Subscription Agreement

In plain English. This is Pazau's master agreement. It applies to every subscription to Pazau Inbox, Pazau Agent, Pazau Voice, and Pazau Insights, and it ties together our other customer terms: the Data Processing Addendum, AI Addendum, Security Addendum, Service Level Agreement, Support Policy and, for healthcare customers, the Business Associate Agreement. The main points:

• You own your data and your Outputs. We process Customer Data only to provide the Services. We never use it to train or fine-tune foundation models.
• You control what the AI agent does. You write the Procedures, connect the Actions, and set the approval thresholds. We are responsible for running the platform as documented. You are responsible for the instructions you give it.
• Commercial terms. Subscriptions run for 12 months and renew automatically unless either party gives 60 days' notice. Invoices are due Net 30. Renewal pricing can increase by up to 7%.
• Liability. Each party's liability is capped at the fees paid or payable in the 12 months before the claim. Data-protection claims have a higher cap of 2× that amount. Indemnities, fraud, and gross negligence are uncapped.
• Governing law. Delaware law applies if you contract with Pazau, Inc. Irish law applies if you contract with Pazau Ireland Limited (customers in the EEA, UK, and Switzerland).

This summary is for convenience only. It does not form part of the Agreement.

This Subscription Agreement (the "Agreement") is entered into between the Pazau entity identified in Section 18.1 ("Pazau", "we" or "us") and the customer entity identified in the applicable Order Form ("Customer" or "you"). It is effective on the date the first Order Form referencing it is signed, or on the date Customer first accepts it electronically, whichever is earlier (the "Effective Date"). Pazau and Customer are each a "party" and together the "parties".

If you accept this Agreement on behalf of a company or other legal entity, you represent that you have authority to bind that entity. Where Customer and Pazau have signed a separately negotiated master agreement covering the Services, that agreement governs instead of this one.

1. Definitions

Capitalized terms have the meanings given below or where they are first defined in bold.

1.1 "Actions" means the integrations, API calls, webhooks, and other operations that Customer configures the AI Features to perform in Customer Systems or Third-Party Services, such as issuing a refund, rebooking a flight, updating an address, or creating a case.

1.2 "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where "control" means ownership of more than 50% of the voting interests of the entity.

1.3 "AI Features" means the features of the Services that use machine learning or large language models to generate, classify, summarize, transcribe, or act on content. This includes Pazau Agent, the AI capabilities of Pazau Voice, AI-assisted drafting and summarization in Pazau Inbox, and automated quality scoring in Pazau Insights.

1.4 "Authorized User" means an employee, contractor, or agent of Customer or its Affiliates who is authorized by Customer to access the Services using Customer's account.

1.5 "Beta Features" means features or functionality identified by Pazau as alpha, beta, preview, early access, or a similar designation.

1.6 "Customer Data" means all data and content submitted to the Services by or on behalf of Customer, its Authorized Users, or its End Users. This includes conversation content, attachments, call recordings and transcripts, knowledge base content, Procedures, Outputs, and Traces. Customer Data does not include Usage Data.

1.7 "Customer Systems" means systems, applications, and data sources owned or controlled by Customer, including its order management, CRM, reservation, billing, and identity systems.

1.8 "Documentation" means Pazau's then-current user and technical documentation for the Services, available at docs.pazau.com.

1.9 "End User" means a customer, patient, member, passenger, or other individual who interacts with Customer through the Services, for example by sending a message, chatting with Pazau Agent, or calling a line handled by Pazau Voice.

1.10 "Fees" means the fees for the Services set out in an Order Form, including subscription fees, per-resolution fees, usage fees, and professional services fees.

1.11 "Model Provider" means a third-party provider of foundation models that Pazau uses to deliver the AI Features. Model Providers are Sub-processors and are listed on the Sub-processors page.

1.12 "Order Form" means an ordering document or online order that references this Agreement and is executed or accepted by the parties. It specifies the Services, Subscription Term, quantities, and Fees.

1.13 "Outputs" means content generated by the AI Features in response to Customer Data or instructions, including replies to End Users, summaries, classifications, transcripts, QA scores, and the parameters of Actions.

1.14 "Personal Data" has the meaning given in the Data Processing Addendum.

1.15 "Procedures" means the natural-language standard operating procedures, policies, guardrails, and instructions that Customer writes or approves in the Services to govern how the AI Features handle conversations.

1.16 "Resolution" means a conversation that Pazau Agent handles to completion without transfer to a human agent, as further defined in the Documentation and the applicable Order Form.

1.17 "Security Incident" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data while it is processed by Pazau or its Sub-processors.

1.18 "Services" means the Pazau subscription services specified in an Order Form, including Pazau Inbox, Pazau Agent, Pazau Voice, and Pazau Insights, together with the Documentation and any related APIs and software development kits. Services does not include Third-Party Services or Professional Services.

1.19 "Professional Services" means implementation, configuration, training, and advisory services described in an Order Form or statement of work.

1.20 "Sub-processor" means a third party engaged by Pazau to process Customer Data on Pazau's behalf.

1.21 "Subscription Term" means the period during which Customer is entitled to use the Services under an Order Form, including any renewal periods.

1.22 "Third-Party Services" means products, services, and platforms that are not provided by Pazau, such as messaging channels, telephony carriers, CRM platforms, and payment processors, including those Customer connects to the Services through integrations or Actions.

1.23 "Traces" means the records the Services generate of how the AI Features handled a conversation, including the Procedures applied, reasoning steps, retrieved sources, Actions invoked and their results, approvals, and Outputs.

1.24 "Usage Data" means metadata and telemetry about the operation and use of the Services, such as feature usage, performance metrics, error logs, and volume counts. Usage Data does not include the content of Customer Data and does not identify Customer, Authorized Users, or End Users.

2. Order Forms and order of precedence

2.1 Order Forms. Customer and its Affiliates may purchase Services by executing Order Forms. Each Order Form is governed by this Agreement and forms a separate contract. An Affiliate of Customer that executes an Order Form is "Customer" for the purposes of that Order Form and is liable for its obligations under it.

2.2 Incorporated documents. The following documents are incorporated into this Agreement by reference: the Data Processing Addendum (the "DPA"), the AI Addendum, the Security Addendum, the Service Level Agreement (the "SLA"), the Support Policy, and, where Customer has executed it or it is referenced in an Order Form, the Business Associate Agreement (the "BAA").

2.3 Order of precedence. If there is a conflict or inconsistency among the documents that make up this Agreement, the following order of precedence applies, from highest to lowest:

1. the BAA, solely with respect to protected health information;
2. the DPA, solely with respect to the processing of Personal Data;
3. the AI Addendum, solely with respect to the AI Features;
4. the Security Addendum;
5. an Order Form, solely with respect to the Services and Fees purchased under it, but only if the Order Form expressly identifies the provision of this Agreement it modifies;
6. the body of this Agreement;
7. the SLA and the Support Policy; and
8. the Documentation.

2.4 No additional terms. Terms in any Customer purchase order, vendor registration portal, supplier code of conduct, or similar document are void and have no effect, even if Pazau accepts or signs the document, unless the parties expressly agree in a signed writing that those terms amend this Agreement.

2.5 Affiliates of Pazau. Pazau may perform its obligations through its Affiliates, including Pazau, Inc. and Pazau Ireland Limited. Pazau remains responsible for the performance of its Affiliates.

3. Access and use of the Services

3.1 Right to use. Subject to this Agreement and payment of the applicable Fees, Pazau grants Customer a non-exclusive, non-transferable (except under Section 20), non-sublicensable right during the Subscription Term to access and use the Services, and to allow its Authorized Users to do so, for Customer's internal business purposes, including serving its End Users, in accordance with the Documentation and the quantities in the applicable Order Form.

3.2 Authorized Users. Seat-based subscriptions are assigned to named Authorized Users. A seat may not be shared by more than one individual but may be reassigned to a new Authorized User who replaces a former one. Customer is responsible for the acts and omissions of its Authorized Users as if they were Customer's own.

3.3 Usage-based Services. Where Fees are based on usage, such as Resolutions, voice minutes, or API calls, Pazau measures usage using its systems as described in the Documentation. Customer may view current usage in the Services' admin console at any time.

3.4 Affiliates and contractors. Customer may permit its Affiliates and third-party contractors, such as business process outsourcers, to use the Services as Authorized Users solely on Customer's behalf. Customer remains responsible for their compliance with this Agreement.

3.5 Sandbox and developer environments. Where an Order Form includes a sandbox environment, Customer may use it only for development, testing, and evaluation. Sandbox environments are excluded from the SLA.

3.6 Beta Features. Pazau may make Beta Features available at no additional charge. Customer's use of Beta Features is optional. Beta Features are provided "as is", are excluded from the SLA and from Pazau's indemnification obligations, and may be modified or discontinued at any time. Pazau's total liability arising from Beta Features will not exceed US$10,000. Pazau's obligations under the DPA and Security Addendum still apply to Customer Data processed through Beta Features.

3.7 Changes to the Services. Pazau continually improves the Services and may update them from time to time. Pazau will not make any change that materially reduces the core functionality, security, or data protection of the Services purchased by Customer during the then-current Subscription Term. If Pazau deprecates a material feature, it will give Customer at least 90 days' notice, except where the deprecation is required by law, by a Third-Party Service, or to address a security risk. Changes to Model Providers are governed by the AI Addendum.

3.8 Professional Services. Pazau will perform any Professional Services described in an Order Form or statement of work in a professional and workmanlike manner. Unless otherwise agreed, Professional Services are billed as stated in the Order Form, and prepaid Professional Services expire 12 months after purchase.

4. Restrictions

4.1 General restrictions. Customer will not, and will not permit any person to:

(a) sell, resell, sublicense, rent, lease, or otherwise make the Services available to any third party other than Authorized Users and End Users as contemplated by this Agreement;

(b) copy, modify, or create derivative works of the Services, or reverse engineer, decompile, or disassemble the Services, except to the extent applicable law expressly permits it notwithstanding this restriction;

(c) access the Services to build a competing product or service, or to copy any features, functions, prompts, or user interface of the Services;

(d) use the Services to store or transmit malicious code, or to interfere with or disrupt the integrity or performance of the Services;

(e) attempt to gain unauthorized access to the Services or their related systems or networks, or to circumvent any usage limits, guardrails, or security controls;

(f) conduct penetration tests, load tests, or vulnerability scans of the Services except as permitted in the Security Addendum;

(g) use the Services in violation of applicable law, including laws governing telemarketing, call recording, consumer protection, and electronic communications;

(h) use the Services to send unsolicited bulk messages or to place automated calls without the consents required by law;

(i) use the AI Features for any Prohibited AI Use as defined in the AI Addendum; or

(j) submit to the Services any payment card data outside the PCI-compliant payment flows of Pazau Voice, or any protected health information unless a BAA is in effect and Customer has enabled the configuration required by the BAA.

4.2 Suspension. Pazau may suspend Customer's or any Authorized User's access to the Services if (a) Customer's account is 30 or more days past due following the notice required by Section 9.5, (b) Pazau reasonably determines that use of the Services poses an imminent risk to the security or availability of the Services or to any third party, or (c) suspension is required by law. Pazau will limit any suspension to the minimum scope and duration necessary, will give Customer advance notice where practicable, and will restore access promptly once the cause is resolved. Suspension under (b) or (c) does not relieve Pazau of its SLA obligations unless the suspension resulted from Customer's breach.

5. Customer Data

5.1 Ownership. As between the parties, Customer owns all right, title, and interest in and to Customer Data. Nothing in this Agreement transfers any rights in Customer Data to Pazau, except the limited rights in Section 5.2.

5.2 License to Pazau. Customer grants Pazau and its Sub-processors a worldwide, non-exclusive, royalty-free license during the Subscription Term, and for the period in Section 10.6, to host, copy, transmit, process, and display Customer Data solely as necessary to (a) provide, secure, support, and maintain the Services for Customer, (b) prevent or address technical, security, or fraud issues, and (c) comply with applicable law. Pazau will process Customer Data only in accordance with this Agreement, the DPA, and Customer's documented instructions.

5.3 No training of foundation models. Pazau will not use Customer Data, and will not permit any Model Provider or other third party to use Customer Data, to train, retrain, or fine-tune any foundation model or any model made available to any other customer. Optional customer-specific model improvement is available only if Customer opts in, and only as described in the AI Addendum.

5.4 Usage Data. Pazau may collect and use Usage Data to operate, secure, and improve the Services and for billing, capacity planning, and benchmarking. Pazau may publish aggregated statistics derived from Usage Data, such as average resolution rates across its customer base, only if the statistics do not identify Customer, Authorized Users, or End Users and do not disclose Customer Data.

5.5 Customer's responsibility for Customer Data. Customer is responsible for the accuracy, quality, and legality of Customer Data and of the means by which Customer acquired it. Customer represents and warrants that it has provided all notices and obtained all consents, authorizations, and rights required by applicable law for Pazau to process Customer Data as contemplated by this Agreement. This includes consents for call recording, for AI-assisted interactions where required, and for the transfer of Customer Data to Third-Party Services that Customer connects.

5.6 Data residency. Customer may select a US or EU hosting region for its workspace, where available for its plan. Pazau will store Customer Data at rest in the selected region as described in the DPA. The EU region is hosted in Dublin, Ireland, with failover to Frankfurt, Germany.

5.7 Export. During the Subscription Term, Customer may export Customer Data at any time using the export features of the Services and the Pazau APIs.

5.8 Legal requests. If Pazau receives a subpoena, warrant, or other legal demand for Customer Data, Pazau will redirect the requester to Customer where possible and will notify Customer promptly, unless prohibited by law. Pazau will challenge any demand it reasonably believes is overbroad or unlawful. The DPA sets out further commitments for government access requests.

6. AI Features

6.1 AI Addendum. Customer's use of the AI Features is subject to the AI Addendum, which forms part of this Agreement. It covers Pazau's commitments on model training, zero data retention with Model Providers, Traces, model changes, and transparency obligations under the EU AI Act.

6.2 Outputs. As between the parties, and subject to Customer's compliance with this Agreement, Customer owns all Outputs. Pazau assigns to Customer any rights Pazau may have in Outputs. Customer acknowledges that similar or identical Outputs may be generated for other customers, and Customer's ownership does not extend to those Outputs.

6.3 Nature of AI Features. The AI Features use probabilistic models. Outputs may be inaccurate, incomplete, or inappropriate for a given situation, even when the AI Features operate as designed. Customer is responsible for evaluating Outputs for its use case, and for deciding which conversations and Actions require human review, using the controls described in Section 7.

6.4 Model Providers. Pazau uses Model Providers listed on the Sub-processors page. Pazau has agreements with each Model Provider that prohibit training on Customer Data and require zero retention of Customer Data beyond what is necessary to process each request.

7. Procedures, Actions and Customer configuration

7.1 Customer configuration. The Services give Customer control over how the AI Features behave. Customer determines, in its sole discretion: (a) the Procedures that the AI Features follow; (b) the Actions that the AI Features may invoke and the Customer Systems and Third-Party Services those Actions reach; (c) the credentials, scopes, and permissions granted to each Action; (d) the thresholds, limits, and conditions under which an Action requires approval by an Authorized User before execution (each an "Approval Step"); (e) the channels, languages, and hours in which the AI Features operate; and (f) the circumstances in which a conversation is transferred to a human agent (together, "Customer Configuration").

7.2 Pazau's responsibility. Pazau is responsible for: (a) providing the Services in accordance with the Documentation and this Agreement; (b) enforcing Customer Configuration as documented, including executing Actions only within the scopes Customer has granted and halting for Approval Steps; (c) maintaining the guardrails of Pazau Guard as described in the Documentation; and (d) recording Traces as described in the AI Addendum.

7.3 Customer's responsibility for Actions. Customer is responsible for Customer Configuration and for the business outcomes of Actions executed in accordance with it. Pazau is not liable for any loss, refund, credit, booking, account change, or other consequence that results from an Action the Services executed in accordance with Customer Configuration. This includes Actions that followed a Procedure that was incomplete, ambiguous, or wrong, or that fell within limits Customer set. Customer remains liable to its End Users for the commitments made by its Procedures and Actions.

7.4 Failure to enforce configuration. If a Security Incident or a defect in the Services causes the Services to execute an Action outside Customer Configuration, such as by exceeding a granted scope or bypassing an Approval Step, Pazau is responsible for that failure, subject to Section 15. Traces will be the primary evidence of whether an Action was executed in accordance with Customer Configuration. Pazau will make the relevant Traces available to Customer on request.

7.5 Recommended controls. Pazau recommends that Customer (a) test new or changed Procedures and Actions in a sandbox or using simulation before deployment, (b) set Approval Steps for Actions with financial, safety, or legal consequences, (c) grant each Action the minimum scope necessary, and (d) review Traces and Pazau Insights results regularly. Pazau's Documentation describes these controls. Customer's decision not to use a recommended control is part of Customer Configuration.

7.6 Customer Systems and Third-Party Services. Customer is responsible for the availability, security, and behavior of Customer Systems and for its relationships with providers of Third-Party Services. Pazau does not control Third-Party Services and is not responsible for them, including for changes to their APIs. Customer's use of a Third-Party Service is governed by Customer's agreement with its provider.

8. Customer responsibilities

8.1 Account security. Customer is responsible for maintaining the confidentiality of its Authorized Users' credentials and API keys. Customer should use the SSO, SCIM, and multi-factor authentication features available for its plan. Customer will notify Pazau promptly at security@pazau.com if it becomes aware of any unauthorized use of its account.

8.2 Lawful use. Customer will use the Services in compliance with applicable law and the Documentation, and will ensure that its communications with End Users through the Services comply with applicable law. This includes providing any required AI disclosures and call-recording notices.

8.3 Regulated data. Customer will not submit to the Services any data subject to heightened regulatory requirements unless the Services are configured and contracted to support it. Protected health information may be processed only under a BAA. Payment card data may be processed only through the PCI-compliant payment flows of Pazau Voice. Customer will not submit government identification numbers, biometric identifiers, or data regulated under 42 C.F.R. Part 2 except as permitted by the Documentation or agreed in writing.

8.4 Cooperation. Customer will provide timely access to information, personnel, and Customer Systems reasonably required for Pazau to deliver Professional Services and support. Pazau is not responsible for delays caused by Customer's failure to do so.

9. Fees, invoicing and taxes

9.1 Fees. Customer will pay the Fees specified in each Order Form. Except as expressly set out in this Agreement, Fees are non-cancelable and non-refundable, and purchased quantities cannot be reduced during the then-current Subscription Term.

9.2 Invoicing. Unless the Order Form states otherwise, subscription Fees are invoiced annually in advance, and usage-based Fees, including per-Resolution Fees above any committed volume, are invoiced monthly in arrears. Seats added during a Subscription Term are invoiced on a pro-rata basis for the remainder of that term.

9.3 Payment terms. Customer will pay each undisputed invoice within 30 days of the invoice date (Net 30), in the currency stated in the Order Form, by wire transfer, ACH, SEPA transfer, or credit card. Where Customer requires a purchase order number to process an invoice, Customer will provide it before the invoice date. The absence of a purchase order does not extend payment deadlines.

9.4 Disputed invoices. Customer may withhold payment of any invoiced amount that it disputes reasonably and in good faith if it notifies Pazau in writing before the due date, with reasonable detail of the dispute. Customer will pay the undisputed portion when due. The parties will work together in good faith to resolve the dispute within 30 days.

9.5 Late payment. Undisputed amounts not paid when due accrue interest at the rate of 1.5% per month, or the maximum rate permitted by law if lower, from the due date until paid. If any undisputed amount is 30 or more days overdue, Pazau may, after giving Customer at least 10 days' written notice, suspend the Services until the overdue amount is paid. Customer will reimburse Pazau for reasonable costs of collection, including attorneys' fees, for amounts more than 60 days overdue.

9.6 Taxes. Fees exclude all sales, use, value-added, goods and services, withholding, and similar taxes and duties ("Taxes"). Customer is responsible for all Taxes associated with its purchases, except taxes on Pazau's net income, property, and employees. If Pazau is required to collect or pay Taxes on Customer's behalf, Pazau will invoice them, unless Customer provides a valid exemption certificate. If Customer is required by law to withhold any Taxes, Customer will gross up its payment so that Pazau receives the full amount invoiced.

9.7 Renewal pricing. Fees for each renewal Subscription Term may increase by up to 7% over the Fees for the same Services in the immediately preceding term, unless the Order Form states otherwise. Pazau will notify Customer of any increase at least 90 days before the end of the then-current Subscription Term. Promotional or one-time discounts apply only to the Subscription Term stated in the Order Form.

9.8 Overages. If Customer's usage exceeds its committed quantities, Pazau will invoice the excess at the overage rates in the Order Form or, if none are stated, at Pazau's then-current list rates less the discount percentage in the Order Form.

10. Term, renewal and termination

10.1 Term of Agreement. This Agreement begins on the Effective Date and continues until all Order Forms have expired or been terminated.

10.2 Subscription Term and renewal. Unless the Order Form states otherwise, each Subscription Term is 12 months from the start date in the Order Form. Each Subscription Term renews automatically for successive 12-month periods unless either party gives written notice of non-renewal at least 60 days before the end of the then-current Subscription Term. Notice of non-renewal may be given by email to the addresses in Section 21 or through the Services' admin console.

10.3 Termination for cause. Either party may terminate this Agreement or an affected Order Form by written notice if the other party materially breaches this Agreement and does not cure the breach within 30 days after receiving written notice describing it in reasonable detail. Either party may also terminate this Agreement immediately by written notice if the other party becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, liquidation, or assignment for the benefit of creditors that is not dismissed within 60 days.

10.4 Other termination rights. Customer may also terminate an affected Order Form as provided in the DPA (objection to a new Sub-processor), the AI Addendum (objection to a material model change), and the SLA (chronic failure).

10.5 Effect of termination. Upon expiration or termination of an Order Form: (a) Customer's right to use the applicable Services ends; (b) if Customer terminates for Pazau's uncured material breach, or under a right in Section 10.4, Pazau will refund any prepaid Fees covering the remainder of the Subscription Term after the effective date of termination; and (c) if Pazau terminates for Customer's uncured material breach, Customer will pay any unpaid Fees covering the remainder of the Subscription Term. Termination does not relieve Customer of its obligation to pay Fees accrued before the effective date of termination.

10.6 Data export and deletion. For 30 days after the expiration or termination of an Order Form, Pazau will, on Customer's request, make Customer Data available for export in the formats described in the Documentation, including Traces in JSON format. After that 30-day period, Pazau will have no obligation to maintain Customer Data and will delete Customer Data from its production systems and backups within 90 days after the expiration or termination, unless applicable law requires further retention. Pazau will provide written confirmation of deletion on request. Any retained Customer Data remains subject to Section 11 and the DPA.

10.7 Survival. Sections 1, 5.1, 5.3, 6.2, 7.3, 9 (for amounts accrued), 10.5 to 10.7, 11, 13.4, 14, 15, 18, and 20 to 22 survive expiration or termination of this Agreement, along with any other provision that by its nature is intended to survive.

11. Confidentiality

11.1 Definition. "Confidential Information" means all information disclosed by one party (the "Discloser") to the other (the "Recipient") that is marked or identified as confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure. Customer's Confidential Information includes Customer Data. Pazau's Confidential Information includes the non-public features of the Services, pricing, security reports, and the terms of this Agreement.

11.2 Exclusions. Confidential Information does not include information that the Recipient can demonstrate: (a) is or becomes generally available to the public through no fault of the Recipient; (b) was known to the Recipient without a duty of confidentiality before disclosure by the Discloser; (c) is received from a third party without breach of a duty of confidentiality; or (d) is independently developed by the Recipient without use of the Discloser's Confidential Information. Exclusions (a) to (d) do not apply to Personal Data within Customer Data, which remains subject to the DPA.

11.3 Obligations. The Recipient will (a) use the Discloser's Confidential Information only to exercise its rights and perform its obligations under this Agreement, (b) not disclose it to any third party except as permitted in this Section 11, and (c) protect it using at least the same degree of care it uses for its own confidential information of a similar nature, and no less than reasonable care.

11.4 Permitted disclosures. The Recipient may disclose Confidential Information to its and its Affiliates' employees, officers, contractors, advisors, auditors, insurers, Sub-processors (in Pazau's case), and actual or prospective acquirers or financing sources who need to know it for the purposes of this Agreement and who are bound by confidentiality obligations at least as protective as this Section 11. The Recipient is responsible for their compliance.

11.5 Compelled disclosure. The Recipient may disclose Confidential Information to the extent required by law, regulation, or court order, if it gives the Discloser prompt notice where legally permitted and reasonable assistance, at the Discloser's cost, to seek a protective order. The Recipient will disclose only the portion of the Confidential Information that it is legally required to disclose.

11.6 Duration. The obligations in this Section 11 continue during the term of this Agreement and for 5 years after its expiration or termination. Obligations with respect to trade secrets continue for as long as the information remains a trade secret under applicable law. Obligations with respect to Customer Data continue for as long as Pazau or its Sub-processors hold it.

11.7 Return or destruction. Upon the Discloser's written request after expiration or termination of this Agreement, the Recipient will return or destroy the Discloser's Confidential Information, except for copies retained in automatic backups or as required by law, which remain subject to this Section 11. Customer Data is returned and deleted in accordance with Section 10.6.

11.8 Equitable relief. A breach of this Section 11 may cause irreparable harm for which damages are an inadequate remedy. The Discloser may seek injunctive or other equitable relief in addition to any other remedies, without the need to post a bond.

12. Security, data protection and service levels

12.1 Security. Pazau will maintain an information security program with administrative, physical, and technical safeguards designed to protect the security, confidentiality, and integrity of Customer Data, as described in the Security Addendum. Pazau maintains SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27701, and ISO/IEC 42001 certifications, and PCI DSS compliance for the payment flows of Pazau Voice. Pazau will not materially reduce the overall level of security described in the Security Addendum during the Subscription Term.

12.2 Security Incidents. Pazau will notify Customer of a Security Incident without undue delay, and in any event no later than 72 hours after becoming aware of it. The notice will include the information described in the DPA and Security Addendum. Pazau will take reasonable steps to contain, investigate, and remediate the Security Incident and will keep Customer informed of material developments.

12.3 Data protection. To the extent Pazau processes Personal Data on Customer's behalf, the Data Processing Addendum applies. Where Customer is a covered entity or business associate under HIPAA and has enabled the required configuration, the Business Associate Agreement applies to protected health information.

12.4 Audits. Pazau's audit obligations are set out in the DPA. In summary, Pazau will make its most recent third-party audit reports and certifications available once per year. On-site audits are permitted following a Security Incident, on 30 days' notice and at Customer's cost. Audits required by a regulator with authority over Customer are permitted.

12.5 Service levels. Pazau will make the Services available in accordance with the Service Level Agreement, which commits to 99.9% monthly uptime for the Business plan and 99.95% monthly uptime for the Enterprise plan. Service credits under the SLA are capped at 10% of the monthly Fees for the affected Service. Except for Customer's termination right for chronic failure in the SLA, service credits are Customer's sole and exclusive remedy for Pazau's failure to meet the SLA.

12.6 Support. Pazau will provide support in accordance with the Support Policy for the support tier in the Order Form.

13. Warranties and disclaimers

13.1 Mutual warranties. Each party represents and warrants that (a) it is duly organized and in good standing under the laws of its jurisdiction, (b) it has full power and authority to enter into this Agreement, and (c) its execution and performance of this Agreement do not breach any agreement with a third party.

13.2 Pazau warranties. Pazau warrants that during the Subscription Term:

(a) the Services will perform materially in accordance with the Documentation;

(b) Pazau will not materially decrease the overall functionality, security, or data protection of the Services;

(c) Pazau will use industry-standard measures designed to detect and prevent the introduction of viruses, ransomware, and other malicious code into the Services; and

(d) Professional Services will be performed in a professional and workmanlike manner consistent with generally accepted industry standards.

13.3 Remedy. If Pazau breaches a warranty in Section 13.2 and Customer notifies Pazau within 30 days after discovering the breach, Pazau will use commercially reasonable efforts to correct the non-conformity. If Pazau cannot do so within 30 days after receiving Customer's notice, Customer may terminate the affected Order Form, and Pazau will refund any prepaid Fees covering the remainder of the Subscription Term after the effective date of termination. These are Customer's sole and exclusive remedies for breach of the warranties in Section 13.2. The warranties do not apply to non-conformities caused by Customer Configuration, Third-Party Services, Beta Features, or use of the Services in violation of this Agreement.

13.4 Disclaimer. EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT, THE SERVICES, OUTPUTS, AND PROFESSIONAL SERVICES ARE PROVIDED "AS IS", AND EACH PARTY DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WITHOUT LIMITING THE FOREGOING, PAZAU DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, THAT OUTPUTS WILL BE ACCURATE, COMPLETE, OR SUITABLE FOR ANY PURPOSE, OR THAT ANY PARTICULAR RESOLUTION RATE WILL BE ACHIEVED. OUTPUTS ARE NOT LEGAL, MEDICAL, FINANCIAL, OR OTHER PROFESSIONAL ADVICE.

14. Indemnification

14.1 Indemnification by Pazau. Pazau will defend Customer, its Affiliates, and their respective officers, directors, and employees against any claim, demand, suit, or proceeding brought by a third party (a "Claim") alleging that the Services, as provided by Pazau, infringe or misappropriate that third party's patent, copyright, trademark, or trade secret. Pazau will indemnify Customer for any damages, fines, and costs finally awarded against Customer, or agreed in a settlement approved by Pazau, arising from the Claim, together with reasonable attorneys' fees.

14.2 Exclusions. Pazau has no obligation under Section 14.1 for any Claim to the extent it arises from: (a) Customer Data, Procedures, or Customer Configuration; (b) Outputs, to the extent the Claim arises from Customer Data or Procedures used to generate them, or from Customer's modification or use of Outputs outside the Services; (c) the combination of the Services with any product, service, data, or process not provided by Pazau, if the Claim would not have arisen but for the combination; (d) modification of the Services by anyone other than Pazau; (e) Third-Party Services or Beta Features; or (f) Customer's continued use of the allegedly infringing Services after Pazau has notified Customer of a non-infringing modification or replacement that provides materially equivalent functionality.

14.3 Mitigation. If the Services become, or in Pazau's reasonable opinion are likely to become, the subject of a Claim under Section 14.1, Pazau may at its option and expense: (a) obtain the right for Customer to continue using the Services; (b) modify or replace the Services so that they are non-infringing without materially reducing their functionality; or (c) if neither (a) nor (b) is commercially reasonable, terminate the affected Order Form and refund any prepaid Fees covering the remainder of the Subscription Term after the effective date of termination. This Section 14 states Pazau's entire liability and Customer's exclusive remedy for any Claim of intellectual property infringement.

14.4 Indemnification by Customer. Customer will defend Pazau, its Affiliates, and their respective officers, directors, and employees against any Claim arising from: (a) Customer Data or Procedures, including any allegation that they infringe or misappropriate a third party's rights or were collected or processed in violation of law or of Customer's privacy notices; (b) Customer's or its Authorized Users' use of the Services in breach of Section 4 or in violation of applicable law, including telemarketing, consumer protection, and call-recording laws; or (c) Actions executed in accordance with Customer Configuration, including claims by End Users relating to the outcome of those Actions. Customer will indemnify Pazau for any damages, fines, and costs finally awarded against Pazau, or agreed in a settlement approved by Customer, arising from the Claim, together with reasonable attorneys' fees.

14.5 Procedure. The indemnified party will (a) give the indemnifying party prompt written notice of the Claim, although a delay in notice relieves the indemnifying party of its obligations only to the extent it is prejudiced by the delay, (b) give the indemnifying party sole control of the defense and settlement of the Claim, and (c) provide reasonable cooperation at the indemnifying party's expense. The indemnifying party may not settle a Claim in a way that admits fault on behalf of the indemnified party or imposes a non-monetary obligation on it without the indemnified party's prior written consent, which will not be unreasonably withheld. The indemnified party may participate in the defense with counsel of its choice at its own expense.

15. Limitation of liability

15.1 Exclusion of indirect damages. EXCEPT FOR THE EXCLUDED CLAIMS IN SECTION 15.4, IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES BE LIABLE UNDER OR IN CONNECTION WITH THIS AGREEMENT FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, OR ANTICIPATED SAVINGS, OR FOR THE COST OF PROCURING SUBSTITUTE SERVICES, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

15.2 General cap. EXCEPT AS PROVIDED IN SECTIONS 15.3 AND 15.4, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE TOTAL FEES PAID AND PAYABLE BY CUSTOMER UNDER THIS AGREEMENT IN THE 12 MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE LIABILITY (THE "GENERAL CAP").

15.3 Data Protection Cap. FOR LIABILITY ARISING FROM A SECURITY INCIDENT, OR FROM PAZAU'S BREACH OF SECTION 5, SECTION 12, THE DPA, THE SECURITY ADDENDUM, OR THE BAA (TOGETHER, "DATA PROTECTION CLAIMS"), PAZAU'S TOTAL AGGREGATE LIABILITY WILL NOT EXCEED TWO TIMES (2×) THE GENERAL CAP (THE "DATA PROTECTION CAP"). The Data Protection Cap is in place of, and not in addition to, the General Cap for Data Protection Claims. Amounts paid under the Data Protection Cap count toward the General Cap for other claims. The following are deemed direct damages recoverable under the Data Protection Cap, to the extent they result from a Security Incident caused by Pazau's breach: (a) reasonable costs of forensic investigation; (b) costs of legally required notifications to individuals and regulators; (c) reasonable costs of call center support and credit or identity monitoring for affected individuals for up to 12 months; and (d) fines and penalties imposed by a regulator.

15.4 Excluded Claims. THE EXCLUSIONS AND LIMITATIONS IN SECTIONS 15.1 TO 15.3 DO NOT APPLY TO: (a) A PARTY'S DEFENSE AND INDEMNIFICATION OBLIGATIONS UNDER SECTION 14; (b) A PARTY'S BREACH OF SECTION 11 (CONFIDENTIALITY), EXCLUDING ANY BREACH RELATING TO CUSTOMER DATA, WHICH IS SUBJECT TO THE DATA PROTECTION CAP; (c) A PARTY'S FRAUD OR FRAUDULENT MISREPRESENTATION; (d) A PARTY'S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT; OR (e) LIABILITY THAT CANNOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW (TOGETHER, THE "EXCLUDED CLAIMS"). NOTHING IN THIS SECTION 15 LIMITS CUSTOMER'S OBLIGATION TO PAY FEES DUE UNDER THIS AGREEMENT.

15.5 Application. The limitations in this Section 15 apply to all claims under this Agreement, the Order Forms, and all incorporated documents, together, and in aggregate, whether in contract, tort (including negligence), strict liability, or otherwise. The existence of multiple claims will not enlarge the caps. The parties agree that the limitations reflect an informed allocation of risk and form an essential basis of the bargain. Service credits under the SLA count toward the General Cap.

15.6 Actions executed as configured. For clarity, losses resulting from Actions executed in accordance with Customer Configuration are not recoverable from Pazau, as set out in Section 7.3.

16. Insurance

16.1 Coverage. During the term of this Agreement, Pazau will maintain, with insurers rated A- or better by A.M. Best, at minimum: (a) technology errors and omissions and cyber liability insurance, including network security and privacy liability, with limits of not less than US$10,000,000 per claim and in the aggregate; (b) commercial general liability insurance with limits of not less than US$2,000,000 per occurrence; and (c) workers' compensation insurance as required by law.

16.2 Certificates. Pazau will provide certificates of insurance on Customer's written request, no more than once per year. Pazau's insurance does not limit its liability under this Agreement, and Pazau's liability is not increased by its insurance limits.

17. Publicity

17.1 Customer lists. Pazau may identify Customer as a customer by name and logo on its website and in marketing materials, in accordance with any trademark guidelines Customer provides. Customer may withdraw this permission at any time by emailing legal@pazau.com, and Pazau will remove the reference within 30 days.

17.2 Other publicity. Neither party will issue a press release, case study, or public statement about the relationship without the other party's prior written consent. Customer's feedback about the Services may be used by Pazau to improve them without restriction, but will not be publicly attributed to Customer without consent.

18. Governing law and disputes

18.1 Contracting entity and governing law. The Pazau entity that Customer contracts with, the governing law, and the courts with exclusive jurisdiction depend on where Customer is domiciled, as shown in the table below.

18.2 Application. This Agreement is governed by the governing law in Section 18.1, without regard to its conflict of laws principles. Each party submits to the exclusive jurisdiction of the courts in Section 18.1. The United Nations Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act do not apply.

18.3 Escalation. Before starting litigation, other than for injunctive relief, a party will give the other written notice of the dispute. Senior executives of each party with authority to settle the dispute will meet, in person or by video conference, within 20 days after the notice to try to resolve it in good faith. If the dispute is not resolved within 45 days after the notice, either party may start proceedings.

18.4 Injunctive relief. Nothing in this Section 18 prevents either party from seeking injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information.

19. Compliance

19.1 Export and sanctions. Each party will comply with the export control and economic sanctions laws of the United States, the European Union, the United Kingdom, and other applicable jurisdictions. Customer represents that neither it nor any of its Authorized Users is named on, or owned or controlled by a person named on, any U.S., EU, UK, or UN sanctions list, and that it will not access or permit access to the Services from a country or region subject to comprehensive sanctions, including Cuba, Iran, North Korea, Syria, and the Crimea, so-called Donetsk People's Republic, and so-called Luhansk People's Republic regions of Ukraine.

19.2 Anti-corruption. Each party will comply with the U.S. Foreign Corrupt Practices Act, the UK Bribery Act 2010, and all other applicable anti-corruption laws. Neither party has received or been offered, and will not offer or accept, any bribe, kickback, or other improper payment or thing of value in connection with this Agreement. Reasonable gifts and entertainment provided in the ordinary course of business do not violate this Section 19.2. Each party will notify the other promptly if it becomes aware of a violation of this Section.

19.3 Accessibility and consumer law. Pazau will maintain the End User-facing components of the Services, such as the chat widget, in material conformance with WCAG 2.1 Level AA as described in the Documentation. Customer is responsible for the accessibility of its own content and for compliance with consumer protection laws applicable to its communications with End Users.

19.4 Government use. The Services are commercial computer software and commercial computer software documentation. If Customer is a U.S. government entity, the Services are licensed with only the rights granted to commercial users under this Agreement, in accordance with FAR 12.212 and DFARS 227.7202.

20. Assignment and change of control

20.1 Assignment. Neither party may assign or transfer this Agreement, in whole or in part, without the other party's prior written consent, which will not be unreasonably withheld. Either party may, however, assign this Agreement in its entirety without consent to an Affiliate or to a successor in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets or of the business to which this Agreement relates, if the assignee agrees in writing to be bound by this Agreement.

20.2 Change of control. A party undergoing a change of control will notify the other party within 30 days after it closes. If Customer is acquired by, or undergoes a change of control in favor of, a direct competitor of Pazau, Pazau may terminate this Agreement on 30 days' written notice and will refund any prepaid Fees covering the remainder of the Subscription Term after the effective date of termination. If Pazau is acquired by a direct competitor of Customer, Customer may terminate this Agreement on 30 days' written notice given within 90 days after Pazau's notice, with the same refund.

20.3 Effect. Any attempted assignment in breach of this Section 20 is void. This Agreement binds and benefits the parties and their permitted successors and assigns.

21. Notices

21.1 Legal notices. Notices of breach, termination, indemnifiable Claims, or disputes ("Legal Notices") must be in writing and delivered by hand, by internationally recognized courier, or by email with confirmation of receipt. Legal Notices to Pazau must be sent to the address of the contracting entity in Section 18.1, attention: General Counsel, with a copy by email to legal@pazau.com. Legal Notices to Customer will be sent to the address and contact in the Order Form.

21.2 Operational notices. Pazau may give notices relating to the operation of the Services, such as Sub-processor changes, maintenance, or model changes, by email to Customer's designated administrators or by posting in the Services' admin console. Customer is responsible for keeping its contact details current and for subscribing to the Sub-processors page notifications.

21.3 Effectiveness. Notices are effective on receipt, or in the case of email, on the next business day after sending if no bounce-back or other failure message is received.

22. General

22.1 Independent contractors. The parties are independent contractors. Nothing in this Agreement creates a partnership, franchise, joint venture, agency, fiduciary, or employment relationship between them.

22.2 Subcontracting. Pazau may use subcontractors, including Sub-processors, to perform its obligations. Pazau remains responsible for their performance in accordance with this Agreement.

22.3 Force majeure. Neither party is liable for any delay or failure to perform its obligations, other than payment obligations, caused by events beyond its reasonable control. These include natural disasters, pandemics, acts of war or terrorism, labor disputes (other than those involving the affected party's own employees), government action, and failures of public utilities or of internet infrastructure not controlled by the affected party. The affected party will notify the other promptly and use reasonable efforts to resume performance. A force majeure event does not excuse Pazau from maintaining the business continuity and disaster recovery measures in the Security Addendum. If a force majeure event prevents performance of a material obligation for more than 30 days, either party may terminate the affected Order Form, and Pazau will refund prepaid Fees covering the remainder of the Subscription Term.

22.4 Third-party beneficiaries. There are no third-party beneficiaries of this Agreement, except as provided in the DPA with respect to the Standard Contractual Clauses.

22.5 Waiver. A failure or delay in exercising a right under this Agreement is not a waiver of that right. A waiver is effective only if it is in writing and signed by the waiving party.

22.6 Severability. If any provision of this Agreement is held invalid or unenforceable, it will be enforced to the maximum extent permissible and the remaining provisions will continue in full force and effect.

22.7 Amendments. This Agreement may be amended only by a written document signed by both parties. Pazau may update the version of this Agreement published at pazau.com/legal from time to time. Updates apply to Customer only from the start of Customer's next renewal Subscription Term, or earlier if Customer accepts them in writing. Updates to the Sub-processor list follow the process in the DPA.

22.8 Entire agreement. This Agreement, including the incorporated documents and all Order Forms, is the parties' entire agreement relating to its subject matter. It supersedes all prior and contemporaneous agreements, proposals, and representations, written or oral, concerning its subject matter. Each party acknowledges that it has not relied on any statement not expressly set out in this Agreement.

22.9 Counterparts and electronic signature. Order Forms and amendments may be executed in counterparts and by electronic signature, each of which is an original and all of which together form one instrument.

22.10 Interpretation. Headings are for convenience only. "Including" and similar words mean "including without limitation". References to a law include its implementing regulations and any amendments or replacements. The English language version of this Agreement controls.

22.11 Contact. Questions about this Agreement can be sent to legal@pazau.com.