Master Service Agreement

This Master Service Agreement (this “Agreement”) is entered into by and between Security Consultants OÜ, an Estonian private limited company, having its principal place of business at Tiskrevälja tn 59-12, Tallinn, 13516, Estonia (the “Company”), and the client entity identified in the applicable Statement of Work (the “Client”).

The Effective Date of this Agreement, as well as the duration of the contractual relationship, shall be the date and period specified in the applicable Statement of Work. The Client’s name and principal business address shall likewise be the name and address set forth in the applicable Statement of Work.

By signing the Statement of Work, the Client is deemed to have acknowledged, accepted, and entered into this Agreement in full. No additional signatures are required for this Agreement to become fully binding and to produce legal effect for both parties In consideration of the mutual covenants and promises made by the parties of this Agreement, Security Consultants OÜ and the Client (to be referred to individually herein as
“Party” and collectively as, the “Parties”) agree to the following:

1. Confidentiality

1.1. Confidential Information” shall mean any non-public proprietary information owned or controlled by a Disclosing Party. This includes information observed or examined from the Disclosing Party’s operations, trade secrets, designs, prototypes, data, financial information, etc.

1.2. Confidential Information does not include information that is public, was rightfully possessed prior to disclosure, received from a third party, or independently developed.

1.3. The Parties may exchange Confidential Information during the term of this Agreement in order to fulfil their contractual and/or legal obligations.

1.4. The Receiving Party shall protect Confidential Information with at least the same care as its own. Disclosure shall be limited to Representatives with a need to know basis, who are bound
by similar confidentiality obligations.

1.5. Confidential Information may be disclosed as required by law, provided the Disclosing Party is notified prior to such disclosure.

1.6. Upon request, the Receiving Party shall return or destroy all Confidential Information, retaining one copy only if necessary for business records.

2. Performance of Services

2.1. The Client may obtain services through the execution of a Statement of Work (SOW), subject to this Agreement's terms. The Company warrants services will be provided with reasonable skill and diligence in accordance with the provisions of the SOW.

2.2. The Company will perform services as described in the SOW, with diligence and using well-trained employees or subcontractors.

2.3. Service Level Agreements

Only the formally agreed communication channels (email and phone calls for incident
response, email, and instant messaging for general activities) are covered by the SLA.

2.3.1. Incident response support process

The Company does not operate a Security Operations Center; the incident response services aim to assist with incident management, providing guidance, consulting, and advice, but can not provide forensics, log analysis, cloud configuration/restoration, or other technical services as part of the vCISO service. If the client requires technical services, these will be provided on a case-by-case basis at an additional cost determined by the specific service required.

The Company will commit to the following SLAs during workdays (business hours) and out of
hours (nights and weekends) for incident response and participation:

vCISO/vDPO Premium

‍

vCISO/vDPO Basic

‍

2.3.2. General activities SLA

The Company commits to the following SLA for general activities during work hours:

‍

2.4. The Company will measure the SLAs and provide quarterly business review reports to the Client. In the event of a failure of the combined SLA between 90% and 100%, 15% of the monthly fee will be refunded.

‍

3. Amendments to Services

3.1. The Company shall meet the Client’s requests for amendment based on the contract insofar as this is possible for it within the scope of its operational capacities and the SOW and insofar as the execution of the request for amendment is appropriate and reasonable. 

3.2. The Company may undertake minor amendments to the project without the client’s prior consent, provided that these comply with the client’s presumed will, are especially urgent, and the client cannot be contacted on time. The Company will inform the Client immediately about such project amendments and their impacts. 

3.3. Insofar as the Company’s expenses increase due to a request for amendment by the Client or the project's time frame is extended, the contracting parties undertake to negotiate a corresponding appropriate adjustment to the SOW and the payment.

‍

4. Client's Duties to Cooperate

4.1. The successful implementation and delivery of the SOW requires the parties to work together closely. The Client will provide continuous and diligent support to the Company in the project work. The client will provide the Company with comprehensive information about all aspects material to the SOW, as well as documentation and information on time and in full.

4.2. The Client will: 

• reply to all questions raised by the Company deemed as relevant for its project work, in full, correctly, and at short notice to the best of its knowledge. 
• inform the Company without being requested to do so and in good time - and also in cases of doubt - about all circumstances which could be significant for the project.

4.3. The Client undertakes to provide assurance in writing and to the best of its knowledge regarding the completeness and correctness of the information handed over to the Company.

‍

5. Non-disclosure

5.1. The Company shall maintain confidentiality for two years after the conclusion of the contract. 

5.2. Confidential information may be disclosed to necessary third parties with prior consent. 

5.3. The non-disclosure obligation pursuant to Clause 5.1 does not apply to confidential information if and insofar as

a) this was already lawfully in the possession of the Company before the disclosure and without a non-disclosure obligation; 

b) this was lawfully sent to the Company after the conclusion of the contract by a third party not subject to a non-disclosure obligation;

c) this was disclosed without the help of the Company or otherwise became generally known without its fault; 

d) The Company is obligated on the basis of mandatory statutory provisions or official orders to disclose the information to authorities, the judiciary or other third parties; 

e) the client has consented to the information being passed on by the Company.

5.4. The Company is entitled to disclose confidential information to the persons it uses to execute the contract, in particular its employees and sub-contractors, as well as persons obligated to non-disclosure as part of their profession, provided that the Company undertakes to obligate these persons to non-disclosure and to data protection.

5.5. The Company is authorized to process the personal data of the client entrusted to it within the scope of the intended purpose, or to have it processed by third parties.

‍

6. Incorporation of the Data Processing Agreement

The Parties acknowledge and agree that the Data Processing Agreement (“DPA”) executed or otherwise accepted between the Parties is hereby incorporated into and forms an integral part of this Agreement. The DPA sets forth the rights and obligations of the Parties with respect to the Processing of Personal Data pursuant to Regulation (EU) 2016/679 (“GDPR”) and any applicable data protection or privacy laws. To the extent that the Parties Process Personal Data under this Agreement, such Processing shall be governed by the terms of the DPA. In the event of any inconsistency between the DPA and this Agreement, the terms of the DPA shall prevail with respect to the Processing of Personal Data.

‍

7. Fees, Ancillary Costs, and Payment Terms

7.1. The Client shall compensate the Company as detailed in the SOW. 

7.2. Payment of all invoices is due within fifteen (15) days of the invoice date unless disputed in good faith. 

7.3. If any undisputed payment due from the Client remains unpaid for more than seven (7) days after the due date, the Company shall have the right to immediately suspend the provision of all Services, including work on any Deliverables under any Statement of Work or other agreement between the parties, without prior notice to the Client. 

7.4. The Company shall bear no liability or responsibility for any losses, damages, or delays incurred by the Client as a result of such suspension of Services.

7.5. Furthermore, the Company may, at its sole discretion, choose to schedule or proceed with any project or service kick-off meeting only upon confirmation of receipt of the applicable payment.

7.6. In the event of any delay in payment by the Client beyond the agreed payment terms, the Company reserves the right, at its sole discretion, to postpone the delivery of any Deliverables specified in the applicable Statement of Work by a number of calendar days equivalent to the duration of the Client’s delay in making such payment. Such postponement shall not be considered a breach of the Company’s obligations, and the Company shall not be liable for any losses or damages arising from or related to such adjusted delivery timelines.

7.7. Applicable taxes are the Client’s responsibility, and payment is to be made by bank transfer or other agreed methods.

7.8. A late payment fee of five percent (5%) of the outstanding invoice amount shall be applied to any undisputed payment not received within seven (7) business days after the due date.

‍

8 . Use of Results and Intellectual Property Rights

8.1. The Client guarantees that any materials produced by the Company will only be used for the agreed purposes. 

8.2. The Company retains ownership of any intellectual property generated through its services, with the Client receiving a non-transferable license to use the results as agreed.

‍

9. Terms and Termination

9.1. This Agreement commences on the Effective Date and continues for one (1) year unless terminated as per this section.

9.2. Either Party may terminate the Agreement with thirty (30) days' notice or immediately in case of a material breach or insolvency.

9.3. In the event that the Client terminates this Agreement without cause prior to its expiration date, the Client shall pay to the Company, within thirty (30) days from the effective date of such termination, an amount equal to eighty percent (80%) of the total remaining fees that would have been due for the remainder of the Term had this Agreement not been terminated early.

99.4 Suspension and Termination for Non-Payment

9.4.1 Payment and Overdue Notice. All invoices are due and payable within fifteen (15) days of the invoice date in accordance with Clause 7.2. If the Client fails to pay any undisputed invoiced amount by its due date, the Company may give the Client written notice of the overdue amount (an "Overdue Notice").

9.4.2 Right to suspend. If any undisputed amount remains unpaid more than seven (7) days after its due date, the Company may, on written notice to the Client, suspend the provision of all or any part of the Services and all work on any Deliverables under any Statement of Work. Such suspension shall continue until all overdue amounts, together with any other sums then payable under Clause 7, have been paid in full.

9.4.3 Effect of suspension. During any period of suspension under Clause 9.4.2:

(a) No liability. The Company shall have no liability to the Client for any loss, damage, cost, expense, or delay of any nature, whether direct or indirect, arising out of or in connection with the suspension. This exclusion extends to loss of profit, loss of revenue, loss of business or opportunity, loss of anticipated savings, wasted expenditure, regulatory or contractual exposure, failure to meet any audit, certification, attestation, or regulatory filing deadline, and loss of or damage to data. Nothing in this Clause excludes or limits liability that cannot lawfully be excluded or limited, including liability for death or personal injury, fraud or fraudulent misrepresentation, or the Company's gross negligence or wilful misconduct.

(b) Withholding of Deliverables. To the extent permitted by applicable law, the Company shall be entitled to withhold, and shall be under no obligation to deliver, release, or provide access to, any Deliverable, report, assessment, register, policy, procedure, certificate, working paper, or other work product created by the Company under this Agreement or any Statement of Work, whether final or in draft, until all overdue amounts have been paid in full. This entitlement applies only to work product of the Company and does not extend to (i) any Confidential Information of the Client, which remains subject to Clause 1.6, or (ii) any Personal Data Processed by the Company on the Client's behalf, or any obligation of the Company under the DPA incorporated by Clause 6 or under applicable data protection law, in respect of which the Company shall continue to perform in full.

(c) Licence suspended. No right, title, licence, or interest in any Deliverable in respect of which fees remain overdue shall pass to the Client, and any licence granted under Clause 8.2 in respect of such a Deliverable is suspended for the duration of the suspension.

(d) Timelines extended. All affected delivery dates, milestones, and timelines shall be extended by a period equal to the duration of the suspension, and no such extension shall constitute a breach by the Company of this Agreement or any Statement of Work.

9.4.4 Right to terminate. If any undisputed amount remains unpaid fourteen (14) days after the date of an Overdue Notice (the "Cure Period"), the Company may terminate this Agreement and/or any affected Statement of Work with immediate effect by giving further written notice to the Client, without prejudice to any other right or remedy. The Company may exercise its rights under Clauses 9.4.2 and 9.4.4 concurrently or in either order, and suspension is not a precondition to termination.

9.4.5 Disputed amounts. This Clause 9.4 does not apply to any amount the Client is disputing in good faith in accordance with Clause 7.2, provided that the Client has notified the Company of the dispute in writing before the due date and continues to pay all undisputed amounts when due.

9.4.6 Amounts payable on termination. Termination under this Clause does not relieve the Client of its obligation to pay all fees and charges accrued up to the effective date of termination, including Third-Party License Fees in respect of licenses and subscriptions provisioned up to that date.

9.4.7 Definitions and allocation. For the purposes of Clauses 9.3 and 9.4: "Professional Services Fees" means the portion of the fees payable under the applicable Statement of Work attributable to consulting, advisory, and vCISO/vDPO services performed by the Company; "Third-Party License Fees" means the portion attributable to third-party software licenses, subscriptions, platforms, and tooling procured or provisioned by the Company for the Client's benefit. Where the applicable Statement of Work does not allocate the fees between these components, the allocation shall be determined by reference to the Company's actual third-party costs incurred for the Client. Upon termination, the Company shall promptly cancel, or cease the renewal of, all cancellable third-party licenses procured for the Client.

9.5 Consequences of Termination

9.5.1 Upon termination or expiry of this Agreement or any Statement of Work for any reason, the Client shall pay the Company for all Services performed and all Deliverables produced up to the effective date of termination, together with all other sums then accrued and payable under Clause 7 and Clause 9.4.6.

9.5.2 To the extent permitted by applicable law, the Company shall be under no obligation to deliver or release any Deliverable or other work product of the Company until all sums due to the Company have been paid in full. Clause 9.4.3(b) applies to any such withholding, including its carve-outs for the Client's Confidential Information and for Personal Data and the DPA.

9.5.3 Termination or expiry shall not affect any right, remedy, obligation, or liability that has accrued to either Party as at the effective date of termination. Clauses 1 (Confidentiality), 5 (Non-disclosure), 6 (Incorporation of the Data Processing Agreement), 7 (Fees, Ancillary Costs, and Payment Terms), 8 (Use of Results and Intellectual Property Rights), 9.3, 9.4, 9.5, 11 (Liability and Indemnification), and 12 (Governing Law), together with any other provision expressly or by implication intended to survive, shall remain in full force and effect after termination.

10 . Force Majeure

10.1. Neither Party shall be liable for delays caused by unforeseen circumstances beyond their control, including natural disasters, strikes, or governmental actions.

‍

11 . Liability and Indeminification

11.1. The Company shall indemnify the Client against liabilities arising from the Company’s gross negligence or willful misconduct. 

11.2. The Client shall indemnify the Company against liabilities arising from the Client’s negligence or misconduct.

‍

12 . Terms and Termination

12.1. This Agreement commences on the Effective Date and continues for one (1) year unless terminated as per this section.

12.2. Either Party may terminate the Agreement with thirty (30) days' notice or immediately in case of a material breach or insolvency.

12.3. Upon termination, the Client must pay for the services performed up to the termination date, and all provisions meant to survive termination shall remain in effect.

‍

13. Governing Law

13.1. This Agreement shall be governed by the laws of Ireland. Disputes will be resolved through negotiation between senior executives of the Parties.

‍

14. Miscellaneous

14.1. Independent Contractor: Company shall perform its duties as an Independent Contractor. 

14.2. Amendment: Any amendment to this Agreement must be in writing and signed by authorized representatives of both Parties. 

14.3. Notices: Notices shall be deemed given on the date received if delivered personally or electronically, or three days after postmarked if sent by certified mail. 

14.4. Waiver: Waivers must be in writing and do not constitute continuing waivers. 

14.5. Severability: If any provision is unenforceable, it shall be replaced with a valid provision that closely reflects the original intent. 

14.6. Entire Agreement: This Agreement and any applicable SOW constitute the entire agreement between the Parties.