coverage for the remaining warranty period. Replacement parts used in the repair of a Product may be new or equivalent to new.

7.2. Services Warranty. FireEye warrants to Customer that Services will be performed in a professional manner in accordance with industry standards for like services. If Customer believes the warranty stated in this Section has been breached, Customer must notify FireEye of the breach no later than thirty (30) days following the date the Services were performed, and FireEye will promptly correct or re-perform the Services, at FireEye’s expense.

7.3. Subscription Warranty. FireEye warrants to Customer the Subscriptions will be provided in a professional manner in accordance with industry standards for similar subscriptions. If Customer believes the warranty stated in this Section has been breached, Customer must notify FireEye of the breach no later than thirty (30) days following the date the warranty was allegedly breached, and FireEye will promptly correct the nonconformity, at FireEye’s expense.

Confidential FireEye Rev. 8/2016

Page 6 ends

7.4. Remedies Exclusive. Except for any Service Level Credits described in Exhibit B, the remedies stated in Sections 7.1-7.3 above are the sole remedies, and FireEye’s sole obligation, with respect to Products, Subscriptions and Services that fail to comply with the foregoing warranties.

7.5. Disclaimer of Warranties. EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH HEREIN, ALL PRODUCTS, SUBSCRIPTIONS, FIREEYE MATERIALS, DELIVERABLES AND SERVICES ARE PROVIDED ON AN “AS IS” BASIS WITHOUT ANY WARRANTY WHATSOEVER. FIREEYE AND ITS SUPPLIERS EXPRESSLY DISCLAIM, TO THE MAXIMUM EXTENT

PERMISSIBLE UNDER APPLICABLE LAW, ALL WARRANTIES, EXPRESS, IMPLIED AND STATUTORY, INCLUDING WITHOUT

LIMITATION ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, NONINFRINGEMENT, OR ARISING FROM COURSE OF PERFORMANCE, DEALING, USAGE OR TRADE. FIREEYE ALSO

MAKES NO WARRANTY REGARDING NONINTERRUPTION OF USE OR FREEDOM FROM BUGS, AND MAKES NO WARRANTY THAT PRODUCTS, FIREEYE MATERIALS, DELIVERABLES, SERVICES OR SUBSCRIPTIONS WILL BE ERROR-FREE.

8. INFRINGEMENT INDEMNITY.

8.1. FireEye shall defend Customer, and its officers, directors and employees, against any third party action alleging that the FireEye Materials infringes a valid U.S. patent or copyright issued as of the date of delivery or performance, as applicable, and FireEye shall pay all settlements entered into, and all final judgments and costs (including reasonable attorneys’ fees) finally awarded against such party in connection with such action.

If the FireEye Materials, or parts thereof, become, or in FireEye’s opinion may become, the subject of an infringement claim, FireEye may, at its option: (i) procure for Customer the right to continue using the applicable FireEye Materials; (ii) modify or replace such FireEye Materials with a substantially equivalent non-infringing FireEye Materials; or (iii) require the return of such FireEye Materials or cease providing affected Product, Subscriptions, Deliverables or Services, and refund to Customer, with respect to Products, a pro-rata portion of the purchase price of such Products based on a three-year straight line amortization of the purchase price, and with respect to Subscriptions, a portion of any pre-paid Fees for such Subscriptions, pro rated for any unused Subscription Term, and with respect to Services, any pre-paid Fees for Services that have not been delivered. THIS SECTION 8.1 STATES THE ENTIRE LIABILITY OF FIREEYE AND CUSTOMER’S SOLE REMEDY WITH RESPECT TO ANY INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS BY THE OFFERINGS, FIREEYE MATERIALS, OR DELIVERABLES.

8.2. FireEye shall have no indemnification obligations with respect to any action arising out of: (i) the use of any Product, Subscription, Deliverable, or Service, or any part thereof, in combination with software or other products not supplied by FireEye; (ii) any modification of the Products, Subscriptions, Deliverables, or Services not performed or expressly authorized by FireEye; or (iii) the use of any the Products, Subscriptions, Deliverables, or Services other than in accordance with this Agreement and applicable Documentation.

8.3. The indemnification obligations shall be subject to Customer: (i) notifying FireEye within ten (10) days of receiving notice of any threat or claim in writing of such action; (ii) giving FireEye exclusive control and authority over the defense or settlement of such action; (iii) not entering into any settlement or compromise of any such action without FireEye’s prior written consent; and (iv) providing reasonable assistance requested by FireEye.

9. LIMITATION OF LIABILITY.

9.1. Consequential Damages Waiver. EXCEPT FOR LIABILITY ARISING UNDER A BREACH OF ANY INTELLECTUAL PROPERTY RIGHT OF FIREEYE, OR THE INDEMNIFICATION OBLIGATIONS SET FORTH IN SECTION 8 (INFRINGEMENT INDEMNITY), IN NO EVENT WILL FIREEYE BE LIABLE FOR ANY SPECIAL, INCIDENTAL, CONSEQUENTIAL

OR EXEMPLARY DAMAGES OF ANY KIND, INCLUDING BUT NOT LIMITED TO ANY LOST PROFITS AND LOST SAVINGS,

HOWEVER CAUSED, WHETHER FOR BREACH OR REPUDIATION OF CONTRACT, TORT, BREACH OF WARRANTY,

NEGLIGENCE, OR OTHERWISE, WHETHER OR NOT FIREEYE WAS ADVISED OF THE POSSIBILITY OF SUCH LOSS OR DAMAGES.

9.2. Limitation of Monetary Damages. EXCEPT FOR LIABILITY ARISING UNDER A BREACH OF ANY

INTELLECTUAL PROPERTY RIGHT OF FIREEYE, PAYMENT OBLIGATIONS OF CUSTOMER, AND THE INDEMNIFICATION OBLIGATIONS SET FORTH IN SECTION 8 (INFRINGEMENT INDEMNITY), AND NOTWITHSTANDING ANY OTHER PROVISIONS OF THIS AGREEMENT OR ANY ORDER OR STATEMENT OF WORK, FIREEYE’S TOTAL LIABILITY ARISING OUT

OF THIS AGREEMENT, THE OFFERINGS, THE FIREEYE IP AND DELIVERABLES SHALL BE LIMITED TO THE TOTAL AMOUNTS Confidential FireEye Rev. 8/2016

Page 7 ends

RECEIVED BY FIREEYE FOR THE RELEVANT OFFERINGS DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE FIRST OCCURRENCE OF THE EVENTS GIVING RISE TO SUCH LIABILITY.

9.3. Applicability. THE LIMITATIONS AND EXCLUSIONS CONTAINED HEREIN WILL APPLY ONLY TO THE MAXIMUM EXTENT PERMISSIBLE UNDER APPLICABLE LAW, AND NOTHING HEREIN PURPORTS TO LIMIT EITHER PARTY’S

LIABILITY IN A MANNER THAT WOULD BE UNENFORCEABLE OR VOID AS AGAINST PUBLIC POLICY IN THE APPLICABLE JURISDICTION.

9.4 SAFETY Act. FireEye and Customer hereby mutually waive and release each other from any and all liabilities relating to any claims for losses or damages of any kind (including, but not limited to, business interruption losses) arising out of an Act of Terrorism as defined by the Support Anti-Terrorism By Fostering Effective Technologies Act of 2002 (“SAFETY Act”)(6 U.S.C. §§ 441-444). FireEye and Customer further agree to be solely responsible to the full extent of any and all losses they may sustain, or for any and all losses their respective employees, officers, or agents may sustain, resulting from an Act of Terrorism as defined by 6 U.S.C. §§ 441-444 when FireEye’s Multi-Vector Virtual Execution Engine and any subscriptions, cloud services platform or associated services (the “Qualified Anti-Terrorism Technology”) are utilized in defense against, response to, or recovery from an Act of Terrorism.

10. Export Control; Anti-Corruption; U.S. Government Restricted Rights.

10.1. Export Control. Export Control. Each party represents and warrants that it shall comply with all laws and regulations applicable to it with respect to the Offerings. Customer further acknowledges and agrees that the Products and FireEye Materials may be subject to restrictions and controls imposed by the United States Export Administration Act, the regulations thereunder, as well as European Union (“EU”) or National export control laws and obligations and similar laws in other jurisdictions. Customer agrees to comply with all applicable export and re-export control laws and regulations, including the Export Administration Regulations (“EAR”) maintained by the U.S. Department of Commerce, trade and economic sanctions maintained by the Treasury Department’s Office of Foreign Assets Control, and the International Traffic in Arms Regulations (“ITAR”) maintained by the Department of State. Specifically, Customer covenants that it shall not, directly or indirectly, sell, export, reexport, transfer, divert, or otherwise dispose of any Products, FireEye Materials, or technology (including products derived from or based on such technology) received from FireEye under this Agreement to any destination, entity, or person prohibited by the laws or regulations of the United States and the EU, without obtaining prior authorization from the competent government authorities as required by those laws and regulations. These prohibitions include, but are not limited to the following: (i) the Products and FireEye Materials cannot be exported or re-exported to any countries embargoed by the United States (currently including Cuba, Iran, North Korea, Sudan or Syria) which includes nationals of these countries employed by Customer; (ii) the Products and FireEye Materials cannot be exported or re-exported for military use in country group ‘b’ prior to valid ‘export license’ or valid ‘license exception’; and (iii) the Products and FireEye Materials cannot be used for any prohibited end uses including any “nuclear, biological or chemical weapon related activities.”; and (iv) the Products and FireEye Materials will not be re-exported or otherwise sold or transferred if it is known or suspected that they are intended or likely to be used for such purposes. Customer agrees to notify FireEye of any suspicious activities by any employee related to the Products. Customer agrees to indemnify, to the fullest extent permitted by law, FireEye from and against any fines or penalties that may arise as a result of Customer’s breach of this provision. This export control clause shall survive termination or cancellation of any Orders.

10.2. Anticorruption Laws. Each Party acknowledges that it is familiar with and understands the provisions of the U.S. Foreign Corrupt Practices Act ("the FCPA") and the U.K. Bribery Act of 2010 (“UKBA”) and agrees to comply with its terms as well as any provisions of local law related thereto. Each party further understands the provisions relating to the FCPA and UKBA’s prohibitions regarding the payment or giving of anything of value, including but not limited to payments, gifts, travel, entertainment and meals, either directly or indirectly, to an official of a foreign government or political party for the purpose of influencing an act or decision in his or her official capacity or inducing the official to use his or her party's influence with that government, to obtain or retain business involving the Offering. Each Party agrees to not violate or knowingly let anyone violate the FCPA or UKBA, and Each Party agrees that no payment it makes will constitute a bribe, influence payment, kickback, rebate, or other payment that violates the FCPA, the UKBA, or any other applicable anticorruption or anti-bribery law.

Confidential FireEye Rev. 8/2016

Page 8 ends

10.3. U.S. Government Restricted Rights. The Offerings, Deliverables and Documentation are “commercial items”, “commercial computer software” and “commercial computer software documentation,” pursuant to DFAR Section 227.7202 and FAR Section 12.212, as applicable. All Offerings and FireEye Materials are and were developed solely at private expense. Any use, modification, reproduction, release, performance, display or disclosure of the Offerings, FireEye Materials and Documentation by the United States Government shall be governed solely by the this Agreement and shall be prohibited except to the extent expressly permitted by this Agreement.

11. CONFIDENTIAL INFORMATION.

11.1. Confidential Information. “Confidential Information” means the non-public information that is exchanged between the parties, provided that such information is: (i) identified as confidential at the time of disclosure by the disclosing party (“Discloser”); or (ii) disclosed under circumstances that would indicate to a reasonable person that the information should be treated as confidential by the party receiving such information (“Recipient”). The terms of any commercial transaction between the parties (including pricing related to the Offerings) shall be considered Confidential Information.

11.2. Maintenance of Confidentiality. Each party agrees that it shall: (i) take reasonable measures to protect the Confidential Information by using the same degree of care, but no less than a reasonable degree of care, to prevent the unauthorized use, dissemination or publication of the Confidential Information as the Recipient uses to protect its own confidential information of a like nature; (ii) limit disclosure to those persons within Recipient’s organization with a need to know and who have previously agreed in writing, prior to receipt of Confidential Information either as a condition of their employment or in order to obtain the Confidential Information, to obligations similar to the provisions hereof; (iii) not copy, reverse engineer, disassemble, create any works from, or decompile any prototypes, software or other tangible objects which embody the other party's Confidential Information and/or which are provided to the party hereunder; and (iv) comply with, and obtain all required authorizations arising from, all U.S. and other applicable export control laws or regulations.. Confidential Information shall not be used or reproduced in any form except as required to accomplish the purposes and intent of an Order or Statement of Work. Any reproduction of Confidential Information shall be the property of Discloser and shall contain any and all notices of confidentiality contained on the original Confidential Information.

11.3. Exceptions. The parties agree that the foregoing shall not apply to any information that Recipient can evidence: (i) is or becomes publicly known and made generally available through no improper action or inaction of Recipient; (ii) was already in its possession or known by it prior to disclosure by Discloser to Recipient; (iii) is independently developed by Recipient without use of or reference to any Confidential Information; or (iv) was rightfully disclosed to it by, or obtained from, a third party. Recipient may make disclosures required by law or court order provided that Recipient: (a) uses diligent efforts to limit disclosure and to obtain, if possible, confidential treatment or a protective order; (b) has given prompt advance notice to Discloser of such required disclosure; and (c) has allowed Discloser to participate in the proceedings.

11.4. Injunctive Relief. Each party will retain all right, title and interest to such party’s Confidential Information. The parties acknowledge that a violation of the Recipient’s obligations with respect to Confidential Information may cause irreparable harm to the Discloser for which a remedy at law would be inadequate.

Therefore, in addition to any and all remedies available at law, Discloser shall be entitled to seek an injunction or other equitable remedies in all legal proceedings in the event of any threatened or actual violation of any or all of the provisions hereof.

11.5. Return of Confidential Information. Within thirty (30) days after the date when all Orders and SOWs have expired or been terminated, or after any request for return of Confidential Information, each party will return to the other party or destroy all of such other party’s Confidential Information, at such other party’s discretion, and, upon request, provide such other party with an officer’s certificate attesting to such return and/or destruction, as appropriate.

11.6. Privacy. If FireEye is a data processor under this Agreement, further to the provisions of Article 17 and 25 of the EU Data Protection Directive EU (Directive 95/46/EC), FireEye agrees that it will:

Confidential FireEye Rev. 8/2016

Page 9 ends

11.6.1 only deal with and process personal data controlled by Customer in compliance with, and subject to, the instructions received from Customer and in compliance with this Agreement and will not use or process the personal data for any other purpose whatever;

11.6.2 adopt and maintain appropriate (including organizational and technical) security measures in dealing with Customer’s personal data in order to protect against unauthorized or accidental access, loss, alteration, disclosure or destruction of such data, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing; and

11.6.3 take all reasonable steps to ensure that (i) persons employed by it, and (ii) other persons engaged at its place of work, are aware of and comply with applicable data privacy laws and regulations.

11.6.4 FireEye may process or otherwise transfer any personal information in or to any country outside the European Economic Area or any country not deemed adequate by the European Commission pursuant to Article 25(6) to the extent necessary for the provision of the Offerings. If required, FireEye will enter into the EU Standard Contractual Clauses as approved by the European Commission for ensuring an adequate level of data protection in respect of the personal information that will be processed or transferred.

12. TERM AND TERMINATION.

12.1. Term.

12.1.1 Products. Products will be licensed according to the applicable terms in Exhibit A, for the period of time stated on the Order (e.g., if the Order lists a Product as being provided for “3Y,” the license for that Product is provided for three years from the date of the Order). If no period of time is stated on the Order, then the Product is licensed perpetually, unless otherwise terminated as set forth herein.

12.1.2 Support Services. Support Services will begin ten (10) days from the date of shipment of the associated Product and continue for the period of time stated on the Order(“Initial Support Term”). Unless otherwise stated on the Order, the Support Services will automatically renew for additional periods of one (1) year each (each, a “Renewal Support Term” and together with the Initial Support Term, the “Support Term”), unless either party notifies the other of its intention not to renew Support Services at least sixty (60) days prior to the expiration of the then-current Support Term. Customer may terminate Support at any time, for convenience, on thirty (30) days’ written notice to FireEye. If Customer terminates Support Services for convenience before the end of the then-current Support Term, Customer will pay any remaining fees owing for the remainder of the thencurrent Support Term within thirty (30) days of the effective date of termination.

12.1.3 Subscriptions. The term of each Subscription will begin on the Order Effective Date and will continue in effect for the period of time stated in the Order (“Initial Subscription Term”). Unless otherwise stated on the Order, the Subscription will automatically renew after its Initial Subscription Term for additional periods of one (1) year each (each, a “Renewal Subscription Term” and together with the Initial Subscription Term, the “Subscription Term”), unless either party notifies the other of its intention not to renew that Subscription at least sixty (60) days prior to the expiration of the then-current Subscription Term. Customer may terminate a Subscription at any time, for convenience, on thirty (30) days’ written notice to FireEye. If Customer terminates a Subscription for convenience before the end of the then-current Subscription Term, Customer will pay any remaining fees owing for the remainder of the then-current Subscription Term within thirty (30) days of the effective date of termination.

12.1.4 Professional Services; Statements of Work. Professional Services described on an Order will be provided at mutually agreed-upon times, and will continue until complete, unless otherwise terminated as set forth herein. The term of each SOW will be as set forth in that SOW. If no term is expressed in an SOW, then the term of that SOW will begin on the SOW Effective Date and continue until the Professional Services described in that SOW are complete or the SOW is earlier terminated as set forth herein. Unless otherwise stated in a SOW, Customer may terminate a SOW at any time for convenience by giving FireEye at least thirty (30) days’ written notice of its intent to terminate the SOW. If Customer terminates an SOW for convenience as set forth in this Section, Customer will pay any amounts owing for Professional Services and Deliverables provided under that SOW up to and including the date of termination. Customer may request that FireEye suspend performing Professional Services during the term of a Statement of Work, and FireEye will suspend such Professional Services within 24 hours of Customer’s request. Customer acknowledges that any such suspension will not affect Customer’s obligation to pay fees for Professional Services rendered through the date of suspension, and that Confidential FireEye Rev. 8/2016

Page 10 ends

resumption of Professional Services may be delayed if FireEye redeploys personnel to other engagements during the period of suspension.

12.2. Termination for Material Breach. Either party may terminate any Order or any SOW upon written notice of a material breach of the applicable Order or SOW by the other party as provided below, subject to a thirty (30) day cure period (“Cure Period”). If the breaching party has failed to cure the breach within the Cure Period after the receipt by the breaching party of written notice of such breach, the non-breaching party may give a second notice to the breaching party terminating the applicable Order or SOW. Termination of any particular Order or SOW under this Section will not be deemed a termination of any other Order or SOW, unless the notice of termination states that another Order or SOW is also terminated. Notwithstanding the foregoing, the Cure Period applicable to a breach by Customer of any payment obligations under any Order or any SOW will be fifteen (15) days. Notwithstanding the foregoing, this Agreement shall terminate automatically in the event Customer has breached any license restriction and, in FireEye’s determination, that breach cannot be adequately cured within the Cure Period.

12.3. Effect of Termination. Termination or expiration of any Order or SOW will not be deemed a termination or expiration of any other Orders or SOWs in effect as of the date of termination or expiration, and this Agreement will continue to govern and be effective as to those outstanding Orders and SOWs until those Orders and SOWs have expired or terminated by their own terms or as set forth herein. The provisions of Section 3 (Payment), Section 6 (Intellectual Property), Section 7.5 (Disclaimer of Warranties), 9 (Limitation of Liability), 10 (Export Control; Anti-Corruption; U.S. Government Restricted Rights), 12 (Confidential Information), and 13 (Miscellaneous), and all accrued payment obligations, shall survive the termination of all Orders and SOWs and the relationship between FireEye and Customer.

13. MISCELLANEOUS.

13.1. Assignment. Customer may not assign any Order or Statement of Work, or any rights or obligations thereunder, in whole or in part, without FireEye’s prior written consent, and any such assignment or transfer shall be null and void. FireEye shall have the right to assign all or part of an Order or Statement of Work without Customer’s approval. Subject to the foregoing, each Order and Statement of Work shall be binding on and inure to the benefit of the parties’ respective successors and permitted assigns.

13.2. Entire Agreement. This Agreement along with any Order, Statement of Work and the Exhibits attached hereto is the entire agreement of the parties with respect to the Offerings and supersedes all previous or contemporaneous communications, representations, proposals, commitments, understandings and agreements, whether written or oral, between the parties regarding the subject matter thereof. FireEye does not accept, expressly or impliedly and FireEye hereby rejects and deems deleted any additional or different terms or conditions that Customer presents, including, but not limited to, any terms or conditions contained or referenced in any order, acceptance, acknowledgement, or other document, or established by trade usage or prior course of dealing. This Agreement may be amended only in writing signed by authorized representatives of both parties.

13.3. Force Majeure. Neither party will be liable to the other for any delay or failure to perform any obligation under this Agreement (except for a failure to pay fees) if the delay or failure is due to unforeseen events, which occur after the signing of this Agreement and which are beyond the reasonable control of the parties, such as strikes, blockade, war, terrorism, riots, natural disasters, refusal of license by the government or other governmental agencies, in so far as such an event prevents or delays the affected party from fulfilling its obligations and such party is not able to prevent or remove the force majeure at reasonable cost.

13.4. Governing Law. This Agreement shall be deemed to have been made in, and shall be construed pursuant to the laws of the State of California and the United States without regard to conflicts of laws provisions thereof, and without regard to the United Nations Convention on the International Sale of Goods or the Uniform Computer Information Transactions Act. Any legal suit, action or proceeding arising out of or relating to the Offerings, the FireEye Materials, this Agreement, an Order or a Statement of Work will be commenced exclusively in a federal court in the Northern District of California or in state court in Santa Clara County, California, and each party hereto irrevocably submits to the jurisdiction and venue of any such court in any such suit, action or proceeding.

Confidential FireEye Rev. 8/2016

Page 11 ends

13.5. Independent Contractors. The parties are independent contractors. Nothing in this Agreement, any Order or any Statement of Work shall be construed to create a partnership, joint venture or agency relationship between the parties. Customer shall make no representations or warranties on behalf of FireEye.

13.6. Language. This Agreement and each Order and Statement of Work are in the English language only, which shall be controlling in all respects. All communications, notices, and Documentation to be furnished hereunder shall be in the English language only.

13.7. Notices. All notices required to be sent hereunder shall be in writing, addressed to receiving party’s current business contact, if known, with a cc: to the General Counsel/Legal Department of the receiving party, and sent to the party’s address as listed in this Agreement, or as updated by either party by written notice. Notices shall be effective upon receipt and shall be deemed to be received as follows: (i) if personally delivered by courier, when delivered; or (ii) if mailed by first class mail, or the local equivalent, on the fifth business day after posting with the proper address.

13.8. Severability. If any provision of this Agreement is held to be illegal, invalid or unenforceable under the laws of any jurisdiction, the provision will be enforced to the maximum extent permissible so as to effect the intent of the parties, and the remaining provisions of this Agreement will remain in full force and effect.

13.9. Third Party Rights. Other than as expressly set out in this Agreement, this Agreement does not create any rights for any person who is not a party to it and no person who is not a party to this Agreement may enforce any of its terms or rely on any exclusion or limitation contained in it.

13.10. Waiver. The waiver of a breach of any provision of this Agreement shall not constitute a waiver of any other provision or any subsequent breach.

13.11. Equal Opportunity. FireEye is committed to the provisions outlined in the Equal Opportunity Clauses of Executive Order 11246, the Rehabilitation Act of 1973, the Vietnam Era Veterans Readjustment Act of 1974, the Jobs for Veterans Act of 2003, as well as any other regulations pertaining to these orders.

Wherefore, the parties have caused this Master Purchase Agreement to be executed as of the Effective Date.

FIREEYE, INC.

Signature: _____________________________
Name: ________________________________
Title: __________________________________
Date: _________________________________

CUSTOMER
Signature: _____________________________
Name: ________________________________
Title: __________________________________
Date: _________________________________

FIREEYE IRELAND LIMITED
Signature: _____________________________
Name: ________________________________
Title: __________________________________
Date: _________________________________
Confidential FireEye Rev. 8/2016

Page 12 ends

EXHIBIT A

PRODUCT LICENSE AND SUPPORT TERMS
(FIREEYE NX, EX, AX, PX, FX, HX, SECURITY ORCHESTRATOR™, MVX SMART GRID, AND CENTRAL MANAGEMENT

SERIES (CMS) PRODUCTS)
The following terms apply to the FireEye NX, EX, AX, PX, FX, HX, Security Orchestrator, MVX Smart Grid, and Central Management Series (CMS) Products, including any add-on features such as FireEye Advanced Threat Intelligence (ATI).

1. Grant of License and Restrictions. Subject to the terms hereof, payment of all fees, and any applicable user/use limitations, FireEye grants Customer a personal, perpetual, nonsublicensable, nonexclusive, right to use the Product, in accordance with the Agreement and this Exhibit A. Customer will maintain the copyright notice and any other notices that appear on the Product, including any interfaces related to the Product. With respect to the FireEye HX Series Product, Customer may install the “agent” software component of the Product on the number of Nodes stated on the applicable Order. With respect to the FireEye EX Series Product, Customer may use the Product in connection with the number of attached URL engines (i.e., email accounts) (“Attached URL Engines”) stated on the applicable Order. FireEye reserves the right to audit Customer’s use of the Product to ensure compliance with this Agreement. “Nodes” are endpoint computing devices owned or controlled by Customer (such as laptops, workstations, and servers), on which Customer installs the agent software. Updates, preview features, Content Feeds and/or Support Services are not necessarily provided with the Software, may require additional payment or include additional terms and conditions, and may be provided on a “preview” basis for a limited period at no additional charge but then licensed for an additional fee at a later date.

Customer acknowledges that Third Party Software distributed with the Products may be subject to separate license terms, and specifically, if the Oracle™ Java® software is included within the Product, that software is subject to the license found at http://www.oracle.com/technetwork/java/javase/terms/license/index.html.

2. Content Feeds. Subject to Customer’s payment in full of all associated fees for the applicable FireEye Content Feed, as set forth on the applicable Order, FireEye shall grant a limited, non-exclusive, personal, nontransferable, non-sublicenseable right to use the Content Feed as set forth in the Documentation for the applicable Product, for Customer’s internal business purposes during the active Support Term for the applicable Product. FireEye shall not disclose to any third party any personally identifiable data or Customer Confidential Information in connection with the Content Feed unless expressly authorized to do so by Customer. The Content Feeds available to the Customer with respect to the Products may include:

2.1 FireEye Dynamic Threat Intelligence™ (DTI™) – The DTI Content Feed (currently available only for customers who have purchased the FireEye NX, EX, AX, HX or FX Product) provides continual, updated information to the Product about threats.

2.2. FireEye Advanced Threat Intelligence™ (ATI™) – The ATI Content Feed (currently available only for customers who have purchased the FireEye NX Product) provides contextual information about malware detected in Customer’s environment, such as information regarding threat groups associated with certain malware, industry verticals in which FireEye has observed certain threat groups operate and in which certain malware is used, and relative frequency of observation of various threats and malware.

3. Support Services. Subject to Customer’s payment in full of all associated fees for FireEye Support Services, FireEye shall provide Support Services for the Products as set forth in Exhibit C, as may be updated by FireEye in its discretion.

Confidential FireEye Rev. 8/2016

Page 13 ends

EXHIBIT B

SUBSCRIPTION TERMS
Confidential FireEye Rev. 8/2016

Page 14 ends

EXHIBIT B-1
SUBSCRIPTION TERMS FOR FIREEYE AS A SERVICE (FAAS) – CONTINUOUS PROTECTION The following terms govern the FireEye as a Service (FaaS) – Continuous Protection (CP) Subscription. 1 Definitions.

1.1 “Alert” means, individually and collectively, APT Alerts, High Priority Alerts, and Low Priority Alerts.

1.2 “APT Alert” means (a) with respect to Products other than HX, an alert generated by a Product, that is identified by the Product as being associated with a “targeted threat,” which means advanced persistent threat (APT) actors or APT activity; (b) with respect to the HX Product, an alert designated by HX as XPLT, EXC, or PRE, that is triggered by a FireEye standard Indicator; and (c) with respect to the TAP Subscription, an “APT Alert” means a TAP Alert designated as an “APT Alert” in the table in Section 1.11 below.

1.3 “APT Only Service” means the Subscription level in which FireEye will provide FaaS Reports and monitoring of APT Alert. If Customer purchases the APT Only Service, FireEye will provide FaaS Reports and monitoring of only APT Alerts, and not any other Alerts.

1.4 “Covered System” means (i) a computing device (to the extent supported by FireEye) that Customer specifies as within the scope of the CP Subscription, and if the Customer has purchased the HX Product, on which a software agent has been installed to support CP Subscription delivery, or (ii) a computing device (to the extent supported by FireEye) whose network traffic is observable to support CP Subscription delivery; (iii) with respect to ETP Subscriptions, mailboxes monitored to support CP Subscription delivery; or (iv) any computing device that both Customer and FireEye agree is within scope of the CP Subscription.

1.5 “Full Coverage Service” means the Subscription level in which FireEye will provide FaaS Reports and monitoring of all Alerts, regardless of the severity level of the Alert as classified by the Product.

1.6 “High Priority Alert Service” means the Subscription level in which FireEye will provide FaaS Reports and monitoring of High Priority Alerts and APT Alerts.

1.7 “FaaS Reports” means the written reports relating to Alerts that FireEye creates and makes available to Customer through the CP Subscription.

1.8 “High Priority Alert” means (a) with respect to Products other than HX and FX, an alert generated by that Product that is classified by that Product as severity level “critical” or “major”; (b) with respect to the FX Product, any alert generated by the FX Product, including APT Alerts; and (c) with respect to a TAP subscription, a TAP Alert designated as a “High Priority Alert” in the table in Section 1.11 below.

1.9 “Low Priority Alert” means an alert generated by a Product or TAP Subscription (as applicable) that is not an APT Alert or a High Priority Alert.

1.10 “Nodes” or “Node Band” refers to number of Covered Systems within the Customer environment, which is reflected on the Subscription Order.

1.11 “TAP Alert” means an alert generated by the TAP Subscription, with a severity level assigned by the TAP Subscription (e.g., “Critical,” “High,” “Medium”). TAP Alerts are investigated and reported on as “APT Alerts” and “High Priority Alerts” as shown in the table below, depending on the TAP Rule Pack that invoked the TAP Alert:

FireEye Rule Pack APT Alerts High Priority Alerts
Application Detection
Cloud Infrastructure
Commodity Malware All
Confidential FireEye Rev. 8/2016

Page 15 ends

Current Events Critical, High Critical, High
DTI Rules All
Exploit Kits All
FTP
Industrial Control Systems Critical, High, Medium Critical, High, Medium Intel Match Critical, High, Medium Critical, High, Medium Linux Critical, High
Malware Methodology Critical, High
Phishing Critical High Critical, High
Point of Sale All All
Security Tools Critical, High, Medium
Targeted Malware All All
Vendor – FireEye
Vulnerability Critical, High, Medium
Web Application Attacks Critical, High, Medium
Windows Critical, High

1.13 “TAP Rule Packs” means a predefined set of criteria that identifies suspicious events or threats based on the associated rule type within the TAP Subscription.
2 Scope of FaaS – Continuous Protection (CP) Subscription. During the Subscription Term, FireEye will provide the CP Subscription as set forth in this Section 2, according to the Subscription level purchased by Customer as set forth in the Subscription Order. If the Subscription Order does not specify the Subscription lvel purchased, then Customer will be deemed to have purchased the APT Only Service. All services Customer requests that are not described in this Section 2 will be performed at mutually agreed upon rates as set forth in Statements of Work. Unless otherwise specified, the CP Subscription is provided by FireEye personnel remotely accessing Customer’s environment from FireEye’s networks. The CP Subscription is available for the number of Nodes purchased (available for Customers who have purchased the FireEye NX, FX, or EX Product or the ETP or TAP Subscription). If the number of Nodes exceeds the amount reflected in the Subscription Order by more than ten percent (10%), FireEye will notify Customer in writing, and will issue an invoice for the next higher Node Band at FireEye’s then-current rates pro-rated for the remaining portion of the then-current Subscription Term.

2.1 Event Analysis.
(a) Time to Begin Analysis. FireEye will begin analysis of an Alert within the times set forth in the table below, calculated from the time the Alert was generated by the Product or TAP Subscription (as applicable). (b) Alerts Investigated. FireEye will investigate and report on the Alerts that correspond with the Subscription level the Customer purchased. If the Customer purchased the APT Only Service, FireEye will investigate and report on only APT Alerts. If the Customer purchased the High Priority Alerts Service, FireEye will investigate and report on only High Priority Alerts and APT Alerts. If the Customer purchased the All Alerts Service, FireEye will investigate and report on APT Alerts, High Priority Alerts, and Low Priority Alerts.

FireEye has no obligation to investigate and report on Alerts that fall outside the purchased Subscription level.
(c) Initial Investigation. FireEye analysts will perform an initial analysis of the Customer’s Covered Systems to determine if the Alert is a true or false positive, benign or suspicious activity. (d) FaaS Reports. If FireEye’s investigation determines that the Alert indicates a true compromise, FireEye will publish a FaaS Report to the FaaS Portal within one (1) hour of the time FireEye makes that determination.

Regardless of whether FireEye’s investigation determines that an Alert indicates a true compromise, FireEye will publish a FaaS Report on the Alert to the FaaS Portal within the times set forth in the table Confidential FireEye Rev. 8/2016

Page 16 ends

below, based on the classification of the Alert (APT Alert, High Priority Alert, Low Priority Alert). Customer acknowledges that in some cases, when FireEye’s investigation is not complete, a FaaS Report may provide only an update of current status of the Alert investigation.

Alerts Investigated (Level of
Service)
FaaS Alert
Classification
Time to
Begin
Investigation
(from time
Product or
TAP
Subscription
generates
Alert)
Time to
Publish FaaS
Report (from
time FireEye
validates
actual
compromise)
Time to Publish
FaaS Report
(when no
validation of
actual
compromise;
from time
Product or TAP
Subscription
generates
Alert)
APT Only
Service
High
Priority
Alerts
Service
Full
Coverage
Service
Yes Yes Yes APT Alert 1 hours 1 hour 24 hours
No Yes Yes High Priority
Alert
7 hours 1 hour 24 hours
No No Yes Low Priority
Alert
24 hours 1 hour 48 hours
The service levels noted in the table above will become effective thirty (30) days following the Order Effective Date, to allow time for Customer to install Products and for FireEye to determine the level of staffing needed to respond to Alerts in Customer’s environment. (e) Extended Investigations; Multiple Related Alerts. When FireEye has identified a true positive or suspicious activity, FireEye analysts may perform an extended investigation, and/or may aggregate and review multiple Alerts from related Covered Systems to determine the extent of activity related to the Alert.

FireEye analysts may append results from the extended investigation or subsequent Alert investigations to the initial FaaS Report if FireEye determines that additional or subsequent Alerts are related, and in such cases, FireEye will not be required to issue a separate FaaS Report for each such related Alert. (f) Non-Remediable Alerts. FireEye has no obligation to notify the Customer or generate a new FaaS Report on new Alerts that are directly related to previous investigations where a FaaS Report has been published and FireEye has provided recommended remediation steps, when the Customer has acknowledged the FaaS Report but chooses not to or cannot remediate the cause of these Alerts. (g) Alert Priority. FireEye may re-prioritize Alerts, regardless of their severity classification, to provide focus to Alerts that FireEye determines may have the largest impact to the Customer’s environment. (h) Continuity of Monitoring. All monitoring, investigation and reporting activities described in this Section 2.1 will be provided on a 24/7/365 basis.

2.2 System Health Monitoring and Notification. For Customers who have purchased the FireEye NX, EX, or FX Product, FireEye will provide Customer with notifications of system health issues such as connectivity problems.

2.3 Containment. When the Customer has purchased the HX Product, FireEye may, when appropriate, recommend containment of the target Covered System from the Customer’s network. Containment must be executed by the Customer.

2.4 Portal Access. Alerts and FaaS Reports will be provided via an online portal (“FaaS Portal”), and FireEye will provide login credentials to the Customer to enable access to the FaaS Portal. The FaaS Portal will be available 99.9% of the time in any calendar month, other than Downtime, as defined below, and this FaaS Portal Service Level commitment will be subject to the Service Level Credits set forth in Section 3 below.

Confidential FireEye Rev. 8/2016

Page 17 ends

2.5 FireEye Intelligence Center. During the Subscription Term, FireEye will provide access to the FireEye Intelligence Center (FIC), which includes the Community Threat Intelligence (CTI) platform, subject to the following:
(a) Permitted Use; Reports. Customer may access, view and use FIC and content appearing on FIC (“FIC Content”) solely for internal use. Some features of FIC may allow Customer to generate a report (each, a “FIC Report”). FIC Reports and FIC Content are FireEye IP. Subject to Customer’s payment obligations, FireEye grants to Customer a limited, non-exclusive right to produce FIC Reports using FIC, and reproduce and distribute those FIC Reports and FIC Content internally for Customer’s own business purposes.
(b) Additional Use Limitations. Customer may appoint up to fifteen (15) users of FIC at any time. Each day, all users on Customer’s account may collectively make up to (A) one hundred (100) queries of IP addresses and domain names and (B) one hundred (100) queries of malware. Customer may request additional queries, to be evaluated by FireEye on a case by case basis. (c) User Content. “User Content” means any communications, images, sounds, and all the material and information that Customer or anyone using Customer’s account contributes to or through FIC, including any contributions to or through the CTI platform (e.g., comments to FIC Content, suspected malware that Customer uploads to FIC). Customer hereby grants FireEye a perpetual, irrevocable, worldwide, paid-up, non-exclusive, license, including the right to sublicense to third parties, and right to reproduce, fix, adapt, modify, translate, reformat, create derivative works from, publish, distribute, sell, license, transmit, publicly display, publicly perform, or provide access to electronically, broadcast, display, perform, and use and practice such User Content as well as all modified and derivative works thereof.

Customer represents that Customer has all necessary rights to grant the license referenced in the preceding sentence. FireEye may use and disclose any of the information it collects about its customers’ use of FIC, including CTI, to the extent such information is de-identified. (d) Restrictions. Customer may not access FIC by any means other than through the interface that is provided or approved by FireEye. Customer will not collect any information from or through FIC using any automated means, including without limitation any script, spider, “screen scraping,” or “database scraping” application, and Customer will not damage, disable, overburden, or impair FIC or interfere with any other party’s use and enjoyment of FIC.
(e) Customer acknowledges that some optional features and content appearing on FIC may require payment of additional fees.

2.6 Reseller and Partner Purchases. If Customer receives the Subscription via a FireEye authorized services or support partner (a “Partner”), Customer agrees that the Subscription and FaaS Reports may be delivered to Customer through the Partner. Notwithstanding any other confidentiality obligations between the parties, Customer authorizes FireEye to disclose information related to the Subscription and Customer Data to Partner.

2.7 Customer Networks. The Subscription may only be provided for computer systems and networks leased to or owned by Customer, and under Customer’s control, up to the number of Nodes allowed, as set forth in the applicable Subscription Order.

2.8 Connectivity Requirements. Unless otherwise specified, the Subscription are provided by FireEye personnel remotely accessing Customer’s environment from FireEye’s networks. Customer must provide outbound TCPbased connectivity from all Products to FireEye for the establishment of a virtual private network (VPN). Details pertaining to specific network access requirements will be established in conjunction with installation activities.

2.9 Credential Security. Customer will be responsible for the following: (a) providing accurate information to FireEye for provisioning access to (and removal of) Customer personnel access to the FaaS Portal; (b) implementing and adhering to strong password standards; (c) providing accurate information to FireEye for domain whitelisting; and (d) reporting any security issues related to the Subscription (including the FaaS Portal) to FireEye immediately.

2.10 Exclusions. Notwithstanding anything else contained in this Agreement to the contrary, FireEye shall have no obligation or responsibility to provide the Subscription for (i) Products for which Customer does not have an active Subscription in place; (ii) Products that the Customer (or FireEye or another third party on Customer’s behalf) has configured with a one-way feed of FireEye’s Dynamic Threat Intelligence (DTI) Subscription; (iii)

Confidential FireEye Rev. 8/2016

Page 19 ends

EXHIBIT B-2
SUBSCRIPTION TERMS FOR FIREEYE AS A SERVICE (FAAS) – CONTINUOUS VIGILANCE The following terms govern the FireEye as a Service (FaaS) – Continuous Vigilance (CV) Subscription. 3 Definitions.

3.1 “Alert” means, individually and collectively, APT Alerts, High Priority Alerts, and Low Priority Alerts.

3.2 “APT Alert” means (a) with respect to Products other than HX, an alert generated by a Product, that is identified by the Product as being associated with a “targeted threat,” which means advanced persistent threat (APT) actors or APT activity; (b) with respect to the HX Product, an alert designated by HX as XPLT, EXC, or PRE, that is triggered by a FireEye standard Indicator; and (c) with respect to the TAP Subscription, an “APT Alert” means a TAP Alert designated as an “APT Alert” in the table in Section 1.11 below.

3.3 “APT Only Service” means the Subscription level in which FireEye will provide FaaS Reports and monitoring of APT Alert. If Customer purchases the APT Only Service, FireEye will provide FaaS Reports and monitoring of only APT Alerts, and not any other Alerts.

3.4 “Covered System” means (i) a computing device (to the extent supported by FireEye) that Customer specifies as within the scope of the CV Subscription, and if the Customer has purchased the HX Product, on which a software agent has been installed to support CV Subscription delivery, or (ii) a computing device (to the extent supported by FireEye) whose network traffic is observable to support CV Subscription delivery; (iii) with respect to ETP Subscriptions, mailboxes monitored to support CV Subscription delivery; or (iv) any computing device that both Customer and FireEye agree is within scope of the CV Subscription.

3.5 “Full Coverage Service” means the Subscription level in which FireEye will provide FaaS Reports and monitoring of all Alerts, regardless of the severity level of the Alert as classified by the Product.

3.6 “High Priority Alert Service” means the Subscription level in which FireEye will provide FaaS Reports and monitoring of High Priority Alerts and APT Alerts.

3.7 “FaaS Reports” means the written reports relating to Alerts that FireEye creates and makes available to Customer through the CV Subscription.

3.8 “High Priority Alert” means (a) with respect to Products other than HX and FX, an alert generated by that Product that is classified by that Product as severity level “critical” or “major”; (b) with respect to the FX Product, any alert generated by the FX Product, including APT Alerts; and (c) with respect to a TAP subscription, a TAP Alert designated as a “High Priority Alert” in the table in Section 1.11 below.

3.9 “Low Priority Alert” means an alert generated by a Product or TAP Subscription (as applicable) that is not an APT Alert or a High Priority Alert.

3.10 “Nodes” or “Node Band” refers to number of Covered Systems within the Customer environment, which is reflected on the Subscription Order.

3.11 “TAP Alert” means an alert generated by the TAP Subscription, with a severity level assigned by the TAP Subscription (e.g., “Critical,” “High,” “Medium”). TAP Alerts are investigated and reported on as “APT Alerts” and “High Priority Alerts” as shown in the table below, depending on the TAP Rule Pack that invoked the TAP Alert:

FireEye Rule Pack APT Alerts High Priority Alerts
Application Detection
Cloud Infrastructure
Commodity Malware All
Confidential FireEye Rev. 8/2016

Page 20 ends

1.13 “TAP Rule Packs” means a predefined set of criteria that identifies suspicious events or threats based on the associated rule type within the TAP Subscription.
2 Scope of FaaS – Continuous Vigilance (CV) Subscription. During the Subscription Term, FireEye will provide the CV Subscription as set forth in this Section 2, according to the Subscription level purchased by Customer as set forth in the Subscription Order. If the Subscription Order does not specify the Subscription lvel purchased, then Customer will be deemed to have purchased the APT Only Service. All services Customer requests that are not described in this Section 2 will be performed at mutually agreed upon rates as set forth in Statements of Work. Unless otherwise specified, the CV Subscription is provided by FireEye personnel remotely accessing Customer’s environment from FireEye’s networks. The CV Subscription is available for the number of Nodes purchased (available for Customers who have purchased the FireEye NX, FX, or EX Product or the ETP or TAP Subscription). If the number of Nodes exceeds the amount reflected in the Subscription Order by more than ten percent (10%), FireEye will notify Customer in writing, and will issue an invoice for the next higher Node Band at FireEye’s then-current rates pro-rated for the remaining portion of the then-current Subscription Term.

2.1 Event Analysis.
(e) Time to Begin Analysis. FireEye will begin analysis of an Alert within the times set forth in the table below, calculated from the time the Alert was generated by the Product or TAP Subscription (as applicable). (f) Alerts Investigated. FireEye will investigate and report on the Alerts that correspond with the Subscription level the Customer purchased. If the Customer purchased the APT Only Service, FireEye will investigate and report on only APT Alerts. If the Customer purchased the High Priority Alerts Service, FireEye will investigate and report on only High Priority Alerts and APT Alerts. If the Customer purchased the All Alerts Service, FireEye will investigate and report on APT Alerts, High Priority Alerts, and Low Priority Alerts.

FireEye has no obligation to investigate and report on Alerts that fall outside the purchased Subscription level.
(g) Initial Investigation. FireEye analysts will perform an initial analysis of the Customer’s Covered Systems to determine if the Alert is a true or false positive, benign or suspicious activity. (h) FaaS Reports. If FireEye’s investigation determines that the Alert indicates a true compromise, FireEye will publish a FaaS Report to the FaaS Portal within one (1) hour of the time FireEye makes that determination.

Page 21 ends

FireEye analysts may append results from the extended investigation or subsequent Alert investigations to the initial FaaS Report if FireEye determines that additional or subsequent Alerts are related, and in such cases, FireEye will not be required to issue a separate FaaS Report for each such related Alert. (f) Non-Remediable Alerts. FireEye has no obligation to notify the Customer or generate a new FaaS Report on new Alerts that are directly related to previous investigations where a FaaS Report has been published and FireEye has provided recommended remediation steps, when the Customer has acknowledged the FaaS Report but chooses not to or cannot remediate the cause of these Alerts. (g) Alert Priority. FireEye may re-prioritize Alerts, regardless of their severity classification, to provide focus to Alerts that FireEye determines may have the largest impact to the Customer’s environment. (h) Hunting. FireEye will conduct periodic proactive hunting techniques on Covered Systems to look for additional indicators of malicious or attacker activity. When FireEye’s investigation reveals a compromise, then within one (1) hour of the time FireEye makes that determination, FireEye will publish a FaaS Report related to that activity to the FaaS Portal. (i) Continuity of Monitoring. All monitoring, investigation and reporting activities described in this Section 2.1 will be provided on a 24/7/365 basis.

Page 22 ends

available 99.9% of the time in any calendar month, other than Downtime, as defined below, and this FaaS Portal Service Level commitment will be subject to the Service Level Credits set forth in Section 3 below.

2.5 FireEye Intelligence Center. During the Subscription Term, FireEye will provide access to the FireEye Intelligence Center (FIC), which includes the Community Threat Intelligence (CTI) platform, subject to the following:
(f) Permitted Use; Reports. Customer may access, view and use FIC and content appearing on FIC (“FIC Content”) solely for internal use. Some features of FIC may allow Customer to generate a report (each, a “FIC Report”). FIC Reports and FIC Content are FireEye IP. Subject to Customer’s payment obligations, FireEye grants to Customer a limited, non-exclusive right to produce FIC Reports using FIC, and reproduce and distribute those FIC Reports and FIC Content internally for Customer’s own business purposes.
(g) Additional Use Limitations. Customer may appoint up to fifteen (15) users of FIC at any time. Each day, all users on Customer’s account may collectively make up to (A) one hundred (100) queries of IP addresses and domain names and (B) one hundred (100) queries of malware. Customer may request additional queries, to be evaluated by FireEye on a case by case basis. (h) User Content. “User Content” means any communications, images, sounds, and all the material and information that Customer or anyone using Customer’s account contributes to or through FIC, including any contributions to or through the CTI platform (e.g., comments to FIC Content, suspected malware that Customer uploads to FIC). Customer hereby grants FireEye a perpetual, irrevocable, worldwide, paid-up, non-exclusive, license, including the right to sublicense to third parties, and right to reproduce, fix, adapt, modify, translate, reformat, create derivative works from, publish, distribute, sell, license, transmit, publicly display, publicly perform, or provide access to electronically, broadcast, display, perform, and use and practice such User Content as well as all modified and derivative works thereof.

Customer represents that Customer has all necessary rights to grant the license referenced in the preceding sentence. FireEye may use and disclose any of the information it collects about its customers’ use of FIC, including CTI, to the extent such information is de-identified. (i) Restrictions. Customer may not access FIC by any means other than through the interface that is provided or approved by FireEye. Customer will not collect any information from or through FIC using any automated means, including without limitation any script, spider, “screen scraping,” or “database scraping” application, and Customer will not damage, disable, overburden, or impair FIC or interfere with any other party’s use and enjoyment of FIC.
(j) Customer acknowledges that some optional features and content appearing on FIC may require payment of additional fees.

2.8 Connectivity Requirements. Unless otherwise specified, the Subscription are provided by FireEye personnel remotely accessing Customer’s environment from FireEye’s networks. Customer must provide outbound TCVbased connectivity from all Products to FireEye for the establishment of a virtual private network (VPN). Details pertaining to specific network access requirements will be established in conjunction with installation activities.

Confidential FireEye Rev. 8/2016

Page 24 ends

3.2.4 Customer shall not be entitled to receive a Credit that exceeds 10% of its prorated monthly Subscription Fee for a Service Outage for the applicable calendar month.

Confidential FireEye Rev. 8/2016

Page 25 ends

EXHIBIT B-3

SUBSCRIPTION TERMS FOR FIREEYE THREAT ANALYTICS PLATFORM (TAP) The following terms govern the Threat Analytics Platform Subscription, including purchase and support of TAP Cloud Collector™ Appliances and Support.

1. TAP Software, Alerts

1.1.1 TAP Software and Hardware. As part of the TAP Subscription, FireEye may deliver to Customer one or more software files (individually and collectively, “TAP Software”), and/or one or more “Cloud Collector” hardware appliances (“Cloud Collector Appliances”), which may contain TAP Software. Subject to full payment of all Fees associated with the TAP Subscription, FireEye grants to Customer a non-exclusive, limited right and license to install and run the TAP Software during the Subscription Term solely for purposes of using the TAP Subscription in accordance with the Documentation for the TAP Subscription.

1.1.2 Access; Customer Logs. FireEye will provide Customer with credentials to enable access to the TAP Subscription. Using the TAP Software, and subject to payment of Fees for the TAP Subscription and any Cloud Collector Appliances, Customer may upload Customer Logs to the TAP portal (“TAP Portal”). “Customer Logs” means any communications, logs and other content and information that Customer or anyone using Customer’s account contributes to or through the TAP Portal. Customer grants to FireEye a perpetual, irrevocable, worldwide, paid-up, non-exclusive license and right to reproduce, modify, create derivative works from, publish, distribute, sell, sub-license, transmit, publicly display and provide access to Customer Logs, for purposes of enhancing FireEye’s products and services, so long as (i) FireEye ensures that any Customer Confidential Information is removed from Customer Logs, and (ii) FireEye’s use of Customer Logs does not in any way identify Customer or its employees or in any other way allow a third party to identify Customer as the source of the Customer Logs.

Customer Logs are Customer’s property, and other than the licenses granted in herein, FireEye does not obtain any ownership rights in Customer Logs.

1.1.3 TAP Alerts. Some features of the TAP Subscription may generate alerts of suspected malicious activity (each, a “TAP Alert”). TAP Alerts are FireEye Materials. FireEye hereby grants to Customer a limited, non-exclusive right to use TAP Alerts, and reproduce and distribute those TAP Alerts internally for Customer’s own business purposes.

1.1.4 Cloud Collector Management. If Customer has installed Cloud Collectors in connection with the TAP Subscription, then FireEye will continuously monitor the Customer’s Cloud Collector Appliances or Cloud Collector TAP Software for system health issues such as monitoring to ensure proper throughput and relay of data.

1.1.5 Cloud Collector Appliances. If the Customer has purchased Cloud Collector Appliances, then during the TAP Subscription Term, FireEye will replace any defective Cloud Collector Appliances as follows:
a) Prior to any return, Customer shall verify that the Cloud Collector Appliance at issue is defective by logging a Support request via one of the mechanisms provided in the Documentation and in accordance with FireEye’s RMA procedures, including providing the part number, serial number, quantity and reason for return, an explanation of all failure symptoms and other relevant information. b) Upon confirmation by FireEye of a defect, Customer shall obtain from FireEye an RMA number. FireEye shall ship via a recognized express courier service a replacement Cloud Collector Appliance to Customer to arrive no later than next business day after FireEye’s issuance of an RMA number, provided the RMA number was issued prior to the business day cutoff time local to the defective Cloud Collector Appliance, provided the replacement does not require any custom pre-configuration, and provided no external-toFireEye circumstances prevent the delivery. The replacement Cloud Collector Appliance may be a new or reconditioned Cloud Collector Appliance (of equivalent or better quality) at FireEye’s sole discretion. c) FireEye shall pay the shipping costs to ship the replacement Cloud Collector Appliance to Customer, but Customer shall bear any and all risk of loss of or damage to said Cloud Collector Appliance at all times after said Cloud Collector Appliance is made available by FireEye to the common carrier.

Confidential FireEye Rev. 8/2016

Page 26 ends

d) Within five (5) business days after Customer receives the replacement Cloud Collector Appliance from FireEye, Customer shall package the defective Cloud Collector Appliance in its original packing material or equivalent, write the RMA number on the outside of the package and return the defective Cloud Collector Appliance, at FireEye’s cost (provided Customer utilizes FireEye’s designated courier service and properly packages the defective Cloud Collector Appliance according to FireEye’s instructions), shipped properly insured, FOB FireEye’s designated facility. Customer shall enclose with the returned Cloud Collector Appliance the applicable RMA form, and any other documentation or information requested by FireEye customer support. Customer shall assume any and all risk of loss of or damage to such Cloud Collector Appliance during shipping. Title to the defective Cloud Collector Appliance shall pass to FireEye upon FireEye’s receipt thereof.
e) When a replacement Cloud Collector Appliance is provided and Customer fails to return the defective Cloud Collector Appliance to FireEye within ten (10) business days after Customer receives the replacement Cloud Collector Appliance from FireEye, FireEye may charge Customer, and Customer shall pay for the replacement Cloud Collector Appliance at the then-current list price.

2. Event Volume; True-Up

2.1.1 Fees for the TAP Subscription are divided into “Tiers” based on the volume of events processed through the TAP Subscription per second (“Event Volume”). If at any point during the Subscription Term, Customer’s Event Volume exceeds the Tier upon which Customer’s TAP Subscription Fees were based, FireEye will not guarantee that Customer Logs in excess of the purchased Tier will be ingested and processed by the TAP Subscription. In times of Event Volume in excess of the paid Tier, Customer Logs will enter a queue. Excessive queueing may cause Customer Logs to be lost from the queue. If at any point during the Subscription Term, Customer’s average Event Volume for any consecutive thirty-day period exceeds the Tier upon which Customer’s TAP Subscription Fees were based, FireEye may issue a true-up invoice for the pro-rated difference between the Fees already paid for that Subscription Term and FireEye’s list prices for the Fees for the Tier associated with Customer’s actual Event Volume for that thirty-day period, pro-rated to reflect that thirty-day period and the remainder of the Subscription Term. FireEye will apply any discounts that were applied to initial Fees to FireEye’s list prices for any true-up invoice.

Until such time that the True Up invoice is paid in full, the TAP Subscription will continue to ingest and process only the Event Volume of the purchased Tier, allowing any excess Customer Logs to enter queueing conditions. The Tier for any Renewal Subscription Term will be the Tier associated with the actual Event Volume for the immediately preceding Subscription Term.

2.1.2 At the end of the Initial Subscription Term and each Renewal Subscription Term, FireEye may true-up Fees for that Subscription Term, and if the average monthly Event Volume for that Subscription Term exceeds the maximum Event Volume for the Tier for which Customer previously paid Fees, then (a) FireEye will issue a true-up invoice reflecting the difference between the Fees already paid for that Subscription Term and the Fees for the Tier associated with Customer’s actual Event Volume.

3. TAP Portal Availability

3.1 FireEye shall undertake commercially reasonable efforts to ensure the TAP Portal availability for 99.9% of the time during each calendar month.

3.1.1 “Service Outage” is where the TAP Portal is not available due to a failure or a disruption in TAP Portal that is not the result of Scheduled Maintenance, Emergency Maintenance, a force majeure event or of the act or omission of Customer.

3.1.2 “Scheduled Maintenance Period" is the period during which weekly scheduled maintenance of the TAP Portal may be performed, or a maintenance window otherwise mutually agreed upon by FireEye and Customer.

3.1.3 "Emergency Maintenance" means any time outside of Scheduled Maintenance that FireEye is required to apply critical patches or fixes or undertake other urgent maintenance. If Emergency Maintenance is required, FireEye will contact Customer and provide the expected time frame of the Emergency Maintenance and availability of the TAP Portal during the Emergency Maintenance.

Confidential FireEye Rev. 8/2016

Page 28 ends

iv. Restrictions. Customer may not access FIC by any means other than through the interface that is provided or approved by FireEye. Customer will not collect any information from or through FIC using any automated means, including without limitation any script, spider, “screen scraping,” or “database scraping” application, and Customer will not damage, disable, overburden, or impair FIC or interfere with any other party’s use and enjoyment of FIC.
v. Customer acknowledges that some optional features and content appearing on FIC may require payment of additional fees.

Confidential FireEye Rev. 8/2016

Page 29 ends

EXHIBIT B-4
SUBSCRIPTION TERMS FOR FIREEYE EMAIL THREAT PREVENTION (ETP) and MOBILE THREAT PREVENTION (MTP) The following terms govern the Email Threat Prevention Subscription and Mobile Threat Prevention Subscription.

1. Definitions.
“Cloud Subscription" means the online, web-based applications and platform which is made accessible to Customer by FireEye via a designated website, which includes the associated offline Software components to be used in connection with FireEye Mobile Threat Prevention and/or FireEye Email Threat Prevention. FireEye Mobile Threat Prevention (“MTP”) and FireEye Email Threat Prevention (“ETP”) are separate Cloud Subscriptions and usage is conditional on what the Customer has indicated on an Order. “Customer Data” means data, information, applications, and any other items originated by Customer that Customer submits to the Cloud Subscription.
“Customer Representatives” means any employee or contractor of Customer or Mobile Device Manager to whom Customer provides access to the Cloud Subscriptions (or any component thereof, including Software) for use on behalf of and for the benefit of the Customer and for Customer’s internal business purposes, subject to all the terms and conditions of this Agreement.
“Licensed Device” means (i) with respect to MTP, the registered devices that Customer may have at any time that are registered to the Cloud Subscription; which maximum number shall be based on the subscription fees paid by Customer and identified on the relevant purchase order from Customer as approved and invoiced by FireEye; and (ii) with respect to ETP, the number of email inboxes Customer may have at any time that are registered to the Cloud Subscription; which maximum number shall be based on the subscription fees paid by Customer and identified on the relevant purchase order from Customer as approved and invoiced by FireEye.

For the avoidance of doubt, with respect to MTP, “registered devices” are those devices which have loaded device Software and which have been registered to the Cloud Subscription and which have not been retired (meaning unregistered).
“Mobile Device Manager” shall mean a third party who has been engaged by the Customer to provide security services for Licensed Devices for the benefit of Customer. Where indicated as such, the Mobile Device Manager shall be a subset of the definition of the Customer Representatives solely as applicable to MTP. “Software” means the object code version of FireEye’s proprietary computer programs delivered to Customer hereunder for use in connection with the Cloud Subscriptions, including collectively and individually the deviceside software used on devices registered to the Cloud Subscription (“Device Software”) and any connector software and/or any other server-side software (collectively the “Premise Software”) , each which are delivered to Customer hereunder for use in connection with the Cloud Subscriptions, and any Documentation, backup copies and updates, upgrades, maintenance releases, bug fixes to any of the forgoing provided to Customer hereunder.

2. Right of Access and Use. During the Subscription Term, and subject to the terms of this Agreement, FireEye grants to Customer a non-exclusive right to (a) permit those Customer Representatives authorized by Customer to access and use the Cloud Subscriptions on Customer's behalf in compliance with the terms of this Agreement, and (b) to install, copy and use Premise Software in connection with Cloud Subscriptions in accordance with the Agreement and this Exhibit, but solely on systems and hardware owned or controlled or otherwise managed by Customer on behalf of and for the benefit of Customer, (c) to install, copy and use Device Software in connection with Cloud Subscriptions in accordance with the Documentation, but solely on devices used by Customer Representatives on behalf of and for the benefit of Customer. Notwithstanding anything else herein, the number of devices Customer and/or Customer Representatives may register to the Cloud Subscriptions may not exceed the number of Licensed Devices.

Notwithstanding anything to the contrary herein, if Customer is using the Cloud Subscriptions for evaluation purposes then such Customer usage is solely for internal testing and evaluation and the Subscription Term shall not exceed fifteen (15) days unless otherwise mutually agreed upon in a signed Evaluation License Agreement.

Confidential FireEye Rev. 8/2016

Page 30 ends

3. Restrictions. Except as otherwise expressly permitted under this Agreement, Customer agrees that it shall not, nor shall it permit any third party to, (a) use the Cloud Subscriptions (or any portion thereof) in excess of or beyond the Subscription Term, the Licensed Device quantity, and/or other restrictions/limitations described in this Agreement; use the Cloud Subscriptions to store or transmit infringing, libelous, or otherwise unlawful or tortious material, or to store or transmit material in violation of third-party privacy or other rights; (d) interfere with or disrupt the integrity or performance of the Cloud Subscriptions or third-party data contained therein; (e) use the Software on equipment or devices which are not specified in the Documentation; (f) Cloud Subscription specific to ETP Cloud Subscriptions, Customer shall route email through a commercially available secure email gateway for anti-spam scanning prior to relay through the FireEye network. No rights or licenses are granted other than as expressly and unambiguously set forth herein. Customer access and usage for the Cloud Subscriptions is limited to the MTP or ETP Subscription that has been paid or are being evaluated by the Customer.

4. Updates, Malware Detection Content and Support Services. Updates and malware detection content and/or support services are not necessarily provided with the Software or Subscriptions, and may require additional payment or include additional terms and conditions. However, to the extent that an update to the Software and/or malware detection content is provided, such update/content shall be deemed “Software” provided subject to this Agreement. If malware detection content/support services are provided, FireEye reserves the right to change the scope or duration of such services at anytime, and to access, freely use and distribute data collected from Customer through such services. If such services are made available, Customer may be required to pay fees or other charges for use or access to some or all such services, which fees and terms will be specified in the invoice or order form for such service.

5. Device Count Increases; Reporting; Invoice. If the number of devices that Customer or Customer Representatives have registered to the Cloud Subscription (“Actual Device Count”) exceeds Customer’s then current Licensed Device count or if Customer wishes to increase the Licensed Device count, then Customer shall notify FireEye (or the applicable FireEye Partner) and submit an Order for the incremental Subscription Fees due, and upon receipt of such Order, the Licensed Device count shall be amended to reflect this change. Upon written request, Customer will provide FireEye a report identifying (i) the Actual Devices; (ii) the copies of and location of the Premise Software maintained; and (iii) any other information reasonably requested by FireEye at the time as it relates to the use of the Cloud Subscription to determine compliance with the terms of this Agreement. FireEye and/or its Authorized Resellers may invoice Customer if it learns of any shortfalls, i.e. that the Licensed Device Count is below the Actual Device count. The fees charged to Customer for increases in License Device counts will be based on the then-current Subscription Term pricing.

6. Cloud Subscription Availability

6.1 FireEye shall undertake commercially reasonable efforts to ensure the Cloud Subscription availability for

99.9% of the time during each calendar month.

6.1.1 “Service Outage” is where the Customer is not receiving Cloud Subscription due to a failure or a disruption in the Cloud Subscriptions and is not the result of Scheduled Maintenance, Emergency Maintenance, a force majeure event or of the act or omission of Customer.

6.1.2 “Scheduled Maintenance Period" is the period during which weekly scheduled maintenance of the Cloud Subscriptions may be performed, or a maintenance window otherwise mutually agreed upon by FireEye and Customer.

6.1.3 "Emergency Maintenance" means any time outside of Scheduled Maintenance that FireEye is required to apply critical patches or fixes or undertake other urgent maintenance. If Emergency Maintenance is required, FireEye will contact Customer and provide the expected time frame of the Emergency Maintenance and availability of the Cloud Subscriptions during the Emergency Maintenance.

6.1.4 "System Availability" means the percentage of total time during which the Cloud Subscriptions shall be available to Customer, excluding the Scheduled Maintenance Period, Emergency Maintenance, force majeure events, or acts or omissions of the Customer that cause system downtime.

Confidential FireEye Rev. 8/2016

Page 32 ends

EXHIBIT B-5
SUBSCRIPTION TERMS FOR FIREEYE ADVANCED THREAT INTELLIGENCE PLUS (ATI+) The following terms govern the Advanced Threat Intelligence Plus (ATI+) Subscription.

The ATI+ Subscription comprises two features: Continuous Monitoring (“CM” or “Continuous Monitoring”) and the FireEye Intelligence Center™ (FIC™) (“FIC”).

1. Continuous Monitoring
The Continuous Monitoring portion of the Subscription is purchased in connection with one or more FireEye Products, and includes the following during the Subscription Term for the specific Products for which Continuous Monitoring was purchased (some Products may not be eligible for CM):
(a) Critical Event Notification. For Customers who have purchased the FireEye NX, FX, HX or EX Product, MVX Smart Grid with Network Smart node product combination, or the ETP or TAP Subscription, FireEye will provide Customer with proactive notifications of events FireEye determines to be critical that are logged by the Products (“Alerts”). FireEye will also provide Customer with access to a detailed description of the Alert. Alerts are not proof of vulnerability, threats or attacks on Customer. (b) System Health Monitoring and Notification. For Customers who have purchased the FireEye NX, EX, FX, HX AX or FX Product, or MVX Smart Grid w/Network Smart node combination (hardware only), FireEye will provide Customer with proactive notifications of serious system health issues related to the hardware for Products covered by Continuous Monitoring. Customers will also be provided with metrics on critical event notifications and, for purchased hardware, the status of monitored hardware parameters. (c) Portal Access. Alerts and critical event notifications from Continuous Monitoring will be provided via an online portal, and FireEye will provide login credentials to the Customer to enable access to that portal. (d) Continuity of Monitoring. The monitoring activities described in (a)-(c) above will be provided on a 24/7 basis.
(f) Reseller and Partner Purchases. If Customer receives the Subscription via a FireEye Partner, Customer agrees that the Subscription may be delivered to Customer through the Partner. Notwithstanding any other confidentiality obligations between the parties, Customer authorizes FireEye to disclose information related to the Subscription to the Partner.
(g) Exclusions. Notwithstanding anything else contained in this Agreement to the contrary, FireEye shall have no obligation or responsibility to provide the Subscription for (i) Products for which Customer does not have an active Subscription in place; (ii) Products that the Customer (or FireEye or another third party on Customer’s behalf) has configured with a one-way feed of FireEye’s Dynamic Threat Intelligence subscription; (iii) Products with an installed FireEye operating system less than version 6.2; (iv) Products that are end of life; (v) Products that have no active support service in place; (vi) Products for which software updates have not been applied; or (vii) Products that have not been installed and deployed.

2. FireEye Intelligence Center™ (FIC™), Community Threat Intelligence™ (CTI™) FireEye will provide the FIC portion of the Subscription, which includes the Community Threat Intelligence (CTI) platform, during the Subscription Term, as set forth below:

2.1 Permitted Use; Reports. Customer may view and use FIC and content appearing on FIC (“FIC Content”) solely for internal use. Some features of FIC may allow Customer to generate a report (each, a “FIC Report”).

FIC Reports and FIC Content are FireEye Materials. Subject to Customer’s payment obligations, FireEye grants to Customer a limited, non-exclusive right to produce FIC Reports and FIC Content using FIC, and reproduce and distribute those FIC Reports and FIC Content internally for Customer’s own business purposes.

Confidential FireEye Rev. 8/2016

Page 33 ends

2.2 Additional Use Limitations. Customer may appoint up to fifteen (15) users of FIC at any time. Each day, all users on Customer’s account may collectively make up to (i) one hundred (100) queries of IP addresses and domain names, and (ii) one hundred (100) queries of malware per day. Customer may request additional queries, to be evaluated by FireEye on a case by case basis.

2.3 User Content. “User Content” means any communications, images, sounds, and all the material and information that Customer or anyone using Customer’s account contributes to or through FIC including any contributions to or through the CTI platform. Customer hereby grants FireEye a perpetual, irrevocable, worldwide, paid-up, non-exclusive, license, including the right to sublicense to third parties, and right to reproduce, fix, adapt, modify, translate, reformat, create derivative works from, publish, distribute, sell, license, transmit, publicly display, publicly perform, or provide access to electronically, broadcast, display, perform, and use and practice such User Content as well as all modified and derivative works thereof. Customer represents that Customer has all necessary rights to grant the license referenced in the preceding sentence. FireEye may use and disclose any of the information it collects about its customers’ use of FIC, including the CTI platform to the extent such information is de-identified.

2.4 Restrictions. Customer may not access FIC by any means other than through the interface that is provided or approved by FireEye. Customer will not collect any information from or through FIC using any automated means, including without limitation any script, spider, “screen scraping,” or “database scraping” application, and Customer will not damage, disable, overburden, or impair FIC or interfere with any other party’s use and enjoyment of FIC. Customer acknowledges that some optional features and content appearing on FIC may require payment of additional fees.

Confidential FireEye Rev. 8/2016

Page 34 ends

EXHIBIT B-6
SUBSCRIPTION TERMS FOR FIREEYE INTELLIGENCE CENTER™ (FIC™) (INCLUDING COMMUNITY THREAT INTELLIGENCE™ (CTI™))
The following terms govern the FireEye Intelligence Center™ (FIC™) Subscription, which includes access to the Community Threat Intelligence™ (CTI™) platform.

1. During the Subscription Term, FireEye will provide access to the FireEye Intelligence Center (FIC), which includes the Community Threat Intelligence (CTI) platform, subject to the following:
i. Permitted Use; Reports. Customer may view and use FIC and content appearing on FIC (“FIC Content”) solely for internal use. Some features of FIC may allow Customer to generate a report (each, a “FIC Report”). FIC Reports and FIC Content are FireEye Materials. Subject to Customer’s payment obligations, FireEye grants to Customer a limited, non-exclusive right to produce FIC Reports and FIC Content using FIC, and reproduce and distribute those FIC Reports and FIC Content internally for Customer’s own business purposes.
ii. Additional Use Limitations. Customer may appoint up to fifteen (15) users of FIC at any time. Each day, all users on Customer’s account may collectively make up to (A) one hundred (100)queries of IP addresses and domain names, and (ii) one hundred (100) queries of malware. Customer may request additional queries, to be evaluated by FireEye on a case by case basis. iii. User Content. “User Content” means any communications, images, sounds, and all the material and information that Customer or anyone using Customer’s account contributes to or through FIC including any contributions to or through the CTI platform (e.g., comments to FIC Content, suspected malware that Customer uploads to FIC). Customer hereby grants FireEye a perpetual, irrevocable, worldwide, paid-up, non-exclusive, license, including the right to sublicense to third parties, and right to reproduce, fix, adapt, modify, translate, reformat, create derivative works from, publish, distribute, sell, license, transmit, publicly display, publicly perform, or provide access to electronically, broadcast, display, perform, and use and practice such User Content as well as all modified and derivative works thereof. Customer represents that Customer has all necessary rights to grant the license referenced in the preceding sentence. FireEye may use and disclose any of the information it collects about its customers’ use of FIC, including the CTI platform, to the extent such information is de-identified. iv. Restrictions. Customer may not access FIC by any means other than through the interface that is provided or approved by FireEye. Customer will not collect any information from or through FIC using any automated means, including without limitation any script, spider, “screen scraping,” or “database scraping” application, and Customer will not damage, disable, overburden, or impair FIC or interfere with any other party’s use and enjoyment of FIC.
v. Customer acknowledges that some optional features and content appearing on FIC may require payment of additional fees.

Confidential FireEye Rev. 8/2016

Page 35 ends

EXHIBIT B-7
SUBSCRIPTION TERMS FOR FIREEYE iSIGHT INTELLIGENCE
The following terms govern the FireEye iSIGHT Intelligence Subscription (“iSIGHT” or “iSIGHT Subscription”). FireEye will provide the iSIGHT Subscription purchased by the Customer, as shown on the Order.

1. Definitions.

1.1 “Access Method(s)” or “Access Methods” means the MySIGHT Portal (“MySIGHT”), Software Development Kit (“SDK”), Application Programming Interface (“API”), Browser Plugin, iSIGHT App for Splunk, or any other method provided by FireEye for Customer to access the iSIGHT Subscription, individually or collectively. All Access Methods are FireEye Material as defined in the Agreement.

1.2 “Application” is a software program the Customer creates, or causes to have created on its behalf, that is designed to access the Content, which includes the features of the SDK/API but adds significant functionality beyond that provided by the SDK/API.

1.3 “Application Programming Interface” or “API” means the latest version of the iSIGHT Application Programming Interface software made generally available by iSIGHT, with its developer’s guide and other related material (available at http://www.isightpartners.com).

1.4 “Browser Plugin” means the iSIGHT Browser Plugin which a Customer may install on Google Chrome and/or other commercially available and supported browsers that allows the Customer to access and view the Content when licensed to do so. The Browser Plugin displays the iSIGHT logo and links to MySIGHT. The Browser Plugin includes the latest version of the Browser Plugin software, its documentation and any html embedded code.

1.5 “Content” means the cyber threat intelligence data and any reports, threat indicators, trends, events, information, documentation or functionality provided in connection with the iSIGHT Subscription. All Content is FireEye Material as defined in the Agreement.

1.6 “End User” means the Customer or the Customer’s employees, as applicable.

1.7 “Software Development Kit” or “SDK” shall mean the latest publicly-available version of the iSIGHT Software Development Kit and any associated documentation, tools, libraries, technical notes, software code, or other materials.

1.8 “iSIGHT App for Splunk” means the application provided by FireEye, which a Customer may install on Splunk, that allows the Customer to access and view the Content in accordance with this Agreement. The iSIGHT App for Splunk includes the latest version of the iSIGHT App for Splunk software, its documentation and any html embedded code.

1.9 “iSIGHT Subscription” includes but is not limited to, Cyber Crime, Cyber Espionage, Critical Infrastructure, Enterprise, Hacktivism, Vulnerability and Exploitation, MySIGHT Portal, Global Response, Analyst Access, iSIGHT SDK, iSIGHT API, iSIGHT Research Reports, or the current offering(s) as listed on the iSIGHT website, and as purchased by the Customer as shown on the Order.

2. License; Access to iSIGHT Subscription and Content.

2.1. Grant of Limited License. During the Subscription Term, FireEye grants to Customer in strict accordance with the terms of this Agreement, a limited, worldwide, revocable, non-exclusive, non-transferable, nonassignable, non-sublicensable royalty-free right and license to:
(a) use MySIGHT, the iSIGHT Subscription, and any Content provided by FireEye for internal use only. The ISIGHT Subscription can be used by End Users who have a valid "need to know" within Customer’s organization, typically defined as a person or group that has a direct role in securing information system or networks. FireEye agrees to provide support for the ISIGHT Subscription in accordance with Section 3 below (“Subscription Support” or “Support”).

Confidential FireEye Rev. 8/2016

Page 36 ends

(b) use the API to search, display, and otherwise access the Content. The API can be used to develop, display, or integrate applications, scripts, tools or workflows that interoperate with iSIGHT Subscriptions for the Customer’s internal use. FireEye agrees to provide Support for the latest version of the API in accordance with Section 3 below.
(c) download, install and use the Software Development Kit (“SDK”) to design, develop and test an Application(s), for the Customer’s internal use only, for the purpose of customizing access to the Content. The Customer may modify the source code versions of sample files, if any, included with the SDK for the purpose of creating Customer’s Application(s), and may make a reasonable number of copies of the SDK as necessary to develop Customer’s Application(s), provided that Customer must reproduce complete copies of the SDK, including without limitation all "read me" files, copyright notices, and other legal notices and terms. FireEye agrees to provide Support for the ISIGHT SDK in accordance with Section 3 below. (d) use the Browser Plugin to search, display and otherwise access the Content for the Customer’s internal use only. Customer may install and use one copy of the Browser Plugin on a single computer per license. FireEye agrees to provide Support for the latest version of the Browser Plugin in accordance with Section 3 below (e) use the ISIGHT App for Splunk to search, display and otherwise access the Content for the Customer’s internal use only. Customer may install and use one copy of the ISIGHT App for Splunk on a single computer per license. FireEye agrees to provide Support for the latest version of the ISIGHT App for Splunk in accordance with Section 3 below.

2.2. Access Keys. Use of the Access Methods and access to the ISIGHT Subscription and the Content by Customer’s End Users is provided through access keys or login credentials. Access keys in association with the Access Methods and ISIGHT Subscription shall be kept in confidence by Customer and Customer’s End Users.

Access keys will be issued to individual End Users by FireEye in accordance with each particular Access Method’s parameters and will not be shared between End Users. Customer may not establish group accounts. Any unauthorized disclosure or dissemination of access keys by Customer or End Users shall be deemed a material breach of this Agreement. Customer shall inform FireEye of any data breach concerning login credentials in a timely manner. FireEye reserves the right to change, suspend, remove, or disable Customer’s access keys to the Access Methods, ISIGHT Subscription , and Content upon notice if a material breach is suspected and not rectified upon notification.

2.3. Latest Version. The license granted to Customer under this Agreement is for the current version of the Access Methods. FireEye may release future versions of the Access Methods as determined in the sole discretion of FireEye. Nothing in this Agreement is a commitment to Customer of compatibility between the existing Access Methods and any future versions of the Access Methods. FireEye reserves the right to discontinue offering particular Access Methods (or any updates thereto) or to modify the Access Methods at any time in its sole discretion.

2.4. Multiple Copies. Customer may receive software for an Access Method in more than one medium and/or in multiple copies. The Customer’s license rights are in accordance with the Order regardless of the number of copies received.

2.5. Additional Licenses. Customer may purchase additional licenses for the Browser Plugin for its authorized End Users through the Chrome Web Store. Customer may purchase additional licenses for the ISIGHT App for Splunk for its authorized End Users through Splunk. Additional licenses for the Browser Plugin and ISIGHT App for Splunk may be purchased and will be valid for the current Subscription Term as provided in the Order.

2.6. Customer Application. The Customer may allow Customer’s employees to access and use the SDK/API on Customer’s behalf to design an Application. The Customer may not rent, lease, sell, transfer, sublicense or time-share the Customer’s Application to any third-party without the express consent of FireEye. Customer shall retain all right, title or interest in the Application and as such, Customer agrees to indemnify and hold harmless FireEye for any claims of infringement made against FireEye in connection with any Application. The Customer’s Application(s) must perform in accordance with the terms of this Agreement and must ensure the security and confidentiality of FireEye’s Confidential Information. Customer assumes full responsibility for any breach of Confidential FireEye Rev. 8/2016

Page 37 ends

security caused by Customer’s Application(s) in connection with the Content, API, SDK, and specifically to any unauthorized disclosure of any FireEye Materials or FireEye Confidential Information.

2.7. Content Modifications. Customer may access the Content from the MySIGHT Portal, via email, SMS, HTML, API, any other Access Methods as officially distributed by FireEye or an FireEye sanctioned third-party integration.

FireEye reserves the right to modify, amend, augment, reduce or alter the Content’s format, or Access Methods, or mode of retrieval of the Content, that in the sole judgment of FireEye is in its customers’ best interests. Customer will be entitled to retrieve the Content with any updates, modifications, additions or changes in the Content.

These changes may require Customer to upgrade its systems, hardware or software and FireEye will not be responsible for the costs of any such changes.

2.8. Prohibited Usage. Customer must comply with any Intellectual Property rights asserted in any materials contained in the Content. The following conduct and usage restrictions apply during Customer’s download, installation, and use of the Content and/or Access Methods, and survive termination of the Agreement or Subscription Term. Customer and its authorized End Users may not:
a. rent, lease, lend, sell, redistribute or sublicense any part of the ISIGHT Subscription or Access Methods to any other party;
b. share the ISIGHT Subscription , Access Methods, Content or Confidential Information with any third-parties, except as expressly authorized in advance by this Agreement or by FireEye in writing; c. use the ISIGHT Subscription or Access Methods in the operation of a service or in any way to provide services to any third-party;
d. create derivative works for external distribution or use based upon the Content; e. create apps, extensions, or other products and services that use Content except as set forth herein; f. display, post, frame, or scrape the Content, except as allowed under this Agreement; g. use the Access Methods for any other purpose than to access the ISIGHT Subscription and the Content; h. use the Access Methods for any illegal or unauthorized purpose to promote or provide instructional information about illegal activities or to promote stalking, physical harm or injury against any group or individual, or any use that violates the rights of privacy and publicity of others; i. create, place, or disseminate any materials or other items that are inappropriate, defamatory, obscene, pornographic, harassing, threatening, abusive, hateful or otherwise offensive, or is unlawful (including any content that infringes any patent, trademark, service mark, copyright, trade secret or other proprietary right of any third-party without appropriate permissions);
j. transmit any viruses, worms, defects, Trojan horses, time-bombs, malware, spyware, or any other computer code of a destructive or interruptive nature in connection with use of the Access Methods; k. use the Access Methods in connection with or to promote any products, services, or materials that constitute, promote or are used primarily for the purpose of dealing in spyware, adware, or other malicious programs or code, counterfeit goods, unsolicited mass distribution of email ("spam"), hacking, surveillance, interception, descrambling equipment, stolen products and items used for theft; l. create any Application that exposes or provides functionality of the Access Methods to any third party; m. interfere, restrict or inhibit any other customer from using the Access Methods or Content or disrupt any services offered by FireEye through any medium;
n. attempt to exceed or exceed the usage limits established by FireEye for the Customer (http://www.isightpartners.com/doc/sdk-bp-docs/#/rate_limiting).

2.9. Restrictions. FireEye expressly reserves the right to limit the number and/or frequency of requests for Content made through the Access Methods in its sole discretion in line with technical design and performance standards as documented in the publicly available developers guide. FireEye may limit the number of network calls that any Application may make via the Access Methods, the maximum file size, or the maximum amount of ISIGHT material that may be accessed. FireEye may change such usage limitations at any time and without notice. In addition to any other rights under this Agreement, FireEye may utilize technical measures to prevent over-usage or to stop usage of any Access Methods or any Application after any usage limitations are exceeded.

The most current API/SDK documentation and developers guide can be found at http://www.isightpartners.com/doc/sdk-bp-docs/#/, and these documents detail the current rates and capabilities of the API.

2.10. Customer recognizes and agrees that certain information and data that will be provided by Customer to FireEye pursuant to the ISIGHT Subscription is not owned by Customer and is not Confidential Information of

Confidential FireEye Rev. 8/2016

Page 39 ends

3.3. Subscription Availability
(a) The FireEye ISIGHT API will have at least 99% system uptime (“API Uptime Standard”). (b) The iSIGHT MySIGHT Portal will have at least a 99% system uptime (“Portal Uptime Standard”). (c) FireEye realizes that a failure to meet the Response Time Standard, API Uptime Standard and the Portal Uptime Standard (collectively, the “Service Level Standards”) could have an adverse impact to Customer. If FireEye fails to meet any of the Service Level Standards (“Service Level Failure”), FireEye will: (i) promptly investigate and report on the root cause of the problem; (ii) advise Customer of the remedial efforts being undertaken with respect to this failure to meet the Service Level Standards; (iii) use commercially reasonable efforts to correct the problem and begin meeting the Service Level Standards; and (iv) take appropriate preventative measures designed to ensure that the problem does not recur.

Confidential FireEye Rev. 8/2016

Page 40 ends

EXHIBIT C

FIREEYE SUPPORT SERVICES APPLICABLE FOR FIREEYE PRODUCTS

1. SUPPORT PURCHASED SEPARATELY FROM THE PRODUCTS. In the event Customer has purchased the Products and pass-through Support Services from FireEye through a FireEye authorized reseller (a "Reseller"), Customer will be entitled to all the rights herein set forth related to the level of Support Service requested and paid for by it, provided Customer: (a) is the original purchaser of the covered Products, (b) has provided true, accurate, current and complete information to FireEye included with its purchase; and (c) has maintained and updated this information to keep it true, accurate, current, and complete.

2. SUPPORT SERVICES PROVIDED BY FIREEYE.

FireEye offers a range of programs for the support of its Products as described below (“Support Programs”).

Customer shall be entitled to receive the Support Services specified on the applicable support invoice and described below to the extent that Customer has paid in full the applicable Fees for Support Services.

2.1 Software Maintenance Services – include each of the following:

Software Updates. During the Support Term , FireEye shall provide Customer notification of bug fixes, maintenance patches and new releases which may contain minor enhancements to the features or functions of the Product (“Updates”). FireEye may designate a particular release of the Product as an Update at its sole discretion. Customer may obtain Updates either through delivery of a machine-readable copy pursuant to instructions contained in the document notifying Customer of an available Update or by downloading the Update from FireEye’s server via the Internet. FireEye reserves the right to impose additional charges for releases of Products (i) that provide major enhancements to the features or functions of the Products, as determined by FireEye at its sole discretion; or, (ii) that provide additional features or perform additional functions not provided or performed by the Products.

Software Error Corrections. During the Support Term, FireEye shall use commercially reasonable efforts to correct any reproducible programming error in the software associated with the Product attributable to FireEye, employing a level of effort commensurate with the severity of the error, provided, however, that FireEye shall have no obligation to correct all errors in the Products. Upon identification of any programming error, Customer shall notify FireEye of such error in writing and shall provide FireEye with enough information to locate and reproduce the error. FireEye shall not be responsible for correcting any errors not attributable to FireEye. Errors attributable to FireEye shall be those that are reproducible by FireEye on unmodified Products. If it is found that a particular error is fixed in the most current Product release, then FireEye shall have no obligation to fix the error in any prior Product release and Customer will need to upgrade to the current Product release in order to obtain the fix.

2.2 Support Programs
(a) Platinum Support includes all of the services set forth above under Software Maintenance Service (section

2.1) and additionally:
• Email, Live Chat, Web or Telephone Support. During the Support Term, FireEye shall provide Customer technical email, live chat, web or telephone support for the Products twenty-four (24) hours per day, 365 days a year. FireEye’s support technician shall only be obligated to respond to Customer’s fifteen (15) designated contacts.
• FireEye shall use commercially reasonable efforts to respond to the request for support as detailed in the Initial Response Times table found at https://www.fireeye.com/support/programs.html regarding use or installation of the Product that is communicated to FireEye via one of the mechanisms above to the attention of FireEye’s support engineers.
• Product Return. During the term of this Agreement, Customer shall have the right to return to FireEye any defective Product subject to the limited warranty. Additionally, FireEye will fulfill the following Advance Return provisions below.

Confidential FireEye Rev. 8/2016

Page 41 ends

• Advance Replacement. Prior to any return as to which Advance Replacement applies, Customer shall verify that said Product is defective by logging a Support request via one of the mechanisms described above and in accordance with FireEye’s RMA procedures, including providing the part number, serial number, quantity and reason for return, an explanation of all failure symptoms and other relevant information. Upon confirmation by FireEye of a defect, Customer shall obtain from FireEye an RMA number. FireEye shall ship via a recognized express courier service a replacement Product to Customer to arrive no later than next business day after FireEye’s issuance of an RMA number, provided the RMA number was issued prior to the business day cutoff time local to the defective Product, provided the replacement does not require any custom pre-configuration, and provided no external-to-FireEye circumstances prevent the delivery. The replacement Product may be a new or reconditioned Product (of equivalent or better quality) at FireEye’s sole discretion. FireEye shall pay the shipping costs to ship the replacement Product to Customer, but Customer shall bear any and all risk of loss of or damage to said Product at all times after said Product is made available by FireEye to the common carrier. The support service will transfer from the defective Product to the replacement Product. Within five (5) business days after Customer receives the replacement Product from FireEye, Customer shall package said defective Product in its original packing material or equivalent, write the RMA number on the outside of the package and return said defective Product, at FireEye’s cost provided Customer utilizes FireEye’s designated courier service and properly packages the defective Product according to FireEye’s instructions, shipped properly insured, FOB FireEye’s designated facility (except that FireEye shall pay for shipping). Customer shall enclose with the returned Product the applicable RMA form, and any other documentation or information requested by FireEye customer support. Customer shall assume any and all risk of loss of or damage to such Product during shipping. Title to the defective Product shall pass to FireEye upon FireEye’s receipt thereof. When a replacement Product is provided and Customer fails to return the defective Product to FireEye within ten (10) business days after Customer receives the replacement Product from FireEye, FireEye may charge Customer, and Customer shall pay for the replacement Product at the then-current list price.
(b) Platinum Priority Plus Support iincludes all of the services set forth above under Platinum Support [section

2.2(a)] and additionally:
• Access to Support. Customer will be provided with direct priority access to Level 2 Advanced Engineering support who shall respond to Customer’s unlimited number of designated contacts. A Designated Support Engineer (DSE) point of contact, who is available during Customer’s business hours (for single Customer site if Product(s) installed at multiple Customer sites), will be made available to be the focal point of contact within FireEye, to project manage Customer’s technical issues. • Onsite Support. Onsite visits for problem assistance at DSE’s sole discretion. • Reporting. FireEye will supply Customer with monthly reports detailing technical support provided during the previous month. Quarterly business reviews will also be conducted. (c) Government Support, if available, includes all of the services set forth above under Platinum Support [section 2.2(a)] and additionally:
• Email, Live Chat, Web or Telephone Support. For the specified country, access to citizens of that country for the fulfillment of Level 1 and 2 technical support requests. (d) Government Priority Plus Support includes all of the services set forth above under Government Support [section 2.2(c)] and additionally:
• Access to Support. Customer will be provided with direct priority access to Level 2 Advanced Engineering support who are citizens of that country and shall respond to Customer’s unlimited number of designated contacts. A Designated Support Engineer (DSE) point of contact who is a citizen of that country and available during Customer’s business hours (for single Customer site if Product(s) installed at multiple Customer sites), will be made available to be the focal point of contact within FireEye, to project manage Customer’s technical issues.
• Onsite Support. Onsite visits for problem assistance at DSE’s sole discretion. • Reporting. FireEye will supply Customer with monthly reports detailing technical support provided during the previous month. Quarterly business reviews will also be scheduled.

Confidential FireEye Rev. 8/2016

Page 42 ends

(e) Special Services. FireEye agrees to use commercially reasonable efforts to respond to any requests by Customer for support services not specifically provided for above. Customer acknowledges that all such services provided by FireEye shall be at FireEye's discretion and then-current fees and policies.

3. CUSTOMER RESPONSIBILITIES.

3.1 Requesting Support Services. When requesting Support Services from FireEye under this Agreement, Customer should have the following information available to provide to FireEye, if requested: (i) detailed problem description, including operating system (“OS”) version, Product model and serial number(s), of the affected Product, and a detailed description of the troubleshooting that has already been done to try to resolve the problem; (ii) detailed system log files; (iii) configuration and login details to allow FireEye access as needed to the Products via the Internet for the purpose of providing support services and permissions needed in order for FireEye to conduct such remote access; (iv) a detailed description of changes to the environment; and (v) Customer’s unique ID, Account ID, the serial number(s) of the Product(s) covered by this Agreement or other unique customer identifier as assigned to Customer by FireEye. Customer acknowledges and agrees that failure to have any or all information or access available as needed by FireEye in order to provide the Support Services may result in delays in FireEye’s response, may hinder FireEye’s ability to perform the Support Services and/or may cause incorrect Support Program fulfillment. FireEye will not be responsible for any such delays and inability to perform due to causes not due to FireEye.

3.2 Customer Assistance. Customer agrees to: (i) ensure that their site complies with any and all applicable FireEye published system environmental specifications; (ii) follow FireEye’s procedures when requesting Support Services; (iii) provide FireEye reasonable access to all necessary personnel to answer questions or resolve problems reported by Customer regarding the Products; (iv) promptly implement all Updates and error corrections provided by FireEye under this Agreement; (v) maintain FireEye supported versions of required third party software, if any; and (v) notify FireEye promptly of any relocation of the Products from the location to which the Products were originally shipped. Customer agrees to use reasonable efforts to resolve internally any support questions prior to requesting Support Services pursuant to this Agreement. During the Support Term, FireEye may obtain information regarding Customer’s email communication and Customer agrees that, as a condition to FireEye’s provision of Support Services, FireEye may use statistical data generated regarding Customer’s email correspondence with customer support so long as the source or content of the emails is not being disclosed.

3.3 Contact People. Customer shall appoint the specified number of individuals (depending upon the Support Program purchased) within Customer's organization to serve as contacts between Customer and FireEye and to receive support through FireEye's telephone support center. Customer’s contacts shall have been adequately trained on the Products and shall have sufficient technical expertise, training and experience. All of Customer's support inquiries shall be initiated through these contacts.

4. EXCLUSIONS. Notwithstanding anything else contained in this Agreement to the contrary, FireEye shall have no obligation or responsibility to provide any Support Services relating to problems arising out of or related to (i) Customer's failure to implement all Updates to the Product which are made available to Customer under this Agreement; (ii) the failure to provide a suitable installation environment; (iii) any alteration, modification, enhancement or addition to the Products performed by parties other than FireEye; (iv) use of the Products in a manner, or for a purpose, for which they were not designed; (v) accident, abuse, neglect, unauthorized repair, inadequate maintenance or misuse of the Products; or relocation of the Products (including without limitation damage caused by use of other than FireEye shipping containers), (vi) operation of the Products outside of environmental specifications; (vii) interconnection of the Products with other products not supplied by FireEye; (viii) use of the Products on any systems other than the specified hardware platform for such Products; or (ix) introduction of data into any database used by the Products by any means other than the use of the software associated with the Products. Notwithstanding anything else contained in this Agreement to the contrary, FireEye will support all generally available ("GA") versions of the FireEye OS, for a minimum of one (1) year from GA release date, regardless of the number of supported OS GA versions. FireEye will also support the two (2) most current OS GA versions, regardless of the elapsed time from GA release date. If available, and at FireEye’s sole discretion, support for any other OS versions or for other problems not covered under this Agreement may be obtained at FireEye's then-current fees and policies for such services. FireEye’s complete end of life policy can be found at http://www.fireeye.com/support/supported-products.html

5. LAPSED SUPPORT AND UPGRADED SUPPORT.

Confidential FireEye Rev. 8/2016

Page 43 ends

5.1 Lapsed Support. After any lapse of Support Services, the parties subsequently may elect to reinstate such Support Services for Products for which the Support Services lapsed pursuant to the terms and conditions set forth in this Agreement; provided, however, that (i) Customer agrees to pay for the period of time that has lapsed as well as any renewal term, and (ii) such Products must be in good working condition, as solely determined by FireEye or its designee.

5.2 Support Program Upgrade. At any time during the Term, Customer may upgrade to FireEye's next level of Support Program by (i) notifying FireEye of Customer's desire to upgrade; (ii) acknowledging in writing the thencurrent terms and conditions for the relevant Support Program; and (iii) paying FireEye the additional Support Fee owed in connection with such upgraded Support Program.
v9/23/2015
Exhibit A
Product Passthrough Terms – Google Apps for Work (for Customers) Customer has entered into a certain written agreement (the “Agreement”) pursuant to which Customer has purchased the right to access and use the Product. These Product Passthrough Terms set forth the terms and conditions under which Customer may access and use such Product.

1. Product.

1.1 Facilities and Data Transfer. All facilities used to store and process Customer Data will adhereto reasonable security standards no less protective than the security standards at facilities where Provider stores and processes its own information of a similar type. Provider has implemented at leastindustry standard systems and procedures to ensure the security and confidentiality of Customer Data,protect against anticipated threats or hazards to the security or integrity of Customer Data, and protectagainst unauthorized access to or use of Customer Data. As part of providing the Product, Provider maytransfer, store and process Customer Data in the United States or any other country in which Provider or its agents maintain facilities. By using the Product, Customer consents to this transfer, processing and storageof Customer Data.

1.2 Modifications.
a. To the Product. Provider may make commercially reasonable changes to the Product, from timeto time. If Provider makes a material change to the Product, Customer may be informed of suchchange, provided that Customer has subscribed with Provider to be informed about such change. b. To URL Terms. Provider may make commercially reasonable changes to the URL Terms from timeto time. If Provider makes a material change to the URL Terms, Customer may be informed ofsuch change through the Notification Email Address or via the Admin Console. If the change has amaterial adverse impact on Customer and Customer does not agree to the change, Customer must sonotify Partner or Provider via the Help Center within thirty days after receiving notice of the change. Upon such notification, Customer will remain governed by the URL Terms in effect immediately prior to the change until the end of the then-current term for the affected Product. If the affected Product is renewed, they will be renewed under Provider’s then current URL Terms.

1.3 Customer Domain Name Ownership. Prior to providing the Product, Provider or Partner may verify that Customer owns or controls the Customer Domain Names. If Customer does not own, or control, the Customer Domain Names, then Provider will have no obligation to provide Customer with the Product.

1.4 Federal Information Security Management Act (FISMA). The Provider’s Product known as “GoogleApps Core Services” received a FISMA “Authorization to Operate” for a Moderate impact system. Provider will continue to maintain a System Security Plan (SSP) for the Google Apps Core Services, based on NIST 800- 53 Rev. 3, or a similarly applicable standard. If Provider does not maintain this SSP as stated, Customer’s sole and exclusive remedy, and Provider’s entire liability, will be Customer’s ability to terminate use of the Product upon thirty days prior written notice.

2. Customer Obligations.

2.1 Compliance. Customer will use the Product in accordance with the Acceptable Use Policy. Provider may make new applications, features or functionality for the Product available from time to time, the use of which may be contingent upon Customer’s agreement to additional terms. In addition, Provider will makeother Non-Google Apps Products (beyond the Product) available to Customer and its End Users inaccordance with the Non-Google Apps Product Terms and the applicable product-specific Provider terms of service. If Customer does not desire to enable any of the Non-Google Apps Products, Customer can enable or disable them at any time through the Admin Console.

2.2 Customer Administration of the Product. Customer may specify one or more Administrators throughthe Admin Console who will have the rights to access Admin Account(s) and to administer the End User Accounts. Customer and Partner are responsible for: (a) maintaining the confidentiality of the password and Admin Account(s); (b) designating those individuals who are authorized to access the Admin Account(s); and (c) ensuring that all activities that occur in connection with the Admin Account(s) comply withthese v9/23/2015
Product Passthrough Terms. Customer agrees that Provider’s responsibilities do not extend to theinternal management or administration of the Product for Customer and that Provider is merely adata-processor.

2.3 End User Consent. Customer’s Administrators may have the ability to access, monitor, use, or disclose data available to End Users within the End User Accounts. Customer will obtain and maintain all required consents from End Users to allow: (i) Customer’s access, monitoring, use and disclosure of this dataand Provider providing Customer with the ability to do so, and (ii) Provider to provide theProduct.

2.4 Unauthorized Use. Customer will use commercially reasonable efforts to prevent unauthorized use of the Product, and to terminate any unauthorized use. Customer or Reseller will promptly notify Provider of any unauthorized use of, or access to, the Product of which it becomes aware.

2.5 Restrictions on Use. Unless Provider specifically agrees in writing, Customer will not, and will use commercially reasonable efforts to make sure a third party does not: (a) sell, resell, lease, or the functional equivalent, the Product to a third party (unless expressly authorized in these Product Pasthrough Terms); (b) attempt to reverse engineer the Product or any component; (c) attempt to create a substitute orsimilar service through use of, or access to, the Product; (d) use the Product for High Risk Activities; or (e) usethe Product to store or transfer any Customer Data that is controlled for export under Export ControlLaws.

Customer is solely responsible for any applicable compliance with HIPAA.

2.6 Third Party Requests. Customer is responsible for responding to Third Party Requests. Provider will, tothe extent allowed by law and by the terms of the Third Party Request: (a) promptly notify Customer of its receipt of a Third Party Request; (b) comply with Customer’s reasonable requests regarding its efforts to oppose a Third Party Request; and (c) provide Customer with the information or tools required for Customer to respond to the Third Party Request. Customer will first seek to obtain the information required to respond to the Third Party Request on its own, and will contact Provider only if it cannot reasonably obtainsuch information.

3. Technical Support Services.

3.1 By Customer. Customer or Partner will, at its own expense, respond to questions and complaints from End Users or third parties relating to Customer’s or End Users’ use of the Product. Customer or Partner will use commercially reasonable efforts to resolve support issues before escalating them to Provider.

3.2 By Provider. If Customer or Partner cannot resolve a support issue consistent with the above, then Customer or Partner (as applicable based on the agreement between Provider and Partner) may escalate the issue to Provider in accordance with the TSS Guidelines. Provider will provide TSS to Customeror Partner (as applicable) in accordance with the TSS Guidelines.

4. Suspension.

4.1 Of End User Accounts by Provider. If Provider becomes aware of an End User’s violation of theseProduct Passthrough Terms, then Provider may specifically request that Customer Suspend the applicable EndUser Account. If Customer fails to comply with Provider’s request to Suspend an End User Account, then Provider may do so. The duration of any Suspension by Provider will be until the applicable End User has cured the breach which caused the Suspension.

4.2 Emergency Security Issues. Notwithstanding the foregoing, if there is an Emergency Security Issue,then Provider may automatically Suspend the offending use. Suspension will be to the minimum extent and of the minimum duration required to prevent or terminate the Emergency Security Issue. If Provider Suspends an End User Account for any reason without prior notice to Customer, at Customer’s request, Providerwill provide Customer the reason for the Suspension as soon as is reasonably possible.

5. Confidential Information.

5.1 Obligations. Customer and Provider will: (a) protect the other’s Confidential Information with thesame standard of care it uses to protect its own Confidential Information; and (b) not disclose theConfidential Information, except to Affiliates, employees and agents who need to know it and who have agreed in writing to keep it confidential. Customer and Provider (and any Affiliates, employees and agents to whom ithas disclosed Confidential Information) may use Confidential Information only to exercise rights and fulfill its obligations under these Product Passthrough Terms, while using reasonable care to protect it. Customer v9/23/2015
and Provider, respectively, will be responsible for any actions of its Affiliates, employees and agents in violation of this Section.

5.2 Exceptions. Confidential Information does not include information that: (a) the recipient of the Confidential Information already knew; (b) becomes public through no fault of the recipient; (c) was independently developed by the recipient; or (d) was rightfully given to the recipient by a third party.

5.3 Required Disclosure. Customer and Provider may disclose the other’s Confidential Information when required by law but only after it, if legally permissible: (a) uses commercially reasonable efforts to notify the other; and (b) gives the other the chance to challenge the disclosure.

6. Intellectual Property Rights; Brand Features.

6.1 Intellectual Property Rights. Except as expressly set forth herein, these Product Passthrough Terms does not grant either Customer or Provider any rights, implied or otherwise, to the other’s content or any of the other’s intellectual property. As between the Customer and Provider, Customer owns all Intellectual Property Rights in Customer Data, and Provider owns all Intellectual Property Rights in theProduct.

6.2 Display of Brand Features. Provider may display those Customer Brand Features authorized byCustomer (such authorization is provided by Customer uploading its Brand Features into the Product), andwithin designated areas of the Service Pages. Customer may specify the nature of this use using theAdmin Console. Provider may also display Provider Brand Features on the Service Pages to indicate thatthe Product are provided by Provider. Neither party may display or use the other party’s Brand Features beyond what is allowed in these Product Passthrough Terms without the other’s prior written consent.

6.3 Brand Features Limitation. Any use of Brand Features will inure to the benefit of the entityholding Intellectual Property Rights in those Brand Features. Any right to use its Brand Features pursuant to these Product Passthrough Terms may be revoked at any time with written notice to the other and a reasonable period to stop the use.

7. Publicity. Customer agrees that Provider may include Customer’s name or Brand Features in a list of Provider customers, online or in promotional materials. Customer also agrees that Provider may verbally reference Customer as a customer of the Provider’s Product that is the subject of these Product Passthrough Terms.

8. Representations, Warranties and Disclaimers.

8.1 Representations and Warranties. Customer and Provider represent that each will comply with all laws and regulations applicable to its provision, or use, of the Product, as applicable (including applicable security breach notification law). Provider warrants that it will provide the Product in accordance with the applicable SLA.

8.2 Disclaimers. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, EXCEPT AS EXPRESSLY

PROVIDED FOR HEREIN, NEITHER PARTY MAKES ANY OTHER WARRANTY OF ANY KIND,

WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR USE AND NONINFRINGEMENT.

PROVIDER MAKES NO REPRESENTATIONS ABOUT ANY CONTENT OR INFORMATION MADE ACCESSIBLE BY OR THROUGH THE PRODUCT. CUSTOMER ACKNOWLEDGES THAT THE

PRODUCT IS NOT A TELEPHONY SERVICE AND THAT THE PRODUCT IS NOT CAPABLE OF

PLACING OR RECEIVING ANY CALLS, INCLUDING EMERGENCY PRODUCT CALLS, OVER PUBLICLY SWITCHED TELEPHONE NETWORKS.

9. Term and Termination.

9.1 Term. The term for the Product will be as decided upon between Partner and Customer. These Product Passthrough Terms will remain in effect for the Term.

9.2 Termination for Breach. The Services may be suspended or terminated, if: (i) Customer is in material breach of these Product Passthrough Terms and fails to cure that breach within thirty days after receipt ofwritten notice; (ii) Customer ceases its business operations or becomes subject to insolvency proceedings andthe proceedings are not dismissed within ninety days; or (iii) Customer is in material breach of these Product Passthrough Terms more than two times notwithstanding any cure of such breaches. v9/23/2015

9.3 Effects of Termination. If Services are terminated, then: (i) the rights granted by Provider to Customer,and Customer to Provider will cease immediately (except as set forth in this Section); (ii) neither Customernor Partner will have access to, or the ability to export, the Customer Data; (iii) Provider will begin todelete Customer Data; and (iv) upon request will promptly use commercially reasonable efforts to return or destroy all other Confidential Information of the other.

10. Miscellaneous.

10.1 Product Development. The Product was developed solely at private expense and is commercial computer software and related documentation within the meaning of the applicable civilian and militaryfederal acquisition regulations and any supplements thereto.

10.2 Force Majeure. Due to circumstances beyond Provider’s controls, Provider may not be able to provide the Product.

10.3 No Waiver. Failure to enforce any provision of these Product Passthrough Terms will not constitute a waiver.

10.4 No Agency. These Product Passthrough Terms do not create any agency, partnership or jointventure.

10.5 No Third-Party Beneficiaries. There are no third-party beneficiaries to these Product PassthroughTerms.

Customer’s sole remedies will be set forth in its agreement with the Partner.

10.6 Survival. The following sections will survive expiration or termination of these Product PassthroughTerms:

Sections 5, 6, 9.3, 10 and 12.

10.7 Severability. If any term (or part of a term) of these Product Passthrough Terms is invalid, illegal, or unenforceable, the rest of these Product Passthrough Terms will remain in effect.

10.8 Conflicting Terms. If there is a conflict between any terms of these Product Passthrough Terms and any other document that makes up the entire agreement as needed for Customer to use the Product,the terms of these Product Passthrough Terms will take precedence.

11. Additional Product Terms.

11.1 Ads. Provider does not serve Ads in the Product or use Customer Data for Ads purposes.

11.2 Aliases. Customer is solely responsible for monitoring, responding to, and otherwise processing emails sent to the “abuse” and “postmaster” aliases for Customer Domain Names but Provider maymonitor emails sent to these aliases for Customer Domain Names to allow Provider to identify Productabuse.

11.3 Google Apps Vault Retention. If Customer is using Google Apps Vault, Provider will have no obligation to retain any archived Customer Data beyond the retention period specified by Customer. If Customerdoes not renew Google Apps Vault, Provider will have no obligation to retain any archived CustomerData.

12. Definitions.
“Acceptable Use Policy” means the acceptable use policy for the Product available at http://www.google.com/a/help/intl/en/admins/use policy.html. The Acceptable Use Policy and such URLlink may be updated or modified by Provider from time to time. “Admin Account(s)” means the administrative account(s) provided to Customer for the purpose of administering the Product. The use of the Admin Account(s) requires a password, which Provider will provide to Customer or Partner.
“Admin Console” means the online tool Customer may use in reporting and certain other administration functions.
“Administrators” mean the Customer-designated technical personnel who administer the Product to End Users on Customer’s behalf.
v9/23/2015
“Ads” means online advertisements displayed by Provider to End Users, excluding advertisements provided by any advertising products that are not part of the Product that Customer chooses to use in connection with the Product.
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with an entity.
“Brand Features” means the trade names, trademarks, service marks, logos, domain names, and other distinctive brand features of each party, respectively, as secured from time totime. “Confidential Information” means information disclosed or exchanged under these Product PassthroughTerms that is marked as confidential or would normally be considered confidential under the circumstances. Customer Data is Customer’s Confidential Information.
“Customer Data” means data, including email, provided, generated, transmitted or displayed via the Product by Customer, End Users, or Partner on behalf of Customer.
“Customer Domain Names” mean the domain names owned or controlled by Customer, which will be usedin connection with the Product.
“Emergency Security Issue” means either: (a) Customer’s use of the Product in violation of the AcceptableUse Policy, which could disrupt: (i) the Product; (ii) other customers’ use of the Product; or (iii) the Providernetwork or servers used to provide the Product; or (b) unauthorized third party access to the Product. “End Users” means the individuals Customer permits to use the Product. “End User Account” means a Provider-hosted account established by Customer through the Product for anEnd User.
“Export Control Laws” means all applicable export and reexport control laws and regulations, including trade and economic sanctions maintained by the Treasury Department’s Office of Foreign Assets Control, and the International Traffic in Arms Regulations (“ITAR”) maintained by the Department ofState. “Google Apps Core Services” means the applicable Product purchased by Customer from Partner whichare more fully described here: http://www.google.com/a/help/intl/en/users/user features.html. The GoogleApps Core Services and such URL link may be updated or modified by Provider from time to time. “Help Center” means the Provider help center accessible at http://www.google.com/support/. The HelpCenter and such URL link may be updated or modified by Provider from time totime. “High Risk Activities” means uses such as the operation of nuclear facilities, air traffic control, or lifesupport systems, where the use or failure of the Product could lead to death, personal injury, or environmental damage. “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, as may be amended fromtime to time, and any regulations issued thereunder.
“Intellectual Property Rights” means current and future worldwide rights under patent law, copyright law, trade secret law, trademark law, moral rights law, and other similarrights. “Non-Google Apps Products” means Provider products which are not part of the Product, but which may be accessed by End Users using their End User Account login and password. The Non-Google Apps Productsare set forth at the following URL: http://www.google.com/support/a/bin/answer.py?hl=en&answer=181865. The Non-Google Apps Products and such URL link may be updated or modified by Provider from time totime. “Non-Google Apps Product Terms” means the terms found at the following URL:
http://www.google.com/apps/intl/en/terms/additional services.html. The Non-Google Apps Product Termsand such URL link may be updated or modified by Provider from time totime. “Notification Email Address” means the email address designated by Customer to receive emailnotifications from Provider. Customer may provide a Partner email address for this purpose if it so chooses. Customer may change this email address through the AdminConsole.
v9/23/2015
“Provider” means the third party provider of the Product. “Partner” means the entity Customer is paying to provide access to and use of the Product. “Service Pages” mean the web pages displaying the Product to EndUsers. “Product” means, as applicable, the Google Apps Core Services purchased from Partner. “SLA” means the Service Level Agreement located here for applicable Google Apps Core Services:
http://www.google.com/apps/intl/en/terms/reseller sla.html. The SLA and such URL link may be updated or modified by Provider from time to time.
“Suspend” means the immediate disabling of access to the Product, or components of the Product, as applicable, to prevent further use of theProduct.
“Term” means the term of these Product Passthrough Terms, which will continue for as long as Customeris receiving Product from Provider, unless terminated earlier pursuant to these Product Passthrough Terms, or pursuant to Customer’s agreement with Partner.
“Third Party Request” means a request from a third party for records relating to an End User’s use of the Product. Third Party Requests can be a lawful search warrant, court order, subpoena, other valid legal order, or written consent from the End User permitting the disclosure. “TSS” means the technical support Product provided by Provider to the Administrators during the Term pursuant to the TSS Guidelines.
“TSS Guidelines” means Provider’s technical support Product guidelines then in effect for the Product. TSS Guidelines are at the following URL: http://www.google.com/a/help/intl/en/admins/tssg.html. The TSSGuidelines and such URL link may be updated or modified by Provider from time totime. “URL Terms” means the Acceptable Use Policy, the SLA and the TSSGuidelines.

SALESFORCE Service Terms
"AppExchange" means the online directory of on-demand applications that work with the Service, located at http://www.appexchange.com or at any successor websites. "Service" means the online, Web-based application provided by Salesforce.com (sometimes referred to as “SFDC”) via http://www.salesforce.com and/or other designated websites, including associated offline components but excluding AppExchange applications.
“Third-Party Applications” means online, Web-based applications and offline software products that are provided by third parties, interoperate with the Service, and are identified as third-party applications, including but not limited to those listed on the AppExchange. “User Guide” means the online user guide for the Services, accessible via http://www.salesforce.com, as updated from time to time.
"Users" means Your employees, representatives, consultants, contractors or agents who are authorized to use the Service and have been supplied user identifications and passwords by You (or by Salesforce.com or Your reseller at Your request).
“You” and “Your” means the customer entity which has contracted to purchase subscriptions to use the Service subject to the conditions of these SFDC Service Terms. "Your Data" means all electronic data or information submitted by You to the Service.

1. Use of Service
(a) User subscriptions cannot be shared or used by more than one User (but may be reassigned from time to time to new Users who are replacing former Users who have terminated employment with You or otherwise changed job status or function and no longer require use of the Service).
(b) You (i) are responsible for all activities occurring under Your User accounts; (ii) are responsible for the content of all Your Data; (iii) shall use commercially reasonable efforts to prevent unauthorized access to, or use of, the Service, and shall notify Your reseller or Salesforce.com promptly of any such unauthorized use You become aware of; and (iv) shall comply with all applicable federal laws and regulations in using the Service.
(c) You shall use the Service solely for Your internal business purposes and shall not: (i) license, sublicense, sell, resell, rent, lease, transfer, assign, distribute, time share or otherwise commercially exploit or make the Service available to any third party, other than to Users or as otherwise contemplated by these SFDC Service Terms; (ii) send spam or otherwise duplicative or unsolicited messages in violation of applicable laws; (iii) send or store infringing, obscene, threatening, libelous, or otherwise unlawful or tortious material, including material that is harmful to children or violates third party privacy rights; (iv)send or store viruses, worms, time bombs, Trojan horses and other harmful or malicious code, files, scripts, agents or programs; (v) interfere with or disrupt the integrity or performance of the Service or the data contained therein; or (vi) attempt to gain unauthorized access to the Service or its related systems or networks.
(d) You shall not (i) modify, copy or create derivative works based on the Service; (ii) frame or mirror any content forming part of the Service, other than on Your own intranets or otherwise for its own internal business purposes; (iii) reverse engineer the Service; or (iv) access the Service in order to (A) build a competitive product or service, or (B) copy any ideas, features, functions or graphics of the Service.

2. Service Provision. Salesforce.com will use commercially reasonable efforts to make the Services available 24 hours a day, 7 days a week, except for: (a) planned downtime (of which SFDC shall give at least 8 hours notice via the Services and which SFDC shall schedule to the extent practicable during the weekend hours from 6:00 p.m. Pacific time Friday to 3:00 a.m. Pacific time Monday), or (b) any unavailability caused by circumstances beyond SFDC’s reasonable control, including without limitation, acts of God, acts of government, flood, fire, earthquakes, civil unrest, acts of terror, strikes or other labor problems (other than those involving SFDC employees), or Internet service provider failures or delays.

Salesforce.com will provide the Services only in accordance with applicable laws and government regulations.

3. Acquisition of Third-Party Products and Services. Any acquisition by You of third-party products or services, including but not limited to Third-Party Applications and implementation, customization and other consulting services, and any exchange of data between You and any thirdparty provider, is solely between You and the applicable third-party provider. Salesforce.com does not warrant or support third-party products or services, whether or not they are designated by Salesforce.com as “certified” or otherwise. No purchase of third-party products or services is required to use the Service as provided by Salesforce.com.

4. Third-Party Applications and Your Data. If You install or enable Third-Party Applications for use with the Service, You acknowledge that Salesforce.com may allow providers of those ThirdParty Applications to access You Data as required for the interoperation of such Third Party Applications with the Service. Salesforce.com shall not be responsible for any disclosure, modification or deletion of You Data resulting from any such access by Third-Party Application providers. The Service shall allow You to restrict such access by restricting Users from installing or enabling such Third-Party Applications for use with the Service.

5. Google Services. Service features that interoperate with Google services depend on the continuing availability of the Google application programming interface (“API”) and program for use with the Service. If Google Inc. ceases to make the Google API or program available on reasonable terms for the Service, Salesforce.com may cease providing such Service features without entitling You to any refund, credit, or other compensation.

6. Proprietary Rights. Subject to the limited rights expressly granted hereunder, Salesforce.com reserves all rights, title and interest in and to the Service, including all related intellectual property rights. The Service is deemed Salesforce.com confidential information, and You will not use it or disclose it to any third party except as permitted in these SFDC Service Terms and except as required by law, upon notice to Salesforce.com.

7. Your Data. As between Salesforce.com and You, You exclusively own all rights, title and interest in and to all of Your Data. Your Data is deemed your confidential information, and Salesforce.com shall not access Your User accounts, including Your Data, except to respond to service or technical problems or at your request.

8. Compelled Disclosure. If either You or Salesforce.com is compelled by law to disclose confidential information of the other party, it shall provide the other party with prior notice of such compelled disclosure (to the extent legally permitted) and reasonable assistance, at the other party’s cost, if the other party wishes to contest the disclosure.

9. Suggestions You agree that Salesforce.com shall have a royalty-free, worldwide, transferable, sublicenseable, irrevocable, perpetual license to use or incorporate into the Service any suggestions, enhancement requests, recommendations or other feedback provided by You or Your Users relating to the operation of the Service.

10. Fees. Contracted for fees for use of the Service represent a firm commitment and the number of User subscriptions contracted for cannot be reduced in the middle of a subscription term.

11. Termination. The master contract governs your termination (FAR 52.212-4(l) & (m)) and cancellation rights with the contractor, and the contract requires continued performance while any disputes are resolved (FAR 52.233-1(i)).

12. Data Storage. You are entitled to a cumulative amount of storage per User subscription for no additional charge as set forth in the User Guide for the Service subscription type purchased. You may purchase additional storage if necessary, and you may contact Your reseller for then-current rates listed in master contract price list.

13. Support. SFDC will provide You with basic support as described from time to time by SFDC at www.salesforce.com. In the event that You have purchased an upgraded support package, then upgraded support contact information will be provided to You together with your initial account set up information.

14. No Warranty. SALESFORCE.COM MAKES NO WARRANTIES OF ANY KIND,

WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE REGARDING

THE SERVICE AND/OR SUPPORT, AND SPECIFICALLY DISCLAIMS ALL

IMPLIED WARRANTIES, INCLUDING ANY WARRANTIES OF

MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW. IN THE EVENT

THAT YOUR AGREEMENT WITH YOUR RESELLER PROVIDES ANY

WARRANTIES WITH RESPECT TO THE SERVICE AND/OR SUPPORT, SUCH WARRANTIES ARE SOLELY BETWEEN YOU AND YOUR RESELLER. This clause does not disclaim any warranties expressly provided in a contract with the U.S.

Government.”

15. No Liability. IN NO EVENT SHALL SALESFORCE.COM HAVE ANY LIABILITY TO YOU

OR ANY USER FOR ANY DAMAGES WHATSOVER, INCLUDING BUT NOT LIMITED TO

DIRECT, INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL

DAMAGES, OR DAMAGES BASED ON LOST PROFITS, HOWEVER CAUSED AND,

WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, WHETHER OR NOT EITHER YOU OR SALESFORCE.COM HAVE BEEN ADVISED OF THE POSSIBILI TY OF SUCH DAMAGES. This clause shall not impair the U.S. Government’s right to recover for fraud or crimes arising out of or related to this Contract under any federal fraud statute, including the False Claims Act, 31 U.S.C. §§ 3729-3733. Furthermore, this clause shall not impair nor prejudice the U.S.

Government’s right to EXPRESS remedies provided in the Contract (i.e. clause 552.238- 72 – Price Reductions, clause 52.212-4(h) – Patent Indemnification, Liability for Injury or Damage (Section 3 of the Price List), and GSAR 552.215-72 – Price Adjustment – Failure to Provide Accurate Information).

16. Further Contact. Salesforce.com may contact you regarding new Salesforce.com service features and offerings.

17. Third Party Beneficiary. SFDC shall be a third party beneficiary to the agreement between You and Reseller solely as it relates to these SFDC Service Terms.

SAP Confidential
SAP General Terms and Conditions enUS.v.5-2011
1 SOFTWARE LICENSE AND SUPPORT AGREEMENT
General Terms and Conditions
("GTC")

1. DEFINITIONS.

1.1 “Add-on” means any development using SAP API’s that adds new and independent functionality, but does not modify existing SAP functionality.

1.2 “Agreement” means these GTCs, any Order Form referencing these GTCs, and the Use Terms and Schedules referenced by these GTCs and/or such Order Forms. All such components are integral to the agreement, and collectively are referred to herein as the “Agreement”.

1.3 “API” means SAP’s application programming interfaces, as well as other SAP code that allow other software products to communicate with or call on SAP Software (for example, SAP Enterprise Services, BAPIs, Idocs, RFCs and ABAP or other user exits) provided under this Agreement.

1.4 “Affiliate” mean any legal entity in the Territory in which the Licensee, directly or indirectly, holds more than fifty percent (50%) of the shares or voting rights. Any such legal entity shall be considered an Affiliate for only such time as such equity interest is maintained.

1.5 “Business Partner” means a legal entity that requires access to the Software in connection with Licensee’s internal business operations, such as customers, distributors and/or suppliers of Licensee.

1.6 "Confidential Information" means, with respect to SAP, all information which SAP protects against unrestricted disclosure to others, including but not limited to: (a) the Software and Documentation and other SAP Materials, including without limitation the following information regarding the Software: (i) computer software (object and source codes), programming techniques and programming concepts, methods of processing, system designs embodied in the Software; (ii) benchmark results, manuals, program listings, data structures, flow charts, logic diagrams, functional specifications, file formats; and (iii) discoveries, inventions, concepts, designs, flow charts, documentation, product specifications, application program interface specifications, techniques and processes relating to the Software; (b) the research and development or investigations of SAP; (c) product offerings, content partners, product pricing, product availability, technical drawings, algorithms, processes, ideas, techniques, formulas, data, schematics, trade secrets, know-how, improvements, marketing plans, forecasts and strategies; and (d) any information about or concerning any third party (which information was provided to SAP subject to an applicable confidentiality obligation to such third party). With respect to Licensee, “Confidential Information” means all information which Licensee protects against unrestricted disclosure to others and which (i) if in tangible form, Licensee clearly identifies as confidential or proprietary at the time of disclosure; and (ii) if in intangible form (including disclosure made orally or visually), Licensee identifies as confidential at the time of disclosure, summarizes the Confidential Information in writing, and delivers such summary within thirty (30) calendar days of any such disclosure.

1.7 "Documentation" means SAP's documentation which is delivered or made available to Licensee with the Software under this Agreement.

1.8 “Intellectual Property Rights” means patents of any type, design rights, utility models or other similar invention rights, copyrights, mask work rights, trade secret or confidentiality rights, trademarks, trade names and service marks and any other intangible property rights, including applications and registrations for any of the foregoing, in any country, arising under statutory or common law or by contract and whether or not perfected, now existing or hereafter filed, issued, or acquired.

1.9 "Modification" means (i) a change to the delivered source code or metadata; or (ii) any development, other than a change to the delivered source code or metadata, that customizes, enhances, or changes existing functionality of the Software including, but not limited to, the creation of any new application program interfaces, alternative user interfaces or the extension of SAP data structures; or (iii) any other change to the Software (other than an Add-on) utilizing or incorporating any SAP Materials (defined below).

1.10 “Professional Services Schedule” means the terms and conditions governing SAP’s delivery of professional services, attached hereto and made a part hereof.

1.11 “SAP Materials” means any software, programs, tools, systems, data, or other materials made available by SAP to Licensee in the course of the performance under this Agreement including, but not limited to, the Software and Documentation, as well as any information, materials or feedback provided by Licensee to SAP relating to the Software and Documentation.

1.12 “SAP Support” means SAP’s then-current SAP support offering specified in the applicable Order Forms and made available to Licensee as stated in the applicable SAP Support Schedule found at www.sap.com/company/legal/index.epx as of the effective date of the first Software Order Form issued under these GTCs. Such SAP Support Schedule is incorporated herein by reference. For the avoidance of doubt, such SAP Support Schedule shall apply to all Order Forms issued under these GTCs, unless otherwise agreed by the parties. SAP recommends Licensee prints a copy of the applicable SAP Support Schedule for Licensee’s own records.

1.13 "Software" means (i) any and all software products licensed to Licensee under this Agreement as specified in Software Order Forms hereto, all as developed by or for SAP, SAP AG, Business Objects Software Limited and/or any of their affiliated companies and delivered to Licensee hereunder; (ii) any new releases thereof made available through unrestricted shipment pursuant to the respective support agreement and (iii) any complete or partial copies of any of the foregoing.

1.14 “Software Order Form” means the order form for the Software and related SAP Support ordered by Licensee thereunder, including information on Software, SAP Support, fees, and other information necessary for the delivery of such items to Licensee.

SAP Confidential
SAP General Terms and Conditions enUS.v.5-2011
2 The Software Order Form does not include fees for professional services, which shall be billed under separate statements of work in accord with the Professional Services Schedule.

1.15 "Territory" means the world except for those countries prohibited by United States’ export laws, and further subject to Section

12.4 of the GTC.

1.16 “Third Party Software” means (i) any and all software products and content licensed to Licensee under this Agreement as specified in Software Order Forms hereto, all as developed by companies other than SAP, SAP AG, Business Objects Software Limited and/or any of their affiliated companies and delivered to Licensee hereunder; (ii) any new releases thereof made available through unrestricted shipment pursuant to the respective SAP Support Schedule and (iii) any complete or partial copies of any of the foregoing.

1.17 "Use" means to activate the processing capabilities of the Software, load, execute, access, employ the Software, or display information resulting from such capabilities.

1.18 “Use Terms” means, with regard to Software specified in a Software Order Form, the SAP Software Use Rights document current at the time of execution of such Software Order Form, copies of which are found at www.sap.com/company/legal/index.epx and made a part hereof. Such SAP Software Use Rights documents are incorporated herein by reference. SAP recommends Licensee prints copies of the applicable SAP Software Use Rights documents for Licensee’s own records

2. LICENSE GRANT.

2.1 License.

2.1.1 Subject to Licensee’s compliance with all the terms and conditions of this Agreement, SAP grants to Licensee a nonexclusive, perpetual (except for subscription based or term licenses) license to Use the Software, Documentation, and other SAP Materials at specified site(s) within the Territory to run Licensee’s and its Affiliates’ internal business operations (including customer back-up and passive disaster recovery) and to provide internal training and testing for such internal business operations and as further set forth in the Software Order Form, unless terminated in accordance with Section 5 herein. This license does not permit Licensee (without being limited specifically to such restrictions) to: (i) use the SAP Materials to provide services to third parties (e.g., business process outsourcing, service bureau applications or third party training) other than to Affiliates (subject to Section 2.2); (ii) lease, loan, resell, sublicense or otherwise distribute the SAP Materials, other than distribution to Affiliates (subject to Section 2.2); (iii) make any Use of or perform any acts with respect to the SAP Materials other than as expressly permitted in accordance with the terms of this Agreement; or (iv) use Software components other than those specifically identified in the Software Order Form, even if it is also technically possible for Licensee to access other Software components. Business Partners may Use the Software only through screen access and solely in conjunction with Licensee’s Use and may not Use the Software to run any of Business Partners’ business operations.

2.1.2 Licensee agrees to install the Software only on information technology devices (e.g. hard disks or central processing units) identified by Licensee pursuant to this Agreement and that has been previously approved by SAP in writing or otherwise officially made known to the public as appropriate for Use or interoperation with the Software (the “Designated Unit”). Licensee must hold the required licenses as stated herein and in the applicable Order Forms, for any individuals that Use the Software, including employees or agents of Affiliates and Business Partners. Use may occur by way of an interface delivered with or as a part of the Software, a Licensee or third-party interface, or another intermediary system.

2.1.3 The terms and conditions of this Agreement relative to “Software” apply to Third Party Software except as otherwise stated in the Software Use Rights Schedule, a Schedule, an Order Form, or an Amendment.

2.2 Affiliate Use. Affiliates’ Use of the Software, Documentation and other SAP Materials to run their internal business operations as permitted under Section 2.1.1 is subject to the following: (i) the Affiliate agrees to be bound by the terms herein in the form of Schedule A (“Affiliate Use Agreement”) attached hereto; and (ii) a breach of such Affiliate Use Agreement by Affiliate shall be considered a breach by Licensee hereunder. If Licensee has an affiliate or subsidiary with a separate agreement for SAP software licenses and/or support services with SAP AG, any SAP AG affiliate (including SAP) or any other distributor of SAP software, the Software shall not be Used to run such affiliate’s or subsidiary’s business operations and such affiliate or subsidiary shall not receive any support services under this Agreement even if such separate agreement has expired or is terminated, unless otherwise agreed to in writing by the parties.

2.3 Outsourcing Services. With SAP’s prior written consent, Licensee may permit services providers to access the Software solely for the purpose of providing facility, implementation, systems, application management or disaster recovery services to Licensee in connection with the business of Licensee for which the Software is herein licensed provided: (i) Licensee and such services provider execute a written agreement that includes provisions requiring such services provider’s compliance with the terms of this Agreement prior to such access, including without limitation non-disclosure of SAP Confidential Information; (ii) Licensee shall hold the required licenses as stated in the Use Terms for all employees of such services provider authorized to access the Software; (iii) such services provider shall be permitted to Use the Software solely to install and configure the Software in accordance with the business of Licensee as set forth herein (or in the case of a disaster recovery vendor, to provide disaster recovery services only); (iv) under no circumstances may such services provider Use the Software to operate or provide processing services to Licensee or any other party, or in connection with such services provider’s own business operations; (v) Licensee shall be responsible for any additional Software, migration tools, or third party software needed to effect such transition; and (vi) Licensee expressly agrees to indemnify SAP, its officers, employees, agents and subcontractors from and against all claims, liabilities, losses, damages and costs (including reasonable attorney fees) suffered by SAP arising from a breach by the services provider of the conditions of this Agreement. Upon SAP request, Licensee shall provide written confirmation to SAP that items (i)-(iv) are fulfilled.

3. VERIFICATION. SAP shall be permitted to audit (at least once annually and in accordance with SAP standard procedures, which may include on-site and/or remote audit) the usage of the SAP Materials. Licensee shall cooperate reasonably in the conduct of such audits. In the event an audit reveals that (i) Licensee underpaid license fees and/or SAP Support fees to SAP and/or (ii) that Licensee has Used the Software in excess of the license quantities or levels stated in the Software Order Form, Licensee shall pay such underpaid fees and/or for such excess usage based on SAP List of Prices and Conditions Software and Support governing use in effect at the time of the audit, and shall execute an additional Software Order Form in accordance with the terms of this Agreement SAP Confidential
SAP General Terms and Conditions enUS.v.5-2011
3 to affect the required licensing of any additional quantities or levels. Reasonable costs of SAP’s audit shall be paid by Licensee if the audit results indicate usage in excess of the licensed quantities or levels. SAP reserves all rights at law and equity with respect to both Licensee’s underpayment of License fees or SAP Support fees and usage in excess of the license quantities or levels.

4. PRICE, PAYMENT, AND DELIVERY.

4.1 Fees. Licensee shall pay to SAP license fees for the Software and fees for SAP Support on the terms in Software Order Forms hereto. Fees for consulting services will be paid as set forth in the Professional Services Schedule. Any fees not paid when due shall accrue interest at the rate of 18% (eighteen percent) per annum, but not to exceed the maximum amount as allowed by law.

4.2 Taxes. Fees and other charges described in this Agreement do not include federal, state or local sales, foreign withholding, use, property, excise, service, or similar transaction taxes (“Tax(es)”) now or hereafter levied, all of which shall be for Licensee’s account. Any applicable direct pay permits or valid tax-exempt certificates must be provided to SAP prior to the execution of this Agreement. If SAP is required to pay Taxes, Licensee shall reimburse SAP for such amounts. Licensee hereby agrees to indemnify SAP for any Taxes and related costs, interest and penalties paid or payable by SAP.

4.3 Delivery of the Software and SAP Support. SAP will deliver the Software and SAP Support by making it available for electronic download through the SAP ServiceMarketplace (http://service.sap.com/swdc) to Licensee. Risk of loss passes at the time of such electronic delivery. Licensee agrees not to request any physical delivery of Software or SAP Support and should it occur that any such delivery will be rejected by Licensee. Licensee agrees and understands that the calculation of Taxes may be affected by the delivery method and delivery location of the Software and corresponding SAP Support.

5. TERM.

5.1. Term. This Agreement and the license granted hereunder shall become effective as of the date first set forth in the first Software Order Form issued under these GTCs, and shall continue in effect thereafter unless this Agreement is terminated upon the earliest to occur of the following: (i) thirty days after Licensee gives SAP written notice of Licensee's direction to terminate this Agreement, for any reason, but only after payment of all license and SAP Support fees then due and owing; (ii) thirty days after SAP gives Licensee notice of Licensee's material breach of any provision of the Agreement (other than Licensee's breach of its obligations under Sections 6, 10 or 11, which breach shall result in immediate termination), including more than thirty days delinquency in Licensee's payment of any money due hereunder, unless Licensee has cured such breach during such thirty day period; (iii) immediately if Licensee files for bankruptcy, becomes insolvent, or makes an assignment for the benefit of creditors. For the avoidance of any doubt, termination of the Agreement shall strictly apply to all licenses under the Agreement, its appendices, schedules, addenda and order documents and any partial termination of the Agreement by Licensee shall not be permitted in respect of any part of the Agreement, its appendices, schedules, addenda, order documents.

5.2 End of Term Duties. Upon any termination hereunder, Licensee and its Affiliates shall immediately cease Use of all SAP Materials and Confidential Information. Within thirty (30) days after any termination, Licensee shall irretrievably destroy or upon SAP’s request deliver to SAP all copies of the SAP Materials and Confidential Information in every form, except to the extent it is legally required to keep it for a longer period in which case such return or destruction shall occur at the end of such period. Licensee must certify to SAP in writing that it has satisfied its obligations under this Section 5.2. Licensee agrees to certify in writing to SAP that it and each of its Affiliates has performed the foregoing. Sections 3, 4, 5.2, 6, 7.2, 8, 9, 10, 12.4, 12.5, 12.6 and 12.8 shall survive such termination. In the event of any termination hereunder, Licensee shall not be entitled to any refund of any payments made by Licensee. Termination shall not relieve Licensee from its obligation to pay fees that remain unpaid.

6. INTELLECTUAL PROPERTY RIGHTS.

6.1 Reservation of Rights. The SAP Materials, and all Intellectual Property Rights embodied in the foregoing, shall be the sole and exclusive property of SAP, SAP AG (the parent company of SAP) or its or their licensors, subject to any rights expressly granted to Licensee in Section 2 and 6.3 herein. Except for the rights set forth in Section 6.3 herein, Licensee is not permitted to modify or otherwise make derivative works of the Software. Any such unauthorized works developed by Licensee, and any Intellectual Property Rights embodied therein, shall be the sole and exclusive property of SAP or SAP AG.

6.2 Protection of Rights. Licensee shall not copy, translate, disassemble, or decompile, nor create or attempt to create the source code from the object code of the Software in any manner. Reverse engineering of the Software and other SAP Materials is prohibited. Licensee is permitted to back up data in accordance with good information technology practice and for this purpose to create the necessary backup copies of the Software. Backup copies on transportable discs or other data media must be marked as backup copies and bear the same copyright and authorship notice as the original discs or other data media. Licensee must not change or remove SAP’s copyright and authorship notices.

6.3 Modifications/Add-ons.

6.3.1 Conditioned on Licensee’s compliance with the terms and conditions of this Agreement, Licensee may make Modifications and/or Add-ons to the Software in furtherance of its permitted Use under this Agreement, and shall be permitted to use Modifications and Add-ons with the Software in accordance with the License grant to the Software set forth in Section 2.1.1 herein. Licensee shall comply with SAP’s registration procedure prior to making Modifications or Add-ons. All Modifications and all rights associated therewith shall be the exclusive property of SAP and SAP AG. All Add-ons developed by SAP (either independently or jointly with Licensee) and all rights associated therewith shall be the exclusive property of SAP and SAP AG. Licensee agrees to execute those documents reasonably necessary to secure SAP’s rights in the foregoing. All Add-ons developed by or on behalf of Licensee without SAP’s participation (“Licensee Add-on”), and all rights associated therewith, shall be the exclusive property of Licensee subject to SAP’s rights in and to the Software; provided, Licensee shall not commercialize, market, distribute, license, sublicense, transfer, assign or otherwise alienate any such Licensee Add-ons. SAP retains the right to independently develop its own Modifications or Add-ons to the Software, and Licensee agrees not to take any action that would limit SAP’s sale, assignment, licensing or use of its own Software or Modifications or Add-ons thereto.

6.3.2 Any Modification developed by or on behalf of Licensee without SAP’s participation or Licensee Add-on must not (and subject to other limitations set forth herein): enable the bypassing or circumventing any of the restrictions set forth in this Agreementand/or provide Licensee with access to the Software to which Licensee is not directly licensed; nor permit mass data extraction from SAP Confidential
SAP General Terms and Conditions enUS.v.5-2011
4 Software to any non-SAP software, including use, modification saving or other processing of data in the non-SAP software; nor unreasonably impair, degrade or reduce the performance or security of the Software; nor render or provide any information concerning SAP software license terms, Software, or any other information related to SAPproducts.

6.3.3 Licensee covenants, on behalf of itself and its successors and assigns, not to assert against SAP or its affiliated companies, or their resellers, distributors, suppliers, commercial partners and customers, any rights in any Modifications developed by or on behalf of Licensee without SAP participation or Licensee Add-ons , or any other functionality of the SAP Software accessed by such Modification developed by or on behalf of Licensee without SAP participation or Licensee Add-on.

7. PERFORMANCE WARRANTY.

7.1 Warranty. SAP warrants that the Software will substantially conform to the specifications contained in the Documentation for six months following delivery. The warranty shall not apply: (i) if the Software is not used in accordance with the Documentation; or (ii) if the defect is caused by a Modification or Add-on (other than a Modification or Add-on made by SAP and which is provided through SAP Support or under warranty), Licensee or third-party software. SAP does not warrant that the Software will operate uninterrupted or that it will be free from minor defects or errors that do not materially affect such performance, or that the applications contained in the Software are designed to meet all of Licensee's business requirements. Provided Licensee notifies SAP in writing with a specific description of the Software’s nonconformance within the warranty period and SAP validates the existence of such nonconformance, SAP will, at its option: a) repair or replace the nonconforming Software, or b) refund the license fees paid for the applicable nonconforming Software in exchange for a return of such nonconforming Software. This is Licensee’s sole and exclusive remedy under this warranty.

7.2 Express Disclaimer. SAP AND ITS LICENSORS DISCLAIM ALL OTHER WARRANTIES EXPRESS OR IMPLIED, INCLUDING

WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE EXCEPT TO THE EXTENT THAT ANY WARRANTIES IMPLIED BY LAW CANNOT BE VALIDLY WAIVED.

8. INDEMNIFICATION.

8.1 Infringement and Defense of Licensee. SAP shall defend Licensee against claims brought against Licensee in the Territory by any third party alleging that Licensee's Use of the Software, in accordance with the terms and conditions of this Agreement, constitutes a direct infringement or misappropriation of a patent claim(s), copyright or trade secret rights, and SAP will pay damages finally awarded against Licensee (or the amount of any settlement SAP enters into) with respect to such claims. This obligation of SAP shall not apply if the alleged infringement or misappropriation results from Use of the Software in conjunction with any other software, an apparatus other than a Designated Unit, failure to use an update promptly provided by SAP if such infringement or misappropriation could have been avoided by use of the update, or unlicensed activities. This obligation of SAP also shall not apply if Licensee fails to timely notify SAP in writing of any such claim. SAP is permitted to control fully the defense and any settlement of any such claim as long as such settlement shall not include a financial obligation on Licensee. In the event Licensee declines SAP’s proffered defense, or otherwise fails to give full control of the defense to SAP’s designated counsel, then Licensee waives SAP’s obligations under this Section 8.1. Licensee shall cooperate fully in the defense of such claim and may appear, at its own expense, through counsel reasonably acceptable to SAP. SAP expressly reserves the right to cease such defense of any claim(s) in the event the Software is no longer alleged to infringe or misappropriate, or is held not to infringe or misappropriate, the third party’s rights.

SAP may settle or mitigate damages arising from any claim or potential claim, by substituting alternative substantially equivalent non-infringing programs and supporting documentation for the Software. Licensee shall not undertake any action in response to any infringement or misappropriation, or alleged infringement or misappropriation of the Software that is prejudicial to SAP’s rights.

8.2 THE PROVISIONS OF THIS SECTION 8 STATE THE SOLE, EXCLUSIVE, AND ENTIRE LIABILITY OF SAP AND ITS LICENSORS TO

LICENSEE, AND IS LICENSEE'S SOLE REMEDY, WITH RESPECT TO THE INFRINGEMENT OR MISAPPROPRIATION OF THIRD-PARTY INTELLECTUAL PROPERTY RIGHTS.

9. LIMITATIONS OF LIABILITY.

9.1 Not Responsible. SAP and its licensors will not be responsible under this Agreement (i) if the Software is not used in accordance with the Documentation; or (ii) if the defect or liability is caused by Licensee, a Modification or Add-on (other than a Modification or Add-on made by SAP which is provided through SAP Support or under warranty), or third-party software. SAP AND

ITS LICENSORS SHALL NOT BE LIABLE FOR ANY CLAIMS OR DAMAGES ARISING FROM INHERENTLY DANGEROUS USE OF THE SOFTWARE AND/OR THIRD-PARTY SOFTWARE LICENSED HEREUNDER.

9.2 Exclusion of Damages; Limitation of Liability. ANYTHING TO THE CONTRARY HEREIN NOTWITHSTANDING, EXCEPT FOR

DAMAGES RESULTING FROM UNAUTHORIZED USE OR DISCLOSURE OF CONFIDENTIAL INFORMATION OR DEATH OR PERSONAL INJURY ARISING FROM EITHER PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, UNDER NO CIRCUMSTANCES AND

REGARDLESS OF THE NATURE OF ANY CLAIM SHALL SAP, ITS LICENSORS OR LICENSEE BE LIABLE TO EACH OTHER OR ANY OTHER

PERSON OR ENTITY FOR AN AMOUNT OF DAMAGES IN EXCESS OF THE PAID LICENSE FEES FOR THE SOFTWARE DIRECTLY

CAUSING THE DAMAGES OR BE LIABLE IN ANY AMOUNT FOR SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR INDIRECT DAMAGES, LOSS OF GOOD WILL OR BUSINESS PROFITS, WORK STOPPAGE, DATA LOSS, COMPUTER FAILURE OR MALFUNCTION, ATTORNEYS’ FEES, COURT COSTS, INTEREST OR EXEMPLARY OR PUNITIVE DAMAGES. The provisions of this Agreement allocate the risks between SAP and Licensee. The license fees reflect this allocation of risk and the limitations of liability herein.

10. CONFIDENTIALITY.

10.1. Use of Confidential Information. Confidential Information shall not be reproduced in any form except as required to accomplish the intent of this Agreement. Any reproduction of any Confidential Information of the other shall remain the property of the disclosing party and shall contain any and all confidential or proprietary notices or legends which appear on the original. With respect to the Confidential Information of the other, each party : (a) shall take all Reasonable Steps (defined below) to keep all Confidential Information strictly confidential; and (b) shall not disclose any Confidential Information of the other to any person other than its bona fide individuals whose access is necessary to enable it to exercise its rights hereunder. As used herein “Reasonable Steps” means those steps the receiving party takes to protect its own similar proprietary and confidential information, which shall not be less than a reasonable standard of care. Confidential Information of either party disclosed prior to execution of this Agreement shall be subject to the protections afforded hereunder.

SAP Confidential
SAP General Terms and Conditions enUS.v.5-2011
5 10.2 Exceptions. The above restrictions on the use or disclosure of the Confidential Information shall not apply to any Confidential Information that: (a) is independently developed by the receiving party without reference to the disclosing party’s Confidential Information, or is lawfully received free of restriction from a third party having the right to furnish such Confidential Information; (b) has become generally available to the public without breach of this Agreement by the receiving party; (c) at the time of disclosure, was known to the receiving party free of restriction; or (d) the disclosing party agrees in writing is free of suchrestrictions.

10.3 Confidential Terms and Conditions; Publicity. Licensee shall not disclose the terms and conditions of this Agreement or the pricing contained therein to any third party. Neither party shall use the name of the other party in publicity, advertising, or similar activity, without the prior written consent of the other, except that Licensee agrees that SAP may use Licensee's name in customer listings or, at times mutually agreeable to the parties, as part of SAP's marketing efforts (including without limitation reference calls and stories, press testimonials, site visits, SAPPHIRE participation).

11. ASSIGNMENT. Licensee may not, without SAP's prior written consent, assign, delegate, pledge, or otherwise transfer this Agreement, or any of its rights or obligations under this Agreement, or the SAP Materials or SAP Confidential Information, to any party, whether voluntarily or by operation of law, including by way of sale of assets, merger or consolidation. SAP may assign this Agreement to any of its affiliates.

12. GENERAL PROVISIONS.

12.1 Severability. It is the intent of the parties that in case any one or more of the provisions contained in this Agreement shall be held to be invalid or unenforceable in any respect, such invalidity or unenforceability shall not affect the other provisions of this Agreement, and this Agreement shall be construed as if such invalid or unenforceable provision had never been contained herein.

12.2 No Waiver. If either party should waive any breach of any provision of this Agreement, it shall not thereby be deemed to have waived any preceding or succeeding breach of the same or any other provision hereof.

12.3 Counterparts. This Agreement may be signed in two counterparts, each of which shall be deemed an original and which shall together constitute one Agreement.

12.4 Regulatory Matters. The Software, Documentation and SAP Materials are subject to the export control laws of various countries, including without limit the laws of the United States and Germany. Licensee agrees that it will not submit the Software, Documentation or other SAP Materials to any government agency for licensing consideration or other regulatory approval without the prior written consent of SAP, and will not export the Software, Documentation and SAP Materials to countries, persons or entities prohibited by such laws. Licensee shall also be responsible for complying with all applicable governmental regulations of the country where Licensee is registered, and any foreign countries with respect to the use of the Software, Documentation or other SAP Materials by Licensee and/or its Affiliates.

12.5 Governing Law; Limitations Period. This Agreement and any claims arising out of or relating to this Agreement and its subject matter shall be governed by and construed under the laws of Commonwealth of Pennsylvania without reference to its conflicts of law principles. In the event of any conflicts between foreign law, rules, and regulations, and United States law, rules, and regulations, United States law, rules, and regulations shall prevail and govern. The United Nations Convention on Contracts for the International Sale of Goods shall not apply to this Agreement. The Uniform Computer Information Transactions Act as enacted shall not apply. Licensee must initiate a cause of action for any claim(s) arising out of or relating to this Agreement and its subject matter within one (1) year from the date when Licensee knew, or should have known after reasonable investigation, of the facts giving rise to the claim(s).

12.6 Notices. All notices or reports which are required or may be given pursuant to this Agreement shall be in writing and shall be deemed duly given when delivered to the respective executive offices of SAP and Licensee at the addresses first set forth in any Software Order Form. Where in this section 12.6 or elsewhere in this Agreement written form is required, that requirement can be met by facsimile transmission, exchange of letters or other written form.

12.7 Force Majeure. Any delay or nonperformance of any provision of this Agreement (other than for the payment of amounts due hereunder) caused by conditions beyond the reasonable control of the performing party shall not constitute a breach of this Agreement, and the time for performance of such provision, if any, shall be deemed to be extended for a period equal to the duration of the conditions preventing performance.

12.8 Entire Agreement. This Agreement constitutes the complete and exclusive statement of the agreement between SAP and Licensee, and all previous representations, discussions, and writings are merged in, and superseded by this Agreement and the parties disclaim any reliance on any such representations, discussions and writings. This Agreement may be modified only by a writing signed by both parties. This Agreement shall prevail over any additional, conflicting, or inconsistent terms and conditions which may appear on any purchase order or other document furnished by Licensee to SAP. This Agreement shall prevail over any additional, conflicting or inconsistent terms and conditions which may appear in any clickwrap end user agreement included in the Software. Signatures sent by electronic means (facsimile or scanned and sent via e-mail) shall be deemed original signatures. This Agreement does not create any partnership, joint venture or principal and agent relationship.

12.9 Hierarchy. The following order of precedence shall be applied in the event of conflict or inconsistency between provisions of the components of this Agreement: (i) the Software Order Form; (ii) the Schedules; (iii) the Use Terms; and (iv) the GTC.

SAP Confidential
SAP General Terms and Conditions enUS.v.5-2011
7 Schedule B to the GTC
“Professional Services Schedule”
The parties agree that this Schedule is hereby annexed to and made a part of the GTC. In each instance in which provisions of this Schedule contradict or are inconsistent with the provisions of the GTC, the provisions of this Schedule shall prevail andgovern.

WHEREAS, Licensee licensed from SAP the right to Use SAP Software pursuant to the Agreement and SAP provides, through its employees, affiliates, and third party contractors (“Consultants”), consulting and professional services (“Services”) including support of installation and implementation of the licensed Software in the United States.

1. Services. Upon request by Licensee, SAP will provide a Consultant(s) to perform, at Licensee’s direction, consulting and professional services including support of installation and implementation of the applicable SAP Software (“Services”). Any Statement(s) of Work (“SOW”) more fully describing the project assumptions, scope, duration and fees for the Services shall reference this Schedule. All Services of the SAP Consultant(s) will be coordinated with the designated Licensee representative. Licensee is responsible for making the necessary internal arrangements for the carrying out of the Services on a non-interference basis.

2. Satisfaction with Performance. If at any time Licensee or SAP is dissatisfied with the material performance of an assigned Consultant or a Licensee project team member, the dissatisfied party shall immediately report such dissatisfaction to the other party in writing and may request a replacement. The other party shall use its reasonable discretion in accomplishing any such change.

3. Compensation of SAP. All Services will be provided by SAP on a time and expense basis at SAP’s then current rates, unless otherwise agreed by the parties in a SOW.

4. Taxes. The fees listed in the applicable SOW do not include taxes. If SAP is required to pay sales, use, property, value-added or other taxes based on the Services provided under this Schedule, then such taxes shall be billed to and paid by Licensee.

This section shall not apply to taxes based on SAP’s income. Licensee also agrees to pay SAP for additional tax amounts if any, created by the taxability of Consultants reimbursed travel and living expenses resulting from long term assignments at Licensee’s locations.

5. Work Product. Unless otherwise agreed to in writing by the parties in a SOW, SAP shall have the sole and exclusive right, title and ownership to any and all ideas, concepts, or other intellectual property rights related in any way to the techniques, knowledge or processes of the SAP Services and deliverables, whether or not developed for Licensee.

6. Warranty. SAP warrants that its Services shall be performed consistent with generally accepted industry standards. SAP

MAKES NO WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, NOR ANY OTHER WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, IN CONNECTION WITH THIS SCHEDULE AND THE SERVICES PROVIDEDHEREUNDER.

7. Limitation of Liability. WITH RESPECT TO SERVICES, ANYTHING TO THE CONTRARY NOTWITHSTANDING, EXCEPT FOR DAMAGES RESULTING FROM UNAUTHORIZED USE OR DISCLOSURE OF THE PROPRIETARY INFORMATION AND SAP’S RIGHT

TO COLLECT UNPAID FEES, UNDER NO CIRCUMSTANCES SHALL SAP, ITS CONSULTANTS OR LICENSEE BE LIABLE TO EACH

OTHER OR ANY OTHER PERSON OR ENTITY FOR AN AMOUNT OF DAMAGES IN EXCESS OF THE FEES PAID FOR THE

APPLICABLE SERVICES HEREUNDER OR BE LIABLE IN ANY AMOUNT FOR SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR

INDIRECT DAMAGES, LOSS OF GOOD WILL OR BUSINESS PROFITS, WORK STOPPAGE, DATA LOSS, COMPUTER FAILURE OR MALFUNCTION, OR EXEMPLARY OR PUNITIVE DAMAGES. The provisions of the Schedule allocate the risks between SAP and Licensee. The License Fees reflect this allocation of risk and the limitations of liability herein.

8. Termination. The terms of this Schedule shall be effective as of the Effective Date of the Agreement and shall remain in effect until terminated by either party upon thirty (30) days prior written notice or otherwise in accordance with a particular SOW.

Licensee shall be liable for payment to SAP for all Services provided prior to the effective date of any such termination, including any expenses incurred pursuant to the provision of such Services, in accord with the applicable SOW.

9. General Provisions.

9.1 SAP may subcontract all or part of the Services to be performed to a qualified third party.

9.2 With respect to the Services provided by SAP under this Schedule and any SOW hereto, the relationship of SAP and Licensee is that of an independent contractor.

9.3 This Schedule, including any applicable SOWs, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements between the parties, whether written or oral, relating to the same subject matter. In the event of any inconsistencies between this Schedule and a SOW, the SOW shall take precedence over the Schedule. Any purchase order or other document issued by Licensee is for administrative convenience only.

10. Survival. Sections 5 and 7 above shall survive any termination of this Schedule.

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 1 (version 11/4/2014)

SUBSCRIPTION SERVICE AGREEMENT
This Subscription Service Agreement (including the Subscription Service Guide, attached hereto) (“Agreement”) is made between the ServiceNow entity (“ServiceNow”) and the customer entity (“Customer”) on the ordering document and becomes effective on the last signature date of the ordering document issued by ServiceNow (“Effective Date”).

The Subscription Service Guide includes: (1) the Customer Support Policy; (2) the Upgrade Policy; (3) the Data Security Guide; and (4) any other attachment set forth or referenced in the Subscription Service Guide. The Subscription Service Guide is posted on www.servicenow.com/schedules.do and incorporated herein by reference.

Pursuant to a separate transaction between Customer and ServiceNow’s authorized reseller (“Reseller”), Customer has purchased from Reseller certain services to be delivered by ServiceNow. This Agreement specifies the terms and conditions under which those services will be provided, apart from price, payment and other terms specified in the separate agreement between Customer and Reseller.

1. DEFINITIONS

1.1. “Confidential Information” means: (a) ServiceNow Core Technology (which is Confidential Information of ServiceNow); (b) Customer Data and Customer Technology (which are Confidential Information of Customer); (c) any other information of a party that is disclosed in writing or orally and is designated as Confidential or Proprietary at the time of disclosure (and, in the case of oral disclosures, summarized in writing within thirty (30) days of the initial disclosure and delivered to the receiving party), or that due to the nature of the information the receiving party would clearly understand it to be confidential information of the disclosing party; and (d) the specific terms and conditions of this Agreement, any Use Authorization, any SOW, and any amendment and attachment thereof, between the parties. Confidential Information shall not include any information that: (i) is or becomes generally known to the public through no fault or breach of this Agreement by the receiving party; (ii) was rightfully in the receiving party’s possession at the time of disclosure without restriction on use or disclosure; (iii) is independently developed by the receiving party without use of the disclosing party's Confidential Information; or (iv) was or is rightfully obtained by the receiving party from a third party not under a duty of confidentiality and without restriction on use or disclosure.

1.2. “Customer Data” means electronic data uploaded by or for Customer and Customer’s agents, employees and contractors, and processed in the Subscription Service, excluding the ServiceNow Core Technology.

1.3. “Customer Technology” means software, methodologies, templates, business processes, documentation or other material authored, invented or otherwise created or licensed (other than by or from ServiceNow) by Customer using or for use with the Subscription Service, excluding the ServiceNow Core Technology.

1.4. “Development Tools” means source code, application programming interfaces (APIs), executable software and tools in human readable format made available by ServiceNow for the implementation, customization, configuration, and use of the Subscription Service, such as scripts, code snippets, sample code, and development tools published by ServiceNow.

1.5. “Documentation” means the ServiceNow product documentation relating to the operation and use of the Subscription Service, Software and Development Tools, including technical program or interface documentation, user manuals, operating instructions and release notes, as updated from time to time by ServiceNow.

1.6. “Product Overview” means the description of the ordered products and their functionalities attached to a Use Authorization or referenced therein.

1.7. “Professional Services” means any services provided by ServiceNow pursuant to an agreed SOW or Service Description.

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 2 (version 11/4/2014)

1.8. “Service Description” means the written description for a packaged Professional Service, attached to a Use Authorization or referenced therein.

1.9. “ServiceNow Core Technology” means: (a) the Subscription Service; Software; Development Tools, Documentation; and ServiceNow technology and methodologies (including, without limitation, products, software tools, hardware designs, algorithms, templates, software (in source and object forms), architecture, class libraries, objects and documentation) existing as of the Effective Date or otherwise arising outside of work under a Professional Service; (b) updates, upgrades, improvements, configurations, extensions, and derivative works of the foregoing and related technical or end user documentation or manuals; and (c) intellectual property anywhere in the world relating to the foregoing.

1.10. “Software” means software provided by ServiceNow to Customer that operates on Customerprovided machines solely to facilitate the use of the Subscription Service.

1.11. “SOW” means a statement of work for Professional Services.

1.12. “Subscription Service” means the ServiceNow software as a service (SaaS) offering identified in a Use Authorization.

1.13. “Subscription Term” means the term of authorized use of the Subscription Service as set forth in the Use Authorization.

1.14. “Use Authorization” means a written document provided to Customer specifying the services that Customer has purchased, along with the term and scope of the authorized use thereof.

2. GRANT OF USE RIGHTS

2.1. SUBSCRIPTION SERVICE. Subject to the terms of this Agreement, ServiceNow authorizes Customer to access and use the purchased Subscription Service during the Subscription Term as set forth in an applicable Use Authorization for its internal business purposes in accordance with the Documentation. Customer shall not use or otherwise access the Subscription Service in a manner that exceeds Customer’s authorized use as set forth in this Agreement and the applicable Use Authorization.

2.2. SOFTWARE. ServiceNow grants Customer a limited, personal, worldwide, non-sublicensable, non-transferable (except as set forth in Section 10.1 (Assignment)), non-exclusive license during the Subscription Term to install and execute Software on machines operated by or for Customer solely to facilitate Customer’s authorized access to and use of the purchased Subscription Service. The Software may include code that is licensed under third party license agreements, including open source made available or provided with the Software. Software is licensed and not sold even if for convenience ServiceNow makes reference to words such as sale or purchase.

2.3. DEVELOPMENT TOOLS. In support of Customer’s authorized internal business use of the Subscription Service during the Subscription Term, ServiceNow grants to Customer a limited, personal, worldwide, non-sublicensable, non-transferable (except as set forth in Section 10.1 (Assignment)), non-exclusive license to download and make a reasonable number of copies of the Development Tools, and to use, copy, modify and create derivative works of the Development Tools, in: (a) using, implementing and integrating the ServiceNow applications with other software and systems; and (b) creating applications on the ServiceNow platform (to the extent Customer has purchased authorized use of the Subscription Service to create applications on the ServiceNow platform). Customer shall not use the Development Tools in a manner that causes it to exceed the limits of its authorized use of the Subscription Service as set forth in this Agreement and the Use Authorization. From time to time, ServiceNow may provide Development Tools subject to the terms and conditions of separate agreements which will be provided to Customer for review and to which Customer will be required to agree prior to use of such Development Tools; provided that ServiceNow shall not require Customer to agree to separate terms and conditions for any Development Tool that is necessary for Customer’s use of its ordered Subscription Service in conformance with the Product Overview unless set forth on the Use Authorization.

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 3 (version 11/4/2014)

2.4. RESTRICTIONS. Customer shall not (and shall not permit others to) do the following with respect to the ServiceNow Core Technology: (i) use the Subscription Service with external programs in a manner that intentionally circumvents contractual usage restrictions; (ii) license, sub-license, sell, re-sell, rent, lease, transfer, distribute or time share or otherwise make any of it available for access by third parties except as otherwise expressly provided in a Use Authorization; (iii) access it for the purpose of developing or operating products or services intended to be offered to third parties in competition with the Subscription Service; (iv) disassemble, reverse engineer or decompile it; (v) copy, create derivative works based on or otherwise modify it except as permitted in this Agreement; (vi) remove or modify a copyright or other proprietary rights notice in it; (vii) use it to reproduce, distribute, display, transmit or use material protected by copyright or other intellectual property right (including the rights of publicity or privacy) without first obtaining the permission of the owner; (viii) use it to create, use, send, store or run viruses or other harmful computer code, files, scripts, agents or other programs or otherwise engage in a malicious act or disrupt its security, integrity or operation; or (ix) access or disable any ServiceNow or third party data, software or network (other than Customer’s instance of the Subscription Service in accordance with this Agreement). Before Customer exercises any of the foregoing actions that Customer believes it is entitled to, Customer shall provide ServiceNow with thirty (30) days’ prior written notice to [email protected] (or, if applicable law or the relevant court order does not allow for such notice, then the maximum amount of notice allowable), and provide reasonably requested information to allow ServiceNow to assess Customer’s claim and, at ServiceNow’s sole discretion, provide alternatives that reduce adverse impacts on ServiceNow’s intellectual property and other rights.

3. ORDERING

3.1. RESELLER ORDERS. Customer shall order and purchase the Subscription Service and Professional Services directly from Reseller pursuant to a separate agreement specifying price, payment and other commercial terms. ServiceNow is not a party to such separate agreement but will provide the purchased services pursuant to this Agreement. For each order, Reseller or ServiceNow will provide Customer with a Use Authorization for Customer to sign and return to ServiceNow. ServiceNow will have no obligation to provide services unless and until it has received a Use Authorization signed by Customer. Reseller is not authorized to make any changes to this Agreement (including any Use Authorizations issued hereunder) or bind ServiceNow to any additional or different terms or conditions. Additional orders for ServiceNow products or services may be placed either through Reseller or ServiceNow, provided that if Customer places an order directly through ServiceNow, Customer shall sign an addendum to this Agreement setting forth pricing, payment and other commercial terms between Customer and ServiceNow.

3.2. USE VERIFICATION. ServiceNow or Reseller may remotely review Customer’s use of the Subscription Service, and upon ServiceNow or Reseller’s written request Customer shall provide any reasonable assistance, to verify Customer’s compliance with the Agreement. If ServiceNow determines that Customer has exceeded its permitted use of the Subscription Service then ServiceNow will notify Customer and within thirty (30) days thereafter Customer shall either: (i) disable any unpermitted use or (ii) purchase additional subscriptions commensurate with Customer’s actual use. If Customer fails to regain compliance within such thirty (30) day period or fails to make payment as provided in its agreement with Reseller, ServiceNow may suspend Customer’s use of the Subscription Service or terminate this Agreement for cause in accordance with Section 9 (Term and Termination), in addition to any other rights or remedies ServiceNow may have.

4. INTELLECTUAL PROPERTY

4.1. SERVICENOW OWNERSHIP. As between ServiceNow and Customer, all rights, title, and interest in and to all intellectual property rights in the ServiceNow Core Technology are owned exclusively by ServiceNow notwithstanding any other provision in this Agreement. Except as expressly provided in this Agreement, ServiceNow reserves all rights in the ServiceNow Core Technology and does not grant Customer any rights, express or implied or by estoppel.

4.2. CUSTOMER OWNERSHIP. As between Customer and ServiceNow, Customer shall retain all of its rights, title, and interest in and to its intellectual property rights in Customer Data and Customer Technology.

Customer hereby grants to ServiceNow a royalty-free, fully-paid, non-exclusive, non-transferable (except as set SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 4 (version 11/4/2014)
forth in Section 10.1 (Assignment)), sub-licensable, worldwide right to use Customer Data and Customer Technology solely for the purpose of providing the Subscription Service and Professional Services to Customer.

4.3. FEEDBACK. ServiceNow encourages Customer to provide suggestions, proposals, ideas, recommendations or other feedback regarding improvements to ServiceNow’s services and related resources. To the extent Customer provides such feedback, Customer grants to ServiceNow a royalty-free, fully paid, sublicensable, transferable (notwithstanding Section 10.1 (Assignment)), non-exclusive, irrevocable, perpetual, worldwide right and license to make, use, sell, offer for sale, import and otherwise exploit feedback (including by incorporation of such feedback into the ServiceNow Core Technology) without restriction.

4.4. PROFESSIONAL SERVICES. Subject to the provisions of this Section 4.4, ServiceNow shall assign to Customer any Newly Created IP (as defined below) in Deliverables upon payment in full by Customer of all amounts due for the Professional Service under which the Deliverable was created. A “Deliverable” is a deliverable that is identified in the applicable SOW or Service Description and that is created by ServiceNow for Customer in the performance of the Professional Services. “Newly Created IP” means intellectual property in any inventions or works of authorship that are made by ServiceNow specifically for Customer in the course of performing Professional Services for Customer that is identified as “Newly Created IP” in an SOW, excluding the ServiceNow Core Technology. To the extent (if at all) any ServiceNow Core Technology is incorporated into a Deliverable, ServiceNow grants to Customer a non-exclusive, royalty-free, non-transferable, non-sublicensable worldwide license to use the ServiceNow Core Technology solely to use the Deliverable in connection with the Subscription Service as contemplated under this Agreement during the Subscription Term. Nothing in this Agreement shall be deemed to restrict or limit ServiceNow’s right to perform similar Professional Services for any other party or to assign any employees or subcontractors to perform similar Professional Services for any other party or to use any information incidentally retained in the unaided memories of its employees providing Professional Services.

5. WARRANTIES

5.1. LIMITED SUBSCRIPTION SERVICE WARRANTY. ServiceNow warrants that during the Subscription Term Customer’s production instances of the Subscription Service shall materially conform to the Product Overview. To submit a warranty claim under this Section, Customer shall (1) reference this Section; and (2) submit a support request to resolve the non-conformity as provided in the Subscription Service Guide. If the non-conformity persists without relief more than thirty (30) days after written notice of a warranty claim provided to ServiceNow under this Section 5.1, then Customer may terminate the affected Subscription Service and submit to Reseller a claim for refund of any prepaid subscription fees covering the remainder of the Subscription Term of the affected Subscription Service after the date of termination. Notwithstanding the foregoing, this warranty shall not apply to any non-conformity due to a modification of or defect in the Subscription Service that is made or caused by any person other than ServiceNow or a person acting at ServiceNow’s direction. THIS SECTION 5.1 SETS FORTH CUSTOMER’S EXCLUSIVE RIGHTS AND REMEDIES (AND SERVICENOW’S SOLE LIABILITY) IN CONNECTION WITH THIS WARRANTY.

5.2. LIMITED PROFESSIONAL SERVICES WARRANTY. ServiceNow warrants that the Professional Services will be performed in a competent and workmanlike manner in accordance with accepted industry standards and practices and all material requirements set forth in the SOW or Service Description. Customer shall notify ServiceNow in writing of any breach within thirty (30) days after performance of the non-conforming Professional Services. Upon receipt of such notice, ServiceNow, at its option, shall either use commercially reasonable efforts to re-perform the Professional Services in conformance with these warranty requirements or shall terminate the affected Professional Services, in which case Customer may submit to Reseller a claim for a refund of any amounts paid for the nonconforming Professional Services. THIS SECTION 5.2 SETS FORTH CUSTOMER’S EXCLUSIVE RIGHTS AND REMEDIES (AND SERVICENOW’S SOLE LIABILITY) IN CONNECTION WITH THIS WARRANTY.

5.3. DISCLAIMER OF WARRANTIES. EXCEPT FOR THE WARRANTIES EXPRESSLY STATED IN

THIS AGREEMENT, TO THE MAXIMUM EXTENT ALLOWED BY LAW, SERVICENOW DISCLAIMS ALL

WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, ORAL OR WRITTEN, INCLUDING WARRANTIES SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 5 (version 11/4/2014)
ARISING UNDER STATUTE, WARRANTIES OF MERCHANTABILITY, ACCURACY, TITLE, NONINFRINGEMENT OR FITNESS FOR A PARTICULAR PURPOSE OR ANY WARRANTIES ARISING FROM USAGE OF TRADE, COURSE OF DEALING OR COURSE OF PERFORMANCE. WITHOUT LIMITING THE

GENERALITY OF THE FOREGOING, SERVICENOW SPECIFICALLY DOES NOT WARRANT THAT THE

SUBSCRIPTION SERVICE, SOFTWARE, PROFESSIONAL SERVICES, DEVELOPMENT TOOLS,

DOCUMENTATION OR DELIVERABLES WILL MEET THE REQUIREMENTS OF CUSTOMER OR OTHERS OR THAT THEY WILL BE ACCURATE OR OPERATE WITHOUT INTERRUPTION OR ERROR. CUSTOMER

ACKNOWLEDGES THAT IN ENTERING THIS AGREEMENT IT HAS NOT RELIED ON ANY PROMISE, WARRANTY OR REPRESENTATION NOT EXPRESSLY SET FORTH HEREIN.

6. CONFIDENTIAL INFORMATION

6.1. CONFIDENTIALITY OBLIGATIONS. The recipient of Confidential Information shall: (i) at all times protect it from unauthorized disclosure with the same degree of care that it uses to protect its own confidential information, and in no event using less than reasonable care; and (ii) not use it except to the extent necessary to exercise rights or fulfill obligations under this Agreement. Each party shall limit the disclosure of the other party’s Confidential Information to those of its employees and contractors with a need to access such Confidential Information for a party’s exercise of its rights and obligations under this Agreement, provided that all such employees and contractors are subject to binding disclosure and use restrictions at least as protective as those set forth herein. Each party’s obligations set forth in this Section 6 shall remain in effect during the term and three (3) years after termination of this Agreement. The receiving party shall, at the disclosing party’s request or upon termination of this Agreement, return all originals, copies, reproductions and summaries of Confidential Information and other tangible materials and devices provided to the receiving party as Confidential Information, or at the disclosing party's option, certify destruction of the same. Provisions for the return of Customer Data are set forth in Section 9.3 (Return of Customer Data).

6.2. REQUIRED DISCLOSURES. A party may disclose the disclosing party’s Confidential Information to a court or governmental body pursuant to a valid court order, law, subpoena or regulation, provided that the receiving party: (a) promptly notifies the disclosing party of such requirement as far in advance as possible to the extent advanced notice is lawful; and (b) provides reasonable assistance to the disclosing party in any lawful efforts by the disclosing party to resist or limit the disclosure of such Confidential Information.

6.3. EQUITABLE REMEDIES. The parties agree that the receiving party’s disclosure of Confidential Information except as provided herein may result in irreparable injury for which a remedy in money damages may be inadequate. The parties further agree that in the event of such disclosure or threatened disclosure, the disclosing party may be entitled to seek an injunction to prevent the breach or threatened breach without the necessity of proving irreparable injury or the inadequacy of money damages, in addition to remedies otherwise available to the disclosing party at law or in equity.

7. INDEMNIFICATION

7.1. SERVICENOW OBLIGATION. Subject to the exclusions set forth below, ServiceNow shall: (i) defend Customer, its officers, directors and employees against any third party suit, claim, action or demand (each a “Claim”) to the extent alleging: (A) that the Subscription Service used in accordance with this Agreement infringes any third party patent, copyright or trademark, or misappropriates any third party trade secret; or (B) that ServiceNow’s personnel when onsite at Customer’s premises caused death, bodily harm or damage to tangible personal property due to their negligence or willful misconduct; and (ii) pay any court-ordered award of damages or settlement amount to the extent arising from any such Claims. If any portion of the Subscription Service becomes the subject of a Claim under Section 7.1(i)(A), ServiceNow may: (a) contest the Claim; (b) obtain permission from the claimant for Customer’s continued use of the Subscription Service; (c) replace or modify the Subscription Service to avoid infringement, if such replacement or modification has substantially the same capabilities as the Subscription Service; or, if the foregoing (a), (b), and (c) are not available on commercially reasonable terms in ServiceNow’s judgment, then (d) terminate Customer’s use of the affected Subscription Service upon sixty (60) days’ written notice, whereupon Customer may submit to Reseller a claim for a refund of any prepaid subscription fees covering the remaining portion of the applicable Subscription Term for the affected SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 6 (version 11/4/2014)
Subscription Service after the date of termination. Notwithstanding the above, ServiceNow shall have no obligation or liability for any Claim under Section 7.1(i)(A) arising in whole or in part from: (1) any use of the Subscription Service which exceeds the authorized use permitted under this Agreement or not in accordance with the Documentation; (2) Customer Data or Customer Technology; (3) use of the Subscription Service by Customer in violation of applicable law; (4) use of the affected Subscription Service after termination in accordance with clause (d) of this Section 7.1; (5) modifications to the Subscription Service made to Customer’s specifications or otherwise made by any person other than ServiceNow or a person acting at ServiceNow’s direction if the Claim would have been avoided by use of the unmodified Subscription Service; or (6) use of the Subscription Service in combination with any hardware, software, application or service that was not provided by ServiceNow, if the Claim would have been avoided by the non-combined or independent use of the Subscription Service.

7.2. CUSTOMER OBLIGATION. Customer shall: (i) defend ServiceNow, its officers, directors and employees against any Claim alleging that: (A) Customer Data, (B) Customer Technology or (C) a modification to the Subscription Service made to Customer’s specifications or otherwise made by or on behalf of Customer by any person other than ServiceNow or a person acting at ServiceNow’s direction (but only if the Claim would have been avoided by use of the unmodified Subscription Service), infringes any patent, copyright or trademark, misappropriates any third party trade secret, or violates any third party privacy rights; and (ii) pay any courtordered award of damages or settlement amount to the extent arising from such Claim.

7.3. PROCESS. All of the foregoing indemnity obligations of ServiceNow and Customer are conditioned on the indemnified party notifying the indemnifying party promptly in writing of any actual or threatened Claim, the indemnified party giving the indemnifying party sole control of the defense thereof and any related settlement negotiations, and the indemnified party cooperating and, at the indemnifying party’s request and expense, assisting in such defense. SECTION 7 STATES EACH PARTY’S ENTIRE LIABILITY AND THE OTHER PARTY’S EXCLUSIVE REMEDY FOR THIRD PARTY CLAIMS AND ACTIONS.

8. LIMITATIONS OF LIABILITY

8.1. LIMITATIONS OF LIABILITY. SERVICENOW SHALL HAVE NO LIABILITY FOR ANY REFUND THAT, IN ACCORDANCE WITH THE TERMS OF THIS AGREEMENT, IS TO BE PAID BY RESELLER. TO THE

EXTENT PERMITTED BY LAW, THE TOTAL, CUMULATIVE LIABILITY OF EACH PARTY ARISING OUT OF

OR RELATED TO THIS AGREEMENT OR THE PRODUCTS OR SERVICES PROVIDED HEREUNDER

WHETHER BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE) OR ANY OTHER LEGAL OR

EQUITABLE THEORY, SHALL BE LIMITED TO THE AMOUNTS PAID BY CUSTOMER FOR THE PRODUCTS OR SERVICES GIVING RISE TO THE CLAIM DURING THE TWELVE (12) MONTH PERIOD PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY. THE EXISTENCE OF MORE THAN ONE CLAIM SHALL NOT ENLARGE THIS LIMIT. THE FOREGOING LIMITATION OF LIABILITY SHALL NOT APPLY TO:
(1) CUSTOMER’S OBLIGATION TO PAY FOR PRODUCTS, SERVICES OR TAXES; (2) A PARTY’S OBLIGATIONS IN SECTION 7 (INDEMNIFICATION); AND (3) INFRINGEMENT BY A PARTY OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS.

8.2. EXCLUSION OF DAMAGES. TO THE EXTENT PERMITTED BY LAW, NEITHER

SERVICENOW NOR CUSTOMER SHALL BE LIABLE TO THE OTHER OR ANY THIRD PARTY FOR LOST

PROFITS (WHETHER DIRECT OR INDIRECT) OR LOSS OF USE OR DATA, COVER, SUBSTITUTE GOODS

OR SERVICES, OR FOR INCIDENTAL, CONSEQUENTIAL, PUNITIVE, SPECIAL OR EXEMPLARY DAMAGES (INCLUDING DAMAGE TO BUSINESS, REPUTATION OR GOODWILL), OR INDIRECT DAMAGES OF ANY

TYPE HOWEVER CAUSED, WHETHER BY BREACH OF WARRANTY, BREACH OF CONTRACT, IN TORT (INCLUDING NEGLIGENCE) OR ANY OTHER LEGAL OR EQUITABLE CAUSE OF ACTION EVEN IF SUCH

PARTY HAS BEEN ADVISED OF SUCH DAMAGES IN ADVANCE OR IF SUCH DAMAGES WERE FORESEEABLE. THE FOREGOING EXCLUSIONS SHALL NOT APPLY TO: (1) PAYMENTS TO A THIRD PARTY ARISING FROM A PARTY’S OBLIGATIONS UNDER SECTION 7 (INDEMNIFICATION); AND (2) INFRINGEMENT BY A PARTY OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS.

8.3. GROSS NEGLIGENCE; WILFUL MISCONDUCT. AS PROVIDED BY LAW, NOTHING HEREIN SHALL BE INTENDED TO LIMIT A PARTY’S LIABILITY IN AN ACTION IN TORT (SEPARATE AND DISTINCT SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 7 (version 11/4/2014)
FROM A CAUSE OF ACTION FOR BREACH OF THIS AGREEMENT) FOR THE PARTY’S GROSS NEGLIGENCE OR WILFUL MISCONDUCT.

9. TERM AND TERMINATION

9.1. TERM AND TERMINATION. This Agreement continues until terminated under the terms of this Agreement. Each party may terminate this Agreement in its entirety either: (i) upon thirty (30) days’ prior written notice to the other party, if at the time of notice there are no Use Authorizations in effect; or (ii) upon written notice if the other party becomes the subject of a petition in bankruptcy or any proceeding related to its insolvency, receivership or liquidation, in any jurisdiction, that is not dismissed within sixty (60) days of its commencement or an assignment for the benefit of creditors. Either party may terminate a Subscription Service or Professional Services upon written notice if the other party materially breaches this Agreement or the applicable Use Authorization for the affected service and does not cure the breach within thirty (30) days after receiving written notice thereof from the non-breaching party. Professional Services are separately ordered from the Subscription Service, and are not required for the Subscription Service. A breach by a party of its obligations with respect to Professional Services shall not by itself constitute a breach by that party of its obligations with respect to the Subscription Service even if the services are enumerated in the same Use Authorization.

9.2. EFFECT OF TERMINATION OF SUBSCRIPTION SERVICE. Upon termination of the Subscription Service for any reason, Customer shall stop using, and ServiceNow shall stop providing, the Subscription Service and all rights granted to Customer in this Agreement shall terminate. If the Subscription Service is terminated by Customer due to ServiceNow’s breach, then Customer may submit to Reseller a claim for refund of all prepaid fees for the remaining portion of the Subscription Term for the terminated Subscription Service after the effective date of termination. Within thirty (30) days following the effective date of a termination by ServiceNow for Customer’s breach, Customer shall pay all remaining amounts for the Subscription Term applicable to the Subscription Service covering the remainder of the Subscription Term regardless of the due dates specified in Reseller’s order form to Customer.

9.3. TRANSITION SERVICES. At least thirty (30) days prior to either the expiration of the Subscription Term (where Customer elects not to renew) or in connection with the termination by Customer of the Subscription Service in accordance with Section 9.1, provided that Customer signs an addendum to this Agreement setting forth payment and other commercial terms between Customer and ServiceNow, Customer may purchase the following services from ServiceNow: (i) one (1) extension of the Subscription Service for up to six (6) months (“Transition Subscription Service”); and (ii) Professional Services. Prior to the commencement of any Transition Subscription Service or Professional Services, Customer shall sign an ordering document and shall pay in advance for the Transition Subscription Service and any Professional Services plus verifiable travel and expenses.

9.4. RETURN OF CUSTOMER DATA. ServiceNow shall provide Customer Data in its standard database export format, excluding the ServiceNow Core Technology, to Customer upon Customer’s written request and at no additional cost to Customer, provided that ServiceNow receives such request from Customer within forty-five (45) days following the expiration or termination of this Agreement for the Subscription Service (including any Transition Subscription Service term, if applicable).If ServiceNow has not received a request within the foregoing time frame, ServiceNow shall have no obligation to maintain or provide any Customer Data and shall thereafter, unless legally prohibited, have the right to delete all Customer Data in its systems or otherwise in its possession or under its control and delete Customer’s instances of the Subscription Service.

9.5. SURVIVAL. Sections 2.4 (Restrictions), 4.1 (ServiceNow Ownership), 4.2 (Customer Ownership), 4.3 (Feedback) and 6 (Confidential Information) through 10 (General Provisions) of this Agreement, together with any other provision required for their construction or enforcement, shall survive termination of this Agreement for any reason.

10. GENERAL PROVISIONS

10.1. ASSIGNMENT. Neither party may assign its rights or obligations under this Agreement, whether by operation of law or otherwise, without the prior written consent of the other party. Notwithstanding the SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 8 (version 11/4/2014)
foregoing, either party may, upon notice and without the other party’s consent: (i) in connection with a merger, reorganization or sale of all or substantially all of the assets or equity of such party, assign this Agreement in its entirety to such party’s successor; and (ii) assign this Agreement in its entirety to any Affiliate. “Affiliates” shall mean any person or entity directly or indirectly Controlling, Controlled by or under common Control with a party to the Agreement, where “Control” means the legal power to direct or cause the direction of the general management of the company, partnership or other legal entity. Any attempted or purported assignment in violation of this Section 10.1 will be null and void. Subject to the foregoing, this Agreement shall bind and inure to the benefit of the parties, their respective successors and permitted assigns.

10.2. COMPLIANCE W ITH LAWS. ServiceNow shall comply with any statutes and regulations that apply to its provision of the Subscription Service, Professional Services, Software, Documentation, Development Tools and Deliverables, under the Agreement, including but not limited to those applicable to the privacy and security of personal information, including trans-border data transfers and data breach notification requirements as required of ServiceNow by law. Customer shall comply with all laws that apply to its use of the Subscription Service, Professional Services, Software, Documentation, Development Tools and Deliverables, under the Agreement, including but not limited to those applicable to collection and processing of Customer Data in ServiceNow systems through the Subscription Service. Customer agrees to provide any required disclosures to and obtain any required consents for the transfer of Customer Data to ServiceNow. ServiceNow shall not be responsible for compliance with any laws applicable to Customer and its industry that are not generally applicable to information technology service providers.

10.3. EXPORT COMPLIANCE. Each party shall comply with United States and foreign export control laws and regulations. Customer acknowledges that the Subscription Service, Professional Services, Software, Documentation, Development Tools and Deliverables are subject to the U.S. Export Administration Regulations (the “EAR”) and that Customer shall comply with the EAR. Without limiting the foregoing, Customer represents and warrants that: (i) Customer is not located in, and shall not use the Subscription Service, Professional Services, Software, Documentation, Development Tools and Deliverables from, any country that is subject to U.S. export restrictions (currently including, but not necessarily limited to, Cuba, Iran, North Korea, Sudan and Syria); (ii) Customer shall not use the Subscription Service, Professional Services, Software, Documentation, Development Tools and Deliverables in the design, development or production of nuclear, chemical or biological weapons, or rocket systems, space launch vehicles, sounding rockets or unmanned air vehicle systems; and (iii) Customer is not prohibited from participating in U.S. export transactions by any federal agency of the U.S. government. In addition, Customer is responsible for complying with any local laws which may impact Customer’s right to import, export or use the Subscription Service, Professional Services, Software, Documentation, Development Tools and Deliverables.

10.4. US GOVERNMENT RIGHTS. All ServiceNow software (including Software) is commercial computer software and all services are commercial items. “Commercial computer software” has the meaning set forth in Federal Acquisition Regulation (“FAR”) 2.101 for civilian agency purchases and the Department of Defense (“DOD”) FAR Supplement (“DFARS”) 252.227-7014(a)(1) for defense agency purchases. If the software is licensed or the services are acquired by or on behalf of a civilian agency, ServiceNow provides the commercial computer software and/or commercial computer software documentation and other technical data subject to the terms of this Agreement as required in FAR 12.212 (Computer Software) and FAR 12.211 (Technical Data) and their successors. If the software is licensed or the services are acquired by or on behalf of any agency within the DOD, ServiceNow provides the commercial computer software and/or commercial computer software documentation and other technical data subject to the terms of this Agreement as specified in DFARS 227.7202-3 and its successors. Only if this is a DOD prime contract or DOD subcontract, the Government acquires additional rights in technical data as set forth in DFARS 252.227-7015. This U.S. Government Rights clause is in lieu of, and supersedes, any other FAR, DFARS or other clause or provision that addresses Government rights in computer software or technical data.

10.5. NOTICE. Except as otherwise provided herein, all notices shall be in writing and deemed given upon: (i) personal delivery; (ii) when received by the addressee if sent by a recognized overnight courier (receipt requested); (iii) the second business day after mailing; or (iv) the first business day after sending by email with SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 9 (version 11/4/2014)
confirmation of receipt, except that email shall not be sufficient for notices regarding a Claim. Notices shall be sent to the parties as set forth on the signature page of this Agreement or as subsequently updated in writing.

10.6. FORCE MAJEURE. No party shall be liable or responsible to the other party, nor be deemed to have defaulted under or breached this Agreement, for any failure or delay in fulfilling or performing any term of this Agreement (excluding Customer’s failure to pay amounts owed when due), when and to the extent such failure or delay is caused by or results from acts beyond the affected party’s reasonable control, including without limitation: strikes, lock-outs or other industrial disputes (whether involving its own workforce or a third party’s), trespassing, sabotage, theft or other criminal acts, failure of energy sources or transport network, acts of God, export bans, sanctions and other government actions, war, terrorism, riot, civil commotion, interference by civil or military authorities, national or international calamity, armed conflict, malicious damage, breakdown of plant or machinery, nuclear, chemical or biological contamination, explosions, collapse of building structures, fires, floods, storms, earthquakes, epidemics or similar events, natural disasters or extreme adverse weather conditions (each a “Force Majeure Event”). The party suffering a Force Majeure Event shall use reasonable efforts to mitigate against the effects of such Force Majeure Event.

10.7. HIGH RISK ACTIVITIES. Customer shall use the ServiceNow Core Technology within the intended business purposes described in the Documentation, and not for any purpose that requires fail-safe performance including, but not limited to, stock trading, financial transaction processing, management of hazardous facilities or applications for which failure could result in death, personal injury, or severe physical or environmental damage (“High Risk Activity”). ServiceNow, its licensors and suppliers expressly disclaim all warranties of fitness for any such use and Customer shall release and hold ServiceNow, its licensors and suppliers harmless from liability arising out of the use of the ServiceNow Core Technology for High RiskActivity.

10.8. USE OF AGGREGATE DATA. Customer agrees that ServiceNow may collect, use and disclose quantitative data derived from the use of the Subscription Service for industry analysis, benchmarking, analytics, marketing, and other business purposes. All data collected, used, and disclosed will be in aggregate form only and will not identify Customer or its users.

10.9. ENTIRETY. This Agreement, together with the Use Authorizations, Product Overviews, SOWs, Service Descriptions, and the Subscription Service Guide (including the Customer Support Policy, the Upgrade Policy and the Data Security Guide), is the final and entire agreement between the parties regarding the products and services provided hereunder and supersedes all prior or contemporaneous oral or written agreements, representations, understandings, undertakings and negotiations with respect to the subject matter hereof. The terms of this Agreement apply to the exclusion of any other terms that Customer seeks to impose or incorporate, or which are implied by trade, custom, practice or course of dealing. Customer acknowledges that it has not relied on any statement, promise or representation made or given by or on behalf of ServiceNow that is not set out in this Agreement. Customer’s orders are not contingent on, and Customer has not relied on, the delivery of any future functionality regardless of any verbal or written communication about ServiceNow’s future plans. This Agreement may be executed in counterparts, each of which shall be deemed to be an original.

10.10. WAIVER AND AMENDMENT. A waiver of any right is only effective if it is in writing and only against the party who signed such writing and for the circumstances given. Any modification of this Agreement must be in writing and signed by authorized representatives of both parties.

10.11. RELATIONSHIP OF THE PARTIES. The parties are independent contractors. Nothing in this Agreement shall be construed to create a partnership, joint venture or agency relationship. Neither party shall have any right or authority to assume or create any obligation of any kind expressed or implied in the name of or on behalf of the other party.

10.12. GOVERNING LAW; JURISDICTION AND VENUE. This Agreement shall be governed by the laws of the state of California, without regard to its conflict of laws principles. The parties hereby irrevocably consent to the exclusive jurisdiction of, and venue in, any federal or state court of competent jurisdiction located in Santa Clara County, California, for the purposes of adjudicating any dispute arising out of this Agreement. Each party hereto expressly consents to service of process by registered mail. To the extent permitted by law, choice of law rules and the United Nations Convention on Contracts for the International Sale of Goods shall not apply.

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 10 (version 11/4/2014)
Notwithstanding the foregoing, either party may at any time seek and obtain appropriate legal or equitable relief in any court of competent jurisdiction for claims regarding such party’s intellectual propertyrights.

10.13. CONSTRUCTION. Products and services shall be provided in the English language unless agreed otherwise. The parties confirm that they have requested that this Agreement and all related documents be drafted in English at the express wishes of the parties. Les parties confirment avoir expressément exigé que le présent contrat et les documents de ServiceNow qui y sont attachés soient rédigés en anglais. Section headings are for convenience only and are not to be used in interpreting this Agreement.

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 1 (version 11/12/2014)

SUBSCRIPTION SERVICE GUIDE
Capitalized terms not defined herein shall have the meaning set forth in the ordering agreement or the use agreement between Customer and ServiceNow.

1. SUPPORT
During the Subscription Term, ServiceNow or its authorized reseller, as applicable, shall provide support for the Subscription Service as set forth in the Customer Support Policy attached hereto, and incorporated herein by reference.

2. UPGRADES
ServiceNow determines whether and when to develop, release and apply any Upgrade (as defined in the Upgrade Policy attached hereto, and incorporated herein by reference) to Customer’s instances of the Subscription Service.

3. DATA SECURITY
ServiceNow shall implement and maintain security procedures and practices appropriate to information technology service providers to protect Customer Data from unauthorized access, destruction, use, modification, or disclosure, as described in the Data Security Guide attached hereto, and incorporated herein by reference.

4. INSURANCE
ServiceNow agrees to maintain in effect during the Subscription Term, at ServiceNow’s expense, the following minimum insurance coverage:
(i) (a) Workers’ Compensation Insurance, in accordance with applicable statutory, federal, and other legal requirements and (b) Employers’ Liability Insurance covering ServiceNow’s employees in an amount of not less than $1,000,000 for bodily injury by accident, $1,000,000 policy limit for bodily injury by disease, and $1,000,000 each employee for bodily injury by disease; (ii) Commercial General Liability Insurance written on an occurrence form and including coverage for bodily injury, property damage, products and completed operations, personal injury, advertising injury arising out of the services and/or products provided by ServiceNow under this Agreement with minimum limits of $1,000,000 per occurrence/$2,000,000 aggregate; (iii) Commercial Automobile Liability Insurance providing coverage for hired and non-owned automobiles used in connection with this Agreement in an amount of not less than $1,000,000 per accident combined single limit for bodily injury and property damage; (iv) Combined Technology Errors’ & Omission Policy with a $5,000,000 per Claim limit, including: (a) Professional Liability Insurance providing coverage for the services and software in this Agreement.

Such coverage to be maintained for at least two (2) years after the termination of this Agreement; and (b) Privacy, Security, and Media Liability Insurance providing liability coverage for unauthorized access or disclosure, security breaches or system attacks, as well as infringements of copyright and trademark that might result from this Agreement; and
(v) Excess Liability over Employers’ Liability, Commercial General Liability and Commercial Automobile Liability with a $5,000,000 aggregate limit.

For the purpose of this Section, a “Claim” means a written demand for money or a civil proceeding which is commenced by service of a complaint or similar pleading.

5. AVAILABILITY SERVICE LEVEL

5.1. DEFINITIONS
(a) “Available” means that the Subscription Service can be accessed by authorized users.

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 2 (version 11/12/2014)
(b) “Excused Downtime” means: (i) Maintenance Time of up to two (2) hours per month; and (ii) any time the Subscription Service is not Available due to circumstances beyond ServiceNow’s control, including without limitation modifications of the Subscription Service by any person other than ServiceNow or a person acting at ServiceNow’s direction, a Force Majeure Event, general Internet outages, failure of Customer’s infrastructure or connectivity (including without limitation, direct connectivity and virtual private network (VPN) connectivity to the Subscription Service), computer and telecommunications failures and delays, and network intrusions or denial-of-service or other criminal attacks. (c) “Maintenance Time” means the time the Subscription Service is not Available due to service maintenance.
(d) “Availability SLA” means the percentage of total time during which Customer’s production instances of the Subscription Service are Available during a calendar month, excluding Excused Downtime.

5.2. AVAILABLITY
If Customer’s production instances of the Subscription Service fall below the Availability SLA of ninety-nine and eight-tenths percent (99.8%) during a calendar month, Customer’s exclusive remedy for failure of the Subscription Service to meet the Availability SLAs is either: (1) to request that the affected Subscription Term be extended for the number of minutes the Subscription Service was not Available in the month in accordance with the Availability SLA; or (2) to request that ServiceNow issue a service credit to Customer for the dollar value of the number of minutes the Subscription Service was not Available in the month in accordance with the Availability SLA (determined at the deemed per minute rate ServiceNow charges to Customer for Customer’s use of the affected Subscription Service), which Customer may request ServiceNow apply to the next invoice for subscription fees.

5.3. REQUESTS
Customer must request all service credits or extensions in writing to ServiceNow within thirty (30) days of the end of the month in which the Availability SLA was not met, identifying the support requests relating to the period Customer’s production instances of the Subscription Service was not Available. The total amount of service credits for any month may not exceed the subscription fee for the affected Subscription Service for the month, and has no cash value. ServiceNow may delay issuing service credits until such amounts reach one thousand U.S. dollars ($1,000) or equivalent currency specified in the applicable Order Form.

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 3 (version 11/12/2014)

CUSTOMER SUPPORT POLICY
This Customer Support Policy governs the support that ServiceNow or its authorized reseller, as applicable, will provide for the Subscription Service. This Policy may be updated from time to time.

Scope
The purpose of Customer Support is to resolve defects that cause the Subscription Service to perform not in substantial conformance to the Product Overview. A resolution to a defect may consist of a fix, workaround or other relief ServiceNow deems reasonable.

Customer Support does not include:
• implementation services
• configuration services
• integration services
• customization services or other custom software development • training
• assistance with administrative functions
Customer Support is not required to provide resolutions for immaterial defects or defects due to modifications of the Subscription Service made by any person other than ServiceNow or a person acting at ServiceNow’s direction.

Business Hours
Customer Support is available 24 hours a day, 7 days a week, including allholidays.

Access Contacts
Customer may contact ServiceNow using one of the following means:
• Support Portal at https://hi.service-now.com/. Customer may get login access to this self-service portal by contacting its ServiceNow administrator.
• Phone using one of the numbers at http://servicenow.com/support/contact-support.html.

Customer shall contact ServiceNow’s authorized reseller in accordance with its agreement with thereseller.

Incident Priority
Incident priority for a defect is determined using the guidelines below:

Priority Definition
P1 Any defect that causes an instance to be unavailable.

P2 Any defect that causes a critical function to fail.

P3 Any defect that significantly impedes work or progress.

P4 Any defect that does not significantly impede work or progress.

Response Times and Level of Effort
Customer submits an incident with ServiceNow via phone or web and with ServiceNow’s authorized reseller as directed by reseller. All support requests are tracked online and can be viewed by Customer’s authorized contacts. Response times do not vary if the incident was filed via phone or web.

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 4 (version 11/12/2014)
ServiceNow or its authorized reseller, as applicable, will use reasonable efforts to meet the target response times and target level of effort stated in the table below. Support from the reseller may be limited to business hours only.

Priority Target Response Times Target Level of Effort
P1 30 minutes Continuously, 24 hours per day, 7 days per week
P2 2 hours Continuously, but not necessarily 24 hours per day, 7 days per week
P3 1 business day As appropriate during normal business hours P4 N/A Varies
Customer Responsibilities
Customer’s obligations are as follows:
(a) Customer agrees to receive from ServiceNow or its authorized reseller, as applicable, communications via email, phone or through the Support Portal regarding the Subscription Service.
(b) Customer shall appoint no more than five (5) contacts (“Customer Authorized Contacts”) to engage Customer Support for questions and/or technical issues. (i) Only Customer Authorized Contacts are authorized to contact Customer Support. (ii) Customer must ensure the information for these contacts is current in the Support Portal at https://hi.service-now.com/.
(iii) Customer Authorized Contacts are trained on the use and administration of the Subscription Service.
(c) Customer shall cooperate to enable ServiceNow to deliver the Subscription Service and support for the service.
(d) Customer is solely responsible for the use of the Subscription Service by its authorized users.

Support Resources
• ServiceNow Website (http://www.servicenow.com/services/overview.html) • ServiceNow Community (https://community.servicenow.com/welcome) • Release Notes (http://wiki.service-now.com/index.php?title=Main_Page) • Product Documentation (http://wiki.service-now.com/index.php?title=Main_Page) • Knowledge Base (https://hi.service-now.com/nav_to.do?uri=kb_home.do) • Support Community (https://community.servicenow.com/community/support) SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 5 (version 11/12/2014)

UPGRADE POLICY

1. UPGRADES
“Upgrades” are ServiceNow’s releases of the Subscription Service for repairs, enhancements or new features applied by ServiceNow to Customer’s instances of the Subscription Service at no additional fee during the Subscription Term. ServiceNow has the discretion to provide new functionality as an Upgrade or as different software or service for a separate fee. ServiceNow determines whether and when to develop, release and apply any Upgrade to Customer’s instances of the Subscription Service.

2. NOTICE; MAINTENANCE DOWNTIME
ServiceNow shall use reasonable efforts to give Customer thirty (30) days prior notice of any Upgrade to the Subscription Service. ServiceNow shall use reasonable efforts to give Customer ten (10) days prior notice of any Upgrade to the cloud infrastructure network, hardware, or software used by ServiceNow to operate and deliver the Subscription Service if ServiceNow in its reasonable judgment believes that the infrastructure Upgrade will impact Customer’s use of its production instances of the Subscription Service. ServiceNow will use commercially reasonable efforts to limit the period of time during which the Subscription Service is unavailable due to the application of Upgrades to no more than two (2) hours per month. Notwithstanding the foregoing, ServiceNow may provide Customer with a shorter or no notice period of an Upgrade if necessary, in the reasonable judgment of ServiceNow, to maintain the availability, security or performance of the Subscription Service or the ability of ServiceNow to efficiently provide the Subscription Service.

3. NOMENCLATURE
A pending Upgrade may be a “Feature Release”, “Patch” or “Hotfix.” A “Feature Release” is an Upgrade that includes new features or enhancements. A “Patch” or a “Hotfix” is an Upgrade to a Feature Release that maintains the functionality of the Feature Release and does not include new functionality. ServiceNow refers to each Feature Release and its associated Patches and Hotfixes as a “Release Family.” For example, ServiceNow’s Feature Release “Aspen” established the “Aspen” Release Family, and ServiceNow’s subsequent Feature Release “Berlin” established the “Berlin” Release Family.

4. PINNING REQUESTS
Customer may submit a support request for “no Upgrade” not fewer than five (5) business days’ prior to a pending Upgrade of the Subscription Service. Subject to the terms and conditions of this Upgrade Policy, Customer’s “no Upgrade” request shall be granted, and the Upgrade shall not be applied to Customer’s instances of the Subscription Service.

5. SUPPORTED AND NON-SUPPORTED RELEASE FAMILIES
ServiceNow offers support for the then current Release Family and the prior two (2) Release Families (“Supported Release Families”) as set forth in the Customer Support Policy. A Customer using a Supported Release Family may be required to Upgrade to a Patch or Hotfix within the Supported Release Family to correct a defect. At its discretion, ServiceNow may offer limited support for additional Release Families (“Non-Supported Release Families”). Without limiting ServiceNow’s discretion to determine the availability of support for NonSupported Release Families, a Customer using a Non-Supported Release Family may be required to Upgrade to a Supported Release Family to correct a defect. Any service level agreements, recovery time objectives or recovery point objectives are not applicable to Non-Supported Release Families. Details of ServiceNow support are further set forth in the Customer Support Policy.

Customer acknowledges that the current Release Family is the most current feature, availability, performance and security version of the Subscription Service. Within a Supported Release Family, the most recent Patch contains the most current feature, availability, performance and security version of the Subscription Service for that Release Family. A Customer that has submitted a “no Upgrade” request may experience defects, for which Customer hereby agrees that ServiceNow is not responsible, including without limitation those that affect the features, availability, performance and security of the Subscription Service, that are fixed in the most SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 6 (version 11/12/2014)
current version of the Subscription Service.

6. REQUIRED UPGRADES
If Customer has requested “no Upgrade” it may nevertheless be required to Upgrade if in the reasonable judgment of ServiceNow the Upgrade is necessary to maintain the availability, security or performance of the Subscription Service or the ability of ServiceNow to efficiently provide the Subscription Service, as follows:

6.1. SUPPORTED RELEASE FAMILY. If Customer is using a Supported Release Family, it may be required to Upgrade to a Patch or Hotfix within the Supported Release Family.

6.2. NON-SUPPORTED RELEASE FAMILY. If Customer is using a Non-Supported Release Family, it may be required to Upgrade to a Supported Release Family.

7. EXCEPTIONS
Notwithstanding the other provisions of this Upgrade Policy, Customer may not submit a support request for “no Upgrade” for any Upgrade to, or that is essential for, the infrastructure network, hardware, or software used by ServiceNow to operate and deliver the Subscription Service.

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 7 (version 11/12/2014)

DATA SECURITY GUIDE
Security Statement of an Enterprise IT Cloud Company
The ServiceNow cloud is built for the enterprise customer with every aspect aimed towards meeting the customer’s demand for reliability, availability and security. ServiceNow’s comprehensive approach to address this demand is enabled by the following: (a) ServiceNow’s robust cloud infrastructure runs on its own applications and utilizes industry best-of-breed technology to automate mission critical functionalities in the cloud service with around-the-clock and around-the-world delivery; (b) ServiceNow achieves flexibility and control in its ability to deliver a stable user experience to the customer by having a logical single tenant architecture; (c) ServiceNow’s application development which has a paramount focus on quality, security, and the user experience is closely connected to the operations of delivering those applications in a reliable and secure cloud environment; (d) ServiceNow invests in a comprehensive compliance strategy that allows its customers to attain their own compliance to applicable laws by obtaining attestations and certifications and running its subscription service from paired data centers situated close to where its customers are located; and (e) ServiceNow’s homogeneous environment where all applications are on a single platform offers ServiceNow a competitive advantage in being able to concentrate its efforts to make the customer’s user experience the best possible.

This Data Security Guide describes the measures ServiceNow takes to protect Customer Data when it resides in the ServiceNow cloud. This Data Security Guide forms a part of any legal agreement into which this Data Security Guide is explicitly incorporated by reference (the “Agreement”) and is subject to the terms and conditions of the Agreement. Capitalized terms that are not otherwise defined herein shall have the meaning given to them in the Agreement.

1. SECURITY PROGRAM
While providing the Subscription Service, ServiceNow shall maintain a written information security program of policies, procedures and controls (“Security Program”) governing the processing, storage, transmission and security of Customer Data. The Security Program includes industry standard practices designed to protect Customer Data from unauthorized access, acquisition, use, disclosure, or destruction. ServiceNow may periodically review and update the Security Program to address new and evolving security technologies, changes to industry standard practices, and changing security threats, provided that any such update does not materially reduce the commitments, protections or overall level of service provided to Customer as describedherein.

2. CERTIFICATIONS AND ATTESTATIONS

2.1. Certifications and Attestations. ServiceNow shall establish and maintain sufficient controls to meet the objectives stated in ISO 27001 and SSAE 16 / SOC 1 and SOC 2 Type 2 (or equivalent standards) (collectively, the “Standards”) for the information security management system supporting the Subscription Service. At least once per calendar year, ServiceNow shall perform an assessment against such Standards (“Assessment”). Upon Customer’s written request, which shall be no more than once per calendar year, ServiceNow shall provide a summary of the Assessment(s) to Customer. Assessments shall be Confidential Information of ServiceNow.

2.2. Safe Harbor. ServiceNow shall maintain self-certified compliance under the U.S.-EU and U.S.- Swiss Safe Harbor Frameworks developed by the U.S. Department of Commerce regarding the collection, use and retention of Personal Data (defined in Section 6 below) from European Union member countries and Switzerland.

3. PHYSICAL, TECHNICAL AND ADMINISTRATIVE SECURITY MEASURES The Security Program shall include the following physical, technical and administrative measures designed to protect Customer Data from unauthorized access, acquisition, use, disclosure, ordestruction:

3.1. Physical Security Measures
(a) Data Center Facilities: (i) Physical access restrictions and monitoring that may include a combination of any of the following: multi-zone security, man-traps, appropriate perimeter deterrents (for example, SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 8 (version 11/12/2014)
fencing, berms, guarded gates), on-site guards, biometric controls, CCTV, and secure cages; and (ii) fire detection and fire suppression systems both localized and throughout the data centerfloor. (b) Systems, Machines and Devices: (i) Physical protection mechanisms; and (ii) entry controls to limit physical access.
(c) Media: (i) Industry standard destruction of sensitive materials before disposition of media; (ii) secure safe for storing damaged hard disks prior to physical destruction; and (iii) physical destruction of all decommissioned hard disks storing Customer Data.

3.2. Technical Security Measures
(a) Access Administration. Access to the Subscription Service by ServiceNow employees and contractors is protected by authentication and authorization mechanisms. User authentication is required to gain access to production and sub-production systems. Access privileges are based on job requirements and are revoked upon termination of employment or consulting relationship. Production infrastructure includes appropriate user account and password controls (for example, the required use of virtual private network connections, complex passwords with expiration dates, and a two-factored authenticated connection) and is accessible for administration.
(b) Logging and Monitoring. The production infrastructure log activities are centrally collected and are secured in an effort to prevent tampering and are monitored for anomalies by a trained security team.
(c) Firewall System. An industry-standard firewall is installed and managed to protect ServiceNow systems by residing on the network to inspect all ingress connections routed to the ServiceNow environment.
(d) Vulnerability Management. ServiceNow conducts periodic independent security risk evaluations to identify critical information assets, assess threats to such assets, determine potential vulnerabilities, and provide for remediation. When software vulnerabilities are revealed and addressed by a vendor patch, ServiceNow will obtain the patch from the applicable vendor and apply it within an appropriate timeframe in accordance with ServiceNow's then current vulnerability management and security patch management standard operating procedure and only after such patch is tested and determined to be safe for installation in all production systems.
(e) Antivirus. ServiceNow updates anti-virus, anti-malware, and anti-spyware software on regular intervals and centrally logs events for effectiveness of such software. (f) Change Control. ServiceNow ensures that changes to platform, applications and production infrastructure are evaluated to minimize risk and are implemented following ServiceNow’s standard operating procedure.

3.3. Administrative Security Measures
(a) Data Center Inspections. ServiceNow performs routine reviews at each data center to ensure that it continues to maintain the security controls necessary to comply with the Security Program. (b) Personnel Security. ServiceNow performs background and drug screening on all employees and all contractors who have access to Customer Data in accordance with ServiceNow’s then current applicable standard operating procedure and subject to applicable law. (c) Security Awareness and Training. ServiceNow maintains a security awareness program that includes appropriate training of ServiceNow personnel on the Security Program. Training is conducted at time of hire and periodically throughout employment at ServiceNow. (d) Vendor Risk Management. ServiceNow maintains a vendor risk management program that assesses all vendors that access, store, process or transmit Customer Data for appropriate security controls and business disciplines.

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 9 (version 11/12/2014)

4. DATA PROTECTION AND SERVICE CONTINUITY

4.1. Data Centers; Data Backup. ServiceNow shall host Customer’s instances in primary and secondary SSAE 16 Type II or ISO 27001 certified (or equivalent) data centers in the geographic regions specified on the Order Form for the Subscription Term. Each data center includes full redundancy (N+1) and fault tolerant infrastructure for electrical, cooling and network systems. The deployed servers are enterprise scale servers with redundant power to ensure maximum uptime and service availability. The production database servers are replicated in near real time to a mirrored data center in a different geographic region. Each customer instance is supported by a network configuration with multiple connections to the Internet. ServiceNow backs up all Customer Data in accordance with ServiceNow’s standard operating procedure.

4.2. Personnel. In the event of an emergency that renders the customer support telephone system unavailable, all calls are routed to an answering service that will transfer to a ServiceNow telephone support representative, geographically located to ensure business continuity for support operations.

5. INCIDENT MANAGEMENT AND BREACH NOTIFICATION

5.1. Incident Monitoring and Management. ServiceNow shall monitor, analyze and respond to security incidents in a timely manner in accordance with ServiceNow’s standard operating procedure. Depending on the nature of the incident, ServiceNow security group will escalate and engage response teams necessary to address an incident.

5.2. Breach Notification. Unless notification is delayed by the actions or demands of a law enforcement agency, ServiceNow shall report to Customer the unauthorized acquisition, access, use, disclosure or destruction of Customer Data (a “Breach”) promptly following determination by ServiceNow that a Breach occurred. The initial report shall be made to Customer security contact(s) designated in ServiceNow’s customer support portal. ServiceNow shall take reasonable measures to promptly mitigate the cause of the Breach and shall take reasonable corrective measures to prevent future Breaches. As information is collected or otherwise becomes available to ServiceNow and unless prohibited by law, ServiceNow shall provide information regarding the nature and consequences of the Breach that are reasonably requested to allow Customer to notify affected individuals, government agencies and/or credit bureaus. Customer is solely responsible for determining whether to notify impacted Data Subjects (defined in 6.1 below) and for providing such notice, and for determining if regulatory bodies or enforcement commissions applicable to Customer or Customer Data need to be notified of a Breach.

5.3. Customer Cooperation. Customer agrees to cooperate with ServiceNow in maintaining accurate contact information in the customer support portal and by providing any information that is reasonably requested to resolve any security incident, identify its root cause(s) and prevent a recurrence.

6. DATA PROCESSING GUIDELINES; COMPLIANCE WITH LAWS

6.1. Customer as Data Controller. Customer acknowledges that in relation to Personal Data supplied and/or processed under the Agreement it acts as Controller and it warrants that it will duly observe all of its obligations under all applicable laws and regulations of the European Union, the European Economic Area and their member states regarding the processing of Personal Data (collectively referred to as “Data Protection Laws”) including, without limitation, obtaining and maintaining all necessary notifications and obtaining and maintaining all necessary Data Subject Consents. Customer shall (i) have sole responsibility for the accuracy, quality, integrity, legality and reliability of Personal Data and of the means by which it acquired Personal Data, (ii) ensure that data processing instructions given to ServiceNow comply with applicable Data Protection Laws, and (iii) comply with all applicable Data Protection Laws in collecting, compiling, storing, accessing and using Personal Data in connection with the Subscription Service. For the purposes of this Data Security Guide, “Personal Data”, “Controller”, “Data Subject” and “Data Subject Consent” shall have the meaning given to these terms in Directive 95/46/EC. For clarity, “process” or “processing” means any operation or set of operations performed upon Customer Data.

6.2. ServiceNow as Data Processor. ServiceNow shall process or otherwise use Personal Data (including possible onward transfers) on behalf of Customer solely for the purpose of providing the services SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 10 (version 11/12/2014)
described in the Agreement and only in accordance with Customer’s lawful instructions (limited to those instructions which ServiceNow can reasonably carry out in the provision of the Subscription Service), the terms of the Agreement, and this Data Security Guide. ServiceNow shall ensure that those employees to whom it grants access to such Personal Data are directed to keep such Personal Data confidential and are informed of any additional data protection obligations applicable to such Personal Data. ServiceNow shall, to the extent legally permitted, promptly notify Customer with respect to any request or communication ServiceNow receives from any regulatory authority in relation to any data processing activities ServiceNow conducts on behalf of Customer. In addition, ServiceNow will cooperate and assist Customer, at Customer’s cost, in relation to any such request and to any response to any such communication. ServiceNow will pass on to the Customer any requests of a Data Subject to access, delete, correct, or block Personal Data processed under the Agreement. If ServiceNow is compelled by law to disclose Customer's information as part of a civil proceeding to which Customer is a party, and Customer is not contesting the disclosure, Customer will reimburse ServiceNow for its reasonable cost of compiling and providing secure access to that information.

6.3. Subcontractors. ServiceNow may engage subcontractors for processing Customer Data under the Agreement, provided ServiceNow shall ensure compliance by such subcontractor(s) with the requirements of this Section 6 by entering into written agreements with such subcontractors which provide that the subcontractor will apply the Safe Harbor principles to the processing of Personal Data. ServiceNow’s use of any subcontractor will not relieve, waive or diminish any obligation ServiceNow has under the Agreement or this Data Security Guide.

7. PENETRATION TESTS

7.1. By a Third Party. ServiceNow contracts with third party vendors to perform an annual penetration test on the ServiceNow platform to identify risks and remediation that help increase security.

7.2. By Customer. No more than once per calendar year Customer may request to perform, at its own expense, an application penetration test of its instances of the Subscription Service. Customer shall notify ServiceNow in advance of any test by submitting a request using ServiceNow’s online support portal and completing a penetration testing agreement. ServiceNow and Customer must agree upon a mutually acceptable time for the test; and Customer shall not perform a penetration test without ServiceNow’s express written authorization. The test must be of reasonable duration, and must not interfere with ServiceNow’s day-to-day operations. Promptly upon completion of the penetration test, Customer shall provide ServiceNow with the test results including any detected vulnerability. Upon such notice, ServiceNow shall, consistent with industry standard practices, use all commercially reasonable efforts to promptly make any necessary changes to improve the security of the Subscription Service. Customer shall treat the test results as Confidential Information of ServiceNow.

8. SHARING THE SECURITY RESPONSIBILITY

8.1. Product Capabilities. The Subscription Service has the capabilities to: (i) authenticate users before access; (ii) encrypt passwords; (iii) allow users to manage passwords; and (iv) prevent access by users with an inactive account. Customer manages each user’s access to and use of the Subscription Service by assigning to each user a credential and user type that controls the level of access to the SubscriptionService.

8.2. Customer Responsibilities. ServiceNow provides the cloud environment that permits Customer to use and process Customer Data in the Subscription Service. The architecture in the Subscription Service includes, without limitation, column level encryption functionality and the access control list engine. Customer shall be responsible for using the column level encryption functionality and access control list engine for protecting all Customer Data containing sensitive data, including without limitation, credit card numbers, social security numbers, financial and health information, and sensitive personal data. Customer is solely responsible for the results of its decision not to encrypt such sensitive data. ServiceNow protects all Customer Data in the ServiceNow cloud infrastructure equally in accordance with this Data Security Guide, regardless of the classification of the type of Customer Data. Customer shall be responsible for protecting the confidentiality of each user’s login and password and shall manage each user’s access to the Subscription Service.

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 11 (version 11/12/2014)

8.3. Customer Cooperation. Customer shall promptly apply any application upgrade that ServiceNow determines is necessary to maintain the security, performance or availability of the Subscription Service.

8.4. Limitations. Notwithstanding anything to the contrary in the Agreement or this Data Security Guide, ServiceNow’s obligations extend only to those systems, networks, network devices, facilities and components over which ServiceNow exercises control. This Data Security Guide does not apply to: (i) information shared with ServiceNow that is not data stored in its systems using the Subscription Service; (ii) data in Customer’s virtual private network (VPN) or a third party network; or (iii) any data processed by Customer or its users in violation of the Agreement or this Data Security Guide.

ServiceNow and the ServiceNow logo are trademarks of ServiceNow, Inc. All other brand and product names are trademarks or registered trademarks of their respective holders. 2 ServiceNow Product Overview
Effective Date: May 2, 2016
DemandManagement ConsolidatesIT requests through a service catalog and routesthem in a workflow to stakeholders who gather additional information to prioritize investment decisions.

Discovery Locates physical and virtual devices connected to an enterprise network.

When Discovery locates a device, it explores its configuration, status, software, and relationshipsto other connected devices, and updatesthe Configuration Management Data Base (CMDB).

Edge Encryption Resides on Customer-owned servers and encrypts and decrypts eligible data stored in their instance. Customer controls and manages the encryption keys for the eligible data in theirinstance.

Enterprise Service Portal -HR In support of HR service delivery, provides employee self-service via an HR service catalog and provides HR the capability to assign tasks to employees.

Uses prebuilt layouts, controls, and content. Requires HR Service Management.

Event Management Aggregates events from monitoring tools used by Customer in its infrastructure, de-duplicates and correlatesinputsfrom such eventsto CMDB, and providesthe ability to filter and prioritize eventsto create incidentsfor remediation.

Facilities ServiceManagement Provides capabilitiesto manage the service delivery of a facilities department by offering a self-service catalog and assignment of requests based on fulfillmentrules.

Field ServiceManagement Provides capabilitiesto create work order recordsfor the repair and service of equipment. Requires AssetManagement.

Financial Planning Assists executives and budget owners in the automation of budget and forecast planning, helping to increase efficiency and simplify theplanning process.

Finance Service Management Enables the finance department to define its services and fulfillrequests through workflow capabilities and knowledge management, andprovides visibility into resource utilization and service delivery performance through dashboards.

HR ServiceManagement Provides capabilities to manage HR service delivery using casemanagement to document the interactions between the employee and HR supportedby the knowledge base.

IncidentManagement Facilitates the process of restoring normal IT operations by providing capabilitiesto record, classify, distribute, and manage incidentsthrough to resolution. Includes Performance Analyticslimited to 15 key performance indicators(KPIs), one dashboard and 90 days of data captured by Incident Management.

Legal Service Management Enables the legal department to define its services and fulfill requests through workflow capabilities and knowledge management, and provides visibility into resource utilization and service delivery performance through dashboards.

ServiceNow and the ServiceNow logo are trademarks of ServiceNow, Inc. All other brand and product names are trademarks or registered trademarks of their respective holders. 3 ServiceNow Product Overview
Effective Date: May 2, 2016
Management through workflow capabilities and knowledge management, andprovides visibility into resource utilization and service delivery performance through dashboards.

Notify Providesthe capability to initiate notification from Customer’sinstance of the subscription service to a supported third-party platform for SMS, voice and other communications protocols.

Customerisrequired to separately purchase any third-party service required to work withNotify.

Orchestration Core Enables orchestration of activities outside Customer’s instance ofthe subscription service. Allows Customer to automate discrete tasks or processes using graphical workflowsthat interact with external systems or services.

Password Reset Providesthe capability to reset User’s passwords that are stored and preauthenticated in a credentialstore outside Customer’sinstance ofthe subscription service,such as Active Directory and othersupported credential stores. Requires Orchestration Core.

PerformanceAnalytics Provides advanced analytics and time series analysisfor KPIs.

PlatformRuntime Allows customer to deploy applications developed on the ServiceNow Platform into production.

Policy andCompliance
Management
Provides a centralized process for creating and managing policies, standards, and internal control proceduresthat are cross-mapped to external regulations and best practices. Additionally, the application providesstructured workflows for the identification, assessment, and continuous monitoringof control activities.

ProblemManagement Facilitates the process of identifying the root causes of errors in the IT infrastructure by providing capabilitiesto record, escalate, and manage problemsthrough to resolution.

Project PortfolioManagement Provides capabilitiesto plan, organize, and manage projects and project portfoliosincluding associated tasks and resources.

ReleaseManagement Facilitatesthe planning, design, build, configuration, testing, and release of hardware and software into the IT infrastructure.

RequestManagement Provides capabilitiesto approve and fulfill requestsfor goods and services defined and presented in the service catalog.

ResourceManagement Provides a view of projects and the availability, allocation, and capacity of assignedresources.

Risk Management Provides an executive view into risk to allow risk managersto quickly identify at-risk assets, perform assessments, and continuously monitor risk exposure.

Security Incident Response Enables SOC/SIRT teams to enact response plans to addresssecurity-related activities, events or incidents. Enables response team collaboration, investigation of network and non-network related activities (i.e.intellectual property theft, criminal activities, etc.) and includes the capability for automated request assignment and remediation across IT and security teams.

ServiceNow and the ServiceNow logo are trademarks of ServiceNow, Inc. All other brand and product names are trademarks or registered trademarks of their respective holders. 5 ServiceNow Product Overview
Effective Date: May 2, 2016
Google Maps ServiceNow may make Google Maps available for use with the subscription service. If Customer uses Google Maps, Customer agrees to the following terms: (i) Customer shall limit its use to 60,000 map views on an annual basis and additional use shall be purchased from Google subject to Google’s terms and conditions, to which ServiceNow is not a party; (ii) Customer agrees, and shall cause its end users to agree, to Google’s Maps Terms (http://maps.google.com/help/terms maps.html or a successor URL as provided by Google), the Legal Notices
(http://www.maps.google.com/help/legalnotices maps.html or asuccessor URL as provided by Google), and the Acceptable Use Policy (http://www.google.com/enterprise/earthmaps/legal/us/maps AUP.html or a successor URL as provided by Google); and (iii) Customer agrees that Google may use Customer data in accordance with its privacy policy and that Google may provide its maps services to Customer. Google Maps may not be available to Customer due to location availability and may not be available during Customer’s entire subscription term. ServiceNow support and warranty do not apply to Google Maps.

Graphical Workflow Provides the capability to automate multi-step processes within Customer’s instance of the subscription service. Each workflow can manage a sequence of activities, such as creating records or running scripts, and the condition-based transitions between them.

Customer is required to purchase Orchestration Core to orchestrate activities using the Graphical Workflow that interact outside Customer’s instance of the subscription service.

KnowledgeManagement Provides role-based tools to create, store, and publish information.

Provides mechanisms for version control and approvals of documents in the reviewprocess.

Live Feed Provides a place to post and sharecontent.

Mobile Provides a customizable ServiceNow interface formobile devices.

On-Call Scheduling Enables creation of on-callschedules and escalation rosters.

OpenFrame An interface technology that enablesreal-time communication channels such astelephone systemsto be integrated into the ServiceNow Platform.

OpenFrame consists of UI elements as well as a set of APIs thatsupport exchange of events and data between ServiceNow and the communications system.

Reporting Providesthe capability to create and share reports and dashboards.

REST API Provides the ability to integrate external systems through REST APIs using standard respond codes, header information, pagination support and streaming data on requests.

Service Catalog Displays a listing of the goods and services that Customer provides within the enterprise to its employees and contractors.

ServiceNow and the ServiceNow logo are trademarks of ServiceNow, Inc. All other brand and product names are trademarks or registered trademarks of their respective holders. 6 ServiceNow Product Overview
Effective Date: May 2, 2016
Service LevelManagement Establishes and monitors status of service contracts and SLAs between the organization and its customers orthird-party service providers.

Service Portal Designer Provides the capability to build portals with a consumer-like experience using both ServiceNow out-of-the-box widgets and templates as well as Customer’s own widgets and styles, while leveraging only HTML andCSS.

SkillsManagement Assigns configured competenciesto groups or users.

Studio Integrated Development Environment (IDE) for professional and low-code (i.e., IT administration) applicationdevelopers.

SurveyManagement Allows for polling and collection of data, including configuration for specific events and/or conditions.

Time Cards Recordstime worked on tasks either manually or automatically.

Visual Task Boards Enables a Kanban-style workspace for either individual or team-based management of tasks.

Visualizations Displays interactive 2-D and 3-D visual representations for any logical data relationships within an instance.

SERVICENOW EXPRESS GENERAL TERMS AND CONDITIONS
SERVICENOW PROPR ETARY AND CONFIDENTIAL Page 1 (version 10/21//2014)

GENERAL TERMS AND CONDITIONS
These General Terms and Conditions and any referenced documents form the agreement (the “Agreement”) under which an Order Form is executed.

1. PROVISION OF SERVICES
ServiceNow will make the following purchased services available to Customer, subject to the terms and conditions of the Agreement and each ordering document signed by Customer and ServiceNow (each, an “Order Form”) and the product overview attached thereto or referenced therein (“Product Overview”), including without limitation:
(a) use of the ServiceNow applications which are made available by ServiceNow as a software as a service (SaaS) (“Subscription Service”); and
(b) professional services and training services (“Professional Services”).

An Order Form for Professional Services shall specify ServiceNow packaged professional services (each offering, a “Packaged Service”), as described in one or more service descriptions (if not attached to the Order Form, then as set forth on www.servicenow.com/be schedules.do) (“Service Description”) or other Professional Services described in one or more written statements of work (“SOW”) signed by ServiceNow and Customer.

2. ORDERING

2.1 ORDERS AND PAYMENT. Upon execution by Customer and ServiceNow, each Order Form is noncancellable and non-refundable except as provided in the Agreement. Prices stated in each Order Form are final. Except as expressly set forth in the applicable Order Form, Subscription Service fees are invoiced annually in advance. Each Subscription Term (as defined in Section 3.1) as set forth in the Order Form is a continuous and non-divisible commitment for the full duration of the Subscription Term regardless of the invoice schedule. Except as expressly set forth in the applicable Order Form or SOW or Service Description, Professional Services fees are invoiced on a time and materials basis monthly in arrears. Customer shall pay each invoice in full within thirty (30) days after the date of invoice. Customer may issue a purchase order consistent with the terms of the Order Form, but a purchase order is not required. If Customer issues a purchase order, then it shall be for the full amount of the Order Form, and any additional or conflicting terms appearing in a purchase order shall not amend the Order Form or the Agreement. Upon request, ServiceNow shall reference the purchase order number on its invoices (solely for administrative convenience) so long as Customer provides the purchase order at least fifteen (15) business days prior to the date of the invoice. Late payments shall accrue interest at a rate of one and one-half percent (1.5%) per month or the legal maximum interest rate, whichever is lower. If Customer is delinquent in payment of amounts for the services owed hereunder, ServiceNow may give notice to Customer of such delinquency and, in such case, Customer shall cure the delinquency within thirty (30) days from the date of ServiceNow’s written notice. If Customer fails to cure the delinquency, ServiceNow may suspend Customer’s use of the Subscription Service or terminate the Agreement for cause in accordance with Section 7 (Term and Termination), in addition to other rights and remedies available.

2.2 TAXES. All payments required by the Agreement are stated exclusive of all taxes, duties, levies, imposts, fines or similar governmental assessments including sales and use taxes, value-added taxes (“VAT”), goods and services taxes (“GST”), excise, business, service, and similar transactional taxes imposed by any jurisdiction and the interest and penalties thereon (collectively, “Taxes”). Customer shall be responsible for and bear Taxes associated with its purchase of, payment for, access to or use of the Subscription Service and Professional Services. Taxes shall not be deducted from the payments to ServiceNow, except as required by law, in which case Customer shall increase the amount payable as necessary so that after making all required deductions and withholdings, ServiceNow receives and retains (free from any Tax liability) an amount equal to the amount it would have received had no such deductions or withholdings been made. Each party is responsible for and shall bear taxes imposed on its net income. If Customer is a tax-exempt entity or claims exemption from any Taxes under the Agreement, Customer shall provide a tax exemption number on the Order Form and a certificate upon execution of the Order Form and, after receipt of valid evidence of exemption, ServiceNow shall not charge Customer any Taxes from which it is exempt. If ServiceNow is required to invoice or collect Taxes associated with Customer’s purchase of, payment for, access to or use of the Subscription Service or Professional Services, ServiceNow will issue an invoice to Customer including the amount of those Taxes, itemized where required by law. Customer shall provide to ServiceNow its VAT or GST identification number(s) on the Order Form for (i) the country where Customer has established its business and/or (ii) any other country where Customer has a fixed establishment. Customer shall use the ordered Subscription Service and Professional Services for Customer's business use in the foregoing location(s) in accordance with the provided VAT or GST identification number(s). The parties’ obligations under this Section shall survive the termination or expiration of the Agreement.

SERVICENOW EXPRESS GENERAL TERMS AND CONDITIONS
SERVICENOW PROPR ETARY AND CONFIDENTIAL Page 2 (version 10/21//2014)

2.3 USE VERIFICATION. Customer may not use or otherwise access the Subscription Service in a manner that exceeds Customer’s authorized use. ServiceNow may review Customer’s use of the Subscription Service, and Customer shall provide any reasonable assistance to verify Customer’s compliance with the Agreement. If ServiceNow determines that Customer has exceeded its permitted use of the Subscription Service then ServiceNow will notify Customer and within thirty (30) days thereafter Customer shall either: (i) disable any unpermitted use or (ii) purchase additional subscriptions. If Customer fails to regain compliance within such thirty (30) day period, ServiceNow may suspend Customer’s use of the Subscription Service or terminate the Agreement for cause in accordance with Section 7 (Term and Termination), in additionto any other rights or remedies ServiceNow may have.

3. GRANT OF USE RIGHTS; OWNERSHIP; CUSTOMER RESTRICTIONS

3.1. SUBSCRIPTION SERVICE. Customer is authorized to use the Subscription Service limited by the purchased amount and subscription term (“Subscription Term”) on the Order Form and the Product Overview.

3.2. DOCUMENTATION. ServiceNow grants to Customer a non-exclusive, non-transferable, worldwide right during the Subscription Term to access and use the documentation relating to the operation and use of the Subscription Service that is provided by ServiceNow to Customer under the Agreement, as updated by ServiceNow from time to time (“Documentation”).

3.3. CUSTOMER DATA. Customer grants ServiceNow a non-exclusive, non-transferable, worldwide right to use the electronic data pertaining to Customer and/or its users that is processed using the Subscription Service (collectively “Customer Data”) strictly for the limited purpose of providing the Subscription Service to Customer.

3.4. SOFTWARE. ServiceNow may provide ServiceNow software products (“Software”) for use in connection with the Subscription Service. Any Software is licensed and not sold (even if for convenience ServiceNow makes reference to words such as “sale” or “purchase”). ServiceNow grants Customer a limited, personal, worldwide, non-sublicensable, nontransferable, non-exclusive license to install and execute the Software on machines operated by or for Customer solely to permit Customer to use the Subscription Service during the Subscription Term in accordance with the terms and conditions of the Agreement. The Software may include code that is licensed under third party license agreements, including open source made available or provided with the Software.

3.5. OWNERSHIP. As between ServiceNow and Customer, all rights, title, and interest in and to all intellectual property rights in the Subscription Service, Software and/or Documentation are owned exclusively by ServiceNow. Except as expressly provided in the Agreement, ServiceNow does not grant Customer (and expressly reserves) any rights, express or implied, or ownership in the Subscription Service, Software and/or Documentation. ServiceNow shall have a royalty-free, worldwide, non-exclusive, transferable, sub-licensable, irrevocable, perpetual right to make, use, sell, offer for sale, import, or otherwise incorporate into the Subscription Service, Software and/or Documentation, any suggestions, enhancements, recommendations or other feedback provided by Customer relating to the Subscription Service, Software and/or Documentation.

3.6. RESTRICTIONS. Customer shall not (and shall not permit others to) do the following with respect to the Subscription Service, Software or Documentation: (i) license, sub-license, sell, re-sell, rent, lease, transfer, distribute or time share or otherwise make any of them available for access by third parties; (ii) disassemble, reverse engineer, decompile or modify them or otherwise create derivative works thereof; (iii) access them for the purpose of developing products or services that compete with the Subscription Service; (iv) use them to operate more or different type of applications or platform not authorized under the Agreement; (v) use them to create, use, send, store or run viruses or other harmful computer code, files, scripts, agents or other programs or engage in any other malicious act; (vi) disrupt their security, integrity or operation; (vii) remove or modify a copyright or other proprietary rights notice in them; (viii) use them to reproduce, distribute, display, transmit or use material protected by copyright or other intellectual property right (including the rights of publicity or privacy) without first obtaining the permission of the owner; (ix) use them to damage the property of another; (x) use them in any manner which violates any law or regulation of the United States, any state thereof or other government authority; (xi) use them in any manner that disables, hacks or otherwise interferes with any security, digital signing, digital rights management, verification or authentication mechanisms or (xii) use them in a manner that temporarily or permanently alters, erases, removes, copies, modifies, halts or disables any ServiceNow or third party data, software or network.

4. WARRANTIES

4.1. LIMITED SUBSCRIPTION SERVICE WARRANTY. ServiceNow warrants that during the Subscription Term Customer’s production instances of the Subscription Service shall materially conform to the Product Overview. To submit a warranty claim under this Section, Customer shall (1) reference this Section; and (2) submit a support request to resolve the non-conformity as provided in the Subscription Service Guide, which is set forth on www.servicenow.com/be_schedules.do. If the non-conformity persists without relief more than thirty (30) days after written notice of a warranty claim provided to

SERVICENOW EXPRESS GENERAL TERMS AND CONDITIONS
SERVICENOW PROPR ETARY AND CONFIDENTIAL Page 3 (version 10/21//2014) ServiceNow under this Section 4.1, then Customer may terminate the affected Subscription Service and ServiceNow shall refund to Customer any prepaid subscription fees covering the remainder of the Subscription Term of the affected Subscription Service after the date of termination. Notwithstanding the foregoing, this warranty shall not apply to any non-conformity due to a modification of or defect in the Subscription Service that is made or caused by any person other than ServiceNow or a person acting at ServiceNow’s direction. THIS SECTION 4.1 SETS FORTH CUSTOMER’S EXCLUSIVE RIGHTS AND REMEDIES (AND SERVICENOW’S SOLE LIABILITY) IN CONNECTION WITH THISWARRANTY.

4.2. LIMITED PROFESSIONAL SERVICES WARRANTY. ServiceNow warrants that the Professional Services will be performed in a competent and workmanlike manner in accordance with accepted industry standards and practices and all material requirements set forth in the SOW or Service Description. Customer shall notify ServiceNow in writing of any breach within thirty (30) days after performance of the non-conforming Professional Services. Upon receipt of such notice, ServiceNow, at its option, shall either use commercially reasonable efforts to re-perform the Professional Services in conformance with these warranty requirements or shall terminate the affected Professional Services and refund to Customer any amounts paid for the nonconforming Professional Services. THIS SECTION 4.2 SETS FORTH CUSTOMER’S EXCLUSIVE RIGHTS AND REMEDIES (AND SERVICENOW’S SOLE LIABILITY) IN CONNECTION WITH THIS WARRANTY.

4.3. DISCLAIMER OF WARRANTIES. EXCEPT FOR THE WARRANTIES EXPRESSLY STATED IN THE

AGREEMENT, TO THE MAXIMUM EXTENT ALLOWED BY LAW, SERVICENOW DISCLAIMS ALL WARRANTIES OF ANY

KIND, EXPRESS OR IMPLIED, ORAL OR WRITTEN, INCLUDING WARRANTIES ARISING UNDER STATUTE,

WARRANTIES OF MERCHANTABILITY, ACCURACY, TITLE, NON-INFRINGEMENT OR FITNESS FOR A PARTICULAR

PURPOSE OR ANY WARRANTIES ARISING FROM USAGE OF TRADE, COURSE OF DEALING OR COURSE OF PERFORMANCE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, SERVICENOW SPECIFICALLY DOES

NOT WARRANT THAT THE SUBSCRIPTION SERVICE, SOFTWARE, PROFESSIONAL SERVICES OR DOCUMENTATION

WILL MEET THE REQUIREMENTS OF CUSTOMER OR OTHERS OR THAT THEY WILL BE ACCURATE OR OPERATE WITHOUT INTERRUPTION OR ERROR. CUSTOMER ACKNOWLEDGES THAT IN ENTERING THE AGREEMENT IT HAS NOT RELIED ON ANY PROMISE, WARRANTY OR REPRESENTATION NOT EXPRESSLY SET FORTH HEREIN.

5. CONFIDENTIALITY AND NON-USE RESTRICTIONS

5.1. CONFIDENTIAL INFORMATION. “Confidential Information” means all information disclosed by a party (“Disclosing Party”) to the other party (“Receiving Party”), whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of the disclosure, including without limitation: each party’s respective business plans and processes; financial and employee data; proprietary technology and product information and designs; the Subscription Service and Software and Customer Data. The terms of the Agreement and Order form(s) are Confidential Information of ServiceNow. Confidential Information excludes information that: (i) is or becomes generally known to the public; (ii) was known to the Receiving Party prior to its disclosure by the Disclosing Party without breach of any obligation to the Disclosing Party; (iii) is received from a third party without any obligation of confidentiality to a third party or breach of any obligation of confidentiality to the Disclosing Party; or (iv) was independently developed by the Receiving Party without reference to the Disclosing Party’s Confidential Information.

5.2. PROTECTION. The Receiving Party shall: (i) at all times protect the confidentiality of the Disclosing Party’s Confidential Information with the same degree of care that it uses to protect its own confidential information, and in no event using less than reasonable care; and (ii) not use Confidential Information of the Disclosing Party except to the extent necessary to exercise its rights or fulfill its obligations under the Agreement. To the extent necessary under the Agreement, the Receiving Party may disclose the Confidential Information of the Disclosing Party to the Receiving Party’s employees or contractors who are bound by written obligations of confidentiality and non-use and non-disclosure restrictions at least as protective as those set forth herein. In the event of a court order or government regulation compelling disclosure of any Confidential Information, the Receiving Party shall provide the Disclosing Party with prompt written notice thereof, and shall reasonably cooperate with the Disclosing Party to seek confidential or other protective treatment. Each party’s obligations set forth in this Section 5 shall remain in effect during the term and three (3) years after termination of the Agreement. The Receiving Party shall promptly return to the Disclosing Party or destroy (with certification of such destruction provided by the Receiving Party upon request) all Confidential Information of the Disclosing Party in its possession or control upon request from the Disclosing Party. Provisions for the return of Customer Data are set forth in Section 7.3 (Return of Customer Data).

6. LIMITATIONS OF LIABILITY AND DAMAGES

6.1. LIMITATIONS OF LIABILITY. TO THE EXTENT PERMITTED BY LAW, THE TOTAL, CUMULATIVE LIABILITY OF EACH PARTY ARISING OUT OF OR RELATED TO The AGREEMENT OR THE SERVICES PROVIDED

HEREUNDER, WHETHER BASED ON CONTRACT, IN TORT OR ANY OTHER LEGAL OR EQUITABLE THEORY, SHALL

BE LIMITED TO THE AMOUNTS PAID BY CUSTOMER FOR THE SERVICE GIVING RISE TO THE CLAIM DURING THE

SERVICENOW EXPRESS GENERAL TERMS AND CONDITIONS
SERVICENOW PROPR ETARY AND CONFIDENTIAL Page 4 (version 10/21//2014) TWELVE (12) MONTH PERIOD PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY. THE EXISTENCE OF MORE THAN ONE CLAIM SHALL NOT ENLARGE THIS LIMIT. THE FOREGOING LIMITATION OF LIABILITY SHALL NOT APPLY TO: (1) BODILY INJURY OR DEATH; (2) INFRINGEMENT BY A PARTY OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS; AND (3) CUSTOMER’S OBLIGATION TO PAY AMOUNTS OWED FOR SERVICES PROVIDED HEREUNDER.

6.2. EXCLUSION OF DAMAGES. TO THE EXTENT PERMITTED BY LAW, NEITHER SERVICENOW NOR

CUSTOMER SHALL BE LIABLE TO THE OTHER OR ANY THIRD PARTY FOR LOST PROFITS (WHETHER DIRECT OR

INDIRECT) OR LOSS OF USE OR DATA, COVER, SUBSTITUTE GOODS OR SERVICES, OR FOR INCIDENTAL,

CONSEQUENTIAL, PUNITIVE, SPECIAL OR EXEMPLARY DAMAGES (INCLUDING DAMAGE TO BUSINESS,

REPUTATION OR GOODWILL), OR INDIRECT DAMAGES OF ANY TYPE HOWEVER CAUSED, WHETHER BY BREACH

OF WARRANTY, BREACH OF CONTRACT, IN TORT OR ANY OTHER LEGAL OR EQUITABLE CAUSE OF ACTION EVEN

IF SUCH PARTY HAS BEEN ADVISED OF SUCH DAMAGES IN ADVANCE OR IF SUCH DAMAGES WERE FORESEEABLE. THE FOREGOING EXCLUSIONS SHALL NOT APPLY TO: (1) BODILY INJURY OR DEATH; AND (2) INFRINGEMENT BY A PARTY OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS.

7. TERM AND TERMINATION

7.1. TERM AND TERMINATION. The Agreement continues until terminated in accordance with its terms. Each party may terminate the Agreement in its entirety either: (i) upon thirty (30) days’ prior written notice to the other party, if at the time such notice is served there are no Order Forms in effect; or (ii) upon written notice if the other party becomes the subject of a petition in bankruptcy or any proceeding related to its insolvency, receivership or liquidation, in any jurisdiction, that is not dismissed within sixty (60) days of its commencement or an assignment for the benefit of creditors. Either party may terminate a Subscription Service or Professional Services effective immediately upon written notice if the other party materially breaches a material obligation under the Agreement or the applicable Order Form for the affected service and does not cure the breach within thirty (30) days after receiving written notice thereof from the non-breaching party. Professional Services are separately ordered from the Subscription Service, and are not required for the Subscription Service. A breach by a party of its obligations with respect to Professional Services shall not by itself constitute a breach by that party of its obligations with respect to the Subscription Service even if the services are enumerated in the same Order Form.

7.2. EFFECT OF TERMINATION OF SERVICE. Upon expiration or other termination of the Subscription Service for any reason, Customer shall stop using, and ServiceNow shall stop providing, the terminated Subscription Service. (a) If the Subscription Service is terminated by Customer due to ServiceNow’s breach, then ServiceNow shall refund to Customer, within thirty (30) days after the effective date of termination, all prepaid fees for the remaining portion of the Subscription Term for the terminated Subscription Service after the effective date of termination. (b) If Professional Service is terminated by Customer due to ServiceNow’s breach, then ServiceNow shall refund to Customer, within thirty (30) days after the effective date of termination, any prepaid amounts for unperformed Professional Service. (c) If the Subscription Service is terminated by ServiceNow due to Customer’s breach, then Customer shall pay to ServiceNow, within thirty (30) days after the effective date of termination, fees for the terminated Subscription Service that would have been payable for the remainder of the Subscription Term after the effective date of termination. (d) Upon expiration or other termination of the Subscription Service for any reason, Customer shall be eligible to request the return of Customer Data in accordance with Section 7.3 (Return of Customer Data).

7.3. RETURN OF CUSTOMER DATA. Following the end of the Subscription Term, where Customer has not renewed, Customer shall have forty-five (45) days to request a copy of the Customer Data from ServiceNow; and, if requested, ServiceNow shall use commercially reasonable efforts to provide a copy of that data within fifteen (15) days in a mutually agreed upon, commercially standard format at no cost to Customer unless ServiceNow determines in its reasonable discretion that the data output is not routine, in which case the parties shall mutually agree on a statement of work for professional services. After such forty-five (45) day period, ServiceNow shall have no obligation to maintain or provide any Customer Data and shall thereafter, unless legally prohibited, have the right to delete all Customer Data in its systems or otherwise in its possession or under its control and delete Customer’s instances of the Subscription Service.

7.4. SURVIVAL. Upon termination of the Agreement for any reason, Customer shall pay all amounts owed hereunder. Sections 3.5 (Ownership), 3.6 (Restrictions), and 5 (Confidentiality and Non-Use Restrictions) through 8 (General Provisions) of these General Terms and Conditions, together with any other provision required for their construction or enforcement, shall survive termination of the Agreement for any reason.

8. GENERAL PROVISIONS

8.1. ASSIGNMENT. Neither party may assign its rights or obligations, whether by operation of law or otherwise, without the prior written consent of the other party. Notwithstanding the foregoing, either party may, upon notice and without the other party’s consent: (i) in connection with a merger, reorganization or sale of all or substantially all of the assets or equity

SERVICENOW EXPRESS GENERAL TERMS AND CONDITIONS
SERVICENOW PROPR ETARY AND CONFIDENTIAL Page 5 (version 10/21//2014) of such party, assign the Agreement in its entirety to such party’s successor; and (ii) assign the Agreement in its entirety to any company, partnership or other legal entity which from time to time directly or indirectly controls, is controlled by or is under the common control with such party. Any attempted or purported assignment in violation of this Section 8.1 will be null and void.

Subject to the foregoing, the Agreement shall bind and inure to the benefit of the parties, their respective successors and permitted assigns.

8.2. NOTICE. Except as otherwise provided herein, all notices shall be in writing and deemed given upon: (i) personal delivery; (ii) when received by the addressee if sent by a nationally recognized overnight courier (receipt requested); (iii) the second business day after mailing; or (iv) the first business day after sending by email, except that email shall not be sufficient for notices regarding a Claim. Notices shall be sent to the parties as set forth on the Order Form or as otherwise agreed to by the parties in writing.

8.3. EXPORT COMPLIANCE. Each party shall comply with United States and foreign export control laws and regulations. Customer acknowledges that the Subscription Service, Professional Services, Software and Documentation are subject to the U.S. Export Administration Regulations (the “EAR”) and that Customer shall comply with the EAR.Without limiting the foregoing, Customer represents and warrants that: (i) Customer is not located in, and shall not use the Subscription Service, Professional Services, Software and Documentation from, any country that is subject to U.S. exportrestrictions (currently including, but not necessarily limited to, Cuba, Iran, North Korea, Sudan and Syria); (ii) Customer shall not use the Subscription Service, Professional Services, Software and Documentation in the design, development or production of nuclear, chemical or biological weapons, or rocket systems, space launch vehicles, sounding rockets or unmanned air vehicle systems; and (iii) Customer is not prohibited from participating in the U.S. export transactions by any federal agency of the U.S. government. In addition, Customer is responsible for complying with any local laws which may impact Customer’s right to import, export or use the Subscription Service, Professional Services, Software and Documentation.

8.4. FORCE MAJEURE. No party shall be liable or responsible to the other party, nor be deemed to have defaulted under or breached the Agreement, for any failure or delay in fulfilling or performing any term of the Agreement, when and to the extent such failure or delay is caused by or results from acts beyond the affected party’s reasonable control, including without limitation: strikes, lock-outs or other industrial disputes (whether involving its own workforce or a third party’s), trespassing, sabotage, theft or other criminal acts, failure of energy sources or transport network, acts of God, war, terrorism, riot, civil commotion, interference by civil or military authorities, national or international calamity, armed conflict, malicious damage, breakdown of plant or machinery, nuclear, chemical or biological contamination, explosions, collapse of building structures, fires, floods, storms, earthquakes, epidemics or similar events, natural disasters or extreme adverse weather conditions (each a “Force Majeure Event”). The party suffering a Force Majeure Event shall use reasonable efforts to mitigate against the effects of such Force Majeure Event.

8.5. US GOVERNMENT RIGHTS. All ServiceNow software is commercial computer software and all services are commercial items. “Commercial computer software” has the meaning set forth in Federal Acquisition Regulation (“FAR”)

2.101 for civilian agency purchases and the Department of Defense (“DOD”) FAR Supplement (“DFARS”) 252.227-7014(a)(1) for defense agency purchases. If the software is licensed or the services are acquired by or on behalf of a civilian agency, ServiceNow provides the commercial computer software and/or commercial computer software documentation and other technical data subject to the terms of the Agreement as required in FAR 12.212 (Computer Software) and FAR 12.211 (Technical Data) and their successors. If the software is licensed or the services are acquired by or on behalf of any agency within the DOD, ServiceNow provides the commercial computer software and/or commercial computer software documentation and other technical data subject to the terms of the Agreement as specified in DFARS 227.7202-3 and its successors. Only if this is a DOD prime contract or DOD subcontract, the Government acquires additional rights in technical data as set forth in DFARS 252.227-7015. This U.S. Government Rights clause is in lieu of, and supersedes, any other FAR, DFARS or other clause or provision that addresses Government rights in computer software or technical data.

8.6. ENTIRETY. Customer acknowledges that it has not relied on any statement, promise or representation made or given by or on behalf of ServiceNow which is not set out in the Agreement. Customer’s order is not contingent on, and Customer has not relied on, the delivery of any future functionality regardless of any verbal or written communication about ServiceNow’s future plans. The Agreement supersedes all prior or contemporaneous oral or written agreement, representations and negotiations, including, but not limited to, any terms contained in Customer’s purchase order.

8.7. WAIVER AND AMENDMENT. A waiver of any right is only effective if it is in writing and only against the party who signed such writing and for the circumstances given. Any modification of the Agreement, an Order Form, the Product Overview, the Subscription Service Guide, a SOW or a Service Description must be in writing and signed by authorized representatives of both parties.

8.8. RELATIONSHIP OF THE PARTIES. The parties are independent contractors. Nothing in the Agreement shall be construed to create a partnership, joint venture or agency relationship. Neither party shall have any right or authority

SERVICENOW EXPRESS GENERAL TERMS AND CONDITIONS
SERVICENOW PROPR ETARY AND CONFIDENTIAL Page 6 (version 10/21//2014) to assume or create any obligation of any kind expressed or implied in the name of or on behalf of the other party. ServiceNow may at any time subcontract or delegate in any manner any or all of its obligations under the Agreement to any third party or agent.

8.9. GOVERNING LAW; VENUE; TIME FOR BRINGING ACTION. The Agreement shall be governed by, subject to, and interpreted in accordance with the laws of the state of California, United States of America, if Customer is located in Canada, United States or Mexico, and the laws of England if Customer is located elsewhere. If Customer is located in Canada, United State or Mexico, the parties hereby irrevocably consent to the nonexclusive jurisdiction of, and venue in, any federal or state court of competent jurisdiction located in San Diego, California, or New York, New York, for the purposes of adjudicating any action or proceeding to enforce the terms of the Agreement. If Customer is located elsewhere, then any dispute arising under the Agreement shall be finally settled by binding arbitration in London, England. Such arbitration shall be conducted in English in accordance with the rules of the International Chamber of Commerce by one (1) arbitrator appointed in accordance with such rules. The arbitrator shall allow such discovery as is appropriate in accomplishing a fair, speedy, and cost-effective resolution of the dispute, and shall be expressly empowered to issue appropriate injunctive relief. The award of arbitration shall be final and binding upon both parties, and judgment on the award rendered by the arbitrator may be entered in any court having jurisdiction thereof. Any monetary award shall be payable in United States dollars. To the extent permitted by law, choice of law rules and the United Nations Convention on Contracts for the International Sale of Goods shall not apply. No cause of action arising hereunder or relating hereto may be brought more than one (1) year after it first accrues. Theprevailing party in an action to enforce the Agreement shall be entitled to costs of bringing the claim and reasonable attorneys’ and experts’ fees and expenses. Notwithstanding the foregoing, either party may at any time seek and obtain appropriate legal or equitable relief in any court of competent jurisdiction for claims regarding such party’s intellectual property rights.

8.10. CONSTRUCTION. The Subscription Service and Professional Services shall be provided in the English language unless agreed otherwise. The parties confirm that they have requested that the Agreement and all related documents be drafted in English at the express wishes of the parties. Les parties ont exigé que le présent contrat et ServiceNow les documents connexes soient rédigés en anglais selon la volonté expresse des parties. Capitalized terms not defined herein shall have the meaning set forth or referenced in the Subscription Service Guide. Section headings are for convenience only and are not to be used in interpreting the Agreement.

SERVICENOW EXPRESS SUBSCRIPTION SERVICE GU DE
SERVICENOW PROPR ETARY AND CONFIDENTIAL Page 1 (version 10/21//2014)

SUBSCRIPTION SERVICE GUIDE
Capitalized terms not defined herein shall have the meaning set forth in the Express General Terms and Conditions or Subscription Service Agreement.

1. CUSTOMER OPERATION OF SUBSCRIPTION SERVICE

1.1. PASSWORDS AND USER NAMES. Customer shall: (a) protect the names and passwords of users of the Subscription Service and prevent and notify ServiceNow of unauthorized use of the Subscription Service; (b) appoint up to five (5) designated support contacts for purposes of contacting ServiceNow support regarding questions and/or technical issues (“Authorized Customer Support Contacts”) and ensure that the Authorized Customer Support Contacts’ information is current in the ServiceNow support portal; (c) be responsible for the lawfulness of, and results obtained from, all CustomerData submitted by users to the Subscription Service and each user’s acts and omissions; and (d) use the Subscription Service only in accordance with the Documentation.

1.2. ACCESS CONTROL. ServiceNow provides the technical architecture that permits Customer to use and process Customer Data in the Subscription Service. This architecture includes an access control list engine. Customer shall be responsible for using the access control list engine for protecting all Personal Data. Customer shall ensure that access to and use of Subscription Service is restricted to only users authorized by Customer. Customer shall be responsible for ensuring all such users maintain the security of any passwords, usernames and other forms of authentication to the Subscription Service. A username and password must be uniquely assigned to a specific person and may not be shared by multiple persons at any one time or transferred. “Personal Data” means information identifying a natural person; an identifiable natural person is someone who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, financial, cultural or social identity.

2. SECURITY PROGRAM; EXCEPTIONS
ServiceNow shall maintain a security program (“Security Program”) that includes industry standard practices designed to protect Customer Data from unauthorized access, use, disclosure, alteration, distribution and destruction. Notwithstanding anything to the contrary in this Agreement, the Security Program apply only to those systems, networks, network devices, facilities and components over which ServiceNow exercises control. The Security Program does not apply to: (i) information shared with ServiceNow that is not Customer Data; (ii) Customer Data in transit over the Internet, Customer’s virtual private network (VPN), or another third party network; (iii) any Customer Data processed by Customer or its users in violation of this Agreement; or (iv) any part of the Subscription Service that is not hosted by ServiceNow.

3. UPGRADES

3.1. UPGRADES. “Upgrades” are ServiceNow’s releases of the Subscription Service for repairs, enhancements or new features applied by ServiceNow to Customer’s instances of the Subscription Service at no additional fee during the Subscription Term. ServiceNow has the discretion to provide new functionality either: (i) as an Upgrade, or (ii) as different software or service for a separate fee. ServiceNow determines whether and when to develop, release and apply any Upgrade to Customer’s instances of the Subscription Service.

3.2. MAINTENANCE. ServiceNow shall use reasonable efforts to give Customer ten (10) days’ notice of any service maintenance to the infrastructure network, hardware or software used by ServiceNow to operate and deliver the Subscription Service if ServiceNow, in its reasonable judgment, believes that such cloud infrastructure maintenance will impact Customer’s use of its production instances of the Subscription Service. ServiceNow will use reasonable efforts to limit the Maintenance Time (as defined below) to no more than two (2) hours per month. Notwithstanding the foregoing, ServiceNow may provide Customer with a shorter or no notice period of service maintenance if necessary, in the reasonable judgment of ServiceNow, to maintain the availability, security, stability or performance of the Subscription Service.

4. SUPPORT
During the Subscription Term, ServiceNow shall use reasonable efforts to resolve Defects in the Subscription Service (“Support”).

A “Defect” means a problem causing the Subscription Service to not conform to the Product Overview. Customer may request Support for a Defect at the online portal https://hi.service-now.com/ or any successor site.

A Defect will be assigned a priority level as follows:

SERVICENOW EXPRESS SUBSCRIPTION SERVICE GU DE
SERVICENOW PROPR ETARY AND CONFIDENTIAL Page 2 (version 10/21//2014) • A Priority Level 1 Defect is any Defect that causes Customer’s instance(s) of the Subscription Service to be not Available (as defined below).
• A Priority Level 2 Defect is any Defect that causes a mission critical function of the Subscription Service to fail. • A Priority Level 3 Defect is any Defect that significantly impedes work or progress. • A Priority Level 4 Defect is any Defect that does not significantly impede work or progress.

Upon notification by Customer of a Defect, ServiceNow shall, in all instances, target an initial response (the “Initial Response”) within the timeframes set forth in the Support Table, as measured from the time that Customer notifies ServiceNow. The initial response from ServiceNow shall include, as applicable and without limitation: (i) ServiceNow’s acknowledgment or notification to Customer of such Defect, and (ii) the classification of such Defect as a Priority Level 1, 2, 3 or 4.

SUPPORT TABLE
Priority Level Target Initial Response
1 30 minutes; at all times
2 2 hours; at all times
3 Within 1 business day
4 Varies
Support does not include: implementation services; configuration services; integration services; customization services or other custom software development; support for modifications of the Subscription Service by any person other than ServiceNow or a person acting at ServiceNow’s direction; training or “how-to”; assistance with administrative functions; professional services; corrections of immaterial Defects or Defects that have a viable workaround; or corrections that will degrade the Subscription Service.

5. SERVICE LEVEL OBJECTIVE

5.1. DEFINITIONS.
(a) “Available” means that the Subscription Service can be accessed by authorized users. (b) “Excused Downtime”: means (i) Maintenance Time of up to two (2) hours per month; and (ii) any time the Subscription Service is not Available due to circumstances beyond ServiceNow’s control, including without limitation modifications of the Subscription Service by any person other than ServiceNow or a person acting at ServiceNow’s direction, a Force Majeure Event, general Internet outages, failure of Customer’s infrastructure or connectivity (including without limitation, direct connectivity and virtual private network (VPN) connectivity to the Subscription Service), computer and telecommunications failures and delays not within ServiceNow’s control, and network intrusions or denial-of-service or other criminal attacks.
(c) “Maintenance Time” means the time the Subscription Service is not Available due to service maintenance.
(d) “Availability Service Level Objective” means the percentage of total time during which Customer’s production instances of the Subscription Service are Available during a calendar month, excluding Excused Downtime.

5.2. AVAILABLITY. ServiceNow shall use reasonable efforts to provide an Availability Service Level Objective of

99.8% over any calendar month. There is no service credit offered for a failure to meet this Availability Service Level Objective.
1 CONFIDENTIAL

SCHEDULE A

TERMS AND CONDITIONS TO

VIRTRU PRO

SUBSCRIPTION AGREEMENT

1. DEFINITIONS
For purposes of this Agreement, the following terms shall have the following meanings:

1.1 “Derivative Work” shall mean a new or
modified work that is based on or derived from a
preexisting work, including, without limitation, a work that, in the absence of a license, would infringe the
copyright in such preexisting work or that uses trade
secrets or other proprietary information with respect to such preexisting work.

1.2 “Materials” shall mean the Virtru Pro
software (including any object code, executable files, or browser plug-ins) or materials related thereto provided by Virtru to Customer hereunder, including, without
limitation, any software downloaded from Virtru’s
website or from the Virtru Pro Services; any related
materials and documentation therefor; and any
modifications, error corrections, bug fixes, new releases, enhanced functionality (including platform integration
features not generally available to non-commercial users of Virtru’s software) or other updates thereto that may be provided hereunder by Virtru to Customer during the
term of this Agreement.

1.3 “Third Party Services” shall mean any
services used in connection with the Materials that are hosted by a party other than Virtru or Licensee.

1.4 “Virtru Pro Services” shall mean the
Virtru hosted services made available by Virtru to
Customer in connection with theMaterials.

2. RIGHTS IN MATERIALS AND TO USE SERVICE

2.1 Grant of Rights. Subject to the terms
and conditions of this Agreement, Virtru (a) hereby grants to Customer a restricted, non-exclusive, nontransferable, nonsublicensable, royalty-free (except as set forth in
Section 2.3), revocable right to use, during the term of this Agreement and in accordance with the
documentation provided by Virtru, the Materials (the
“License”), and (b) Virtru will make the Virtru Pro Services available to Customer pursuant to this Agreement during the term of this Agreement. Except as set forth in this Section 2.1, no other right or license of any kind is granted by Virtru to Customer hereunder with respect to the
Materials or the Virtru Pro Services. Customer
acknowledges and agrees that, unless otherwise agreed in writing between the parties, Customer shall be solely
responsible for procuring and complying with any license or right to use any Third Party Services, including those offered by Customer’s email servicesprovider.

2.2 Restrictions. Customer shall not,
without the prior written consent of Virtru: (a) copy all or any portion of the Materials or Virtru Pro Services;
(b) decompile, disassemble, scrape or otherwise reverse engineer the Materials, Virtru Pro Services or any portion thereof, or determine or attempt to determine any source code, algorithms, methods or techniques embodied in the Materials or used in the Virtru Pro Services or any portion thereof; (c) modify, translate or create any Derivative Works based upon the Materials or Virtru Pro Services;
(d) distribute, disclose, market, rent, lease, assign,
sublicense, pledge or otherwise transfer the Materials, in whole or in part, to any third party or export the Materials outside the United States; (e) remove or alter any
copyright, trademark, trade name or other proprietary
notices, legends, symbols or labels appearing on or in
copies of the Materials or the Virtru Pro Services;
(f) perform, or release the results of, benchmark tests or other comparisons of the Materials or Virtru Pro Services with other programs or services; (g) transfer the Materials to any computer other than a computer owned by
Customer and used by Customer in Customer’s
operations; (h) permit the Materials or Virtru Pro Services to be used for processing the data of any third party;
(i) incorporate the Materials, Virtru Pro Services or any portion thereof into any other program, product or
service, or use the Materials or Virtru Pro Services to provide similar services or functionality to third parties; (j) provide any third party with access to the Virtru Pro
Services other than as expressly permitted herein or by the Terms of Service (as defined below); (k) use the
Materials or Virtru Pro Services for any unlawful or
tortious purpose; or (l) use the Materials or Virtru Pro Services for any purpose other than in accordance with
the terms and conditions of this Agreement or Virtru’s
then-current terms of service (available at
https://www.virtru.com/terms-of-service) (the “Terms of Service”). Customer shall ensure that all Customer end
users of the Virtru Pro Service and Materials comply with 2 CONFIDENTIAL
the terms and conditions of this Agreement. Customer
shall be responsible for compliance with this Agreement by each Customer end user and it shall monitor and
manage all Customer users in connection with this
Agreement.

2.3 Fees; Payment. In consideration of the
Virtru’s provision of the Virtru Pro Services and Materials, Customer shall make payments to Virtru in accordance
with the terms set forth on the cover page of this
Agreement. Sales and use tax, VAT, or GST are
Customer’s sole responsibility, and Customer
acknowledges and agrees that all fees are exclusive of all such taxes.

2.4 Seats; Reporting. Customer shall
initially be permitted to use the Materials and Virtru Pro Services with respect to the number of seats set forth on the cover page of this Agreement (the “Baseline Seat
Count”). Each seat shall be used by one Customer user.

During the term of this Agreement, Customer will report to Virtru the total number of users of the Materials and Virtru Pro Services on an annual basis. Such report will be submitted to [email protected] and shall be due thirty (30) days prior to each anniversary of the date of this
Agreement (each, a “Reporting Date”) based on the
actual number of users as of the date thirty (30) days prior to such Reporting Date (each, a “Seat Count Date”). If the actual number of Customer users as of any Seat Count
Date is higher than the Baseline Seat Count, Customer will pay the “Subscription Fee per Seat” set forth on the cover page of this Agreement (the “Subscription Fee”) for each such additional user for any Renewal Term.

2.5 Adjustment Events. In addition to the
annual reporting required under Section 2.4 above,
Customer shall report to Virtru any increase of ten
percent (10%) or more in the aggregate number of
Customer users in excess of the Baseline Seat Count that occurs between Reporting Dates (an “Adjustment Event”)
and agrees to pay Virtru, within thirty (30) days following any such Adjustment Event, a prorated Subscription Fee
for each such additional user for the remaining portion of the applicable term and for any Renewal Term.

2.6 Seat Count Audit. At any time during
the term of this Agreement, Virtru shall have the right to audit Customer’s usage of the Virtru Pro Services and
Materials (a “Seat Count Audit”). If the actual number of Customer users as of the date of any Seat Count Audit is higher than the Baseline Seat Count, Customer will pay
the “Subscription Fee per Seat” set forth on the cover
page of this Agreement for the remaining portion of the applicable term and for any Renewal Term.

3. SUPPORT
Virtru will provide support to Customer and its end users through Virtru’s generally available online ticketing and support system. Except as expressly provided in Schedule B, which is incorporated herein by reference, in this
Section 3 or as may otherwise be provided under a
written support agreement entered into by Virtru and
Customer, Virtru is under no obligation to support the
Materials or Virtru Pro Services in any way, nor to provide any modification, error correction, bug fix, new release or other update (each an “Update”) to or for the Materials or Virtru Pro Service. In the event Virtru, in its sole discretion, supplies or makes available any Update to
Customer, such Update shall be deemed to be part of the Materials or Virtru Pro Services (as applicable) hereunder and shall be subject to the terms and conditions of this Agreement.

4. PROPRIETARY RIGHTS

4.1 General. As between Virtru and
Customer, Virtru retains all right, title and interest, including, without limitation, all patent rights, copyrights, trademarks and trade secrets, in and to the Materials,
Virtru Pro Services and any portion thereof, including, without limitation, any copy or Derivative Work of the
Materials, Virtru Pro Services or any portion thereof and any Update thereto. Customer agrees to take any action
reasonably requested by Virtru to evidence, maintain,
enforce or defend the foregoing. Customer shall not take any action to jeopardize, limit or interfere in any manner with Virtru’s ownership of and rights with respect to the Materials, Virtru Pro Services or any Derivative Work or Update. Customer shall have only those rights in or to the Materials, Virtru Pro Services and any Derivative Work or Update granted to it pursuant to this Agreement.

4.2 Feedback. Customer and its authorized
users may provide suggestions, requests,
recommendations and other feedback concerning
Customer’s use of the Materials and Virtru Pro Services (including, without limitation, any errors or difficulties discovered with respect thereto) (the “Feedback”).

Customer agrees that all Feedback shall be the sole
3 CONFIDENTIAL
property of Virtru and Virtru may use such Feedback at its discretion without the consent ofCustomer.

5. PROPRIETARY INFORMATION

5.1 Proprietary Information. Both parties
acknowledge that, in the course of this Agreement each
may obtain confidential or proprietary information of the other party (“Proprietary Information”). “Proprietary
Information” will include, without limitation, (a) the
existence of and terms of this Agreement, (b) trade
secrets, know-how, inventions (whether or not
patentable), techniques, processes, programs (whether in source code or object code form), ideas, algorithms,
formulas, schematics, testing procedures, software design and architecture, computer code, documentation, design
and functional specifications, product requirements,
problem reports, performance information, software
documents, hardware, devices, designs, drawings,
unpublished patent applications, data, plans, strategies and forecasts, and (c) technical, engineering,
manufacturing, product, marketing, servicing, financial, personnel and other information. Virtru’s “Proprietary
Information” will include, without limitation, the
Materials (including all Derivative Works and Updates)
and all confidential information related thereto provided by Virtru to Customer in connection with this Agreement.

Virtru’s Proprietary Information shall, as between
Customer and Virtru, belong solely to Virtru, and
Customer’s Proprietary Information shall, as between
Customer and Virtru, belong solely to Customer.

5.2 Use and Disclosure Restrictions. Each
party agrees (a) to protect the other party’s Proprietary Information from unauthorized dissemination and use; (b) to use the other party’s Proprietary Information only for the performance of this Agreement and the exercise of
any rights under this Agreement; (c) not to disclose any Proprietary Information, or any part or parts thereof, to any of its employees, agents, contractors or any other
individuals except to its employees who are under
confidentiality obligations no less restrictive than the requirements of this Section 5; (d) with respect to
Customer, not to disclose or otherwise provide to any
third party, without the prior written consent of Virtru or as otherwise set forth in a separate written agreement
between the parties hereto entered into after the date
hereof, as applicable, any of Virtru’s Proprietary
Information, materials or any data or other information produced, obtained or created by Customer in connection with Customer’s use of the Materials, including, without limitation, the existence of this Agreement and the
existence and possible applications of the Materials; (e) to undertake whatever action is necessary (or authorize the other party to do so in the name of such party) to prevent or remedy any breach of such party’s confidentiality
obligations herein set forth or any other unauthorized
disclosure of any Proprietary Information by its current or former employees, agents or contractors; and (f) not to remove or destroy any proprietary or confidential legends or markings placed upon or contained within the
Proprietary Information provided to such party by the
other party.

5.3 Exclusions. The foregoing restrictions
on disclosure and use shall not apply with respect to any Proprietary Information that: (a) is or becomes publicly known through no act or omission of the other party; (b) was rightfully known by the receiving party without
confidential or proprietary restriction before receipt from the other party, as evidenced by the receiving party’s
contemporaneous written records; (c) becomes rightfully known to the receiving party without confidential or
proprietary restriction from a source other than the
disclosing party that does not owe a duty of
confidentiality with respect to such Proprietary
Information; or (d) is independently developed without
the use of the Proprietary Information as evidenced by
the receiving party’s written records. In addition, a party may use or disclose Proprietary Information to the extent (i) approved in writing by the other party and (ii) a party is legally compelled to disclose such Proprietary
Information, provided, however, that prior to any such
compelled disclosure, such party shall cooperate fullywith the other party in protecting against any such disclosure and/or obtaining a protective order narrowing the scope of such disclosure and/or use of the Proprietary
Information. Further, each party may disclose the terms and conditions of this Agreement: (A) in confidence, to legal counsel; (B) in confidence, to accountants, banks, and financing sources and their advisors; and (C) in
connection with the enforcement of this Agreement or
any rights hereunder.

5.4 Equitable Relief. Each party agrees
that, due to the unique nature of the other party’s
Proprietary Information, the unauthorized disclosure or use of the other party’s Proprietary Information or any other breach of any provision of this Section 5 will cause irreparable harm and significant injury to the other party, the extent of which will be difficult to ascertain and for which there will be no adequate remedy at law.

Accordingly, each party agrees that the other party, in addition to any other available remedies, shall have the right to seek an immediate injunction and other equitable relief enjoining any breach or threatened breach of this Section 6 without the necessity of posting any bond or
other security. Each party shall notify the other party in writing immediately upon becoming aware of any such
breach or threatened breach.

CONFIDENTIAL
4 6. NO WARRANTY

THE MATERIALS AND VIRTRU PRO SERVICES ARE
PROVIDED “AS IS” AND VIRTRU DISCLAIMS ALL

WARRANTIES AND REPRESENTATIONS, WHETHER

EXPRESS OR IMPLIED, RELATING TO THE MATERIALS AND

VIRTRU PRO SERVICES, INCLUDING, WITHOUT

LIMITATION, ANY WARRANTIES OF DESIGN,

MERCHANTABILITY, FITNESS FOR A PARTICULAR

PURPOSE, TITLE OR NONINFRINGEMENT OF THIRD PARTY

RIGHTS, OR WARRANTIES ARISING FROM A COURSE OF

DEALING, COURSE OF PERFORMANCE, USAGE OR TRADE
PRACTICE. VIRTRU DOES NOT GUARANTEE THE ACCURACY

OF THE INFORMATION INCLUDED IN, TRANSMITTED

THROUGH OR MADE AVAILABLE BY THE MATERIALS OR

VIRTRU PRO SERVICES, WHICH MAY INCLUDE
INACCURACIES OR ERRORS. VIRTRU DOES NOT

GUARANTEE THAT THE MATERIALS OR VIRTRU PRO

SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE,

THAT BUGS OR MALFUNCTIONS WILL BE CORRECTED OR

THAT THE MATERIALS, VIRTRU PRO SERVICES OR
VIRTRU’S SERVERS ARE FREE OF HARMFUL COMPONENTS.

VIRTRU DOES NOT GUARANTEE THAT THE MATERIALS OR

VIRTRU PRO SERVICES ARE ACCURATE, WITHOUT ERROR
OR RELIABLE.

7. VIRTRU’S ENTIRE LIABILITY

TO THE EXTENT ALLOWED BY APPLICABLE LAW AND

NOTWITHSTANDING ANY FAILURE OF ESSENTIAL

PURPOSE OF ANY LIMITED REMEDY OR LIMITATION OF
LIABILITY: (a) IN NO EVENT SHALL VIRTRU OR ITS

SUPPLIERS BE LIABLE FOR ANY DAMAGES FOR LOSS OF

PROFITS, LOSS OF BUSINESS, LOSS OF USE OR DATA,

INADVERTENT DISCLOSURE OF DATA, OR INTERRUPTION

OF BUSINESS, OR FOR ANY INDIRECT, SPECIAL,

INCIDENTAL OR CONSEQUENTIAL DAMAGES OF ANY KIND

OR OTHER ECONOMIC LOSS ARISING FROM OR RELATING

TO THIS AGREEMENT OR THE SUBJECT HEREOF, EVEN IF

VIRTRU HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH

DAMAGES, HOWEVER CAUSED, AND
(b) NOTWITHSTANDING ANYTHING IN THIS AGREEMENT
TO THE CONTRARY, VIRTRU’S ENTIRE LIABILITY ARISING

FROM OR RELATING TO THIS AGREEMENT OR THE

SUBJECT HEREOF, UNDER ANY LEGAL THEORY (WHETHER

IN CONTRACT, TORT, INDEMNITY OR OTHERWISE), IF ANY,
SHALL NOT EXCEED ONE THOUSAND DOLLARS (US$1,000).

8. INDEMNIFICATION
Customer shall defend, indemnify and hold Virtru
harmless against any loss, liability, damage or cost
(including reasonable attorneys’ fees) in connection with claims, actions, demands, suits, or proceedings made or brought against Virtru by a third party alleging (a) that any modification or addition to the Materials or Virtru Pro Services made by or for Customer (other than by Virtru) infringes a copyright, mask work right, trade secret,
trademark right or patent of the third party; (b) in
combination with any other product or service not
provided, specified or recommended in writing by Virtru for use with the Materials or Virtru Pro Services; or (b) with respect to the development, manufacture,
marketing, sales, distribution or use of any of the
Materials or Virtru Pro Services, including, without
limitation, a product liability claim or a claim for breach of any warranty or support obligations. In connection with a claim under this Section 9, Virtru shall: (i) provide
Customer with prompt notice of the claim; (ii) permit
Customer to control the defense and any settlement of
the claim (provided that Customer may not settle any
claim unless such settlement unconditionally releases
Virtru of all liability in connection with such claim); and (iii) provide cooperation as reasonably requested by
Customer (at Customer’s expense).

9. TERM AND TERMINATION

9.1 Term. This Agreement shall commence
on the Effective Date and, unless sooner terminated
pursuant to the terms hereof, shall continue in full force and effect for one (1) year (the “Initial Term”).

Thereafter, this Agreement shall automatically renew for successive one (1) year periods (each a “Renewal Term”), unless either party provides the other party with written notice of its intent not to renew at least thirty (30) days prior to the end of the then-current term. The automatic renewal of this Agreement will be for the Baseline Seat Count, as adjusted pursuant to Sections 2.4, 2.5 and/or

2.6, on the same payment terms as set forth on the cover page of this Agreement.

9.2 Termination. Either party may
terminate this Agreement immediately upon written
notice to the other party if the other party fails to perform any of its duties or obligations hereunder and, except with respect to Customer’s breach of Section 2.1 or 2.2, which breach shall not be subject to any cure period, fails to cure such default within thirty (30) days following receipt of written notice from the non-defaulting party specifying the occurrence or existence of the default. Customer
shall notify Virtru within twenty-four (24) hours of
Customer becoming aware of any breach (other than by
Virtru) of the terms and conditions of this Agreement,
including, without limitation, Sections 2 and 5.

9.3 Effect of Termination. Upon the
expiration or termination of this Agreement, the rights granted to Customer hereunder shall terminate, Customer will cease all use of the Materials, return to Virtru or destroy the Materials in its possession, and, upon Virtru’s request, so certify such actions to Virtru. Any costs

CONFIDENTIAL
5 incurred in returning or destroying the Materials upon termination shall be borne by Customer. The provisions
of Sections 2.2, 4.2, 5, 6, 7, 8, 9.3, and 10 shall survive the expiration or any termination of this Agreement.

Termination of this Agreement by either party shall not act as a waiver of any breach of this Agreement and shall not act as a release of either party from any liability for breach of such party’s obligations under this Agreement.

Neither party shall be liable to the other for damages of any kind solely as a result of terminating this Agreement in accordance with its terms, and termination of this
Agreement by a party shall be without prejudice to any
other right or remedy of such party under this Agreement or applicable law.

10. GENERAL PROVISIONS

10.1 Notices. Any notice, request, demand
or other communication required or permitted hereunder
shall be in writing, shall reference this Agreement and shall be deemed to be properly given: (a) when delivered personally; (b) seven (7) days after having been sent by registered or certified mail, return receipt requested, postage prepaid; or (c) two (2) business days after deposit with a private industry express courier, with written
confirmation of receipt. All notices shall be sent to the address set forth on the cover page of this Agreement and to the notice of the person executing this Agreement (or to such other address as may be designated by a party by giving written notice to the other party pursuant to this Section 10.1).

10.2 Assignment. This Agreement may not
be assigned, in whole or part, whether voluntarily, by
operation of law or otherwise, by Customer without the
prior written consent of Virtru. Subject to the preceding sentence, the rights and liabilities of the parties hereto shall bind, and inure to the benefit of, their respective assignees and successors and is binding on the parties and their successors and assigns. Any attempted assignment
other than in accordance with this Section 10.2 shall be null and void.

10.3 Governing Law, Jurisdiction and Venue.

This Agreement is to be construed in accordance with and governed by the internal laws of the Commonwealth of
Virginia (but expressly excluding the Uniform Computer
Information Transactions Act (“UCITA”) as enacted in
Virginia) without giving effect to any choice of law rule that would cause the application of the laws of any
jurisdiction other than the internal laws of the
Commonwealth of Virginia (excluding UCITA) to the rights and duties of the parties. Any legal suit, action or
proceeding arising out of or relating to this Agreement shall be commenced in a federal court in the Eastern
District of Virginia or in state courts with jurisdiction over Fairfax County, Virginia, and each party hereto irrevocably submits to the exclusive jurisdiction and venue of any
such court in any such suit, action or proceeding.

10.4 Attorneys’ Fees. If any legal action,
including, without limitation, an action for arbitration or injunctive relief, is brought relating to this Agreement or the breach hereof, the prevailing party in any final
judgment or arbitration award, or the non-dismissing
party in the event of a dismissal without prejudice, shall be entitled to the full amount of all reasonable expenses, including all court costs, arbitration fees and actual
attorneys’ fees paid or incurred in good faith.

10.5 Waiver. The waiver by either party of a
breach of or a default under any provision of this
Agreement, shall be in writing and shall not be construed as a waiver of any subsequent breach of or default under the same or any other provision of this Agreement, nor
shall any delay or omission on the part of either party to exercise or avail itself of any right or remedy that it has or may have hereunder operate as a waiver of any right or
remedy.

10.6 Severability. If the application of any
provision of this Agreement to any particular facts or
circumstances shall be held to be invalid or unenforceable by an arbitration panel or a court of competent
jurisdiction, then (a) the validity and enforceability ofsuch provision as applied to any other particular facts or
circumstances and the validity of other provisions of this Agreement shall not in any way be affected or impaired
thereby and (b) such provision shall be enforced to the maximum extent possible so as to effect the intent of the parties and reformed without further action by the parties to the extent necessary to make such provision valid and enforceable.

10.7 Relationship of the Parties. Nothing
contained in this Agreement shall be deemed or
construed as creating a joint venture, partnership, agency, employment or fiduciary relationship between the
parties. Neither party nor its agents have any authority of any kind to bind the other party in any respect
whatsoever, and the relationship of the parties is, and at all times shall continue to be, that of independent
contractors.

10.8 Restricted Rights. If Customer is an
agency or instrumentality of the United States
Government, the Materials are “commercial computer
software” and “commercial computer software
documentation,” and, pursuant to FAR 12.212 or DFARS
227.7202, and their successors, as applicable, use
reproduction and disclosure of the Materials are governed by the terms of this Agreement.

CONFIDENTIAL
6 10.9 Reference. Customer agrees to serve as
a “reference customer” that may be disclosed by Virtru to third parties (including by displaying Customer’s name, logo and/or a link to Customer’s web site on Virtru’s web site) and, upon reasonable notice from Virtru, shall serve as a reference to potential customers, vendors, investors, or other third parties designated by Virtru; provided,
however, that Virtru shall provide Customer with
reasonable prior notice of its need to have Customer
serve as a reference.

10.10 Entire Agreement. This Agreement, any
Schedules and any Exhibits attached hereto and
incorporated herein by reference, and the Terms of
Service constitute the entire agreement between the
parties concerning the subject matter hereof and
supersede all prior or contemporaneous representations, discussions, proposals, negotiations, conditions,
agreements and communications, whether oral or
written, between the parties relating to the subject
matter of this Agreement and all past courses of dealing or industry custom. No amendment or modification of
any provision of this Agreement shall be effective unless in writing and signed by a duly authorized signatory of each of Virtru and Customer.

10.11 Counterparts and Electronic Signatures.

The Parties may execute this Agreement in counterparts, each of which is deemed an original, but all of which
together constitute one and the same agreement. This
Agreement may be delivered electronically or by facsimile transmission, and the parties hereby agree that any
electronic or facsimile signatures hereto are legal, valid and enforceable as originals.

CONFIDENTIAL

SCHEDULEB

MAINTENANCE AND SUPPORT SERVICES SCHEDULE

1. DEFINITIONS
For purposes of this Schedule, the following term shall have the following meaning:
(a) “Support Services” means the delivery of front-end support to Customer’s end users by telephone, email or other methods and the training of Customer’s end users, in each case relating to the use of the Materials and Virtru Pro Services.

2. SUPPORT SERVICES.

Virtru will be responsible for providing Customer’s end users with Support Services. Virtru will not be required to provide the Support Services if Customer has failed to pay any amount payable to Virtru under this Agreement and such amount is more than thirty (30) daysoverdue.

3. UPDATES.

Virtru will provide Customer with one copy of each Update made generally available by Virtru to its customersthat pay for customer support and maintenance during the term of thisAgreement.

4. SUPPORT HOURS.

Virtru will provide the Support Services during Virtru’s normal business hours, Monday to Friday, except holidays.

Virtru will respond to Customer support inquiries or requests within one business day. vCloud Air (U.S. and Japan Data Centers)

TERMS OF SERVICE
Last updated: November 5, 2014
VMware vCloud Air is an infrastructure as a service offering. By accessing any service offered through VMware vCloud Air (the “ Service Offering”) you agree to be bound by these terms of service between you and VMware (“ Agreement”). If you do not agree to this Agreement, you must not access the Service Offering. An individual accepting this Agreement on behalf of anorganization represents and warrants having legal authority to bind that organization. “ You” means the entity accepting this Agreement. “ VMware,” “ we,” or “ us” means VMware, Inc., a Delaware corporation, to the extent that you are purchasing the Service Offering in the United States, VMware vCloud Service G.K., a company organized and existing under the laws of Japan, to the extent that youare purchasing the Service Offering in Japan, and VMware International Limited, a companyorganized and existing under the laws of Ireland, to the extent that you are purchasing the Service Offering elsewhere. Capitalized terms used in this Agreement are defined throughout this Agreement and in Section 14.

EVALUATION PROGRAM USE. When you access the Service Offering under aVMware evaluation program, you may use the Service Offering only for non-productioncomputing activity. Notwithstanding any other provision in this Agreement, under a VMwareevaluation program, we provide the Service Offering “AS-IS” without indemnification, supportor warranty of any kind, expressed or implied, and we will not be liable for any damages. Upon termination of the evaluation, you will no longer have access to the Service Offering andYour Content.

1. The Service Offering.

1.1 Generally. This Agreement governs your access and use of the Service Offering. We may deliver the Service Offering to you with the assistance of our affiliates, licensors and providers.

Service Level Agreements may apply to the Service Offering. You will comply with all laws, rulesand regulations applicable to your use of the Service Offering, and with the Third Party Terms,the Service Description, the Privacy Addendum, and the Support Policy, all of which are incorporated herein by reference.

1.2 Access to the Service Offering. You may access and use the Service Offering solely foryour own benefit and only in accordance with this Agreement. To access the Service Offering, you must register for the Service Offering and set up an authorized account with Login Credentials. You may monitor and manage your Service Offering account via the My VMware Portal availableat www.vmware.com/accounts and through the Service Offering Portal available at http://vcloud.vmware.com. You must keep confidential your Login Credentials. If you set up an authorized account for an organization, you will require that all authorized users of that account (including anyone providing services to you) keep confidential their Login Credentials. You will keep your registration information accurate, complete and current as long as you use the ServiceOffering.

You are responsible for any use that occurs under your Login Credentials, including any activities by you, or your employees, contractors or agents. If you believe an unauthorized user has gained access to your Login Credentials, you will notify us as soon as possible. Neither we nor ouraffiliates are responsible for any unauthorized access to or use of your account.

1.3 Verifying; Cooperation. We have the right to verify your compliance with this Agreement. Ifwe seek to verify that compliance, you will provide information or other materials reasonablyrequested by us to assist the verification. We monitor the overall performance and stability of the infrastructure of the Service Offering. You may not block or interfere with that monitoring. If we reasonablybelieve a problem with the Service Offering may be attributable to Your Content or your use of theService Offering, you will cooperate with us to identify and resolve the source of that problem.

1.4 Additional Terms; Third Party Content. As part of your use of the Service Offering, youmay receive access to additional data, content, software or applications subject to separate terms. If so, those separate terms will prevail over this Agreement as to your use of that data, content, software or applications. Third Party Content is available “AS IS” without indemnification or support, andwe disclaim all express and implied warranties (including warranties of merchantability, fitness for a particular purpose, and non-infringement). You are responsible for reviewing, accepting, and complying with any third party terms of use or other restrictions applicable to the Third Party Content. Those terms will be available to you through a notification within the Service Offering or ina document available at https://www.vmware.com/files/pdf/support/vmware-vcloud-air-third-partyterms.pdf. It is your responsibility to check the Third Party Terms, which may be modified from time to time. We may provide billing and related services associated with the Third Party Content. Wewill not provide any support for the Third Party Content unless otherwise noted in the Third PartyTerms.

We reserve the right to suspend or terminate the Third Party Content at any time, but we willuse commercially reasonable efforts to provide reasonable notice of that suspension ortermination.

1.5 Early Evaluation/Beta Features. We may identify and make available on an early evaluationor beta basis certain features or functionality within the Service Offering. You must use these features or functionality only for evaluation purposes and for the period that we specify. We providethese features and functions “AS-IS,” without indemnification or support and disclaim all express and implied warranties (including warranties of merchantability, fitness for a particular purpose, and noninfringement). Any early evaluation or beta features or functionality do not constitute animplied commitment to offer to you or anyone these features and functionality as part of the ServiceOffering on a generally available basis.

1.6 Open Source Software. You may receive open source software when you use theService Offering and any open source software distributed to you is made available under the applicable open source license, which can be found at: http://www.vmware.com/download/open_source.html.

You may obtain a copy of these licenses and any source code (and modifications) that we are required to make available under these licenses (the “ Source Files”) at http://www.vmware.com/download/open_source.html or by sending a written request, with your name and address to: VMware, Inc., 3401 Hillview Avenue, Palo Alto, CA 94304, United Statesof America. All written requests must clearly specify: Open Source Files Request, Attention:General Counsel. This offer to obtain a copy of the Source Files is valid for three years from the date youlast received open source software as part of the Service Offering or last accessed the ServiceOffering.

2. Data Protection and Security.

2.1 Data Protection. We will process personal data contained in Your Content as set forth inthe Privacy Addendum.

2.2 Your Content and Security. You are solely responsible for Your Content. You are responsible for protecting the security of Your Content, including any access you might provide to Your Content by your employees, customers or other third parties, and in transit to and from the ServiceOffering.

The Service Offering provides you with certain software and functionality to help you protectYour Content from unauthorized access. You will take and maintain appropriate security, protectionand backup of Your Content, which might include the use of encryption technology to protectYour Content from unauthorized access. You are responsible for providing any necessary notices toyour users and obtaining any legally-required consents from your users concerning their use of the Service Offering. You are solely responsible for complying with any laws or regulations that might apply to Your Content. You are responsible for any losses or other consequences arising from your failure to encrypt or back up Your Content.

3. Acceptable Use.

3.1 General Restrictions. You and those accessing the Service Offering through you may not:(a) resell or sublicense the Service Offering; or (b) use or access the Service Offering: (i) in a way prohibited by law, regulation, governmental order or decree; (ii) to violate any rights of others; (iii)to try to gain unauthorized access to, test the vulnerability of, or disrupt the Service Offering or any other service, device, data, account or network; (iv) to spam or distribute malware; (v) in a way that could harm the Service Offering or impair anyone else’s use of it; (vi) in a way intended towork around the Service Offering’s technical limitations, recurring fees or usage limits; or (vii) in any application or situation where failure of the Service Offering could lead to the death or seriousbodily injury of any person, or to severe physical or environmental damage. You must ensure that your users comply with the terms of this Agreement, and you agree that if you become aware of any violation by one of your users, you will terminate that user’s access to Your Content immediately.If we have reason to believe that you or your users have breached this Agreement, we or our designated representative may review your use of the Service Offering, including your account,Your Content, and your records, to verify your compliance with this Agreement.

3.2 Content Restrictions. You will take steps to ensure that those accessing any service you provide with the Service Offering do not post content that: (a) may create a risk of harm,loss, physical or mental injury, emotional distress, death, disability, disfigurement, or physical ormental illness to anyone; (b) may create a risk of any other loss or damage to any person or property;(c) may constitute or contribute to a crime or tort; (d) contains any information or content that isillegal, unlawful, harmful, abusive, pornographic, racially or ethnically offensive, defamatory, infringing, invasive of personal privacy or publicity rights, harassing, humiliating to other people (publiclyor otherwise), libelous, threatening, or otherwise objectionable; or (e) contains any information or content that you do not have a right to make available under any law or under contractual or fiduciary relationships. You are solely responsible for any software, product or service that a third party licenses, sells or makes available to you that you install or use with the Service Offering.Your use of that software, product or service is governed by separate terms between you and that third party. We are not a party to and are not bound by any of those separate terms. You representand warrant that Your Content does not and will not violate any third-party rights, including any Intellectual Property Rights, and rights of publicity and privacy. You will ensure that your use ofthe Service Offering complies at all times with your privacy policies and all applicable laws and regulations, including any encryption requirements.

3.3 Violations of Acceptable Use. If you become aware that any of Your Content or youruser’s use of Your Content violates Section 3.1 or 3.2, you will take immediate action to remove the applicable part of Your Content or suspend the end user’s access. If you fail to do so, we mayask you to do so. If you fail to comply with our request within twenty-four hours, we may suspendyour account or disable access to Your Content until you comply with ourrequest.

3.4 Notification of Infringement Concerns. If you believe that your copyrighted work has been copied and is accessible on our Service Offering in a way that constitutes copyright infringement, please send a notice to us as further detailed in Section 8 of the Community Terms of Use available at http://www.vmware.com/community_terms.html.

4. IP Ownership.

4.1 Ownership of Service Offering. We and our licensors own and retain all right, title andinterest in and to the Service Offering and any related VMware Software, including all improvements, enhancements, modifications and derivative works thereof, and all Intellectual Property Rights therein. This includes any information that we collect and analyze in connection with theService Offering, such as usage patterns, user feedback and other information to improve and evolve our software products and services offerings. Your rights to use the Service Offering are limited to those expressly granted in this Agreement. No other rights with respect to the Service Offering, any related VMware Software, or any related Intellectual Property Rights are implied.

4.2 Ownership of Your Content.You and your authorized users retain all right, title and interestin and to Your Content and all Intellectual Property Rights therein. Our rights to access and useYour Content are limited to those expressly granted in this Agreement. No other rights with respectto Your Content or any related Intellectual Property Rights are implied.

4.3. Feedback.We will be free to use for any purpose any feedback (such as comments or suggestions) that you provide to us regarding the Service Offering. You hereby grant to us a nonexclusive, perpetual, irrevocable, royalty-free, transferable, worldwide right and license, with the right to sublicense, to use, reproduce, perform, display, disclose, distribute, modify, prepare derivative works of and otherwise exploit the feedback without restriction in any manner now known or inthe future conceived and to make, use, sell, offer to sell, import and export any product or service that incorporates the feedback.

5. Order, Delivery, Payment, and Taxes.

5.1 Generally.Sections 5.3 (Direct Orders), 5.4 (Delivery), 5.5 (Invoicing and Payment Terms) and

5.6 (Taxes) apply only to orders you place directly with, and the Service Offering you purchase directly from, VMware. When ordering through, or purchasing the Service Offering from, aVMware authorized reseller, the authorized reseller might specify similar terms.

5.2 Orders.All Orders issued to VMware are subject to the terms of this Agreement and are not binding until accepted by VMware. We are not required to provide any Service Offering to youuntil you provide all information we require for processing your Order.

5.3 Direct Orders.For orders placed directly with VMware, you must issue a purchase orderto VMware for the initial Service Offering order, but a purchase order is not required for themonthly billings that occur after the initial Order billing. For subsequent billings, all fees (including subscription renewals, metered usage components, and other add-ons) will be paid in accordance with this Agreement. Your Order will be deemed accepted when we authorize the purchasedService Offering for your Login Credentials.

5.4 Delivery.When VMware accepts your Order for the Service Offering, we will deliverthe corresponding Login Credentials to you by email to the address associated with your account. If VMware ships a physical object in connection with an add-on feature of the Service Offering, shipping and delivery terms are Ex Works VMware’s regional fulfillment facility (INCOTERMS2010).

5.5 Invoicing and Payment Terms. You will pay all fees for use of the Service Offering inthe amount and currency specified in your invoice, within 30 days after the date of the invoice, and regardless of your usage level during a billing period. You will also be responsible for all additional fees for any subscription renewals and metered usage components consumed, and other subscriptions, features, products, services or add-ons that you purchase within the Service Offering.

You will be billed in advance for the monthly or prepaid charges due to the subscription services purchased. Any metered usage components and any initial monthly fees will be billed in arrears.The applicable fees for subscriptions (including renewals), features and other available products and services will be governed by the then-current applicable price list at the time the initial, renewal,or add-on order is submitted, or as otherwise agreed. We may increase or add new fees for theService Offering by notifying you at least 30 days in advance.

5.6 Taxes.Service Offering fees are exclusive of taxes, and you shall pay or reimburse for all taxes arising out of transactions contemplated by this Agreement. If you are required to pay or withhold any tax for payments due under this Agreement, you shall gross your payments to us so wereceive sums due in full and free of any deductions. You will provide documentation to us showing that taxes have been paid to the relevant taxing authority. “ Taxes” means any sales, VAT, use, gross receipts, business and occupation, and other taxes (other than taxes on our income), export and import fees, customs duties and similar charges imposed by any government or other authority. You hereby confirm that we can rely on the name and address you provide to us when you agree to theService Offering or in connection with your payment method as being the place of supply for sales taxand income tax purposes or as being the place of supply for VAT purposes where you have established your business.

6. Temporary Suspension.

6.1 Generally.Upon prior written notice to you, we may suspend your use of the Service Offeringif we reasonably determine: (a) payment for the Service Offering is not received within 30 days from the date on which payment is due; (b) you or your use of the Service Offering is in breach of this Agreement; (c) you fail to address our request to take action as specified in Section 3.3; (d) your use of the Service Offering poses a security risk to the Service Offering or other users of theService Offering; or (e) suspension is required pursuant to our receipt of a subpoena, court order, or other request by a law enforcement agency.

6.2 Effect of Suspension.You will remain responsible for all fees incurred before or during the suspension. You will not be entitled to any service credits under the Service Level Agreement that you might have otherwise accrued during the period of suspension.

7. Term and Termination.

7.1 Term of Agreement.This Agreement will be in effect through the Subscription Term, plus any renewals, unless terminated earlier as permitted under this Agreement or the Service Description.

Upon the completion of the Subscription Term, the subscription will automatically renew asspecified in the Service Description, unless terminated as permitted under the Service Description.

7.2 Termination for Cause. We may terminate this Agreement effective immediately uponsending you an email notice if: (a) you breach any provision in Sections 3.1 or 3.2; (b) you do not resolve the underlying cause resulting in a suspension of your account pursuant to Section 6.1 (otherthan suspension due to a subpoena, court order, or other request by a law enforcement agency) within 10 days after your account is suspended; or (c) you commit a material breach that cannot be cured.

7.3 Termination for Insolvency. We may terminate this Agreement effective immediatelyupon sending you an email notice if you: (a) terminate or suspend your business; (b) become insolvent, admit in writing your inability to pay your debts as they mature, make an assignment for thebenefit of creditors; or (c) become subject to control of a trustee, receiver or similar authority or any bankruptcy or insolvency proceeding.

7.4 Effect of Termination. Upon the termination of this Agreement for any reason: (a) allrights granted to you under this Agreement, including your ability to access the Service Offering,will immediately terminate; and (b) you must promptly discontinue all use of the Service Offering and delete or destroy any of our Confidential Information. We will retain Your Content for a period of30 days following the effective date of the termination, although you will cease to have access to the Service Offering or Your Content during this period. After the 30 days, Your Content will bedeleted.

Sections 1.6 (Open Source Software), 3 (Acceptable Use) 4 (IP Ownership), 5 (Order,Delivery, Payment and Taxes), 7 (Term and Termination), 9 (Disclaimer), 11 (Limitation of Liability),12 (Confidential Information), 13 (General), and 14 (Definitions), will survive the termination of this Agreement. Termination of the Service Offering (except to the extent that the termination is permitted under Section 13.3 of this Agreement or Section 3.6 of the Service Description) willnot entitle you to any refunds, credits, or exchanges, and you will be liable for all monthly billing fees for the remainder of the Subscription Term after termination, as well as all usage and otherfees incurred up to the termination date.

8. Support and Subscription Services. When applicable, and subject to the terms of this Agreement, we will provide to you support for the Service Offering in accordance with theterms specified in the Support Policy. We will not provide support to any end users of YourContent.

9. Disclaimer. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, WE ANDOUR

LICENSORS AND SERVICE PROVIDERS DISCLAIM ALL WARRANTIES, WHETHEREXPRESS,

IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY

AND FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT AND ANY

WARRANTIES ARISING FROM COURSE OF DEALING OR COURSE OF PERFORMANCE

REGARDING OR RELATING TO THE SERVICE OFFERING OR ANY MATERIALS ORSERVICES FURNISHED OR PROVIDED TO YOU UNDER THIS AGREEMENT. WE AND OURLICENSORS

AND SERVICE PROVIDERS DO NOT WARRANT THAT THE SERVICE OFFERING WILLBE

UNINTERRUPTED OR FREE FROM DEFECTS, OR THAT THE SERVICE OFFERING WILL MEET (OR IS DESIGNED TO MEET) YOUR BUSINESS REQUIREMENTS.

10. Indemnification.

10.1 Indemnification by Customer. You will defend and indemnify us against any third party claim arising from or relating to: (a) Your Content; (b) any infringement or misappropriation of any Intellectual Property Rights by you, your customers, your end users or your suppliers; (c) violationof law by you; (d) your use of the Service Offering (including any activities under your account and any use by your employees, personnel or end users) in violation of this Agreement, or (e) your use of any Third Party Content. We will (a) provide you with notice of the claim within a reasonable period of time after learning of the claim; and (b) reasonably cooperate in response to your requests for assistance. You may not settle or compromise any indemnified claim without our priorwritten consent.

10.2 Defense and Indemnification. Subject to the remainder of this Section 10, we will defendyou against an Infringement Claim and indemnify you from the resulting costs and damages finally awarded against you to that third party by a court of competent jurisdiction or agreed to in settlement. You will (a) provide us with notice of any Infringement Claim within a reasonable period of time after learning of it; (b) allow us sole control over the claim’s defense and settlement; and(c) reasonably cooperate in response to our requests for assistance. You may not settle or compromise any Infringement Claim without our prior written consent.

10.3 Remedies. If the Service Offering becomes, or in our opinion is likely to become, the subjectof an Infringement Claim, we will at our option and expense either: (a) procure the rights necessary for you to keep using the Service Offering; (b) modify or replace the Service Offering to make itnoninfringing; or (c) terminate this Agreement and refund any pre-paid fees for the Service Offeringprorated for its remaining Subscription Term.

10.4 Exclusions. We will have no obligation under this Section 10 or otherwise with respect toany claim based on: (a) a combination of VMware Software with non-VMware products or content, including Your Content; (b) use of the Service Offering for a purpose or in a manner not specified in this Agreement or the Service Description; (c) any modification to the Service Offering madewithout our express written approval; or (d) any Service Offering provided on a no charge basis.This Section 10 states your exclusive remedy for any infringement actions or claims.

11. Limitation of Liability.

11.1 Generally. TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL WEOR

OUR LICENSORS OR SERVICE PROVIDERS BE LIABLE FOR ANY LOST PROFITS OR

BUSINESS OPPORTUNITIES, LOSS OF USE OF THE SERVICE OFFERING, LOSS OF

REVENUE, LOSS OF GOODWILL, BUSINESS INTERRUPTION, LOSS OF DATA, OR ANY

INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES UNDER ANY THEORYOF

LIABILITY, WHETHER BASED IN CONTRACT, TORT, NEGLIGENCE, PRODUCT LIABILITY,OR OTHERWISE. IN ADDITION, OUR AND OUR LICENSORS’ AND SERVICE PROVIDERS’

LIABILITY UNDER THIS AGREEMENT WILL NOT, IN ANY EVENT, REGARDLESS OFWHETHER

THE CLAIM IS BASED IN CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE,EXCEED THE GREATER OF: (A) THE AGGREGATE FEES PAID OR PAYABLE TO US FOR YOUR ACCESS TO AND USE OF THE SERVICE OFFERING IN THE TWELVE (12) MONTHS PRIOR TO THE EVENT GIVING RISE TO YOUR CLAIM, OR (B) $5,000 USD (OR THE EQUIVALENTIN LOCAL CURRENCY). REGARDLESS OF WHETHER WE OR OUR LICENSORS ORSERVICE

PROVIDERS HAVE BEEN ADVISED OF THE POSSIBILITY OF THOSE DAMAGES AND REGARDLESS OF WHETHER ANY REMEDY FAILS OF ITS ESSENTIAL PURPOSE. THESE LIMITATIONS OF LIABILITY IN THIS SECTION 11.1 WILL NOT APPLY TO (A)VMWARE’S

INDEMNIFICATION OBLIGATIONS UNDER THIS AGREEMENT OR (B) ANY LIABILITYWHICH MAY NOT BE EXCLUDED BY APPLICABLE LAW.

11.2 Further Limitations.Our licensors and service providers will have no liability of any kindunder this Agreement. You may not bring a claim under this Agreement more than eighteen (18)months after the cause of action arises.

12. Confidential Information.

12.1 Protection. A party may use Confidential Information of the other party solely to exerciseits rights and perform its obligations under this Agreement or as otherwise permitted underthis Agreement. Each party will disclose the Confidential Information of the other party only to the employees, service providers or contractors of the recipient party who have a need to know the Confidential Information for purposes of this Agreement and who are under a duty ofconfidentiality no less restrictive than each party’s duty hereunder. Each party will use reasonable care toprotect the confidentiality of the other party’s Confidential Information.

12.2 Exceptions. The recipient’s obligations under Section 12.1 with respect to anyConfidential Information will terminate if the recipient can show by written records that the information: (a)was already known to the recipient at the time of disclosure by the other party; (b) was disclosed tothe recipient by a third party who had the right to make the disclosure without anyconfidentiality restrictions; (c) is, or through no fault of the recipient has become, generally available to thepublic; or (d) was independently developed by the recipient without access to, or use of, discloser’s Confidential Information. The recipient may disclose Confidential Information to the extentthe disclosure is required by law or regulation. The recipient will provide the other party notice,when practicable, and will take reasonable steps to contest and limit the scope of any required disclosure.

13. General.

13.1 Assignment.You may not assign or transfer this Agreement, in whole or in part, by operationof law or otherwise, without our prior written consent. Any attempted assignment or transfer without that consent will be void. Subject to these limits, this Agreement will bind and inure to the benefitof the parties and their respective successors and assigns.

13.2 Notices. Any notice delivered by us to you under this Agreement will be delivered by emailto the email address associated with your account or by posting on either the Service Offering Portal or the My VMware Portal, except as otherwise set forth in this Agreement. Please direct legal noticesor other correspondence to VMware, Inc., 3401 Hillview Avenue, Palo Alto, California 94304, United States of America, Attention: Legal Department.

13.3 Modifications.We may change periodically the Service Offering, the terms of your access to the Service Offering, this Agreement, the Service Description, the Privacy Addendum, the Third Party Terms, the Service Level Agreement, or the Support Policy. It is your responsibility toregularly check the Service Offering console and the My VMware portal for updates. We will notify you of any material, detrimental change to this Agreement, the Service Description, the Privacy Addendum,the Service Level Agreement, or the Support Policy. The modified Agreement, Service Description, Privacy Addendum, Service Level Agreement, or Support Policy, as applicable, will becomeeffective as of the date stated in that notification. If we make a material, detrimental change to theService Offering (other than the termination or modification of any beta feature or functionality),this Agreement, the Service Description, the Privacy Addendum, the Service Level Agreement, orthe Support Policy, then you may terminate this Agreement within 30 days of the change to theService Offering or within 30 days of the notification. In that event, the termination will be effective as of the date we receive your notification, unless you state an effective date in your notification that iswithin 45 days after we receive your notification. In the event of that termination, we will refund anyprepaid fees, pro-rated for the remainder of your Subscription Term, and less any discounts that wouldthen not be earned. Your continued use of the Service Offering after the effective date of anymodification to the Agreement, the Service Description, the Privacy Addendum, the Third Party Terms, the Service Level Agreement, or the Support Policy will be deemed acceptance of the modified terms,as applicable.

13.4 Waiver. The waiver of a breach of any provision of this Agreement will not constitute a waiver of any other provision or any later breach.

13.5 Severability. If any provision of this Agreement is held to be invalid or unenforceable,the provision will be enforced to the maximum extent permissible so as to effect the intent of theparties, and the remaining provisions of this Agreement will remain in force.

13.6 Compliance with Laws; Export Control. Each party will comply with all laws applicable tothe actions contemplated by this Agreement. You acknowledge that the Service Offering is of United States origin, is provided subject to the U.S. Export Administration Regulations (including “deemed export” and “deemed re-export” regulations), and may be subject to the export control laws of the applicable territory. You represent and warrant that (a) you are not, and are not acting on behalf of, (1) any person who is a citizen, national, or resident of, or who is controlled by the government of any country to which the United States has prohibited export transactions; or (2) any person orentity listed on the U.S. Treasury Department list of Specially Designated Nationals and BlockedPersons, or the U.S. Commerce Department Denied Persons List or Entity List; (b) you will not permit the Service Offering to be used for any purposes prohibited by law, including any prohibited development, design, manufacture or production of missiles or nuclear, chemical or biological weapons; (c) Your Content will not be classified or listed on the United States Munitions list, contain defense articles, defense services or contain ITAR-related data; (d) Your Content will not require an export license and is not restricted from export to any VMware global resource or personnel under applicable export control laws; and (e) you are not subject, either directly or indirectly, to anyorder issued by any agency of the United States government, revoking or denying, in whole or in part, your United States export privileges. You will notify VMware immediately if you become subject to any such order.

13.7 Government Regulations.For purposes of sales to government entities in the U.S.:The Service Offering and its documentation are deemed to be “commercial computer software” and “commercial computer software documentation,” respectively, pursuant to DFARS Section227.7202 and FAR Paragraph 12.212(b), as applicable. Any use, modification, reproduction, release, performing, displaying or disclosing of the Service Offering and documentation by or on behalf of the U.S. Government will be governed solely by the terms and conditions of thisAgreement.

13.8 Force Majeure. We will not be liable for any delay or failure to perform any obligationsunder this Agreement due to any cause beyond our reasonable control, including acts of God, labor disputes or other industrial disturbances, systemic electrical, telecommunications or other utility failures, earthquakes, storms or other elements of nature, blockages, embargoes, riots, acts or orders of government, acts of terrorism or war.

13.9 Construction. The headings of sections of this Agreement are for convenience and are notfor use in interpreting this Agreement. As used in this Agreement, the word ‘including’ means “including but not limited to.”

13.10 Governing Law. This Agreement is governed by the laws of the State of California,United States of America (excluding its conflict of law rules), except as follows: To the extent that you choose a Japan data center Service Offering, then this Agreement is governed by the laws of Japan (excluding its conflict of law rules). The United Nations Convention for the International Sale of Goods does not apply.

13.11 Third Party Rights. Other than as expressly set out in this Agreement, this Agreement does not create any rights for any person who is not a party to it, and no person who is not a party to this Agreement may enforce any of its terms or rely on any exclusion or limitation contained init.

13.12 Order of Precedence. The terms of this Agreement will supersede and control over any conflicting or additional terms and conditions of any other purchasing related document issued by you.

13.13 Entire Agreement. This Agreement, as may be revised by us, is the entire agreement ofthe parties regarding its subject matter. This Agreement supersedes all prior or contemporaneous communications, understandings and agreements, whether written or oral, between the parties regarding its subject matter.

14. Definitions.

14.1 “Confidential Information” means non-public technical, business or other information or materials disclosed or otherwise made available by one party that are in tangible form andlabeled “confidential” or the like, or, information which is provided under circumstances reasonablyindicating their confidentiality. Our Confidential Information includes: (1) Login Credentials; and (2) any information or materials relating to the Service Offering.

14.2 “Infringement Claim” means any third party claim that any VMware Software used toprovide the Service Offering infringes any patent, trademark or copyright of the third party, or misappropriates a trade secret (but only to the extent that the misappropriation is not a result of your actions) under the laws of: (a) the United States; (b) Canada; (c) the European Economic Area;(d) Australia; (e) New Zealand; (f) Japan; or (g) the People’s Republic of China, to the extent thatthose countries are part of your places of use of the Service Offering.

14.3 “Intellectual Property Rights” means all worldwide intellectual property rights, including copyrights, trademarks, service marks, trade secrets, patents, patent applications, and moralrights, whether registered or unregistered.

14.4 “Login Credentials”mean any passwords, authentication keys or security credentials that enable your access to and management of the Service Offering.

14.5 “Order” means the internet order page, order document, purchase order, or purchase agreement issued to VMware that specifies your purchase of the Service Offering.

14.6 “Privacy Addendum” means the then-current version of the Service Offering DataPrivacy Addendum document available at http://vcloud.vmware.com/legal, which we may modify from timeto time.

14.7 “Service Description” means the then-current Service Offering Service Descriptiondocument available at https://www.vmware.com/files/pdf/vcloud-air/vcloud-air-Service-Description.pdf, which contains technical and other information and which we may modify from time to time.

14.8 “Service Level Agreement” means the then-current Service Level Agreement document available at https://www.vmware.com/support/vcloud-air/sla.html, which we may modify from timeto time.

14.9 “Subscription Term” means the time period of your access to the Service Offering,as specified by your Order.

14.10 “Support Policy” means the then-current version of the Service Offering SupportPolicy document available at http://www.vmware.com/support/services/iaas-production.html, which wemay modify from time to time.

14.11 “Third Party Content” means third party data, service, content, software orapplications, including open source software.

14.12 “Third Party Terms” means the then-current version of the third party license terms applicable to the Service Offering that are available at https://www.vmware.com/files/pdf/support/vmware-vcloud-air-third-party-terms.pdf, which wemay modify from time to time.

14.14 “VMware Software” means the software programs listed in our commercial price list.

14.15 “Your Content” means any and all applications, files, information, data or other content uploaded to or published or displayed through the Service Offering by you, your users, us (acting upon your instructions as part of a service), or any third party users who access any service you provide with the Service Offering.

Product Proposal
Prepared for:

GTrans
February 4, 2025
Submitted by Swiftly, Inc.

Confidential and Proprietary | Swiftly, Inc. 1
Hopthru by Swiftly
Trustworthy ridership data with
Hopthru Cleanse
Ridership insights are only as useful as the data they’re built on.

Hopthru Cleanse automatically finds and fixes data errors, ensuring staff use the highest-quality data to inform ridership analyses.

Hopthru Cleanse is an intelligent data-cleaning product specifically tailored for APC-generated data.

Cleanse works by processing raw APC data obtained from your Clever Devices CAD/AVL system and addressing common challenges such as layover noise and driver activity. While other APC processors discard data from entire trips due to one erroneous APC event, Cleanse is the only APC processor that discards data at the event level. This leads to overall higher coverage scores and more “real” data for ridership analysis and reporting. Cleanse is most often used by agencies who are looking to use Hopthru as their source of truth for APC Certification for National Transit Database (NTD) reporting.

Cleanse processes raw APC data in three distinct stages:
➔ Data correlation: APCs don't inherently know which service they're on. Cleanse’s correlation process accurately matches raw APC data with the schedule, enriching it with route, stop, and trip information.
➔ Data cleaning: APCs count everything, but not all data is relevant. Cleanse filters out extraneous information such as driver boardings and layover activity. ➔ Data expansion: For agencies without fleet-wide APC coverage, Cleanse identifies trips missing from APC data and expands them based on historical patterns.

The result is the industry’s most accurate APC data, arming staff with the best possible information to drive important decisions about where to invest in future service and direct limited agency resources today. And because Cleanse works automatically, it outputs this highly accurate data with limited-to-no intervention from agency staff.

Confidential and Proprietary | Swiftly, Inc. 2
Hardware monitoring for ongoing data quality
Quality APC data is the result of good software and healthy hardware. Hopthru’s diagnostic reporting will allow GTrans to:
➔ Quickly understand the health of its hardware.
➔ Be notified when vehicles have not been reporting, or have been reporting anomalies. ➔ Prioritize issues based on severity.

Key use cases of Hopthru Cleanse
➔ Accurate data for NTD reporting and more: Cleanse outputs extremely accurate APC data, improving outcomes in all downstream contexts that use APC data as an input – whether it’s NTD reporting, compliance with federal requirements, grant writing, measuring operational efficiency, or resource allocation.
➔ Truly automated data validation: Cleanse automates away the most tedious parts of APC data analysis by using advanced algorithms to find data anomalies, omit extraneous information, and fill in data gaps when they crop up. This drastically reduces the burden on staff members, allowing them to focus on higher-priority projects.

Confidential and Proprietary | Swiftly, Inc. 3
➔ Maximizing limited agency resources: Accurate data is crucial for impactful transit decisions.

Cleanse’s industry-leading data accuracy equips staff with trustworthy ridership statistics, leading to smarter allocation of resources, more efficient service delivery, and as a result, higher rider satisfaction.
“Before Hopthru, diving into our APC data was a dreaded process. Now we can understand every nook and cranny of our data in minutes.”
Christopher Belden
Duluth Transit Authority, Duluth, MN
NTD Certification Services
In addition to the software necessary to produce clean data, Swiftly provides the services necessary to achieve NTD Certification.

1. Manual Sampling: Swiftly will generate a random sampling plan of at least 29 trips in accordance with the NTD guidelines. If Swiftly staff can be provided with the corresponding security camera footage, we can remotely count boardings and alightings to compare against data produced by Hopthru Cleanse.

2. Expansion Algorithm Approved by Qualified Statistician: Hopthru’s expansion algorithm will be approved by a qualified statistician in accordance with NTD guidelines so that it can be used in NTD reporting.

3. NTD Submission Package: Swiftly will furnish a submission package on behalf of GTrans.

Confidential and Proprietary | Swiftly, Inc. 4
Hopthru Analyze: Insights that drive
action (optional)
Agencies commonly pair Cleanse with Hopthru Analyze, though it is not required for NTD Certification.

Hopthru Analyze equips agencies with a powerful, elegant toolset for understanding ridership trends when planning service change. With Analyze, agencies can transform raw ridership data into informed planning and operations decisions, slicing and dicing rider datasets across multiple variables, including dates, times of day, routes, stops, and trips, among others. Analyze then presents the data in a user-friendly dashboard, filled with intuitive graphs and maps, enabling staff to explore the data in greater detail and uncover trends that would be difficult to spot using just a spreadsheet.

Confidential and Proprietary | Swiftly, Inc. 5
“Hopthru is mission-critical. Having an acute understanding of how our riders use our service is critical for continuous improvement. Hopthru ensures that our service planning
team never misses a beat.”
Katie Persons
North County Transit District (NCTD), North San Diego County, CA The Analyze product offers detailed analysis at every level of service, offering a clear picture of rider demand throughout a transit network. Through trend analysis, agencies can easily identify shifts in demand, answering key questions such as whether recent service changes are being received as expected and how demand fluctuates across seasons. Analyze’s trend analysis also allows users to view performance and demand changes over time, providing real-time insights to adjust operations as needed.

Agencies can fine-tune route efficiencies by examining data at the trip level, and realize large-scale improvements by iterating on the service foundation already in place. Additionally, Analyze allows users to build, save, and distribute custom reports, surfacing insights on specific routes, stops, trips, or blocks.

The ability to filter data and create tailored reports ensures that the right insights are easily accessible for all team members.

Analyze also provides agencies with visibility into the health of their APC systems, ensuring that they are aware of any outages or issues that might contribute to inaccurate data. This proactive monitoring ensures data reliability and supports smarter decision-making across the agency.

Swiftly agencies use Hopthru Analyze during ridership analyses to achieve significant efficiency improvements during, including:
➔ Comprehensive rider trends, at a glance: Hopthru Analyze provides a holistic view of an agency’s performance with insights across the entire system all the way down to the route and stop level.

This bird's-eye perspective helps staff assess overall efficiency, while also enabling them to drill down into specific areas for a more granular analysis. Whether it’s understanding performance trends across the whole agency or focusing on individual routes, trips, or stops, Analyze equips teams with the tools to see the big picture and the details in one seamless platform. ➔ Intuitive insights over time: Hopthru enables agencies to spot emerging trends and assess performance shifts over time by comparing current data to historical benchmarks. This helps agencies identify changes in demand, assess the impact of service changes, and better plan for future needs. By understanding these trends, agencies can make proactive adjustments to services and resources, improving overall operational responsiveness and efficiency.

Confidential and Proprietary | Swiftly, Inc. 6
➔ Rider demand trends at the micro level: The Analyze product allows staff to dive deep into specific parts of transit service by analyzing individual routes, trips, and stops. This detailed analysis empowers teams to optimize service at the micro level, uncover inefficiencies, and make data-driven decisions to improve performance where it matters most. Additionally, the ability to tag routes or stops to track amenities, projects, or other key initiatives allows agencies to link operational data with broader organizational goals.
➔ Open data access across departments: Without Hopthru Analyze, agency staff are commonly limited to static, pick-level reports, and teams cannot self-serve their more complex analytical needs like trend analysis between multiple picks. Because Hopthru Analyze has access to each individual APC event, and is not constrained by pre-determined aggregation, staff use Analyze to self-serve and access the full breadth of their data.
➔ Streamlining data analysis: Without Hopthru, agency staff frequently require combining multiple reports for key analyses, including trend analysis and corridor planning. This tends to be highly time-intensive. We’ve also worked with some teams that lacked automatic geographical mapping altogether, having to take data from a static report, perform minor data manipulations, and join it with a data layer in ARC maps. Hopthru Analyze automates the vast majority of this type of manual work, saving time and improving staff morale.
➔ Freeing staff from silos and labor-intensive system management: Without Hopthru, agencies commonly rely on specific individuals and walled-off knowledge silos for ridership analyses. This creates contingency risk, and can also require significant staff-time investment. By using Hopthru Analyze, agencies are able to fulfill their analytical needs while also eliminating bottlenecks of specific staff or departments.

Confidential and Proprietary | Swiftly, Inc. 7
Demonstrated APC data accuracy
Hopthru by Swiftly has consistently delivered outstanding results, providing customer agencies with the accuracy they need to achieve National Transit Database (NTD) Certification. With a 100% success rate for completed certification projects, our solution has a proven track record of meeting and exceeding the rigorous standards required for certification.

The following examples highlight our APC accuracy from past projects, representative of the broader success we achieve across our client base.

Confidential and Proprietary | Swiftly, Inc. 8
Agency APC accuracy results
Thousand Oaks Transit
Thousand Oaks, CA
➔ Achieved NTD Certification with 100% counts, eliminating the need for an expansion algorithm—demonstrating Hopthru’s data completeness
➔ Delivered 99% accuracy for Unlinked Passenger Trips (UPT) compared to manual counts
RTA of Central Maryland
Savage, MD
➔ 99% accuracy for UPT
➔ 97% accuracy for Passenger Miles Traveled (PMT)
Santa Barbara MTD
Santa Barbara, CA
➔ 98% accuracy for UPT
➔ 95% accuracy for PMT
North County Transit District
Oceanside, CA
➔ 99.5% accuracy for UPT
➔ 99.5% accuracy for PMT
TheBus
Prince George’s County, MD
➔ 96% accuracy for UPT
➔ 96% accuracy for PMT
Denton County Transportation Authority
Denton, TX
➔ 98% accuracy for UPT
➔ 97% accuracy for PMT
Implementation
The following sample timeline demonstrates our proposed approach to achieving NTD Certification for GTrans by the October 31, 2025 deadline. This timeline uses the following assumptions:
➔ Swiftly has a signed contract by March 28, 2025
➔ GTrans has cloud-enabled security camera footage that Swiftly will access to collect passenger count samples
➔ GTrans has access to, and will share raw apc data from its Clever CAD database for the time period starting July 1, 2024 until the Hopthru Go Live date Task/Milestone Apr May Jun Jul Aug Sep Oct
Project Kickoff x
Hopthru Cleanse Integration x
Data QA / Trip Sampling x x x x
NTD Thresholds Met x
Submit NTD Certification
Package for Review
x
Analyze training x
Go Live x
Confidential and Proprietary | Swiftly, Inc. 9

Gardena City CouncilMarch 11, 2025

Gardena City Council
March 11, 2025