End User Platform Agreement

IISRI® will provide purchased services as outlined in this Agreement and applicable Purchase Orders. Access may be temporarily unavailable due to scheduled maintenance (with advance notice), or external factors beyond IISRI®'s control such as natural disasters, cyberattacks, or third-party service failures.

IISRI® follows industry-standard security protocols and undergoes periodic audits. IISRI® will report any actual or reasonably suspected security breach, personal data breach, or cyber event affecting the Services or data to affected customers without undue delay and in any event within twenty-four (24) hours of discovery. This 24-hour obligation applies in addition to, and does not replace, any regulatory notification timeframe (including any 72-hour requirement under Applicable Data Privacy Laws and the Addenda).

Customers may be invited to test beta services at no charge. These features are not yet fully developed and may be modified or discontinued at IISRI®'s discretion, and are provided without warranties and may be subject to additional terms. Any scanning or invasive functionality made available as a beta service is subject to the same authorisation, consent-attestation and record-keeping requirements as the paid Services under Section 8.4(f). The "as is" basis and any exclusion of warranties or liability for beta services operate only as between IISRI® and the Customer, and do not limit or exclude any obligation owed to any Vendor, Scan Target, other third party, or regulator.

IISRI® aims for high availability and performance. Interruptions may occur as described in Section 2.1, and IISRI® is not liable for events beyond its reasonable control (see Section 11.9).

IISRI® provides standard "Basic" support with commercially reasonable efforts at no additional charge, via email and online resources during designated support hours.

Customers requiring prioritized support, dedicated account management, or enhanced SLAs may opt for "Pro" and "Enterprise" packages under a separate agreement.

Where a Customer has been referred by a Reseller, the Reseller is the primary support contact. IISRI® provides second-line technical support to the Reseller, and may assist Customers directly in exceptional circumstances.

Customers who register for a free trial or use free features have temporary access at no cost until:

• (a)The trial period ends;
• (b)Free credits are used; or
• (c)The customer subscribes.

If the customer does not subscribe before the trial ends, stored Customer Services Data may be permanently deleted. During the trial, services are provided "as-is" without warranties and IISRI® assumes no liability for loss related to the free trial. Any scanning or invasive functionality used during a free trial is subject to the authorisation and consent requirements of Section 8.4(f), and the "as-is" basis and liability exclusions operate only as between IISRI® and the Customer and do not limit any obligation owed to any third party or regulator.

Customers use services by expending credits over a one-year subscription. At the end of the period, unused credits may be void without refund; impacted customers are notified 60 days before expiry. If additional credits are purchased during an active term, remaining credits roll over and extend for a further 12 months. The term begins on the purchase-order date and renews automatically for successive terms unless cancelled in accordance with this Agreement.

Usage is subject to the quantities in applicable purchase orders (Slots or Credits). Purchasing additional credits automatically increases the usage limit for the remainder of the term and beyond, if applicable.

The customer is responsible for:

• (a)Ensuring Users comply with this Agreement and for all activities through its use of the Services;
• (b)Maintaining the accuracy, legality and validity of Customer Services Data, including obtaining necessary consents or rights;
• (c)Preventing unauthorized access, securing credentials, and promptly notifying IISRI® of any unauthorized access or suspected breach; and
• (d)Complying with the terms of any Non-CyberRank Applications integrated with the Services.

Customers may not:

• (a)Provide access to unauthorized persons;
• (b)Resell, license, sublicense, lease, rent or distribute any portion of the Services, including reports or outputs;
• (c)Transmit illegal, defamatory, infringing or otherwise tortious material;
• (d)Introduce Malicious Code;
• (e)Use the Services unlawfully or for fraudulent or harmful purposes;
• (f)Interfere with or degrade the Services;
• (g)Attempt unauthorized access to the Services or related systems;
• (h)Circumvent usage limits;
• (i)Remove or alter proprietary notices;
• (j)Frame or mirror the Services except for internal business use;
• (k)Develop a competing product or service; or
• (l)Modify, reverse-engineer, disassemble or tamper with the Services or website.

Partners, including managed security service providers, are subject to a separate signed agreement with IISRI® permitting them to resell, license, sublicense or distribute the Services, including reports or outputs.

CyberRank's privacy policy is available at CyberRank.ai and is subject to updates. It includes, among others:

• (a)Data Collection - IISRI® may collect personal information in connection with a customer's use of the Services, as detailed in the Privacy Policy;
• (b)Customer Obligations - the customer affirms it has adhered to all Applicable Data Privacy Laws concerning the collection and disclosure of personal information and is not relying on IISRI® to fulfil its compliance obligations; and
• (c)IISRI® Obligations - in relation to the limited personal information received from customers or Users, IISRI® will independently adhere to all applicable legal requirements as a data controller and will not rely on the customer to fulfil its controller obligations.

Where IISRI® identifies a violation by a User, it may request the customer suspend that User; if the customer does not comply, IISRI® may suspend the User directly until the violation is resolved. In a Disruption Event, IISRI® may impose an automatic suspension limited to the minimum scope and duration necessary. Where suspension occurs without prior notice, IISRI® will explain as soon as reasonably possible on request.

IISRI® and third parties may offer Non-CyberRank Applications and consulting services; interactions with external providers are independent of IISRI®, which neither guarantees nor supports them. The customer is responsible for reviewing any additional terms, and IISRI® is not liable for third-party products, services, websites or content.

Customers may cancel by written notice at least 30 days before the renewal date; failure to do so results in automatic renewal.

IISRI® may update offerings, pricing and features at renewal, with 60 days' notice of material changes. For reseller-referred customers, price changes are also subject to the notice and protections in the applicable Reseller Agreement.

IISRI® may suspend access for material breach, non-payment (in accordance with Section 4.5), or activities that disrupt CyberRank's infrastructure or security. Termination is governed exclusively by Section 12.

IISRI® may monitor usage to ensure compliance; on exceedance or misuse it may require additional credits or restrict access in accordance with Section 3.11.

• (a)Permission by acceptance. By accepting this Agreement, the Customer is permitted to use the Services in respect of Scan Targets domiciled in, or with systems located in, the United States of America, its territories or possessions ("US Scan Targets"), and in respect of personal information of United States residents (including California residents), subject to the Customer's compliance with this Agreement, including the authorisation and consent requirements of Section 8.4(f).
• (b)Assumption of risk. The Customer acknowledges that such use may subject the Customer, and claims arising from it, to the laws and jurisdiction of the United States, and the Customer accepts that risk.
• (c)Indemnity. The Customer shall indemnify and hold harmless the Provider Group against any claim, proceeding, regulatory action, loss, liability, damage, cost or expense (including the costs of defending or responding) brought or arising in, or under the laws of, the United States of America, its territories or possessions, or by or on behalf of any US Scan Target or United States resident, arising out of or in connection with the Customer's use of the Services, including any Scan initiated by the Customer and any collection or processing of US-resident data. This indemnity applies whether or not authorisation was obtained, is additional to Sections 8.2 and 8.4(f) (without duplication of amounts recovered under those Sections), and is carved out of the exclusive remedy and the liability caps, as provided in Section 9.1.
• (d)Downstream (where a contract exists). Where the Customer has a contractual relationship with a US Scan Target, the Customer shall use reasonable endeavours to bind that Scan Target to resolve any claim relating to the Services or CyberRank outside the courts of the United States, and to name IISRI® as a third-party beneficiary of that provision.
• (e)Limits of this Section. The Customer acknowledges that IISRI®'s dispute-resolution mechanism in Section 10.2 and the indemnities in this Agreement bind only the Customer and do not bind any Scan Target, other third party, or regulator.

• (a)Except for the limited rights expressly granted, the CyberRank IP is owned by Novimix and licensed to IISRI®, and IISRI® retains all other ownership, title and interest in the Services and associated proprietary materials; the Customer acquires no rights by implication.
• (b)The Customer retains ownership of its Customer Services Data; however, IISRI® may use Customer Services Data (excluding username, password and billing info) to generate Generic Reports and as specified in Section 5.2.
• (c)IISRI® grants the Customer a non-exclusive right to use and publish only its own aggregated security and privacy ratings at its discretion.

Customers acknowledge that IISRI® processes publicly available vendor data under its own legal basis as an independent data controller. Vendor Services Data is the proprietary information of IISRI®, which may process and use it (including ratings) in compliance with applicable laws to:

• (a)Provide the Services, including providing Vendor data to Customers;
• (b)Communicate with vendors or contacts designated by the Customer;
• (c)Identify and resolve service or technical issues;
• (d)As explicitly authorized by the Customer; and
• (e)As required by law.

IISRI® may also use Vendor Services Data in aggregated, anonymized, de-identified form for internal research, benchmarking, analytics and product improvement, provided such use is for administrative purposes and general statistics, does not identify the Customer or individuals, and any public disclosure is limited to overall trends. Vendor-specific findings (including unpatched vulnerabilities and breach details) are shared with Customers solely for their own third-party risk assessments and may not be used for competitive intelligence or disclosed to third parties.

In respect of Vendor Services Data (including Compromised Credential Data):

• (a)Lawful basis - IISRI® processes the data on the basis of its legitimate interests (and those of its Customers and the public) in assessing and improving information security, which it has assessed as not overridden by the interests or rights of the data subjects, having regard to the security purpose and the minimisation measures below;
• (b)Data minimisation - IISRI® displays Compromised Credential Data in truncated form as a minimisation measure and acknowledges that truncated data may remain Personal Information and treats it accordingly;
• (c)Transparency - IISRI® maintains a public privacy notice describing this processing and, as it has no direct relationship with the affected individuals and individual notification would involve disproportionate effort, relies on the disproportionate-effort exemption from individual notification (Article 14(5)(b) EU/UK GDPR and the equivalent under the New Zealand Privacy Act 2020); and
• (d)Data-subject rights - IISRI® operates a process to receive and respond to access, correction, objection and erasure requests at privacy@iisri.com within applicable statutory timeframes.

The Customer grants IISRI® a worldwide, perpetual, irrevocable, transferable, royalty-free license to use and incorporate feedback into the Services, provided IISRI® does not publicly attribute it to the Customer without consent.

The Customer grants IISRI® a royalty-free license to use its ratings for marketing, including publishing on IISRI®'s or CyberRank's website, provided that:

• (i)The rating is at least "B" (else it may be published as "Lower than B"); or
• (ii)The Customer gives explicit consent regardless of level.

Consent may be withdrawn and removal required within 10 business days by contacting IISRI® per Section 10.

"Confidential Information" means information disclosed by one party ("Disclosing Party") to the other ("Receiving Party"), orally or in writing, labeled or reasonably understood as confidential. IISRI®'s includes the Services and proprietary materials; the Customer's includes personal identifiable information in Customer Services Data; both parties' includes pricing, business and marketing strategies, technology, specifications, roadmaps, designs and operational processes. It excludes information that:

• (i)Becomes public without breach;
• (ii)Was lawfully held before disclosure;
• (iii)Is received from a third party without breach;
• (iv)Is independently developed; or
• (v)Is used or disclosed in aggregated or anonymised form under Sections 5.2 or 5.4 (which does not remove confidentiality from any personal information or identifiable Customer Services Data).

The Receiving Party will:

• (i)Protect the information with at least reasonable care;
• (ii)Use it only within the scope of this Agreement;
• (iii)Disclose it only to personnel who need it and are bound by equivalent obligations, remaining accountable for their compliance; and
• (iv)Maintain confidentiality for five (5) years after termination, except trade secrets, which remain confidential indefinitely.

The Receiving Party may disclose Confidential Information when legally required, provided it gives the Disclosing Party prior notice (unless prohibited) and reasonable assistance, at the Disclosing Party's expense, to challenge or limit the disclosure. If disclosure is required in a proceeding where the Disclosing Party is a party and does not contest it, the Disclosing Party will reimburse the reasonable costs of providing secure access.

Each party represents it has legal authority to enter into this Agreement and perform its obligations.

IISRI® warrants that:

• (a)The Purchased Services will perform materially in accordance with the Documentation;
• (b)Professional Services will be performed competently and professionally; and
• (c)IISRI® has taken commercially reasonable measures to prevent Malicious Code.

The Customer's exclusive remedy for breach of these warranties is as specified in Sections 12.1 and 12.2; this does not limit the indemnities in Section 8.

Both parties warrant they will comply with all applicable laws concerning the provision and use of the Services, including data security and breach notification laws.

Except as expressly provided, neither party makes any warranties, express, implied, statutory or otherwise, and each disclaims implied warranties of merchantability and fitness for a particular purpose to the maximum extent permitted by law. Neither party assumes liability for damages caused by third-party hosting providers or non-CyberRank applications.

IISRI® shall defend the Customer against any third-party claim alleging that the Customer's use of a Purchased Service infringes or misappropriates intellectual property rights ("Claim Against Customer"), provided the Customer:

• (a)Promptly notifies IISRI® in writing;
• (b)Grants IISRI® full control over defense and settlement; and
• (c)Provides reasonable assistance.

IISRI® may, at its option:

• (i)Modify the Services to avoid infringement without materially reducing functionality;
• (ii)Obtain a license for continued use; or
• (iii)Terminate the affected Services on 30 days' notice and refund prepaid, unused fees.

IISRI® has no obligation to the extent the claim arises from:

• (i)Any Non-CyberRank Application;
• (ii)The Customer's breach;
• (iii)The Customer's negligence, recklessness or wilful misconduct;
• (iv)Combination with unauthorized products, systems or data; or
• (v)Modifications by the Customer or its agents.

This indemnification liability is capped at total fees paid in the prior 12 months.

The Customer shall defend IISRI® against any third-party claim arising out of or in connection with the Customer's use of the Services, including:

• (i)Claims arising from Customer Services Data alleging infringement or misappropriation of intellectual property rights;
• (ii)Claims arising from the Customer's use of the Services in breach of this Agreement;
• (iii)Claims by any Scan Target or other third party alleging unauthorised access to, interference with, or scanning of their systems or data, or breach of privacy, arising from a scan initiated by the Customer, or arising from the Customer's breach of Section 8.4(f); and
• (iv)Claims falling within Section 3.13 (United States exposure).

The Customer shall indemnify IISRI® for damages, losses, settlement amounts approved in writing by IISRI®, and reasonable legal fees, provided IISRI®:

• (a)Promptly notifies the Customer;
• (b)Grants the Customer control over defense and settlement (except the Customer cannot settle without unconditionally releasing IISRI®); and
• (c)Provides reasonable assistance at the Customer's expense.

This clause does not apply to the extent the claim arises from IISRI®'s breach, negligence, recklessness or wilful misconduct. The Customer's liability under limbs (i) and (ii) is capped at total fees paid in the prior 12 months; the Customer's liability under limbs (iii) and (iv) and under Section 8.4(f) is not subject to that cap or to the exclusive remedy in Section 8.3.

This Section 8 sets forth the exclusive remedies and obligations of the parties with respect to the claims described herein. Nothing in this Section 8.3 limits or excludes the Customer's obligations under Sections 3.13 or 8.4(f), which are additional to, and not the exclusive remedy for, the matters they cover.

The Customer acknowledges that IISRI® provides AI, cybersecurity and privacy intelligence and analytical services based on aggregation and interpretation of External Data Sources, including publicly available information, internet-facing infrastructure, domain and network metadata, threat intelligence feeds, third-party datasets, and non-invasive scanning techniques. Outputs may be probabilistic, predictive or inferred and are subject to limitations in data quality, completeness, timeliness and model interpretation, including bias, uncertainty and error.

• (a)CyberRank outputs (risk scores, alerts, reports, classifications, recommendations) may be based on both factual data and probabilistic, inferred or predictive modelling.
• (b)Such outputs are subject to uncertainty, including limitations in data availability, timing delays, incomplete visibility, false positives and false negatives.
• (c)IISRI® does not guarantee that any output is accurate, complete, current or free from error.
• (d)IISRI® does not perform intrusive penetration testing, exploitation, or internal system auditing through CyberRank unless expressly agreed in a separate written agreement.
• (e)CyberRank outputs do not constitute legal, regulatory, compliance, or security certification or assurance.
• (f)Authorisation and consent for scanning. Before initiating any invasive scanning functionality made available through CyberRank, the Customer must obtain all necessary Authorisations and consents from the organisation being assessed or scanned (the "Scan Target"), and must confirm, via the attestation presented in the platform, that it holds valid Authorisation to perform the scan. IISRI® records each such confirmation (including the user, timestamp, Scan Target and attestation text). The Customer warrants that each person completing the attestation is authorised to give it on the Customer's behalf and that the Authorisation is accurate and subsisting. The Customer assumes full responsibility and liability for such activities and releases, indemnifies, and holds harmless the Provider Group from any claims, losses, liabilities, damages, or expenses arising from or relating to the Customer's use of such functionality. The Customer's confirmation does not transfer to IISRI® any responsibility for obtaining or verifying the underlying Authorisation. The Customer's indemnity under this Section 8.4(f) is carved out of the exclusive remedy and the liability caps, as provided in Section 9.1.

The Customer acknowledges that any reliance on CyberRank outputs is at the Customer's sole risk, and the Customer shall independently evaluate and validate all outputs before taking any action or making any business, security, or compliance decision.

All notices must be in writing and are deemed given:

• (i)Upon personal delivery;
• (ii)Five business days after mailing;
• (iii)Two business days after confirmed facsimile; or
• (iv)One business day after email transmission with confirmation of receipt or delivery, or upon electronic confirmation of an in-platform notice.

Indemnification notices may be given by any method in this Section 10.1, including by email with confirmation of receipt or delivery or by in-platform notice with electronic confirmation. Notices to IISRI®: Independent Information Security Rating Institute (IISRI®) Ltd, Level G, 26 Hobson Street, Auckland City 1010, New Zealand; Legal@iisri.com.

This Agreement is governed by and interpreted under the laws of New Zealand, without regard to conflict-of-law principles. Any dispute arising out of or in connection with this Agreement, including any question regarding its existence, validity or termination, shall be finally resolved by arbitration under the Rules of Arbitration of the International Chamber of Commerce (ICC), which Rules are deemed incorporated by reference. The seat of arbitration shall be [Auckland, New Zealand / Singapore]; the tribunal shall consist of [one] arbitrator; and the language of the arbitration shall be English. Notwithstanding the foregoing, either party may seek urgent injunctive or interim relief from any court of competent jurisdiction. Customers established in the EEA, the UK, or California, or whose use of the Services involves personal data of individuals in those jurisdictions, are subject to the applicable addenda: Addendum A (EU GDPR), Addendum B (UK GDPR), and Addendum C (CCPA/CPRA); in the event of conflict, the relevant addendum prevails to the extent required by applicable law. Where a Customer has been referred by a Reseller and a dispute involves both this Agreement and the applicable Reseller Agreement, this Agreement and any dispute between IISRI® and the Customer shall remain governed exclusively by the laws of New Zealand and resolved by ICC arbitration as set out above, regardless of the governing law or dispute-resolution mechanism in the Reseller Agreement. The Reseller Agreement governs only the IISRI®-Reseller relationship and shall not affect the governing law or dispute resolution applicable to any Customer.

This Agreement, including all Purchase Orders, is the complete understanding and supersedes prior agreements. Conflicting terms in Customer-issued documents are void. Order of precedence:

• Applicable jurisdiction-specific addenda (to the extent required by law);
• The applicable Purchase Order;
• This Agreement;
• The Documentation.

Neither party may assign without prior written consent, except in a merger, acquisition, or sale of substantially all assets; provided that IISRI® may assign or novate to Novimix or to any other member of the Provider Group that is a body corporate. If a party is acquired by a direct competitor of the other, the other may terminate on written notice.

The parties are independent contractors; no partnership, franchise, joint venture, agency, fiduciary, or employment relationship is created.

Except for members of the Provider Group in respect of Sections 8 and 9, this Agreement creates no third-party beneficiary rights, and no person who is not a party has any right under the Contract and Commercial Law Act 2017 or otherwise to enforce it.

Failure to enforce any provision is not a waiver of it.

If any provision is invalid, the remaining provisions continue in effect.

Section headings are for reference only.

Each party may seek equitable relief to prevent unauthorized use of its intellectual property.

Neither party is liable for delays or failures due to causes beyond reasonable control, including natural disasters, terrorism, labor disruptions and internet failures. A merger, acquisition or change of control shall not itself constitute a force majeure event and is governed by Section 11.2.

The Customer acknowledges that it is acquiring the Services and Professional Services in trade, that both parties are in trade, and that it is fair and reasonable that the parties are bound by this clause. To the maximum extent permitted by section 43 of the Fair Trading Act 1986 and section 5D of the Consumer Guarantees Act 1993, the parties agree that the Consumer Guarantees Act 1993 and sections 9, 12A, 13 and 14(1) of the Fair Trading Act 1986 do not apply to this Agreement. This clause does not apply where the Customer acquires the Services as a consumer otherwise than in trade, in which case the Customer's rights under the Consumer Guarantees Act 1993 are unaffected.

This Addendum applies where the Customer is established in the EEA, or where the Customer's use of the Services involves processing personal data of individuals located in the EEA, as governed by Regulation (EU) 2016/679 (GDPR).

• (a)IISRI® acts as an independent Data Controller in respect of personal data it collects directly from Customers and Users (such as account credentials and billing contact details) and processes for its own purposes per its Privacy Policy.
• (b)IISRI® does not act as a Data Processor on behalf of the Customer; IISRI® processes Vendor Services Data under its own legal basis as an independent data controller, and the Customer is not instructing IISRI® to process personal data on its behalf through the Services.
• (c)Where the Customer inputs personal data beyond what is contemplated, it does so as an independent controller and is solely responsible for a valid legal basis.

IISRI® shall:

• (a)Process personal data only for the purposes in its Privacy Policy and this Agreement;
• (b)Implement appropriate measures under Article 32 GDPR;
• (c)Notify affected Customers of a personal data breach within 72 hours of becoming aware where it is likely to risk individuals' rights and freedoms, per Articles 33 and 34 GDPR (without prejudice to the 24-hour contractual notification in Section 2.2);
• (d)Honour data-subject rights requests within one month, extendable by two months for complex or numerous requests, per Article 12(3);
• (e)Not transfer personal data outside the EEA without adequate protection, including SCCs or another Chapter V mechanism; and
• (f)Maintain records under Article 30.

Where IISRI® transfers personal data from the EEA to New Zealand, the parties acknowledge New Zealand holds an EU adequacy decision. For transfers to other third countries, IISRI® shall implement appropriate safeguards including the EU SCCs (Commission Implementing Decision (EU) 2021/914) or successors.

IISRI® may engage sub-processors bound by data-protection obligations at least equivalent to this Addendum, and shall make available a current list on request.

The lead supervisory authority shall be determined by the location of IISRI®'s EU representative (Article 27) or the supervisory authority of the Member State where processing takes place.

In case of conflict between this Addendum and the main Agreement, this Addendum prevails to the extent necessary to ensure GDPR compliance.

IISRI® acts as an independent controller of Vendor Services Data (including Compromised Credential Data) on the legal basis and subject to the minimisation, transparency and data-subject-rights safeguards set out in Section 5.2A, which applies for the purposes of this Addendum.

This Addendum applies where the Customer is established in the UK, or where its use of the Services involves personal data of individuals in the UK, governed by the UK GDPR and the Data Protection Act 2018 ("UK Data Protection Law").

Addendum A is incorporated by reference, with:

• (a)"GDPR" read as "UK GDPR" / "UK Data Protection Law";
• (b)"European Commission" read as "UK Secretary of State" or "ICO" as appropriate;
• (c)"EEA" read as "United Kingdom";
• (d)The supervisory authority being the ICO (ico.org.uk); and
• (e)UK transfers governed by the ICO's IDTA or the UK Addendum to the EU SCCs (or successors).

The parties acknowledge New Zealand holds a UK adequacy regulation. For transfers to other non-adequate countries, IISRI® shall implement the IDTA or another ICO-approved mechanism.

In case of conflict between this Addendum and the main Agreement or Addendum A, this Addendum prevails to the extent necessary for UK Data Protection Law compliance.

This Addendum applies where the Customer is a business subject to the CCPA as amended by the CPRA, and its use of the Services involves personal information of California residents.

IISRI® acts as an independent Business in respect of personal information it collects for its own commercial purposes. Where IISRI® processes personal information solely on the Customer's behalf and direction, it acts as a Service Provider and shall not: sell or share the information for cross-context behavioural advertising; retain, use or disclose it outside the Services or as permitted by law; or combine it with information from other sources except as permitted by CCPA/CPRA.

IISRI® shall:

• (a)Provide the same level of privacy protection required of businesses under CCPA/CPRA;
• (b)Notify the Customer promptly if it can no longer meet its obligations;
• (c)On verified consumer request forwarded by the Customer, assist within 45 days with requests to know, delete, correct, or opt out of sale/sharing;
• (d)Not sell or share personal information; and
• (e)On termination, delete or return personal information as directed unless retention is required by law.

The Customer represents that it has provided required notices to California consumers, has a valid legal basis to share personal information with IISRI®, and will honour consumer rights requests within CCPA/CPRA timelines.

IISRI® confirms it does not sell personal information of California residents as defined under CCPA/CPRA and will not do so without explicit agreement and required notices.

In case of conflict between this Addendum and the main Agreement, this Addendum prevails to the extent necessary for CCPA/CPRA compliance.