Exhibit 10.16
Parties | Diginex Solutions (HK) Limited (‘‘DIGINEX’’) | Forvis
Mazars LLP (‘‘CUSTOMER’’ or “Forvis Mazars”) |
Registered No. | 263911 | OC308299 |
Registered Address | Diginex Solutions (HK) Ltd Smart-Space Fintech 2, Room 3, Unit 401-404, Core C, 3 Cyberport Rd, Pok Fu Lum Hong Kong SAR |
Forvis Mazars LLP
|
Service Commencement for Annual License Date | Start date Upon Signing |
Term | 24 months |
Termination Notification Date |
NA |
This Agreement is entered into by and between Forvis Mazars, with offices at 30 Old Bailey, London, United Kingdom, EC4M 7AU (“CUSTOMER”) and Diginex Solutions (HK) Limited, with offices at Smart-Space Fintech2, Room 3, Units 401-404, Core C, Cyberport 3, 3 Cyberport Road, Telegraph Bay, Hong Kong (“DIGINEX”). The Agreement shall commence on 1 April 2025 and shall continue for the term of the license unless terminated earlier in accordance with the Terms and Conditions outlined in this agreement.
SCOPE OF WORK
Internal and External Licenses
Forvis Mazars’ internal platform and external client platforms license includes access to one of LUMEN’s existing self-assessment modules (Conditions at Work, Gender or ESG). The license also includes the ability to use the Self-Assessment Questionnaire (SAQ) builder to create and deploy custom question sets at any time and an integrated worker voice tool (diginexAPPRISE) that can be deployed to collect standardised, actionable data directly from workers.
Each platform (both internal and external client platforms) will hold three brand admin users and unlimited brand users accounts.
In agreement with Diginex, Forvis Mazars’ clients will receive a reduced diginexLumen Pro annual license cost of (up to the first 10 clients). Diginex and Forvis Mazars will .
1 |
Training
Diginex will provide train the trainer training to selected Forvis Mazars personnel and training materials (videos) in English only. The training will cover:
● | Platform navigation and functionalities | |
● | Supplier/internal team training on accessing and utilising the platform. | |
● | Training on creating external client platform set up |
FEES AND PAYMENT
1. | In consideration of Diginex performing its obligations under this Agreement, the Customer shall pay Diginex the costs set out in the tables below (“Charges”). | |
2. | Diginex shall: |
a. | When raising and submitting invoices, quote this Agreement and provide such other information in respect of its invoices as the Customer may reasonably require from time to time; and | |
b. | Send all invoices to: with a copy to |
3. | The Customer shall pay the Charges within 30 days of receipt of a valid invoice. All charges shall be calculated, and payments made in pounds sterling. |
a. | All amounts pursuant to this Agreement are exclusive of any VAT properly chargeable in accordance with laws. The Customer shall pay VAT at the rate for the time being properly chargeable in respect of the Services subject to Diginex providing the Customer with such valid tax invoices or other documentation as may be required by any relevant laws. | |
b. | If the Customer disputes any amount invoiced, it shall notify Diginex of the nature of the dispute within 21 days of receipt of the invoice giving all the relevant details. Pending the resolution of the dispute the Customer shall be entitled to withhold payment of the disputed part of such charge. | |
c. | Diginex may charge interest on the late payment of any undisputed Charges properly invoiced which shall accrue daily from the due date to the date of actual payment on any overdue amounts under this Agreement (whether before or after judgment) at the rate of one per cent per annum above the base rate of the Bank of England for the time being in force. | |
d. | Payment by the Customer shall be without prejudice to any claims which the Customer may have against Diginex and shall not constitute any acknowledgement by the Customer as to the proper performance by Diginex of its obligations under this Agreement. |
2 |
Unit | Feature | (US$) Price* | ||
Annual License fees | ||||
1 | UK Only Forvis Mazars platform diginexLumen Pro annual license fee (includes access to 1 core SAQ, worker survey, SAQ builder and Apprise platform). For add-on features and cost of language translations, please consult Appendix 1: diginexLumen Pro optional Add Ons pricing. | |||
Training | ||||
1 | Training on use of platform features Train the trainer training on use of diginexLUMEN & APPRISE platform features includes free support for the first 3 months. | |||
Total |
*All prices displayed above are excluding VAT, GST, sales tax and any other applicable taxes.
Unit | Feature | (US$) Price* | |||
Annual License fees for Forvis Mazars clients | |||||
Forvis Mazars client platforms per client (up to the first 10 clients) No separate account set up fee required. This includes technical support for Forvis Mazars dealing with escalated queries linked to service disruptions that impact Forvis Mazars clients.
Up to suppliers per client, thereafter (i.e. suppliers) an additional per client. |
/client charged upon sign-up for a license** |
*All prices displayed above are excluding VAT, GST, sales tax and any other applicable taxes.
**
3 |
TERMS AND CONDITIONS
1. DEFINITIONS
1.1 “Authorized Users” means Customer’s employees, agents, and/or independent contractors or others as otherwise authorized by Customer and approved by DIGINEX and who agree to be bound by terms and conditions no less restrictive than those contained in this Agreement and solely to the extent that they are acting on behalf of Customer.
1.2 “Confidential Information” means any and all information disclosed by a party (“DISCLOSER”) to the other party (“RECIPIENT”) in confidence orally or in writing or labeled or identified as “confidential” or “proprietary”; or otherwise in tangible form,; or otherwise is of such a type or disclosed in such a way that a reasonable person would understand that the information disclosed is confidential or proprietary under the circumstances. Confidential Information includes, without limitation, business and financial information, software, source code and specifications, trade secrets, technical information, business forecasts and strategies, personnel information, and proprietary information of third parties.
1.3 “Customer Content” means all information submitted, uploaded, entered or otherwise provided by Customer with regard to Customer’s use of the Product.
1.4 “Data Protection/ Privacy Legislation” means all applicable data protection and privacy legislation in force from time to time in the UK including the UK GDPR; the Data Protection Act 2018 (DPA 2018) (and regulations made thereunder) and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended and all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of Personal Data;
1.4 “Documentation” means any published technical manuals including any updates thereto, relating to the use of the Product made generally available by DIGINEX, including through its website.
1.5 “Force Majeure Event” means an event that arises out of causes beyond a party’s reasonable control, including, without limitation, war, civil commotion, act of God, pandemic, strike or other stoppage (whether partial or total) of labor, any law, decree, regulation or order of any government or governmental body (including any court or tribunal) and/or delays or outages caused by an internet service provider or independent hosting facility.
1.6 “Personal Data” means any information relating to an identified or identifiable natural person (‘data subject’).
1.7 “Product” means diginexLUMEN™, a software tool that facilitates the supply chain due diligence, and any related updates, materials and documentation made available to Customer by DIGINEX in connection with this Agreement.
1.7 “SaaS Services” means DIGINEX’s internet-accessible services providing Customer and its Authorized Users access and use of the Product that is hosted by or on behalf of DIGINEX by its service providers, which may include, but is not limited to, hosting, management, and maintenance.
4 |
1.8 “SaaS Listing” means the operating parameters and availability standards for the SaaS Services as published or made available by DIGINEX.
1.9 “Good Industry Practice” means the exercise of that degree of skill, diligence and prudence which would reasonably and ordinarily be expected from a reasonably skilled and experienced contractor engaged in the same type of undertaking under the same or similar circumstances.
1.10 “Virus” means any thing or device (including any software, code, file or program) which may: prevent, impair or otherwise adversely affect the operation of any computer software, hardware or network, any telecommunications service, equipment or network or any other service or device; prevent, impair or otherwise adversely affect access to or the operation of any program or data, including the reliability of any program or data (whether by re-arranging, altering or erasing the program or data in whole or part or otherwise or encrypting or transmitting the data); or adversely affect the user experience or adversely affect the user, including worms, Trojan horses, viruses, malware, spyware and other similar things or devices
2. CUSTOMER ORDER AND DELIVERY OF PRODUCT DIGINEX will make the Product available or otherwise accessible to Customer via user password and log-in details unique to the Authorized User(s) of the Company and intended strictly for purposes set forth in this Agreement.
3. RIGHTS AND RESTRICTIONS
3.1 CUSTOMER LICENSE. Subject to the terms and conditions of this Agreement, DIGINEX hereby grants Customer and its Authorized Users a non-sublicensable, non-assignable, non-transferable, non-exclusive license to access and use the Product through SaaS Services solely for Customer’s own internal business purposes (including granting Customer access to Customer’s client’s external platform; provided such client has provided it’s written consent to both the Customer and Diginex)and in accordance with this Agreement and the Documentation.
3.2 RESTRICTIONS. Customer agrees not to and agrees not to permit anyone to: (i) rent, sell, lease, pledge, encumber, allow any lien or otherwise transfer the Product or any part thereof, or permit or enable the use thereof for the benefit of any third party; (ii) reverse assemble, reverse compile or reverse engineer the Product, or otherwise attempt to discover any Product source code or underlying DIGINEX Confidential Information; (iii) modify or create derivative works of the Product whether based upon the SaaS Listing or Documentation or otherwise, (iv) merge the Product with any other software; (v) use the Product on or with any system for which it was not intended; (vi) access the Product or use the Documentation in order to build a similar product or competitive product; or (vii) use the Product in a way which is not expressly authorized hereunder or which may be illegal.
5 |
4. TERM AND TERMINATION
4.1 TERM. This Agreement shall be effective from the Service Commencement for Annual License Date
4.2 DIGINEX TERMINATION. DIGINEX may terminate this Agreement by providing no less than 90 days written notice to Customer and specifying the date of termination. Notwithstanding any other terms in this Agreement, DIGINEX may terminate this Agreement immediately with notice, and will be entitled to take immediate possession or control of the Product, if DIGINEX determines that Customer is in material breach of this Agreement, which breach is irremediable or (if such breach is remediable) fails to remedy that breach within a period of 30 days after being notified in writing to do so or that the Product; (i) is being misused or used in breach of this Agreement; (ii) is in the possession of any third party not authorized by DIGINEX; or (iii) is in danger of being seized by others. Subject to 4.3 below, in the event this Agreement is terminated for any reason other than for the expiration of the Term or in accordance with clause 4,4, DIGINEX shall be entitled to restrict Customer’s access to the Product and delete any Customer Content entered into or stored on the Product .
4.3 CUSTOMER TERMINATION. Customer may terminate this Agreement by providing DIGINEX with written notice of its intention (including through the online customer service feature in the subscription management section, if available) not to renew the Agreement at least thirty days prior to the expiration of the subscription Term. Customer may terminate this Agreement immediately and with notice if DIGINEX has materially breached this Agreement, which breach is irremediable or (if such breach is remediable) fails to remedy that breach within a period of 30 days after being notified in writing to do so. In the event this Agreement is terminated by Customer in accordance with this clause 4.3, DIGINEX shall make available to Customer, any Customer Content entered into or stored on the Product.
4.4 MUTUAL TERMINATION. In the event that one party commences negotiations with or negotiates for any compromise or arrangement with its creditors or allows any judgement against it to remain unsatisfied for seven days or calls any meeting of its creditors or has a receiver of all or any of its assets appointed or enters into any liquidation, the other party may terminate the Agreement immediately by written notice.
4.5 EFFECT OF TERMINATION. Upon the termination of this Agreement, all licenses granted hereunder shall immediately terminate and Customer shall return or destroy all Documentation and materials made available by DIGINEX in connection with this Agreement.
4.5 SURVIVAL. The Sections entitled Definitions, Restrictions, Effect of Termination, Survival, Ownership, Disclaimer of Warranty, Limitation of Liability, Confidentiality, and General shall survive any such termination or expiration.
6 |
5. SAAS, UPDATES, UPGRADES, AND SUPPORT
5.1 UPDATES AND UPGRADES. DIGINEX may from time to time at its sole discretion make changes or updates to the Product or infrastructure of the SaaS Services (such as computer infrastructure, storage technology, security, technical configurations, hosting facilities within the data center region, etc.). DIGINEX will use commercially reasonable efforts to provide Customer with at least forty-eight (48) hours advanced notice of any downtime required for such updates and upgrades to the Product and infrastructure of the SaaS Services (“Scheduled Downtime”). DIGINEX will use commercially reasonable endeavours to make the Services and Software available twenty-four (24) hours a day, seven (7) days a week, except for Scheduled Downtime.
5.2 SUPPORT. Customer Support will be provided in a timely and professional manner by qualified support engineers in accordance with DIGINEX’s applicable support policy. Customer Support shall consist of any one or more of the following:
i. Access to DIGINEX support website 24x7x365 support.
ii. Access to DIGINEX help desk and the ability to open and manage support incidents via DIGINEX support online or by telephone.
iii. Production environment support: 24x7 solely for high severity incidents; normal business hours for lesser severities as determined by Diginex in its sole discretion.
6. OWNERSHIP
6.1. DIGINEX TITLE. DIGINEX retains all right, title and interest in and to the Product. This Agreement does not transfer any of DIGINEX’s right, title or interest in and to the Product and Confidential Information of DIGINEX, including any intellectual property rights therein. There are no implied licenses, and all rights not expressly granted hereunder are reserved to DIGINEX and its licensors.
6.2 CUSTOMER CONTENT. Customer exclusively owns all rights, title and interest in and to all Customer Content. Customer Content will be stored and processed in the data center region specified in the SaaS Documentation. DIGINEX shall not access Customer’s Authorized User accounts or Customer Content stored within such Authorized User accounts, except in response to SaaS or technical issues where Customer provides DIGINEX with the relevant credentials required to access such data. DIGINEX will collect, modify and analyze meta data and/or operations data which does not contain any Customer Content, such as log files and transaction counts. DIGINEX is not responsible for unauthorized access, alteration, theft or destruction of Customer Content arising from Customer’s own or its Authorized Users’ actions or omissions in contravention of the Documentation. Customer’s ability to recover any lost data resulting from DIGINEX’s misconduct is limited to restoration by DIGINEX from the most recent back-up.
7 |
Notwithstanding this Clause 6.2, DIGINEX may use de-identified or aggregate Customer Content for research and analysis purposes including, but not limited to, benchmarking to enhance the platform functionality and data accuracy for our customers. De-identified data is data that is not linked or reasonably linkable to a particular person, Customer or device. Aggregate data is Customer Content that DIGINEX has combined with information from other customers so that the use of and recipient of the data does not identify any particular person, Customer or device from the data.
6.3 TRANSFER OF CUSTOMER CONTENT. If Customer’s Authorized Users provide any personal data to DIGINEX in connection with use of the Product, and/or provides DIGINEX access to any Customer Content, then Customer warrants that (i) it is duly authorized to provide personal data to DIGINEX and it does so lawfully in compliance with relevant legislation, (ii) DIGINEX or its subcontractors, acting on behalf of DIGINEX, may use such data strictly for the purposes of performing its obligations under this Agreement, (iii) DIGINEX and its subcontractors shall comply with the applicable data protection/ privacy legislation at all times when processing Customer data; and (iv) DIGINEX may disclose such data to any DIGINEX entity and its subcontractors for this purpose and may transfer such data to countries outside of the country of origin.
DIGINEX
and its Affiliates have committed to comply with relevant Data Protection/Privacy Legislation, and personal data will be transferred
in accordance with DIGINEX’ Data Privacy Policy, a copy of which can be found at https://www.diginex.com/privacy-policy. DIGINEX
will never share Personal Data with third party commercial entities for direct marketing purposes, unless Customer gives DIGINEX affirmative
permission. Customer agrees not to provide any health, payment card or similarly sensitive Personal Data that imposes specific data security
obligations for the processing of such data unless it is a supported feature in the Documentation of the Product.
6.4 SECURITY. DIGINEX will maintain and administer a security policy with physical and technical safeguards designed to protect the security, integrity and confidentiality of the Customer Content. DIGINEX runs security background checks on all operations staff. Security audits are conducted periodically to certify that security controls are in place and are being carried out. A copy of DIGINEX’s Data Security Protocol will be provided upon request. In the event that DIGINEX has determined that a security breach of Customer’s or an Authorized User’s data has occurred, DIGINEX will provide Customer with notice of the security breach without undue delay but in no event later than five (5) working days from such determination, unless doing so would be detrimental to DIGINEX’s remediation efforts for such breach. After initial notification, DIGINEX will keep Customer updated on a regular basis and provide an incident report which may include the steps taken by DIGINEX to investigate the security breach and potential measures to be taken by the Customer to minimize potential damages. The parties understand and agree that DIGINEX may be prevented by law, regulation, or a third-party arrangement from providing such notice(s) and/or reports within the above time frames.
8 |
6.5. CUSTOMER RESPONSIBILITIES. Customer shall not and shall not allow any third party to: (i) make the Product available to any third party not authorized or as otherwise contemplated by this Agreement; (ii) send or store code that can harm or result in damage to the Product (including but not limited to malicious code and malware); (iii) willfully interfere with or disrupt the integrity of the Product or the data contained therein; (iv) attempt to gain unauthorized access to the Product or its related systems or networks; (v) use the Product to provide services to third parties except as expressly permitted by the Agreement; (vi) use the Product in order to cause harm, such as overload or create multiple agents for the purpose of disrupting operations of a third party; (vii) remove or modify any program markings or any notice of DIGINEX’ or its licensors’ proprietary rights; (viii) perform or disclose any benchmark or performance tests on the Product; or (ix) perform or disclose any of the following security testing of the SaaS environments or associated infrastructure: network discovery, port and service identification, vulnerability scanning, password cracking, remote access testing, penetration testing or any other test or procedure not authorized in the Documentation. A breach by Customer of its obligations under this section shall be considered a material breach of the Agreement.
6.6. DIGINEX WARRANTIES
DIGINEX warrants that it has and shall maintain all necessary licences, consents, and permissions necessary for the performance of its obligations under this Agreement and will comply with all applicable laws and regulations with respect to its obligations under this Agreement and shall be liable for all acts and/or omissions of its Affiliates or its subcontractors as if such acts and/or omissions were its own.
6.7. INTELLECTUAL PROPERTY RIGHTS INDEMNITY
DIGINEX shall indemnify the Customer against all liabilities, costs, expenses, damages and losses and interest and legal costs suffered or incurred by the Customer arising out of or in connection with any claim brought for actual or alleged infringement of a third party’s intellectual property rights arising out of, or in connection with, the supply of the SaaS Services.
7. DISCLAIMER OF WARRANTY
DIGINEX
warrants that the Product will materially conform to the Documentation during the Term and DIGINEX will provide the SaaS Services using
reasonable skill and care in an efficient and professional manner in accordance with Good Industry Practice and use commercially reasonable
endeavours to not transmit any Viruses via the Product/SaaS Services. If it is established that DIGINEX has breached such warranty, DIGINEX
will, at its option, (a) use reasonable efforts to cure the defect; (b) in the event DIGINEX cannot, after commercially practicable attempts
to do so, achieve the remedies in (a), where the breach relates to SaaS, DIGINEX may terminate the subscription to the Product and provide
a refund of pre-paid, unused fees calculated against the remainder of the subscription term as of the effective date of such termination.
Customer must report the alleged breach of warranty with reasonable specificity in writing within thirty (30) days of its occurrence
to benefit from this warranty and the remedies stated herein. The above remedies and warranties are DIGINEX’S only warranties and
DIGINEX’S sole obligation for breach of such warranties . To the extent permitted by law, no other warranties or conditions,
whether express or implied, including, without limitation, third party warranties, non-infringement, the implied warranties of merchantability
or fitness for a particular purpose are made by DIGINEX. DIGINEX does not warrant that the product offered will meet customer’s
requirements or that use of the SaaS will be uninterrupted or error-free.
9 |
8. LIMITATION OF LIABILITY
8.1. In no event shall either party be liable to the other party or any other party, whether in contract or tort, or otherwise for any incidental, indirect, punitive, exemplary, special, consequential or unforeseeable loss, damage or expense, loss of profits, loss of business, loss of opportunity, loss or corruption of data, however arising, even if advised of the possibility of such loss or damages being incurred.
8.2. Subject to clause 8.3 below, each party’s liability to the other under the agreement, for damages, losses, or liability for any cause whatsoever and regardless of the form of action whether contractual or non-contractual, shall be limited to a maximum of the fees paid and owed for the product provided to customer during the twelve (12) months preceding the claim or where the claim relates to services only the fees paid and owed for the services giving rise to the claim. The above limitations will not in any way limit customer’s obligation to pay.
8.3. DIGINEX liability for breaches of its confidentiality obligations, Data Protection obligations and its liability in connection with the intellectual property rights indemnity shall be limited in any calendar year to .
9. CONFIDENTIALITY
9.1. RECIPIENT agrees: (1) to take commercially reasonable measures to maintain the DISCLOSER’s Confidential Information in confidence; (2) not to disclose the DISCLOSER’s Confidential Information to any third parties, except as described below; and (3) not to use any Confidential Information except to perform its obligation and exercise its rights under this Agreement. RECIPIENT may disclose DISCLOSER’s Confidential Information to its officers, directors, or those of its employees, agents and contractors as are necessary for the use expressly set forth in the Agreement, and only after such employees and contractors have agreed in writing to be bound by terms no less restrictive than the provisions of this Agreement.
10 |
9.2.
The restrictions set forth in this section shall not apply to any Confidential Information that the RECIPIENT can demonstrate (1)
was known to it prior to its disclosure by the DISCLOSER; (2) is or becomes publicly known through no wrongful act of the RECIPIENT;
(3) has been rightfully received from a third party authorized to make such disclosure without restriction; (4) is independently developed
by the RECIPIENT without reliance upon the other party’s Confidential Information; or (5) has been approved for release by the
DISCLOSER’s prior written authorization.
9.3. The parties agree that a breach of this section may cause immediate and irreparable harm for which monetary damages would be an inadequate remedy and therefore, the parties agree that in addition to any other remedies available at law or hereunder, the DISCLOSER shall be entitled to seek equitable relief, including injunctive relief, from any court having jurisdiction, to protect its rights and interests pursuant to this section.
10 GENERAL
10.1 GOVERNING LAW; INJUNCTIVE RELIEF . This Agreement and any dispute or claim arising out of or in connection with the Agreement or its subject matter or formation (including non- contractual disputes or claims) shall be governed by and construed in accordance with English law and Forvis Mazars LLP and Diginex irrevocably submit to the exclusive jurisdiction of the Courts of England.
10.2. WAIVERS; AMENDMENTS; ENTIRE AGREEMENT; PRIORITY. No failure or delay in exercising any right hereunder will operate as a waiver thereof, nor will any partial exercise of any right or power hereunder preclude further exercise. Any waivers or amendments shall be effective only if made in writing and agreed by both parties. This Agreement, the SaaS Listing or applicable Documentation, and the Subscription Order Form, together form the complete and mutual understanding of the parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict among this Agreement, the SaaS Listing or applicable Documentation, and the Subscription Order Form, the order of precedence from highest to lowest shall be (i) the Subscription Order Form, (ii) SaaS Listing or applicable Documentation, and (iii) this Agreement.
10.3 SEVERABILITY. If any provision of this Agreement shall be adjudged by any court of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and enforceable.
10.4 NON-EXCLUSIVE SERVICE. Customer acknowledges that the Product is provided on a non-exclusive basis. Nothing shall be deemed to prevent or restrict DIGINEX’s ability to provide the Product, SaaS Services or other technology, including any features or functionality first developed for Customer, to other parties.
10.5 FORCE MAJEURE. Each party will be excused from performance for any period during which, and to the extent that, such party, or any subcontractor is prevented from performing any obligation or service, in whole or in part, as a result of a Force Majeure Event.
11 |
10.6 NO THIRD-PARTY BENEFICIARIES. This Agreement is an agreement between the parties, and confers no rights upon either party’s employees, agents, contractors, partners of customers or upon any other person or entity.
11 MARKETING
11.1 CO-BRANDING . Co-branded marketing materials to be agreed between marketing teams, to include flyers & social media posts (LinkedIn).
11.2. PUBLICITY. Diginex and the Customer will announce the partnership on respective LinkedIn / websites and are permitted to add each other’s logos to their respective websites. Upon signing, both parties work together to draft a press release for immediate release announcing the Partnership. Further co-marketing activities e.g., joint events, joint blog posts, joint customer case studies to be scoped and developed on a case-by-case basis. The Forvis Mazars name and logo shall only be used with the prior written consent of Forvis Mazars.
SIGNED for and on behalf of DIGINEX
Mark Blick CEO
Date: 26 March 2025
Signed /s/ Mark Blick
|
SIGNED for and on behalf of the Customer
NameMichelle Olckers Title Partner
Date: 26 March 2025
Signed /s/ Michelle Olckers
|
12 |
Appendix 1: diginexLumen Pro optional Add Ons pricing
diginexLUMEN
Pro
for MNCs/Brands & Consultants
Tailored for companies requiring in-depth analysis, managing complex supply chains, and customized solutions.
OPTIONAL ADD ONS PER SINGLE LICENSE: |
||
Group Forvis Mazars platform diginexLumen Pro annual license fee (includes access to 1 core SAQ, worker survey, SAQ builder and Apprise platform).
|
||
+ WORKFORCE SURVEY (Collect data on the types of workers and their demographics employed by your suppliers) |
||
+ ADDITIONAL EXPERT-BUILT CORE SAQ | ||
+
SAQ BUILDER (Create your own customized assessments) |
||
+ IMPROVEMENT PLANS (Recommended Actions Based on International Standards and Best Practices that can be customized, agreed and tracked) | ||
+ APPRISE (worker voice tool, 1 core Apprise Survey included) |
||
+ ADDITIONAL EXPERT-BUILT CORE APPRISE SURVEY (Gender, Employee well-being) |
||
+ DEVELOPMENT OF NEW APPRISE SURVEY QUESTIONNAIRE (up to 40 questions) |
||
+ TRANSLATION OF APPRISE SURVEY TO NEW WORKER LANGUAGE (Includes Voiceover) | ||
+ DATA TRIANGULATION OF CUSTOM BUILD SAQ AND APPRISE SURVEY | ||
+ WhatsAPP INTEGRATION (Enables WhatsApp Messaging allowing end-users to send survey requests directly to workers own mobile phone numbers.) Only in Apprise. |
|
Pricing list for platform translations on demand.
13 |
Schedule 1 – Mandatory Supplier Clauses
Diginex shall fully comply with this Schedule 1 for the duration of the Agreement. Any breach of this Schedule 1 shall be considered a material breach pursuant to clause 4.3 of the Agreement.
1. | Criminal finances act 2017 |
● | Neither Party shall take any action which facilitates the evasion of taxes anywhere in the world or which is contrary to any related financial crime laws and regulations (including without prejudice to the generality of the foregoing the Criminal Finances Act 2017). | |
● | The Parties shall insofar as required to do so, and whether or not either Party is an associated person of the other for the purposes of the Bribery Act 2010, the Criminal Finances Act 2017 or any other relevant laws and regulations, maintain on an ongoing basis appropriate systems, procedures and controls designed to prevent any breach of this paragraph. |
2. | Restricted entities |
“Restricted Entity” means an entity from which the Client’s receipt of the Services would violate, or cause it to be likely to violate: (i) independence rules of any applicable regulatory authority of the Client and/or any affiliate of the Client (including any Forvis Mazars entity worldwide) who receives the Services; or (ii) any applicable regulations relating to the professional ethics or independence of auditors, including permissibility of payment and/or receipt of referral fees, and any other legal or regulatory requirements related to the independence of auditors;
If:
● | there is a change in Control (as defined in section 574 of the Capital Allowances Act 2001) of the Supplier or a member of its group and Control is acquired or proposed to be acquired (directly or indirectly) in a single transaction or series of related transactions by a Restricted Entity; or | |
● | all or substantially all of the assets of the Supplier or any member of its group are acquired or proposed to be acquired by a Restricted Entity; or | |
● | the Supplier becomes a Restricted Entity; or | |
● | the Supplier is merged or proposed to be merged with or into a Restricted Entity; |
then the Supplier shall provide the Client with no less than 60 days’ prior written notice (or to the extent that the Supplier is prohibited from providing such notice by law, the maximum amount of notice permissible by law) of such event (“Closing of Change in Control Event”) and on receipt of such notice the Client may, at any time following the Closing of Change in Control Event, terminate this Agreement with immediate effect in its sole discretion by giving the Supplier written notice. If this Agreement is terminated under this Clause, the Supplier shall cease to provide the Services unless, in the Client’s sole discretion, the Client requests otherwise in writing.
14 |
Anti-slavery
1. | In performing its obligations under the agreement, the Supplier shall: |
● | comply with all applicable anti-slavery and human trafficking laws, statutes, regulations, and codes from time to time in force including but not limited to the Modern Slavery Act 2015 (Anti-slavery Law); and | |
● | maintain throughout the term of this Agreement its own policies and procedures to ensure its compliance; and | |
● | not engage in any activity, practice, or conduct that would constitute an offence under sections 1, 2 or 4, of the Modern Slavery Act 2015 if such activity, practice, or conduct were carried out in the UK; and |
include in its contracts with its permitted direct subcontractors and suppliers’ anti-slavery and human trafficking provisions that are at least as onerous as those set out herein or require that each of its permitted direct subcontractors and suppliers shall comply with all applicable anti-slavery and human trafficking laws, statutes, regulations and codes from time to time in force including but not limited to the Modern Slavery Act 2015.
2. | The Supplier represents and warrants that: |
● | neither the Supplier nor any of its officers, employees or other persons associated with it: |
● | has been convicted of any offence involving slavery and human trafficking; and | |
● | having made reasonable enquiries, so far as it is aware, has been or is the subject of any investigation, inquiry or enforcement proceedings by any governmental, administrative or regulatory body regarding any offence or alleged offence of or in connection with slavery and human trafficking. |
3. | The Supplier shall implement due diligence procedures for its permitted direct subcontractors, and suppliers and other participants in its supply chains, to ensure that there is no slavery or human trafficking in its supply chains. |
4. | The Supplier shall notify Forvis Mazars LLP as soon as it becomes aware of: |
● | any actual or suspected slavery or human trafficking in a supply chain which has a connection with this Agreement. |
5. | The Supplier shall: |
● | maintain a complete set of records to trace the supply chain of all Goods and Services provided to the Client in connection with this Agreement; and | |
● | permit the Client and its third-party representatives, on reasonable notice during normal business hours, to have access to and take copies of the Supplier’s records and any other information and to meet with the Supplier’s personnel to review the Supplier’s compliance with its obligations under this clause; and | |
● | implement annual reviews of its compliance and its permitted direct subcontractors’ and suppliers’ compliance with the Anti-slavery Law, either directly or through a third party, and provide a copy of the annual reviews to the Client. |
6. | The Supplier shall implement a system of training for its officers and employees to ensure compliance with Anti-slavery Law. |
7. | The Supplier shall keep a record of all training offered and completed by its employees to ensure compliance with Anti-slavery Law and shall make a copy of the record available to the Client on request. |
8. | The Supplier shall indemnify the Client against any losses, liabilities, damages, demands, penalties, costs (including but not limited to legal fees) and expenses incurred by, or awarded against, the Client as a result of any breach by the Supplier of the Anti-slavery Law or the provisions herein or applicable anti-slavery and human trafficking laws, statutes, regulations and codes from time to time in force including but not limited to the Modern Slavery Act 2015. |
The Client may terminate the agreement with immediate effect by giving written notice to the Supplier if the Supplier commits a breach of the provisions herein or applicable anti-slavery and human trafficking laws, statutes, regulations, and codes from time to time in force including but not limited to the Modern Slavery Act 2015.
15 |
Schedule 2 – Security Schedule
Diginex shall fully comply with the security measures in this Schedule 2 for the duration it holds, accesses or otherwise processes Forvis Mazars data. The third party shall notify Forvis Mazars immediately if it is unable to comply with any of the security measures in this schedule. Any breach of this Schedule 2 shall be considered a material breach pursuant to clause 4.3 of the Agreement.
Organisation of Information Security | The third party shall ensure there is senior management commitment to identifying and mitigating information security risk. Named individuals with accountability and responsibility should be documented. The third party shall ensure the implementation, communication, and maintenance of Information Security Policies. | |
Access Controls
|
The third party shall ensure access to Forvis Mazars data and information systems processing Forvis Mazars data is based on the principle of least privilege. The third party shall ensure technical measures are in place to control access to Forvis Mazars’ data including:
● Multi Factor Authentication;
● Role Based Access Control;
● Inactivity device lockout; and
● Additional controls for remote access. The third party shall ensure physical security controls are in place at facilities that process or store Forvis Mazars Data including:
● CCTV;
● Physical ID badges;
● Electronic access control systems;
● Clear desk measures;
● Secure containment of physical data; and
● Secure containment of confidential waste. The third party shall ensure there is secure provisioning and deprovisioning of access rights including:
● Appropriate approval of access rights
● Regular User Access Reviews
● Removal of access rights on termination of contract
Each user will be provided with a unique user account and policies shall make the user accountable for activities undertaken utilising their user credentials. Passwords controls shall be applied in line with current best practise as advised by the NCSC or other reputable professional body. |
16 |
Application Security | The third party shall ensure a software development lifecycle policy is implemented with all activities tracked and logged. The following best practice elements shall be followed:
● Any application provided to Forvis Mazars should not be susceptible to OWASP’s top 10 vulnerabilities.
● Cryptographic and API keys are securely managed.
● The third party shall maintain separate development, test and production environments.
● Forvis Mazars production data is not used in the Test or Development environments. | |
Security Operations | The third party shall:
● Maintain and store appropriate logs in a secure manner;
● Regularly monitor its logs;
● Fully investigate any security alerts;
● Conduct penetration testing of the technology environment at least once per annum;
● Conduct vulnerability scans of the technology environment at least monthly;
● Identify and remediate vulnerabilities without undue delay;
● Remediate all external critical and high vulnerabilities within 30 days;
● Implement an effective patch management routine;
● Implement and maintain industry best practice measures for the pseudonymisation and encryption of personal data. This includes, but is not limited to, the use of secure encryption algorithms such as AES 256 for data at rest and TLS 1.2 or higher for data in transit. The third party shall ensure that all encryption keys are securely managed and regularly rotated. | |
Back Up | The third party shall ensure:
● Backups are held off-site;
● Backups are encrypted;
● Access to backups is restricted;
● A backup schedule is implemented;
● Regular Backup testing takes place;
● Appropriate RPO’s are set. | |
Third Party Security | The third party shall ensure any suppliers or service providers involved with this service maintain appropriate security measures to meet the requirements in this schedule.
The third party shall conduct regular security reviews of its suppliers or service providers to ensure they maintain appropriate security measures in accordance with this schedule. |
17 |
Information Security Risk Management | The third party shall establish and maintain an information security risk management program to identify, assess, mitigate, and monitor risks associated with the security of information and systems. This program shall be aligned with industry best practices and standards such as ISO 27001 or NIST SP 800-53. The third party shall promptly notify Forvis Mazars of any significant changes to its risk profile. | |
Incident reporting/ management | The third party shall establish, document, and maintain an information security incident management program to respond and recover from any security incident. The third party shall document how incidents are identified, classified, and responded to, including specific playbooks. If a security incident occurs, the third party shall notify Forvis Mazars without undue delay, providing details of the incident, impact, and actions taken to mitigate and prevent reoccurrence. | |
Personnel Security | The third party shall implement and maintain a comprehensive HR Security Program including:
● Appropriate background checks for all employees and contractors, in accordance with relevant laws and regulations.
● Comprehensive security awareness training, administered at least annually, for all employees and contractors.
● Third party employees shall be subject to contractual provisions ensuring they remain accountable for their actions |
18 |
Schedule 3 – Supplier Code of Conduct
19 |