EX-10.19

Agreed and accepted


“Microsoft”	“Partner”
Signature:	Signature:
Name: Annona Loughnane	Name: Josh Payne
Title: CVP/CFO EMEA and Asia	Title: Chief Executive Officer
Date:	Date:

This SOW (and all Exhibits attached hereto), pursuant to the Microsoft Purchase Order Terms and Conditions (together with the SOW, the “Agreement”), is entered into by the parties and effective as of the SOW Effective Date above. Terms not defined herein will have the meaning provided in the Purchase Order Terms and Conditions.

Microsoft and Partner are each a “Party” and together the “Parties” for the purposes of this SOW.

1. Service Descriptions, Delivery and End Dates, and Early Access

Partner will perform or deliver to Microsoft under the Agreement the services described in this SOW (collectively, the “Services”). The Parties agree that the Services under this SOW are “Cloud Services” for the purposes of the PO Terms and that there are no Goods, Services or Deliverables provided under this SOW. The Term of this agreement will commence upon the Effective Date of this SOW and end on the last remaining Service End Date.

1.1 GPU Services. During the Term, Partner will provide and make available to Microsoft Graphics Processing Units (GPUs) and hosting services, at the Data Center Location. The Data Center Location shall be the data center facilities located at the land at Kvandal North in the municipality of Narvik, Norway at Nordmoveien 301, 8530 Bjerkvik, Narvik, Norway.

Partner will deliver the GPU infrastructure by tranche, by its corresponding Delivery Date as set out in Table 1, each such GPU tranche being a “GPU Service” or “Tranche”. The Service Term of each GPU Service will begin upon its Acceptance by Microsoft in accordance with the acceptance process described in Section 2 and end on the Service End Date provided in Table 1.

Microsoft may, in its sole discretion choose to extend the expiration date of a Tranche beyond the Year 6 End Date (in Table 1) for the applicable Tranche for a period of up to six (6) additional months by providing written notice to Partner no later than three (3) months prior to the Year 6 End Date (in Table 1) for the applicable Tranche. Microsoft shall, in its sole discretion, decide the length of time of such extension (which will be no longer than six (6) months) and the price for the applicable Tranche during such extension period shall be the Year 6 pricing under Section 3.1. If Microsoft makes this election, such election will be documented via an amendment to this SOW.

1.2 Early Access Capacity. 60 days prior to delivering the first GPU Service of a GPU Type or the first GPU Service after a mutually agreed Technology Change (as defined in Section 3.4), Partner shall provide Microsoft with two (2) Contract Racks (as defined in Exhibit A) subject to the acceptance and validation criteria outlined in Section 2, that meet the criteria outlined in Exhibits B (Supplier Validation and Acceptance Criteria), D (GPU as a Service Security Standards), and F (GPU Services specs) (the “Early Access Capacity”), and that are separate from and in addition to the GPU Services provided by Partner under Table 1. Partner will provide Microsoft with the Early Access Capacity free of charge and under the terms outlined in Section 3.4. Partner will notify relevant subcontractors providing Services on Partner’s behalf under this SOW of this Early Access Capacity requirement and agrees to provide this notice within five (5) days of executing of this SOW so that Microsoft can collaborate with the relevant subcontractors.

1.3 Colocation Space. The Parties agree that in addition to the GPU Services and Early Access Capacity described above, throughout the duration of this Agreement, Partner will provide Microsoft with designated space at the Data Center Location that (i) is air cooled and equipped with 6MW of power, (ii) is sufficient for Microsoft to supply CPU, storage, and networking needs related to the operation of the GPUs and for which Partner will provide the physical installation for racks, trays, and rear door heat exchangers (if required for air cooling), (iii) meets the requirements set forth in Exhibit D (GPU as a Service Security Standards), and (iv) Microsoft reviews and agrees upon in advance (the “Colocation Space”). Partner will make this Colocation Space available to Microsoft at least ninety (90) days before delivery of the first GPU Service.

2. Acceptance Process & Step‑in Right

Acceptance: Delivery of each GPU Service under this SOW will be deemed completed upon acceptance in accordance with the acceptance process provided below (“Acceptance”) and in Section 2.b. The timelines provided in the chart below may be changed if mutually agreed upon in writing by the parties.


Supplier Validation	Prior to delivery, Supplier must perform a structured validation sequence on all components, including hardware health checks (e.g. GPU diagnostics, memory tests), system performance benchmarks (e.g. HPL‑MxP, HPCG), and network validation (e.g. NCCL tests) as described in Exhibit B – Supplier Validation and Microsoft Acceptance Criteria. Supplier must provide copies of its test results to Microsoft as described below. Upon completion of Supplier’s testing, Supplier will provide notice to Microsoft that the Services are ready for acceptance testing by Microsoft, must provide copies of its test results to Microsoft, and must certify that it has performed the validation criteria and met the obligations outlined in Exhibit B (“Delivery Notice”).
Acceptance Period	Following receipt of the Delivery Notice, Microsoft shall have (i) 35 days for the first GPU Service delivered under Table 1 or for the first GPU Service delivered after a Technology Change (as defined in Section 3.4 below) and (ii) 5 days for all other GPU Services (including the Early Access Capacity) delivered under this SOW, to conduct its own testing and validation of the GPU Service (“Acceptance Period”).
Acceptance or Rejection	• Acceptance: Within the Acceptance Period, if Microsoft determines that the GPU Service meets the criteria outlined in Exhibit B, Microsoft will provide Supplier with a written notice that the Services are accepted (“Acceptance”). • Rejection: if Microsoft reasonably determines that the GPU Services fail to meet the criteria outlined in Exhibit B or reasonably determines that the Delivery Notice is insufficient (e.g., no


	certification is provided), it will provide a written notice of rejection detailing the specific deficiencies. Supplier will have fifteen (15) business days to cure the deficiencies and resubmit for acceptance testing.
Deemed Acceptance	If Microsoft does not provide notice of rejection within the Acceptance Period, the Services will be deemed accepted.

Validation conditions.

Prior to delivery, Supplier shall use the Microsoft‑provided operating system image for bring‑up and readiness of each GPU Service, where reasonably practicable. If Supplier uses a non‑Microsoft‑provided operating system image, Supplier shall ensure that:

such image is functionally equivalent to the Microsoft‑provided operating system image, including identical GPU driver versions, firmware levels, kernel configuration, and system settings relevant to performance, power, and stability; and

any transition from such image to the Microsoft‑provided operating system image does not introduce revalidation, reconfiguration, or delays to production readiness.

ii.

Supplier shall execute Microsoft‑provided validation tests as part of the standard bring‑up process for any Early Access Capacity and each GPU Service, using the operating system image into which such tests are embedded. These validation tests may be run in parallel with other Supplier deployment activities but must be successfully completed prior to delivery. Successful completion of these validation tests and the delivery to Microsoft of satisfactory evidence of the successful completion are necessary pre‑requisites to delivery to Microsoft.

Step‑in right: Supplier shall ensure that concurrently with the closing of the applicable financing or colocation arrangements with any Third Party Operators (as defined below), Microsoft, Supplier and (i) any parties that have provided financing in relation to this SOW and (ii) the relevant colocation service provider (“Third Party Operators”) will enter into a side letter or other agreement (in form and substance satisfactory to Microsoft) which provides that, upon the occurrence of an Insolvency Event (as notified or determined by Microsoft) with respect to Supplier, such Third Party Operators will agree to give Microsoft the option to become the replacement “Manager” (or analogous term) under the financing documents or colocation services agreement (as applicable) and shall permit the services to be provided in accordance with the terms of this SOW so long as Microsoft continues to comply with its payment and other obligations thereunder. Microsoft will not have any obligation to exercise this option.

3. Payment

3.1 GPU and Colocation Prices. The Parties have agreed to use the below prices to calculate the Service Fees owed under this Agreement:

GPU Service Price:

     SOW

     GPU Type

     Location

     Term

     Price
($/GPU/hr)
Years 1‑5

     Price
($/GPU/hr)
Year 6

     6

     NVIDIA VR200

     Kvandal North, Norway

     6 years

     $[***]

     $[***]

Colocation Price. The Parties have agreed to a price of $[***] for 6MW the Colocation Space that Partner will make available for Microsoft’s CPU, Storage and Networking needs.

3.2 Service Fees. The total fees for the GPU Services and Colocation Space (“Service Fees”) will not exceed $[***]. The Service Fees will be payable in accordance with the milestone payment schedule for GPU Services set forth in Table 1 and this Section 3.2 (consisting of $[***] for GPU Services) and in monthly payments as outlined in Section 3.2.f for Colocation Fees ($[***]).

For the avoidance of doubt, additional services not provided in this SOW that are (i) subject to a separate charge and (ii) mutually agreed by the parties shall be priced and billed separately.

Table 1


	Tranche 1	Tranche 2	Tranche 3	Total
GPU Type	VR200	VR200	VR200	VR200
Year 1‑5 Price per GPU Hr	$[***]	$[***]	$[***]
Year 6 Price per GPU Hr	$[***]	$[***]	$[***]
GPU Quantity	[***]	[***]	[***]	[***]
Capacity (MW)	[***]	[***]	[***]	[***]
Delivery Date	[***]	[***]	[***]
Year 1‑5 End Date	[***]	[***]	[***]
Year 6 End Date	[***]	[***]	[***]
Year 1‑5 Value	$[***]	$[***]	$[***]	$[***]
Year 6 Value	$[***]	$[***]	$[***]	$[***]
Total Tranche Value	$[***]	$[***]	$[***]	$[***]
Upfront Payment 1	$[***]	$[***]	$[***]	$[***]
Upfront Payment 2	$[***]	$[***]	$[***]	$[***]
Est. Monthly Payment Yr 1‑5	$[***]	$[***]	$[***]
Est. Monthly Payment Yr 6	$[***]	$[***]	$[***]

*Estimated Monthly Payments are calculated based on a 730‑hour month and take into account a prepayment of [***]. These figures are included for illustrative purposes only. Total monthly and upfront payments paid by Microsoft are not to exceed the Tranche Value. The actual monthly installment amounts for GPU Services will be calculated on the basis outlined in Section 3.2.a below.

Payment Calculations.

The total amount owed for each GPU Service will be calculated by multiplying the number of GPUs by the corresponding Price and by the number of hours in the corresponding Service Term (“Total Amount”).

ii.

Upfront Payment: Partner shall invoice an upfront payment in the total amount equal to [***] of the Total Tranche Value provided in Table 1 (“Upfront Payment”) in accordance with the following terms:

Upfront Payment 1: [***] of the Total Tranche Value may be invoiced no earlier than 15 days following execution of this SOW; and

Upfront Payment 2: The individual Upfront Payment 2 amounts identified in Table 1 for each Tranche may be invoiced no earlier than 90 days before the Delivery Date of that specific Tranche. For example, the invoice for Upfront Payment 2 for Tranche 2 may be invoiced no earlier than 90 days before September 28, 2027;

Notwithstanding Section 3.2.b, Microsoft will pay invoices for these Upfront Payments within 15 days following the date of invoice.

iii.

The monthly installment amount for each GPU Service will be calculated by multiplying the number of GPUs in the GPU Service by the Price per GPU multiplied by the number of hours in the month, and multiplying by [***] to reflect the necessary adjustment given the payment of the Upfront Payment. Notwithstanding Clause 4(a) of the PO Terms, the Parties hereby agree that the Partner shall be entitled to invoice Microsoft monthly commencing upon one (1) day after Microsoft has accepted the GPU Service from Partner pursuant to the acceptance processes outlined in Section 2 (the “Billing Start Date” for that GPU Service) up until the end of the Service Term.

Except in respect of the Upfront Payment, Microsoft will pay all invoices within 30 days following the date of invoice.

Total Amounts are exclusive of value added tax, which will be included on each invoice, as applicable.

Payment Method: All payments must be made by Wire or ACH transfer.

Partner will be solely responsible for all expenses it incurs while performing the Services, unless Microsoft otherwise consents in writing.

Colocation Space Service Fee: Microsoft will pay a monthly fee of $[***] during the term of this SOW, starting when Microsoft gains access to the Colocation Space through the last Service End Date.

3.3 Early and Late Delivery

Late Delivery and Late Fees: If Partner becomes aware that a GPU Service item is likely to be delivered to Microsoft later than the applicable Delivery Date (as identified in Table 1), it will inform Microsoft (i) of such delay within 5 business days and (ii) of the anticipated date on which the item is likely to be delivered. Partner will continue to keep Microsoft informed of any further delays in delivery within 5 business days after Partner becomes aware of such delays.

If a GPU Service is not delivered by its Delivery Date, Partner will credit Microsoft 100% of the equivalent of a daily bill for each day after the Delivery Date that Partner has not handed off the GPU Service for acceptance testing in accordance with Section 2 (“Delay Credit”). For example, for a tranche of 1,000 GPUs, if the equivalent hourly bill rate is $[***]/hr, the daily credit for each day after the Delivery Date delayed will be calculated as: 1,000 GPUs*$[***]/hr *24hrs = $[***]/day. If such a delay is caused directly by Nvidia, and solely in that circumstance, Section 3.3.h will apply.

Microsoft will be entitled to set off the entirety of the Delay Credit for any Tranche against charges in the first invoice it receives from Partner (under Section 3.2) after Acceptance of that Tranche (and where the Delay Credit is larger than the charges in the first invoice, in one or more subsequent monthly invoices as needed until the entirety of the accrued Delay Credit is completely set off against fees owed by Microsoft).

GPU Service termination right: If: (i) a GPU Service has not been accepted within sixty (60) days following the Delivery Date; or (ii) Partner’s notifications to Microsoft make clear that a GPU Service, in Partner’s reasonable judgment, is not likely to be delivered within sixty (60) days following the Delivery Date, and Partner cannot deliver an equivalent capacity (as determined by Microsoft in its sole reasonable discretion) by the Delivery Date, Microsoft may elect to either terminate the GPU Service or agree to an Updated Delivery Date. For the avoidance of doubt, such right of termination shall be limited to the relevant GPU Service and shall not extend to any GPU Service or any other SOW between Microsoft and the Partner. Partner will continue to pay Delay Credits owed from the Delivery Date up until delivery, in accordance with Section 3.3.a.

Updated Delivery Date: If Microsoft has agreed to an Updated Delivery Date under Section 3.3.b and the applicable GPU Service is not delivered on or before the Updated Delivery Date, the GPU Service will be deemed terminated by Microsoft, unless the Parties agree otherwise in writing. For the avoidance of doubt, this Section 3.3.c only applies to Updated Delivery Dates that are later than 60 days after the original Delivery Dates set forth in Table 1.

Upfront Payment on Termination: If a GPU Service is terminated by Microsoft in accordance with either Sections 3.3.b or 3.3.c, then within 60 days of such termination, Partner will refund Microsoft the proportionate amount of the Upfront Payment that corresponds to the terminated GPU Service. The refund of the Upfront Payment shall be the sole remedy for the events described in Section 3.3.b and 3.3.c. The events described in Section 3.3.b or 3.3.c will not constitute a material breach subject to Section 14(i) of the PO Terms (as referenced in and replaced by Section 6.10 of the SOW).

Obligations: If a GPU Service is terminated by Microsoft, Microsoft will have no obligation to pay for the GPU Service.

Early Delivery: If Partner can deliver a GPU Service on an earlier date than the Delivery Date (the “Early Delivery Date”), then Partner may propose the Early Delivery Date to Microsoft at least 14 days prior to such Early Delivery Date. Microsoft shall have 3 business days from the date of Partner’s proposal to accept or reject such proposed Early Delivery Date. Microsoft’s acceptance or failure to respond within such 3 days shall constitute acceptance of the Early Delivery Date, which shall be deemed the Delivery Date of such GPU Service. In the event of Microsoft’s rejection within such 3 days, the Delivery Date of such GPU Service shall not change and the proposed Early Delivery Date shall not be valid. Alternatively, Microsoft may propose a date between the Early Delivery Date and the then current Delivery Date, which shall be deemed the new Delivery Date.

Phased delivery: Partner will not deliver a Tranche until all tranches with an earlier Delivery Date have been successfully merged with the existing production Tranche(s), to the extent such a merger is operationally practicable and required under the applicable SOW; provided that Partner can still deliver a Tranche early in the event there has not been a successful merging of previously delivered Tranches due to events outside of Partner’s reasonable control (including Microsoft’s failure to timely perform its obligations and responsibilities). A Tranche has been successfully merged with the existing production Tranche or Tranches if all Tranches in a given cluster are operating as a single compute cluster. For the avoidance of doubt, (i) any delivery delays arising out of Partner’s compliance with this Section 3.3.g will not trigger the terms (including, without limitation, Microsoft’s termination rights) described in Section 3.3, and (ii) such merger of Tranches shall not apply to the extent the Tranches are to be delivered under separate SOWs and/or in separate locations.

Delays Caused Directly by Nvidia. In the event that a GPU Service is not delivered by its Delivery Date and such delay is directly caused by NVIDIA, Partner will not be required to provide Microsoft Delay Credits in accordance with Section 3.3.a, provided that:

(i)

Partner has, within 60 calendar days of the SOW Effective Date, provided Microsoft with commercially reasonable evidence (e.g. an initial allocation confirmation) that it has placed binding orders with Nvidia for the purchase and delivery of a sufficient volume of the components needed in time for Partner to deliver the relevant GPU Service to Microsoft by its Delivery Date; AND

(ii)

NVIDIA has changed its supply commitments to Partner and Partner has provided written notice to Microsoft of such changes within 7 calendar days of Partner becoming aware of such changes; AND

(iii)

Partner has provided written notice under subsection (ii), above, at least 45 calendar days before the relevant Delivery Date.

In such circumstance (i.e. where (i), (ii), and (iii)) have all occurred):

(x) the parties agree to amend this SOW to extend the Service End Date for the relevant GPU Service such as to maintain the 6‑year weighted average duration across the GPU Services and the Total Tranche Value under this SOW; AND

(y) The number of days of delay directly attributable to Nvidia will be added to the 60‑day thresholds in Sections 3.3.b(i) and 3.3.b(ii).

Where Partner provides Microsoft with written notice under subsection (ii), above, Microsoft and Partner will promptly collaborate in good faith to engage with Nvidia to attempt to mitigate the impact of the potential delay.

In the event that Partner determines that it can deliver a GPU Service on an earlier date than the Delivery Date, Partner will promptly notify Microsoft and the parties will discuss in good faith potential adjustments to the requirements of Section 3.3.f (Early Delivery) and the effect that such early delivery will have on the Parties’ respective obligations under this SOW, including invoicing, payments, and SLAs.

Partner shall provide Microsoft with written weekly status reports detailing progress against the complete datacenter project plan for the Datacenter Location and delivery of the GPU Services, including milestones, timelines, risks, and mitigation actions. Each report shall include documentation evidencing and confirming that all required components, equipment, materials, and supplies have been ordered in accordance with the project plan, together with additional supporting documentation reasonably requested by Microsoft. Microsoft reserves the right, upon reasonable notice, to conduct datacenter site visits at any time to monitor progress and verify compliance with the project plan and this SOW.

3.4 Early Access Capacity Delivery

Partner will provide Microsoft with Early Access Capacity at a global location of Partner’s choosing at least sixty (60) days before the first GPU Service of a GPU Type or the first GPU Service after a mutually agreed Technology Change (as defined below) is delivered by Partner, provided that Partner will make best efforts to deliver the Early Access Capacity ninety (90) days before the applicable GPU Service delivery date. The Early Access Capacity is subject to the Supplier Validation and Acceptance Criteria outlined in Exhibit B and the acceptance process.

If Partner does not meet the Early Access Capacity delivery requirements in Section 3.4.a. above, Microsoft may, in its sole discretion, extend the GPU Service Delivery Date for the first GPU Service of a GPU Type or for the first GPU Service following a Technology Change, by the same number of days that the Early Access Capacity delivery was delayed (the new GPU Service Delivery Dates being the “Adjusted Delivery Date”). For example, if the Early Access Capacity is delivered fifty‑five days before a GPU Service Delivery Date for Tranche 1, Microsoft may push the GPU Service Delivery Date for Tranche 1 by 5 days. If this option is exercised:

Late fees will be calculated using the Adjusted Delivery Dates;

ii.

The Acceptance Period for the GPU Service will begin on the Adjusted Delivery Date;

iii.

The Billing Start Date will be one day after Acceptance by Microsoft; and

iv.

The GPU Service End Date for that GPU Service will be adjusted to preserve contract value.

If the Parties agree to switch the GPU type (e.g., VR200 to VR Ultra) or make another Technology Change for a GPU Service, Partner agrees to provide Early Access Capacity for the first GPU Service that incorporates this new GPU type or technology change and agrees to deliver that Early Access Capacity under the same terms as provided in Section 3.4.a and 3.4.b.

For purposes of this SOW, a “Technology Change” means a new GPU Type, changes in backend networking, changes in OEM/ODM, or changes in BMC or firmware in BMC.

3.5 Optional Services. During the Term, Microsoft may elect to consume Integrated Platform Services—including but not limited to managed Nscale Kubernetes Service (NKS), Slurm on Kubernetes (SLONK) orchestration, High‑Performance AI Storage, and Fleet Operations observability—as generally made available by Partner. Such services shall be provisioned via Order Form and billed on a monthly consumption basis in arrears at Partner’s then‑current rates or at such other rates agreed to by the parties.

4. Enhanced Ticketing Workflow & Monitoring

Supplier acknowledges Microsoft’s interest in providing necessary visibility to metrics and/or logs to enable Supplier’s monitoring solutions. To support this goal, Supplier commits to dedicating engineering resources to collaborate with Microsoft’s technical teams. This collaboration will begin with a joint discovery workshop, to be completed within ninety (90) days of the SOW Effective Date, with the objective of defining current‑state challenges and desired future‑state requirements. The output of this workshop will be a mutually agreed‑upon project plan that outlines the scope, timeline, and resource allocation for developing and implementing a streamlined solution.

5. Deployment Phase Project Governance and Communication

Project Delivery: Supplier is committed to maintaining optimal service availability and delivering product enhancements efficiently. Proactive and transparent communication will be provided regarding any technical issues or planned infrastructure changes, such as those to data center equipment, that may impact service availability. Furthermore, timely notifications will be issued concerning any potential feature or engineering delays, including details on the nature of the issue, its potential impact, and revised timelines. The goal is to minimize any potential disruption for Microsoft and enable effective planning through clear and anticipatory communication.


Commitment to Predictable Timelines	Supplier acknowledges that predictable, transparent, and reliable delivery is a critical success factor for Microsoft. Both parties will maintain a shared, end‑to‑end project timeline that includes built‑in buffers for key dependencies. This timeline will be reviewed weekly.
Proactive Risk Communication	Supplier commits to notifying Microsoft in writing within five (5) business days of identifying any significant risk that will likely impact a milestone delivery date. This notification will include a description of the risk, the potential impact, and a proposed mitigation plan.


Governance Structure	The parties will establish a formal governance plan, including weekly project status meetings, Monthly Business Reviews (MBRs), and a documented escalation matrix for critical P0 incidents (the “Red Button” protocol) documented in the Partner‑Microsoft RACI Chart (Exhibit C).
Status Reporting	Supplier will provide a written weekly status report to Microsoft detailing progress against milestones, risks, and upcoming activities.
Escalation Path	An escalation path for issue resolution will be documented in the Partner‑Microsoft RACI Chart (Exhibit C).

Public Announcement: Each of Microsoft and the Partner may make a public announcement (jointly or independently) in respect of the Services to be delivered under this SOW after the execution of this SOW, provide the contents of such announcement is mutually agreed by the parties.

Security Requirements: The Parties agree that upon Partner’s notification to Microsoft that it is prepared to assess security at the Data Center Location, the Parties will undertake a joint audit of the security requirements at the deployment site for the Services in order to assess compliance with Clause 15 of the PO Terms (“Security Audit”). Microsoft acknowledges and agrees that the indemnity given under Clause 21 (a)(2) of the PO Terms (as amended by this SOW) shall not apply to any claims relating to non‑compliance with Clause 15 of the PO Terms arising prior to the Delivery Date of the first GPU Service milestone.

6. Special Conditions

6.1 Relationship to Other Agreements

The Parties hereby agree that the PO Terms attached as Exhibit E shall be amended as set out below. In the event of any conflict or inconsistency between the PO Terms and the terms of this SOW (including without limitation this Clause 6 Special Conditions) then the terms of this SOW shall take precedence.

The Parties agree that Clause 2 of the PO Terms shall be disapplied for the purposes of this SOW. Without prejudice to the generality of the foregoing, the Parties agree that as at the date hereof neither the Parties (nor any of their Affiliates) have entered into a Microsoft Supplier Services Agreement.

6.2 Invoices

The Parties agree that following the Acceptance of the Cloud Services in accordance with Clause 2 (Acceptance Process) then the Cloud Services shall be deemed accepted for the full Term for the purposes of Clause 4(a) and 5(a) of the PO Terms.

The Parties agree that Clause 4(c) of the PO Terms shall be deleted and the following clause shall apply in its place:

“4.2(c) Microsoft may, acting in good faith, dispute any invoice by providing written notice to Partner within 30 calendar days of receiving the applicable invoice.”

6.3 Payment Terms, Cash Discounts, Offset and Expenses

The Parties agree that Clause 5(a) of the PO Terms shall be deleted and the following clause shall apply in its place:

“4.2(c) After Microsoft accepts the Goods, Services, Deliverables or Cloud Services and receives a correct and undisputed invoice, Microsoft will pay such invoice within 30 calendar days of receiving the applicable invoice.”

The Parties agree that Clause 5(d) of the PO Terms shall be disapplied for the purposes of this SOW and replaced with the following:

If Supplier is in breach of its obligation under this Agreement to apply undisputed service credits against the charges for the GPU Services, then Microsoft shall be entitled to set off such undisputed service credits against charges payable under this Agreement; provided that, for the avoidance of doubt, in no event shall Microsoft be entitled to set off any such undisputed service credits against future Upfront Payments. Microsoft will provide notice to Supplier within a reasonable time after the set‑off.

6.4 Taxes

The Parties agree that Clause 6 (Taxes) of the PO Terms shall be supplemented with the following subsection e.:

“e. 1) Microsoft will take into account applicable duly executed tax forms delivered by Supplier or an applicable Affiliate (such as any IRS Forms W9 or W‑BEN E (evidencing the entitlement of Supplier or its applicable Affiliate to an exemption from, or reduction in the rate of withholding under an applicable income tax treaty)), (2) Microsoft acknowledges that the character of the Supplier’s performance of its obligations hereunder involves the performance of services and Microsoft will reasonably take into account information regarding the place of performance of such services provided to it by Supplier outside the United States, and (3) in the event of any change in Law which results in a requirement on Microsoft to withhold any taxes then the Parties shall discuss in good faith the possibility of any mitigations.”

6.5 Inspection and Acceptance

The Parties agree that Clause 7 (Inspection and Acceptance) of the PO Terms shall be disapplied for the purposes of this SOW and the Acceptance Process shall be as set out in Clause 2 (Acceptance Process) of this SOW.

6.6 Changes

The Parties agree that Clause 9 (Change) of the PO Terms shall be deleted and the following clause shall apply in its place:

Notwithstanding anything to the contrary, any amendment or variation to this SOW or the PO Term shall only be effective if in writing and signed by both the parties.

6.7 Tools and Equipment

The Parties agree that Clause 10 (Tools and Equipment) of the PO Terms shall be deleted and the following clause shall apply in its place:

“10. Notwithstanding any other term of the agreement (including without limitation this SOW and the PO Terms), Microsoft acknowledges and agrees that Partner (and/or its licensors (as applicable)) shall retain all rights, title and interest in and to the Infrastructure. Nothing in the agreement (including without limitation this SOW and the PO Terms) shall be construed to grant or convey to Microsoft (and/or any Authorised User) any ownership interest in the Infrastructure. The Parties respectively acknowledge that the agreement provides solely for the provision and use of the Services (including use of the Infrastructure), as expressly set out in this SOW and the PO Terms.

For the purpose of this Section, “Infrastructure” means processing, servers, GPUs, storage, networks, systems, tools, data centre facilities, hardware, and/or other fundamental computing resources used by Partner to provide the Services in accordance with the SOW and the PO Terms.

Partner shall in its discretion, acting reasonably, and in accordance with good industry practice, determine the means and methods for the physical configuration, operation, preventative maintenance, and repair of the Infrastructure, in compliance with the SLA and subject to the SOW and the PO Terms.”

6.8 Ownership and Use of the Parties Respective IP

The Parties agree that Clause 12(c) to shall be deleted and replaced by the following clause:

12.c. Supplier grants to Microsoft and its affiliated companies (including their employees, contractors, consultants, outsourced workers, and interns engaged by Microsoft or any of its affiliated companies to perform services), their Customers, and each of their end users (if any), to the limited extent necessary to the performance of the Cloud Services, a worldwide, nonexclusive, unlimited, non‑assignable paid‑up and royalty free right to access and use, during the term, Cloud Services, in each case for their business purposes. Access to the Cloud Services is unlimited unless otherwise specified in a SOW.

The Parties agree that the definition of “Microsoft Materials” as set out in the first sentence of Clause 12.i(1) of the PO Term shall be deleted and replaced by the following:

“(1) Supplier may use “Microsoft Materials”, meaning any tangible or intangible materials, provided by or on behalf of Microsoft, any of its affiliated companies, or their respective end users, to Supplier to perform Services, Deliverables, or Cloud Service.”

For the avoidance of doubt, for the purposes of this SOW and Clause 12 of the PO Term, the Parties acknowledge and agree that the Partner shall provide Cloud Services only, and not Goods or other Deliverables.

6.9 Representations and Warranties

The Parties agree that Clause 13(a) of the PO Terms shall be deleted and replaced by the following provision:

“13.a. Each Party represents and warrants that it has the full rights and authority to enter into, perform under, and grant the rights according to these PO Terms and its performance will not violate any agreement or obligation between it and any third party.”

The Parties agree that Clause 13(b) of the PO Terms shall be deleted and replaced by the following provision:

“13.b. Supplier represents and warrants that Services will be performed professionally consistent with industry standard;”

The Parties agree that Clause 13(c) of the PO Terms shall be deleted and replaced by the following provision:

“13.b. Supplier represents and warrants that the Cloud Services will be provided in accordance with the Service Level Agreement.”

The Parties agree that Clause 13(g) of the PO Terms shall be deleted and replaced by the following provision:

“13.g. Each Party will comply with all Laws, rules, and regulations, including Data Protection Law (as defined in Exhibit A of the PO Terms), and Anti‑Corruption Laws (i.e., all Laws against fraud, bribery, corruption, inaccurate books and records, inadequate internal controls, and/or money‑laundering, including the U.S. Foreign Corrupt Practices Act), whether local, state, federal or foreign relating to such Party in connection with these PO Terms and the SOW. The Goods, Services, Deliverables, Cloud Services, parts, components, devices, software, technology, and other materials provided under these PO Terms (collectively, “Items”) may be subject to applicable trade laws in one or more countries. Each Party will comply with all relevant laws and regulations applicable to the import or export of the Items, including but not limited to, trade laws and regulations such as the U.S. Export Administration Regulations or other end‑user, end use, and destination restrictions by the U.S. and other governments, as well as sanctions regulations administered by the U.S. Office of Foreign Assets Control (“Trade Laws”). Supplier agrees to provide Microsoft with the import/export control classifications and information, including documentation, on the applicable import, export, or re‑export authorizations, and all necessary information about the Items for any required import, export or re‑export procedures and/or licenses, without additional cost to Microsoft. For additional information, see https://www.microsoft.com/en us/exporting. “Law” means all applicable laws, rules, statutes, decrees, decisions, orders, regulations, judgments, codes, enactments, resolutions, and requirements of any government authority (federal, state, local, or international) having jurisdiction;”

The Parties agree that Clause 13(h) of the PO Terms shall be deleted and replaced by the following provision:

“13.h Each Party will comply with all applicable Anti‑Corruption Laws. While performing under these PO Terms, Supplier will provide training to its employees on compliance with Anti‑Corruption Laws and, upon request by Microsoft, will complete Microsoft’s standard online training for supplier compliance with Anti Corruption Laws; and”

6.10 Termination

Clause 14 (Termination) of the PO Terms shall be deleted and replaced by the following provision:

“14.Termination

Termination by Either Party for Cause: Without affecting any other right or remedy available to it, either Party may terminate any SOW with immediate effect by giving written notice to the other Party if the other Party:

(i) commits a material breach of any terms of the SOW, which breach is irremediable or (if such breach is remediable) fails to remedy that breach within sixty (60) days after being notified in writing to do so; or

(ii) the other Party suspends or ceases carrying on its business or a substantial part thereof, or suffers an Insolvency Event. For the purpose of this Clause 14.a.ii and the SOW, “Insolvency Event” means with respect to a Party, (a) entering into a composition or arrangement with its creditors other than for the sole purpose of a solvent reconstruction; (b) an inability to pay its debts as they become due; (c) suspends or threatens to suspend making payments on any of its debts; (d) the value of the assets of the Party is less than its liabilities (taking into account contingent and prospective liabilities); (e) a person becoming entitled to appoint or appointing a receiver or an administrative receiver over that Party’s assets; (f) a creditor or encumbrancer attaches or takes possession of the whole or any part of that Party’s assets which is not discharged within 14 days; or (g) any corporate action, legal proceedings or other procedure or step is taking in relation to: (i)

the suspension of payments, a moratorium of any indebtedness, winding‑up, dissolution, administration or reorganisation (by way of voluntary arrangement, scheme of arrangement or otherwise); or (ii) the appointment of a liquidator, receiver, monitor, administrative receiver, administrator, compulsory manager or other similar officer in respect of any Party or any of its assets; or (h) any event occurs, or proceeding is taken, in any jurisdiction that has an effect equivalent or similar to any of the events mentioned in (a) to (g) above; or

(iii) a Party assigns, transfers or novates this SOW in contravention of Clause 26 (Assignment) without the prior written consent of the other Party, provided that such right to terminate must be exercised within 30 days of the assigning party providing notice of the assignment to the other party (after which time, this termination right shall lapse).

6.11 Security, Privacy, Artificial Intelligence and Data Protection

Clause 15.d of the PO Terms shall be deleted and replaced by the following provision:

Supplier will comply with (i) the privacy and data protection requirements in Exhibit A of the PO Terms if Supplier processes Personal Data on behalf of Microsoft and (ii) the security terms in Exhibit D of the GPU Services SOW. The parties agree that Supplier shall not process any Personal Data on behalf of Microsoft in connection with the Agreement and Microsoft shall not provide any such Personal Data to Supplier, unless as specifically requested by Microsoft and agreed by Supplier, and Supplier shall not provide any Personal Data to Microsoft to handle unless specifically requested by Supplier and agreed by Microsoft.

Clause 15.e of the PO Terms shall be deleted and replaced with the following provision:

Supplier will not use any AI System in connection with or incorporate any AI System into the Goods, Services, Cloud Services, or any Deliverable. “Al System” means an engineered system that applies an optimized model so that the system can, for a given set of human‑defined objectives, make predictions, recommendations, or decisions influencing the environments it interacts with. AI Systems include AI Models.

6.12 Insolvency, Limitations of Liability

The Parties agree that Clause 19 (Insolvency; Limitations of Liability) of the PO Terms shall be deleted and replaced by the following provision:

“19. Limitations of Liability

Exclusions of Consequential and Related Damages: Except with respect to each Party’s indemnification obligations provided in Sections 21.a and 21.c, in no event shall either Party be liable for any consequential, indirect, special, incidental, contingent, punitive or exemplary damages (whether foreseeable or unforeseeable), loss of or corruption of data, loss of revenue, loss of profits, loss or depletion in goodwill, however caused and, whether arising under contract, tort (including negligence) breach of statutory duty or otherwise, whether or not the Party has been advised of the possibility of such damages. The foregoing exclusions will not apply to the extent prohibited by Applicable Law.

General Limitation: Subject to Clause 19. a and 19.c, each Party’s total liability to the other, whether in contract, tort (including negligence), breach of statutory duty or otherwise arising under or in connection with a SOW, shall not exceed, in aggregate for each SOW, an amount equal to one fifth (1/5) of the Service Fees owed under this SOW, as provided in Clause 3.2.

General Exclusions: Nothing in these PO Terms, including Clauses 19.a or 19.b, excludes or limits either Party’s liability for:

death or personal injury caused by its negligence or wilful misconduct of a Party;

ii.

fraud or fraudulent misrepresentation;

iii.

Supplier’s or Microsoft’s payment obligations (including without limitation Microsoft’s obligation to pay the Service Fees under Clause 4.2.c of these PO Terms and the SOW.

iv.

a breach of its confidentiality obligations under Clause 23;

for any liabilities that cannot be excluded under Applicable Law; or

vi.

infringement of intellectual property rights.

Indemnity Limitation: In addition to the General Limitation under Clause 19.b, each Party’s total liability to the other arising under or in connection with Clause 21 (Indemnification and Other Remedies) shall not exceed, in aggregate, an amount equal to one fifth (1/5) of the Service Fees owed under the SOW, as provided in Clause 3.2.

6.13 Subcontracting

The Parties agree that Clause 20 (Subcontracting) of the PO Terms shall be deleted and replaced by the following provision:

“20. Supplier will be entitled to subcontract to any third party to furnish any Goods, Services, Deliverables, or Cloud Services without Microsoft’s prior written consent. If Supplier subcontracts any Services or Cloud Services to any subcontractor, Supplier will be fully liable to Microsoft for any actions or inactions of subcontractor, remain subject to all obligations under these PO Terms and require the subcontractor to agree in writing to terms with Supplier no less onerous than the security and privacy and data protection terms in Section 15 of these PO Terms and Exhibit A of the PO Terms.”

6.14 Indemnification and Other Remedies

The Parties agree that Clause 21 (Indemnification and Other Remedies) of the PO Terms, subsection (a) shall be deleted in its entirety and replaced with the following:

“21 Indemnification and Other Remedies

Supplier Indemnity: Supplier will defend, indemnify and hold harmless Microsoft and Microsoft affiliates companies against all claims, demands, loss, costs, damages, and actions for: (1) actual or alleged infringements of any third‑party IP or IP rights or Microsoft IP or IP Rights, which arise from the Goods, Services, Deliverables, or Cloud Services provided under these PO Terms; (2) any breach of Section 15, Exhibit A, or any Supplier warranty contained therein that occurs after delivery of the first GPU Service milestone under the SOW; (3) any act or omission of or failure to comply with tax obligations or tax law by Supplier or Supplier’s agents, employees or subcontractors; (4) any breach by Supplier or its subcontractors of any artificial intelligence, confidentiality, or privacy, data protection, or publicity obligations under these PO Terms in connection with Supplier’s provision of the Services; (5) the negligent of willful acts of Supplier or its subcontractors, which result in any bodily injury, including mental injury, or death to any person or loss, disappearance or damage to tangible or intangible property; and (6) any claims of its employees, affiliated companies or subcontractors regardless of the basis

including but not limited to the payment of settlements, judgments and reasonable attorney’s fees.

The parties agree that the second sentence of Section 21.b will be deleted in its entirety and replaced with the following:

“If Supplier does not comply with this Section 21(b), then in addition to any amounts reimbursed under this Section 21 (Indemnification and Other Remedies), Supplier will pay reasonable costs to transition Services and Cloud Services to a new supplier.”

The parties agree that Section 21 will be supplemented with the following subsections c. and d.:

Microsoft Indemnity: Microsoft will defend, indemnify and hold harmless Supplier and Supplier affiliates companies against all claims, demands, loss, costs, damages, and actions for: (1) actual or alleged infringements of any third‑party intellectual property rights, which arise from the use of the Microsoft Materials in accordance with these PO Terms; (2) any breach by Microsoft of the confidentiality obligations under these PO Terms; (3) the negligent or willful acts or omissions of Microsoft or its subcontractors, which results in any personal injury, or death to any person or loss, disappearance or damage to tangible or intangible property.

Indemnification Process: The indemnified Party will:

upon becoming aware of a claim giving rise to an indemnity under these PO Terms, promptly notify the indemnifying Party in writing of such claim or allegation, setting forth in reasonable detail the facts and circumstances surrounding the claim; and

ii.

give the indemnifying Party sole control of the defense of any such claim or allegation and any related settlement negotiations, provided that an indemnified Party may participate in its defence at its own cost and expense, and shall not make any admission of liability or take any other action that limits the ability of the indemnifying Party to defend or settle the claim; and

iii.

provide reasonable co‑operation to the indemnifying Party in the defense and settlement of such claim, at the indemnifying Party’s expense.

6.15 Insurance

The following wording at the end of Clause (22) of the PO Terms shall be deleted:

Supplier must obtain Microsoft’s prior written approval for any deductible or retention in excess of $100,000 USD per occurrence or accident.

6.16 Independent Development

The following additional wording shall be inserted at the end of Clause 24 (Independent Development) of the PO Terms:

Nothing in these PO Terms restricts Supplier’s ability to, directly or indirectly, license, develop, manufacture, or distribute, same or similar technology or services to the Goods, Services, Deliverables, or Cloud Services contemplated by these PO Terms to third parties other than Microsoft.

6.17 Assignments

Clause 26 (Assignments) of the PO Terms shall be deleted and replaced by the following provision:

“Clause 26 Assignments

No right or obligation under these PO Terms will be assigned by Supplier without the prior written consent of Microsoft. Notwithstanding the foregoing, Supplier may assign, transfer or novate any of its rights or obligations under these PO Terms to (i) its external financiers pursuant to any loan or other debt financing obtained by Supplier, and (ii) an affiliate of Supplier, provided Microsoft is given advance notice and such assignment at the time thereof will not cause a disruption to the provision of Services to Microsoft.

Microsoft may assign, transfer or novate its rights and obligations under these PO Terms and any applicable SOW, provided that (i) the transferee shall be (x) an investment grade counterparty (as rated by S&P, Fitch or Moody’s) and sufficiently capitalized relative to the Services being transferred as measured by credit rating or other generally accepted indicators, and (y) not subject to trade compliance restrictions or other prohibitions which would materially and adversely impact Supplier’s ability to provide the Services as contemplated under these PO Terms and any applicable SOW; or (ii) if the assignment, transfer or novation is made to an affiliate of Microsoft Corporation (a “Microsoft Affiliate”), clause (i) above shall not apply, provided that Microsoft Corporation guarantees the payment obligations of Microsoft Affiliate under these PO Terms and the applicable SOW for the benefit of Supplier.

Any assignment in contravention of this Clause 26 will be void. For the avoidance of doubt, any Change of Control of a party shall not constitute an assignment for the purposes of this Clause 26. For the purposes of this Clause 26.c.:

“Change of Control” means: (i) a sale of all or substantially all of the assets or undertakings of Supplier; (ii) a sale resulting in a change of more than 50% of the voting power of the equity shares of Supplier; or (iii) a capital raise, merger, consolidation, recapitalization, or reorganization of Supplier with or into any third party.

ii.

Notwithstanding anything to the contrary in this Section 26.c, if a Change of Control results in a Restricted Party holding greater than 50% of the voting power of the Supplier or an ability to control the management of the Supplier, then Supplier must promptly provide notice to Microsoft, and within 30 days of receiving such notice, Microsoft will either consent to the Change of Control or terminate this Agreement. If Microsoft does not provide a decision within 30 days of receiving such notice, then it will be deemed to have consented to the Change of Control.

iii.

“Restricted Party” means Amazon, Google, Tencent or Alibaba (or any of their respective affiliates).

In addition to clauses a. through c. above, Supplier and any assignee may pledge, assign, collaterally assign, convey, or grant a lien or security interest in its right, title and interest in and to all or any portion of this SOW, the receivables and other payments due hereunder and proceeds thereof, including pursuant to any loan or other debt financing obtained by Supplier, any affiliate, or any assignee, from one or more third‑party debt financing sources. In addition, Microsoft acknowledges and agrees that Supplier and any secured party in respect of the financing described above may and is authorized to, in its sole and absolute discretion, file one or more UCC‑1 financing statements (and amendments thereto and continuations thereof from time to time) describing the Agreement and the receivables and other payments due hereunder and proceeds thereof, which may include precautionary UCC financing statements.

6.18 Force Majeure

A new Clause 27A (Force Majeure) shall be inserted after Clause 27 (Notice of Labour Disputes) as follows:

“Clause 27A Force Majeure

Neither party will be liable during any period where a Force Majeure Event occurs.

For the purposes of this Clause 27A, “Force Majeure Event” means an unforeseeable event, beyond the control of the parties, not caused by the gross negligence or intentional misconduct of the party claiming a Force Majeure event, and which could not have been avoided by the party’s use of due care (i.e. the exercise of skill, diligence, and prudence that would be reasonably and ordinarily expected from a skilled and experienced person engaged in the same type of undertaking under the same or similar circumstances). Examples include acts of God, natural disasters (flood, fire, earthquakes), war, epidemic, pandemic, civil disturbance, action by a governmental entity, acts of terror, strikes, or network or device failure external to the respective datacenter and that is not within the control of the party claiming a Force Majeure Event. For clarity, Hardware Failures (defined in Exhibit A of the SOW) and delays caused by hardware suppliers are not, in and of themselves, Force Majeure Events.

6.19 Reserved

6.20 Patent License

The Parties agree that Clause 28 (Patent License) of the PO Terms shall be deleted.

6.21 Jurisdiction and Governing Law

The first sentence of Section 29 of the PO Terms shall be deleted and replaced with the following:

This SOW shall be governed and construed in accordance with the laws of England and Wales.

7. [RESERVED]

8. Access to the Services and Usage Guidelines

Acceptable Use Policy: Microsoft shall ensure that it and its end users’ use of the Cloud Services will not violate the Acceptable Use Policy, including the Usage Guidelines below, or any applicable Law.

Usage Guidelines: Microsoft shall not, and shall not attempt to:

access, use or permit the use of all or any part of the Cloud Services for any unauthorized (per these Usage Guidelines) or unlawful purpose;

ii.

reverse engineer, decompile, disassemble the Cloud Services;

iii.

use Cloud Services to store or send content:

containing malicious code or malware;

which is threatening, illegal or fraudulent, false, deceptive or promotes bigotry, racism, abuse, hatred, harassment or harm against any individual or group;

which violates privacy rights (including but not limited to the Data Protection Legislation), or constitutes an infringement of intellectual property or other proprietary rights; or

is otherwise unlawful or tortious intended to damage any system or data or cause damage or injury to any person or property;

iv.

use the Cloud Service for crypto mining, or operating a coin service, exchange or other service for the purposes of generating, distributing, or transacting in digital currencies;

circumvent, disable, bypass or interfere with security‑related features of the Cloud Services;

vi.

conduct any high‑risk activities or critical applications requiring fail‑safe performance, such as the operation of nuclear facilities, air traffic control or other transportation systems, or life support systems, where the use or failure of the Cloud Services could lead to death, personal injury, or severe physical or environmental damage;

vii.

to provide services to any countries or regions that are subject to any embargoes imposed by applicable Law or any end‑user who it knows or has reason to know will utilize them in the design, development or production of weapons or intended for military or military‑intelligence end‑use; or

viii.

except as authorized under Exhibit D, perform any security testing of any facilities used to provide the Services without Supplier’s prior written consent.

[The remainder of this page is intentionally left blank.]

Omitted Schedules

Exhibits A, B, C, D and F to this exhibit, which are described above, have been omitted pursuant to Item 601(a)(5) of Regulation S‑K because they do not contain information material to an investment or voting decision and that information is not otherwise disclosed in this exhibit or the disclosure document. The registrant will furnish supplementally copies of Exhibits A, B, C, D and F to the Securities and Exchange Commission or its staff upon request.

Exhibit A – Service Level Agreement and Support Addendum

[***]

Exhibit B – Supplier Validation and Acceptance Criteria

[***]

Exhibit C – RACI, Severity Definitions, Incident Response Times and Escalation Matrix

[***]

Exhibit D – GPU as a Service Security Standards

[***]

Exhibit E – PURCHASE ORDER TERMS AND CONDITIONS

[See over page]

Microsoft Corporation Purchase Order Terms & Conditions (“PO Terms”)

Acceptance and Effect. These PO Terms are between Microsoft Corporation or any of its US subsidiaries (“Microsoft”) and the supplier identified in the applicable SOW (“Supplier”) and cover:

“Cloud Services”: the services, websites (including hosting), solutions, platforms, and products that Supplier makes available under or in relation to these PO Terms, including the software, mobile apps, equipment, technology, and services necessary for Supplier to provide the foregoing.

“Deliverables”: all work product developed by Supplier (or Supplier’s approved subcontractor) for Microsoft as part of the delivery of Goods, Services or Cloud Services, including intellectual property (“IP”) in connection with these PO Terms. Deliverables are “work made for hire” for Microsoft as that term is defined under copyright law.

“Goods”: software and/or tangible goods licensed or purchased by Microsoft under these PO Terms.

“Services”: professional services, advertising, consulting services, and support and maintenance services purchased by Microsoft under these PO Terms.

“SOW” means any of the following: (1) Microsoft purchase orders; (2) statements of work or other order forms signed by both parties’ authorized representatives; or (3) written agreements signed by both parties’ authorized representatives referencing, and subject to, these PO Terms.

These PO Terms are effective upon Supplier’s commencement of performance or the date of Supplier’s signature on the applicable SOW, whichever is earlier. Except as set forth in Section 2 below, Supplier’s acceptance of these PO Terms is expressly limited to these terms and conditions without counterproposal.

Relationship to Other Agreements. The terms and conditions of these PO Terms are the complete and binding agreement between Microsoft and Supplier except:

If the parties mutually executed an agreement, such as a Microsoft Supplier Services Agreement, which is effective on the date of these PO Terms and applies to the Goods, Services, Deliverables, or Cloud Services ordered with these PO Terms, and that agreement applies to the relationship of the parties governed by these PO Terms, then the provisions of such agreement are incorporated. If a conflict arises between these PO Terms and such agreement, to the extent of that conflict, the terms of such agreement will apply. For the purposes of these PO Terms, online terms or agreements that Microsoft accepts to login or access Goods, Services, Deliverables, or Cloud Services, such as installed applications, embedded software, software as a service, or a platform, are not an agreement that has been “mutually executed” and will not replace, supplement or amend the terms in these PO Terms in any way.

If multiple agreements with similar or contradictory provisions could apply to these PO Terms, the parties agree the terms most favorable to Microsoft will apply, unless the result would be unreasonable, unconscionable, or prohibited by law.

Except as stated above in this Section 2, and other than changes described in Section 9 and the Termination provisions in Section 14, additional or different terms (for example, online terms or agreements) will not supersede these PO Terms unless the parties mutually execute a written document.

Packing, Shipment and Returns of Goods or Deliverables. Unless specifically provided in these PO Terms:

Packing.

(1)

Price based on weight will include net weight only.

(2)

Supplier will not charge Microsoft for packaging or pre‑shipping costs, such as boxing, crating, handling damage, drayage, or storage.

Shipping.

(1)

Supplier will mark all containers with necessary handling and shipping information, PO number(s), date of shipment, and names of the consignee and consignor.

(2)

An itemized invoice and packing list, and other documentation required for domestic or international transit, regulatory clearance or identification of the Goods or Deliverables will accompany each shipment.

(3)

Microsoft will only pay for the quantity received, not to exceed the maximum quantity ordered.

(4)

Microsoft or its agent will hold over‑shipments at Supplier’s risk and expense for a reasonable time awaiting Supplier’s shipping instructions.

(5)

Microsoft will not be charged for shipping or delivery costs.

(6)

Unless otherwise agreed, Goods and Deliverables will be delivered on the 10th day after the purchase order date:

(1)

FOB to the Microsoft designated delivery location if the Goods and Deliverables originate in the same jurisdiction as the Microsoft designated delivery location; or

(2)

DDP (Incoterms 2010) to the Microsoft designated delivery location for cross border delivery of Goods and Deliverables to the Microsoft designated delivery location.

(7)

Supplier will bear all risk of loss, damage, or destruction to the Goods or Deliverables, in whole or in part, occurring before final acceptance by Microsoft at the designated delivery location. Microsoft is responsible for any loss caused by the gross negligence of its employees before acceptance.

Returns. Supplier will bear the expense of return shipping charges for over‑shipped quantities or rejected items.

Invoices.

Unless otherwise agreed, Supplier will invoice Microsoft monthly in arrears and only for accepted Goods, Services, Deliverables, and Cloud Services.

Supplier will invoice Microsoft as per instructions received in their PO email notification. Therefore, Supplier will invoice Microsoft:

•

Either using SupplierWeb (microsoft.com);

•

Or, using the SAP Business Network Supplier for purchase orders sent via Ariba.

The Microsoft invoicing process is an electronic invoice submission process. MS Invoice (https://einvoice.microsoft.com) is a web‑based application, provided by Microsoft to its payees, which allows payees to submit electronic invoices directly to Microsoft. The MS Invoice tool supports electronic invoice submissions on a one‑on‑one basis or via mass upload if there are multiple invoices. Payee should contact the Microsoft Accounts Payable Help Desk at https://www.microsoft.com/en‑us/procurement/contracting‑apsupport.aspx with any questions or utilize the self‑help sections within SupplierWeb or the SAP Business Network for invoice guidance. Invoices must contain the following information: PO number, item number, description of item, quantities, unit prices, extended totals, packing slip number, shipping, ship to city and state, taxes, and any other information reasonably required by Microsoft. Supplier will not charge Microsoft for researching, reporting on, or correcting any errors relating to its invoices.

Microsoft may dispute any invoice by providing written notice or partial payment. Microsoft will make commercially reasonable efforts to notify Supplier in writing of any disputed amount within 60 days of receiving the applicable invoice. Neither failing to provide notice nor payment of an invoice is a waiver of any claim or right.

Payment Terms, Cash Discounts, Offset, and Expenses.

After Microsoft accepts the Goods, Services, Deliverables, or Cloud Services and receives a correct and undisputed invoice (the “Create Date”), Microsoft will release payment by net 10 days less a 2% discount on the invoiced amount or by net 60 days with no discount if Microsoft does not issue payment within 10 days following the Create Date.

Microsoft is not obligated to pay any invoice received from Supplier more than 120 days after Microsoft accepts the Goods, Services, Deliverables, or Cloud Services.

Payment of an invoice will not constitute acceptance under these PO Terms, and is subject to adjustment for errors, shortages, defects, or other failure of Supplier to meet the requirements of these PO Terms.

Microsoft may set‑off amounts owed to Microsoft against an amount Microsoft owes Supplier or Supplier’s affiliated companies. Microsoft will provide notice to Supplier within a reasonable time after the set‑off.

Unless otherwise agreed, Supplier is responsible for all expenses incurred providing the Goods, Services, Deliverables, or Cloud Services and performing under these PO Terms.

Taxes.

Except as otherwise provided below, the amounts to be paid by Microsoft to Supplier do not include taxes. Microsoft is not liable for any taxes that Supplier is legally obligated to pay, including net income or gross receipts taxes, franchise taxes, and property taxes. Microsoft will pay Supplier any sales, use or value added taxes it owes due to these PO Terms and which the law requires Supplier to collect from Microsoft.

Microsoft will not be involved in the importation of the Goods, Services, Deliverables, or Cloud Services, and import taxes are the responsibility of the Supplier unless otherwise agreed in a SOW.

If Microsoft provides Supplier a valid exemption certificate, Supplier will not collect the taxes covered by such certificate.

If the law requires Microsoft to withhold taxes from payments to Supplier, Microsoft may withhold those taxes and pay them to the appropriate taxing authority. Microsoft will deliver to Supplier an official receipt for such taxes. Microsoft will use reasonable efforts to minimize any taxes withheld to the extent allowed by law.

Inspection and Acceptance.

Microsoft may cancel these PO Terms or the applicable SOW if Supplier fails to comply with the standards and specifications in these PO Terms.

All Goods and Services will be subject to Microsoft’s inspection and testing, at any time and place, including the period of manufacture and before final acceptance. If Microsoft inspects or tests at Supplier’s premises, Supplier, without additional charge, will provide all reasonable facilities and assistance for the safety and convenience of Microsoft’s inspectors. No inspection or testing done or not done before final inspection and acceptance will relieve the Supplier from responsibility for defects or for other failure to meet the requirements of these PO Terms.

If any item provided under these PO Terms is defective in materials or workmanship or not in conformity with the requirements, then Microsoft may reject it without correction, require its correction within a specified time, accept it with an adjustment in price, or return it to Supplier for full credit. When Microsoft provides notice to Supplier, Supplier will promptly replace or correct, at their expense, any item rejected or requiring correction. If, after Microsoft’s request, Supplier fails to promptly replace or correct a defective item within the delivery schedule, Microsoft may, at its sole option: (1) replace or correct such item and charge the cost to Supplier; (2) without further notice terminate these PO Terms or the applicable SOW for default, return the rejected item to Supplier at Supplier’s expense and Supplier will promptly refund any amounts paid by Microsoft for the returned item; or (3) require a reduction in price.

Notwithstanding any prior inspections or payments made, all Goods and Services will be subject to final inspection and acceptance at Microsoft’s designated location within a reasonable time after delivery or performance. Records of all inspection work will be complete and available to Microsoft during performance of these PO Terms and for such further period as Microsoft determines.

Additional Cloud Services Requirements.

Service Levels. Supplier will schedule any Cloud Services upgrades or maintenance during the Maintenance Window defined in the applicable SOW. Supplier will provide Cloud Services in accordance with the service levels and terms specified at https://aka.ms/CS SLA (or any successor link), which is deemed part of documentation (e.g., specifications) and incorporated and made part of these PO Terms.

Business continuity. Supplier will be responsible for establishing, implementing, testing, and maintaining an effective enterprise‑wide business continuity program (including disaster recovery and crisis management procedures) to provide continuous access to, and support for, the Cloud Services to Microsoft. At a minimum, Supplier must, at all times: (1) back up, archive and maintain duplicate or redundant systems that: (i) are located at a secure physical location (other than the location of primary system(s) used to provide Cloud Services); (ii) are updated and tested at least annually; and (iii) can fully recover the Cloud Services and all Microsoft Materials on a daily basis; and (2) establish and follow procedures and frequency intervals for transmitting backup data and systems to Supplier’s backup location. On request, Supplier will provide Microsoft with an overview of Supplier’s enterprise business continuity program and will promptly and in good faith provide written responses to Microsoft’s inquiries in connection with that program to enable Microsoft to review the adequacy of the program.

Transition. If the applicable SOW terminates or expires, or if Microsoft requests in writing, Supplier will provide: (1) backup media to Microsoft (as reasonably requested by Microsoft) containing all Microsoft Materials (unless the Cloud Services provide this as a self‑service function to Microsoft); and (2) all assistance Microsoft reasonably requires (at Microsoft’s expense) to timely and smoothly transition from the Cloud Services.

Changes. Microsoft may suspend Supplier’s performance, increase or decrease the ordered quantities, or make changes for Microsoft’s reasonable business needs (each, a “Change Order”), by written notice to Supplier, including via e‑mail, and without any notice to Supplier sureties, subcontractors, or assignees. Unless mutually agreed, a Change Order does not apply to change the Goods and Services timely and fully delivered before the date of the Change Order. If any change causes an increase or decrease in the cost of, or the time required for, Supplier’s performance, an equitable adjustment may be made in the price or delivery schedule or both, if Microsoft agrees to such adjustment in writing.

10.

Tools and Equipment. All tools, equipment or materials acquired by Supplier for use in providing the Goods and Services, which have been furnished to, paid for by or charged against Microsoft, including specifications, drawings, tools, dies, molds, fixtures, patterns, hobs, electrodes, punches, artwork, screens, tapes, templates, special test equipment, gauges, content, data, and software, will remain or become Microsoft’s property, treated as Microsoft Confidential Information, and delivered in good condition, normal wear and tear excepted, by Supplier to Microsoft’s designated delivery location per Section 3, immediately upon demand and without cost to Microsoft. Supplier warrants the item(s) and information will not be used for any work or production of any materials or parts other than for Microsoft, without Microsoft’s prior written permission. Supplier will identify for Microsoft all third‑party IP or software used in conjunction with the Services.

11.

Reports. Upon request from Microsoft, Supplier will promptly provide Microsoft with a Software Bill of Materials (“SBOM”) for all software provided under these PO Terms. Each SBOM will meet the minimum requirements established by the U.S. Department of Commerce or otherwise set forth by Law.

12.

Ownership and Use of the Parties’ Respective IP.

Each party will own and retain all rights to its pre‑existing IP and any IP developed independently of the Goods, Services, Deliverables, and Cloud Services under these PO Terms, including any of such party’s IP rights therein.

Microsoft will own all Deliverables, including all IP rights, all media in any format, hardware, and other tangible materials created by Supplier while delivering the Services. Any Supplier work which is a written or customized product or report related to, or to be used in, a Deliverable is regarded as IP.

If Deliverables do not qualify as a work made for hire, Supplier assigns to Microsoft all right, title, and interest in and to the Deliverables, including all IP rights. Supplier waives all moral rights in Deliverables.

If Supplier uses any Supplier or third‑party IP in any Good or Service, Supplier will continue to own Supplier’s IP rights. Supplier will grant Microsoft a worldwide, nonexclusive, perpetual, irrevocable, royalty‑free, fully paid up right and license, under all current and future IP rights, to use Supplier’s and third‑party IP consistent with Microsoft’s ownership interests under this Section 12.

Supplier grants to Microsoft and its affiliated companies (including their employees, contractors, consultants, outsourced workers, and interns engaged by Microsoft or any of its affiliated companies to perform services) a worldwide, irrevocable, nonexclusive, perpetual, paid‑up and royalty free license for any Goods that include software or other IP not subject to a mutually executed separate license (including installed applications). The license allows Microsoft to use such software and IP in connection with Goods. Microsoft may transfer this license to a Microsoft affiliated company, or a successor owner by sale or lease.

of the Cloud Services, a worldwide, nonexclusive, unlimited, paid‑up and royalty free right to access and use, during the term, Cloud Services, in each case for Microsoft’s business purposes. Access to the Cloud Services is unlimited unless otherwise specified in a SOW.

Pass through warranties and indemnities. Supplier assigns and passes through to Microsoft all of the third‑party manufacturers’ and licensors’ warranties and indemnities for the Goods.

Title to the Goods (other than licensed software) will pass from Supplier to Microsoft on final acceptance.

Microsoft IP.

(1)

Supplier may use “Microsoft Materials,” meaning any tangible or intangible materials, provided by or on behalf of Microsoft, any of its affiliated companies, or their respective end users, to Supplier to perform Services, Deliverables, or Cloud Services, or obtained or collected by Supplier in connection with the Goods, Services, Deliverables, or Cloud Services (e.g., usage data) (including hardware, software, source code, documentation, methodologies, know how, processes, techniques, ideas, concepts, technologies, reports and data). Microsoft Materials may include any modifications to, or derivative works of, the foregoing materials, (i) Personal Data, (ii) trademarks, (iii) inputs and prompts to and outputs generated by an AI Model (as defined below), and any data entered into any Supplier database as part of the Services or Cloud Services. Microsoft Materials do not include Microsoft products obtained by Supplier outside of and unrelated to these PO Terms.

(2)

Microsoft grants Supplier a nonexclusive, non‑sublicensable (except to subcontractors approved by Microsoft in accordance with these PO Terms), revocable license (i) under Microsoft’s IP rights in the Microsoft Materials to copy, use and distribute Microsoft Materials provided to it only as necessary to perform the Services in accordance with these PO Terms, and (ii) to use Microsoft Materials only as necessary to perform the Cloud Services in accordance with these PO Terms. Supplier will not Sell, share, license, or otherwise commercialize any Microsoft Materials.

(3)

Microsoft retains all other interest in Microsoft Materials and related IP rights. Supplier has no right to sublicense Microsoft Materials except to approved subcontractors as required to perform the delivery of Goods, Services, Deliverables, and CloudServices. If the Microsoft Materials come with a separate license, the terms of that license will apply and those terms control in the case of conflict with these PO Terms. Supplier will obtain a separate license to any Microsoft products or services used in connection with the Good, Services, Deliverables, or Cloud Services.

(4)

Supplier will take reasonable precautions to protect and ensure against loss or damage, theft, or disappearance of Microsoft Materials.

(5)

Microsoft may revoke the license to Microsoft Materials at any time for any reasonable business reason. The license will terminate automatically on the earlier of the expiration or termination of these PO Terms or an applicable SOW. Supplier will promptly return any Microsoft Materials on request or termination of Supplier’s license.

(6)

Regarding Supplier’s use of Microsoft Materials:

(i)

Supplier will not modify, reverse engineer, decompile, or disassemble Microsoft Materials except as allowed by Microsoft;

(ii)

Supplier will leave in place, and not alter or obscure proprietary notices and licenses contained in Microsoft Materials;

(iii)

Microsoft is not obligated to provide technical support, maintenance, or updates for Microsoft Materials;

(iv)

all Microsoft Materials are provided “as‑is” without warranty; and

(v)

Supplier assumes the risk of loss, damage, unauthorized access or use, or theft or disappearance of Microsoft Materials in Supplier’s (or subcontractor’s) care, custody, or control.

(7)

No Microsoft Materials, IP or Confidential Information, may be used by Supplier or an AI Model to customize, train, or improve, directly or indirectly, any artificial intelligence model or product, including any AI Model, (collectively, “AI Training”) without Microsoft’s express prior written consent. Any AI Training without obtaining such consent is a material breach and Supplier’s limitation of liability in Section 19 will not apply to claims based on a breach of this section. If Microsoft provides such consent, the parties will first enter into a separate written agreement that addresses the terms governing the AI Training. “AI Model” means any artificial intelligence model (which includes any deep learning or machine learning model) used in connection with or incorporated into the Goods, Services, Cloud Services, or any Deliverable.

13.

Representations and Warranties. Supplier represents and warrants that:

it has full rights and authority to enter into, perform under, and grant the rights in according to these PO Terms and its performance will not violate any agreement or obligation between it and any third party;

Services will be performed professionally and be at or above industry standard;

Goods, Services, Cloud Services, and Deliverables must meet the standards and specifications in these PO Terms and be suitable for the intended use;

it will provide to Microsoft all Goods, Services, and Deliverables free from: (1) any defects in design, workmanship, and materials; (2) any liability for royalties; and (3) any mechanic’s liens or any other statutory lien or security interest or encumbrance;

the Goods, Services, Cloud Services, Deliverables and any Supplier or third‑party IP provided to Microsoft under these PO Terms:

(1)

are not governed, in whole or in part, by an Excluded License. “Excluded License” means any software license that requires as a condition of use, modification and/or distribution, that the software or other software combined and/or distributed with it be: (i) disclosed or distributed in source code form; (ii) licensed to make derivative works; or (iii) redistributable at no charge; and

(2)

will not be subject to license terms that require any (i) Microsoft product, service, or documentation, or any Supplier or third‑party IP licensed to Microsoft, or documentation which incorporates or is derived from such Goods, Services, Cloud Services, Deliverables, or Supplier or third‑party IP, or (ii) Microsoft Materials or Microsoft IP, to be licensed or shared with any third party;

the Goods, Services, Cloud Services, Deliverables and any Supplier or third‑party IP provided to Microsoft under these PO Terms will not:

(1)

to the best of Supplier’s knowledge, infringe any third‑party patent, copyright, trademark, trade secret or other proprietary right of any third party; or

(2)

contain any viruses or other malicious code that will degrade or infect any Goods, Deliverables, products, services, or any other software or Microsoft’s network or systems;

Supplier will comply with all Laws, rules, and regulations, including Data Protection Law (as defined in Exhibit A), AI Laws (as defined in Section 15(f)), and Anti‑Corruption Laws (i.e., all Laws against fraud, bribery, corruption, inaccurate books and records, inadequate internal controls, and/or money‑laundering, including the U.S. Foreign Corrupt Practices Act), whether local, state, federal or foreign. The Goods, Services, Deliverables, Cloud Services, parts, components, devices, software, technology, and other materials provided under these PO Terms (collectively, “Items”) may be subject to applicable trade laws in one or more countries. The Supplier will comply with all relevant laws and regulations applicable to the import or export of the Items, including but not limited to, trade laws and regulations such as the U.S. Export Administration Regulations or other end‑user, end use, and destination restrictions by the U.S. and other governments, as well as sanctions regulations administered by the U.S. Office of Foreign Assets Control (“Trade Laws”). Microsoft may suspend or terminate these PO Terms immediately to the extent that Microsoft reasonably concludes that continued performance would violate Trade Laws or put it at risk of becoming subject to sanctions or penalties under Trade Laws. Supplier is responsible for ensuring compliance with the transfer or re‑transfer of intangible items, such as technology. Supplier agrees to provide Microsoft with the import/export control classifications and information, including documentation, on the applicable import, export, or re‑export authorizations, and all necessary information about the Items for any required import, export or re‑export procedures and/or licenses, without additional cost to Microsoft. For additional information, see https://www.microsoft.com/en‑us/exporting. “Law” means all applicable laws, rules, statutes, decrees, decisions, orders, regulations, judgments, codes, enactments, resolutions, and requirements of any government authority (federal, state, local, or international) having jurisdiction;

Supplier will comply with all applicable Anti‑Corruption Laws. While performing under these PO Terms, Supplier will provide training to its employees on compliance with Anti‑Corruption Laws and, upon request by Microsoft, will complete Microsoft’s standard online training for supplier compliance with Anti‑Corruption Laws; and

Supplier will, at its expense: (1) implement and maintain appropriate technical and organizational measures to protect the Microsoft Materials, including Personal Data, and any other Microsoft Confidential Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Microsoft Materials, including Personal Data, or any other Microsoft Confidential Information, transmitted, stored or otherwise processed; (2) as soon as commercially and technologically practicable, remediate any material vulnerabilities of which Supplier becomes aware; and (3) comply with Supplier’s confidentiality, artificial intelligence, privacy and data protection obligations under these PO Terms, including Sections 15, 16 and Exhibit A.

14.

Termination. Microsoft may terminate these PO Terms or the applicable SOW with or without cause.

Termination is effective upon written notice. If Microsoft terminates for convenience, its only obligation is to pay for:

Deliverables or Goods it accepts before the effective date of termination; or

Services performed, where Microsoft retains the benefit after the effective date of termination; or

Cloud Services delivered before the effective date of termination (or any post termination transition requested by Microsoft). Supplier will (without prejudice to any other remedies Microsoft may have) provide a pro‑rata refund to Microsoft for any prepaid unused fees.

15.

Security, Privacy, Artificial Intelligence and Data Protection. Supplier will comply with the following, at its own cost and expense.

Without limiting Microsoft’s audit rights in these PO Terms, Supplier will (1) participate in the Microsoft Supplier Security and Privacy Assurance (“SSPA”) program, as required by Microsoft, including by attesting to Supplier’s compliance status with respect to all applicable portions of Microsoft’s then current Supplier Data Protection Requirements (“DPR”) on an annual basis (or more frequently if additional portions of the DPR become available), and (2) comply with Microsoft’s then current DPR. See https://www.microsoft.com/en‑us/procurement/supplier‑contracting.aspx, Supplier Security and Privacy Assurance (SSPA) (aka.ms), for SSPA program details, including the program requirements and current DPR.

Supplier will, at its expense, implement and maintain appropriate technical and organizational measures to protect Confidential Information, including Personal Data, against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Confidential Information, including Personal Data, transmitted, stored or otherwise processed, and will, as soon as commercially and technologically practicable, remediate any material vulnerabilities of which Supplier becomes aware. Supplier’s security procedures must include risk assessment and controls for: (1) system access; (2) system and application development and maintenance; (3) change management; (4) asset classification and control; (5) incident response, physical and environmental security; (6) disaster recovery/business continuity; and (7) employee training. Those measures will be set forth in a Supplier security policy. Supplier will make that policy available to Microsoft, along with descriptions of the security controls in place for the Services and Cloud Services, upon Microsoft’s request and other information reasonably requested by Microsoft regarding Supplier security practices and policies.

When Supplier provides Cloud Services: 1) At Supplier’s cost, Supplier will maintain a valid certification under the International Organization for Standardization standard ISO 27001 or a valid SOC 2 Type II attestation report (“Supplier Certification”). Supplier will promptly provide to Microsoft upon Microsoft’s request a full copy of the Supplier Certification and report on which the Supplier Certification is based. The Supplier Certification will cover all Cloud Services, except cloud infrastructure services provided by cloud infrastructure providers other than Supplier or its affiliates. (2) Supplier will only use the cloud infrastructure provider (“CIP”) identified in the applicable SOW in providing Cloud Services and will notify Microsoft at least 90 days before it changes, adds, or undertakes any plan to change, the CIP and at least 30 days before any change in location of Microsoft Materials. If Microsoft rejects the change, it may terminate the applicable SOW immediately, with no further obligations.

Supplier will comply with the privacy and data protection requirements in Exhibit A.

Without limiting Supplier’s obligations under these PO Terms, including the DPR, on becoming aware of any Security Incident (defined below), Supplier will:

(1)

notify Microsoft without undue delay of the Security Incident (in any case no later than it notifies any similarly situated customers of Supplier and in all cases before Supplier makes any general public disclosure (e.g., a press release));

(2)

promptly investigate or perform required assistance in the investigation of the Security Incident and provide Microsoft with detailed information about the Security Incident, including a description of the nature of the Security Incident, the approximate number of

Data Subjects affected, the Security Incident’s current and foreseeable impact, and the measures Supplier is taking to address the Security Incident and mitigate its effects; and

(3)

promptly take all commercially reasonable steps to mitigate the effects of the Security Incident, or assist Microsoft in doing so.

“Security Incident” means any: (1) accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Confidential Information, including Personal Data, transmitted, stored, or otherwise processed by Supplier or its subcontractors; or (2) Security Vulnerability (i) related to Supplier’s handling of Confidential Information, including Personal Data, or (ii) impacting Microsoft products, services, software, network, or systems. “Security Vulnerability” means a weakness, flaw, or error found within a security system of Supplier or its subcontractors that has a reasonable likelihood to be leveraged by a threat agent in an impactful way. Supplier will comply with this Section 15(e) at Supplier’s cost unless the Security Incident arose from Microsoft’s negligent or willful acts or Supplier’s compliance with Microsoft’s express written instructions.

Supplier must obtain Microsoft’s written approval before notifying any governmental entity, individual, the press, or other third party of a Security Incident that affected or reasonably could affect Microsoft, including any Confidential Information that Supplier received from Microsoft or Processed on behalf of Microsoft.

Artificial Intelligence. Supplier will not use any AI System in connection with or incorporate any AI System into the Goods, Services, Cloud Services, or any Deliverable without Microsoft’s prior written consent. Supplier will, at its expense, implement and maintain appropriate technical and organizational measures to ensure any AI System used or developed in connection with or incorporated into the Goods, Services, Cloud Services, or any Deliverable, and any Goods, Services, Cloud Services, or Deliverables intended to be used with or incorporated into an AI System, complies with AI Laws and Policies, including all Policies related to the ethical or responsible use of artificial intelligence technology. Supplier’s artificial intelligence program must include processes and controls sufficient to meet the requirements mandated under applicable AI Laws and Policies. Those measures will be set forth in a Supplier artificial intelligence policy, including all documentation needed to demonstrate compliance with AI Laws. Supplier will make that policy available to Microsoft on Microsoft’s request along with descriptions of the controls in place for the artificial intelligence technology, and will provide any other information reasonably requested by Microsoft regarding Supplier’s responsible artificial intelligence practices and policies. Supplier will cooperate with Microsoft, upon request, to assist Microsoft in responding to an AI Inquiry, including providing Microsoft will all necessary information regarding any AI System used or developed in connection with or incorporated into the Goods, Services, Cloud Services, or any Deliverable, or any Goods, Services, Cloud Services, or Deliverables intended to be used with or incorporated into an AI System. “AI System” means an engineered system that applies an optimized model so that the system can, for a given set of human‑defined objectives, make predictions, recommendations, or decisions influencing the environments it interacts with. AI Systems include AI Models. “AI Laws” means any Laws applicable to Supplier or Microsoft, relating to artificial intelligence systems and technology, including Regulation (EU) 2024/1689 of the European Parliament and of the Council, Executive Order 14110 on Safe, Secure and Trustworthy Artificial Intelligence and any implementing, derivative or related legislation, rule, regulation, and regulatory guidance, as amended, extended, repealed and replaced, or re‑enacted. “AI Inquiry” means an inquiry by a governmental body, standards body, or similar entity relating to (1) any AI System used or developed in connection with or incorporated into the Goods, Services, Cloud Services, or any Deliverable, or (2) any Goods, Services, Cloud Services, or Deliverables intended to be used with or incorporated into an AI System.

Notifications.

(1)

Supplier must obtain Microsoft’s written approval before (i) notifying any governmental entity, individual, the press, or other third party of a Security Incident that affected or reasonably could affect Microsoft, including any Confidential Information that Supplier received from Microsoft or Processed on behalf of Microsoft, or (ii) responding to, or notifying any governmental entity, individual, the press, or other third party of, an AI Inquiry. As part of its notification to Microsoft, Supplier will disclose the identity of the third party and a copy of the notification (if the notification to the third party has not been sent, Supplier will provide a draft to Microsoft). Supplier will permit Microsoft to offer edits or updates to the notification.

(2)

Supplier may notify a third party about a Security Incident affecting Personal Data if Supplier is under a legal obligation to do so, provided that Supplier makes every effort to give Microsoft prior notification, as soon as possible and if prior notification is not possible, notify Microsoft immediately once it becomes possible to give notification.

16.

Supplier Code of Conduct. Supplier will comply with the most current Supplier Code of Conduct at https://aka.ms/scoc and the most current Anti‑Corruption Policy for Microsoft Representatives at http://aka.ms/microsoftethics/representatives, and any other Policies (e.g., those related to physical or information security or artificial intelligence) or training identified by Microsoft in a SOW or otherwise during the Term (and will provide such training).

17.

Accessibility. Any device, product, website, web‑based application, cloud service, software, mobile applications, or content developed or provided by or on behalf of Supplier or Supplier’s Affiliate under these PO Terms must comply with all legal accessibility requirements. For purchases with a User Interface (UI) this includes conformance to Level A and AA Success Criteria of the latest published version of the Web Content Accessibility Guidelines (“WCAG”), available at https://www.w3.org/standards/techs/wcag#w3c all, Section 508 of the Rehabilitation Act, available at https://www.section508.gov and the European standard EN 301 549 available at https://eur‑lex.europa.eu/eli/dir/2016/2102/oj. Suggested documentation includes completion of the VPAT 2.4 INT: which incorporates all three of the above standards and is available at https://www.itic.org/policy/accessibility/vpat.

18.

No Waiver. Microsoft’s delay or failure to exercise any right or remedy will not result in a waiver of that or any other right or remedy.

19.

Insolvency; Limitations of Liability.

The insolvency or adjudication of bankruptcy, filing a voluntary petition in bankruptcy, or making an assignment for the benefit of creditors by either party will be a material breach of these PO Terms. For these PO Terms, “insolvency” means either (1) the party’s liabilities exceed its assets, each fairly stated, or (2) the party’s failure to pay its business obligations on a timely basis in the regular course of business.

Limitations of Liability. EXCEPT FOR THE INDEMNIFICATION OBLIGATIONS STATED IN SECTION 21, A BREACH OF A PARTY’S ARTIFICIAL INTELLIGENCE, CONFIDENTIALITY, SECURITY, PRIVACY, DATA PROTECTION, AND PUBLICITY OBLIGATIONS UNDER THESE PO TERMS, INFRINGEMENT, MISUSE, OR MISAPPROPRIATION OF IP RIGHTS IN CONNECTION WITH THESE PO TERMS, OR FRAUD, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES (INCLUDING DAMAGES FOR LOSS OF DATA, REVENUE, AND/OR PROFITS), WHETHER FORESEEABLE OR UNFORESEEABLE, WHICH ARISE OUT OF THESE PO TERMS, REGARDLESS OF WHETHER THE LIABILITY IS BASED ON BREACH OF CONTRACT, TORT, STRICT LIABILITY, BREACH OF WARRANTIES OR OTHERWISE, AND EVEN IF THE PARTY IS ADVISED OF THE POSSIBILITY OF THOSE DAMAGES.

20.

Subcontracting. Supplier will not subcontract with any third party to furnish any Goods, Services, Deliverables, or Cloud Services without Microsoft’s prior written consent. If Supplier subcontracts any Services or Cloud Services to any subcontractor, Supplier will be fully liable to Microsoft for any actions or inactions of subcontractor, remain subject to all obligations under these PO Terms, require the subcontractor to agree in writing that Microsoft is an intended third‑party beneficiary of its agreement with Supplier and require the subcontractor to agree in writing to terms no less protective of Microsoft than the terms of these PO Terms applicable to the work performed by the subcontractor, including the privacy and data protection terms in Section 15 of these PO Terms and Exhibit A.

21.

Indemnification and Other Remedies.

Supplier will defend, indemnify and hold harmless Microsoft and Microsoft affiliates companies against all claims, demands, loss, costs, damages, and actions for: (1) actual or alleged infringements of any third‑party IP or IP rights or Microsoft IP or IP Rights, which arise from the Goods, Services, Deliverables, or Cloud Services provided under these PO Terms; (2) any claim that, if true, would constitute a breach of Section 15, Exhibit A, or any Supplier warranty contained herein; (3) any act or omission of or failure to comply with tax obligations or Law by Supplier or Supplier’s agents, employees, or subcontractors; (4) any breach by Supplier or its subcontractors of any artificial intelligence, confidentiality, security, or privacy, data protection, or publicity obligations under these P0 Terms; (5) the negligent or willful acts or omissions of Supplier or its subcontractors, which results in any bodily injury, including mental injury, or death to any person or loss, disappearance or damage to tangible or intangible property; and (6) any claims of its employees, affiliated companies or subcontractors regardless of the basis, including, but not limited to, the payment of settlements, judgments, and reasonable attorneys’ fees.

In addition to all other remedies available to Microsoft, if use of the Goods, Services, Deliverables, or Cloud Services under these PO Terms are enjoined, injunction is threatened, or may violate applicable law, Supplier, at its expense will notify Microsoft and immediately replace or modify such Goods, Services, Deliverables, and Cloud Services so they are non‑infringing, compliant with applicable law, and useable to Microsoft’s satisfaction. If Supplier does not comply with this Section 21(b), then in addition to any amounts reimbursed under this Section 21 (Indemnification and Other Remedies), Supplier will refund all amounts paid by Microsoft for infringing or non‑compliant Goods, Services, Deliverables, and Cloud Services and pay reasonable costs to transition Services and Cloud Services to a new supplier.

22.

Insurance. Supplier will maintain sufficient insurance coverage to meet obligations required by these PO Terms and by Law. Supplier’s insurance must include the following coverage (or the local currency equivalent) to the extent these PO Terms or the applicable SOW creates risks generally covered by these insurance policies:

Table A1 – Required Insurance Coverage


Coverage	Form	Limit1
Commercial general liability, including contractual and product liability2	Occurrence	$2,000,000 USD
Automobile liability	Occurrence	$2,000,000 USD
Privacy and cybersecurity liability, as reasonably commercially available (including costs arising from data destruction, hacking or intentional breaches, crisis management activity related to data breaches, and legal claims for security breach, privacy violations, and notification costs)	Per claim	$2,000,000 USD


Workers’ compensation	Statutory	Statutory
Employer’s liability	Occurrence	$500,000 USD
Professional liability/E&O, covering third‑party proprietary rights infringement (e.g., copyright and trademark) if reasonably commercially available	Per claim3	$2,000,000 USD

NOTES:

All limits per claim or occurrence unless statutory requirements are otherwise may be converted to local currency.

Supplier will name Microsoft, its subsidiaries, and their respective directors, officers, and employees as additional insureds in the Commercial general liability policy, to the extent of contractual liability assumed by Supplier in Section 21.

With a retroactive coverage date no later than the effective date of these PO Terms or the applicable SOW or Order. Supplier will maintain active policy coverage or an extended reporting period providing coverage for claims first made and reported to the insurer within 12 months after these PO Terms terminate or expire or the applicable SOW or Order is fulfilled.

Supplier must obtain Microsoft’s prior written approval for any deductible or retention in excess of $100,000 USD per occurrence or accident. Supplier will deliver to Microsoft proof of the insurance coverage required under these PO Terms on request. Supplier will promptly buy additional coverage, and notify Microsoft in writing, if Microsoft reasonably determines Supplier’s coverage is less than required to meet its obligations.

23.

Non‑Disclosure of Confidential Matters. If the parties have entered into a standard Microsoft Non‑Disclosure Agreement, the terms of such agreement will apply to and be incorporated in these PO Terms and the existence of and all terms and conditions of these PO Terms and Microsoft Materials will be deemed Microsoft Confidential Information. If the parties have not entered into a standard Microsoft Non‑Disclosure Agreement, then Supplier agrees that during the term of these PO Terms and for 5 years thereafter, Supplier will hold in strictest confidence, and will not use or disclose to any third party (except to a Microsoft Affiliate), any Microsoft Confidential Information. The term “Microsoft Confidential Information” means all nonpublic information that Microsoft or an affiliated company designates in writing or orally as being confidential, or which, under the circumstances of disclosure would indicate to a reasonable person that it ought to be treated as confidential. Notwithstanding anything to the contrary in these PO Terms, all Personal Data shared with Supplier or a Supplier affiliate and in connection with these PO Terms is Microsoft Confidential Information. If Supplier has questions regarding what comprises Microsoft Confidential Information, Supplier will consult Microsoft. Microsoft Confidential Information will not include information known to Supplier before Microsoft’s disclosure to Supplier, or information publicly available through no fault of Supplier.

On expiration or termination of these PO Terms or the applicable SOW, or on request by Microsoft or Microsoft’s Affiliate, Supplier will without undue delay: (i) return all Microsoft Confidential Information (including copies thereof) to Microsoft or the applicable Microsoft Affiliate; or (ii) where requested by Microsoft or its Affiliate, destroy the Microsoft Confidential Information (including copies thereof) and certify its destruction, in each case unless the Law expressly requires otherwise. For any Microsoft Confidential Information that Supplier retains after expiration or termination of these PO Terms or the applicable SOW (for example, because Supplier is legally required to retain the information), Supplier will continue to comply with all terms of these PO Terms applicable to that Confidential Information, including all confidentiality obligations, and those applicable terms will survive such termination or expiration.

24.

Independent Development. Nothing in these PO Terms restricts Microsoft’s ability to, directly or indirectly, acquire, license, develop, manufacture, or distribute, same or similar technology or services to the Goods, Services, Deliverables, or Cloud Services contemplated by these PO Terms. Microsoft may use, market, and distribute such similar technology or services in addition to, or in lieu of, the technology or services contemplated by these PO Terms, including any software or cloud services (in whole or in part).

25.

Audit. During the term of these PO Terms and for 4 years after (or a longer term as required to comply with Law), Supplier will keep usual and proper records and books of account and quality and performance reports related to Goods, Services, Deliverables, or Cloud Services, the Processing of Personal Data, and as otherwise required for legal compliance (“Supplier Records”). During this period, Microsoft may audit and/or inspect the applicable records and facilities to verify Supplier’s compliance with these PO Terms, including privacy, security, export compliance, accessibility, and taxes. Microsoft or its designated independent consultant or certified public accountant (“Auditor”) will conduct audits and inspections. Microsoft will provide reasonable notice (15 days except in emergencies) to Supplier before the audit or inspection and will instruct the Auditor to avoid disrupting Supplier’s operations, including consolidating audits where practical. Supplier agrees to provide Microsoft’s designated audit or inspection team reasonable access to the Supplier records and facilities. If the auditors determine that Microsoft overpaid Supplier, Supplier will reimburse Microsoft for any such overpayment. If Supplier overcharged Microsoft 5% or more during an audited period, it will immediately refund Microsoft all overpayments plus pay interest at 0.5% per month on such overcharge. Microsoft will bear the expense of its auditors or inspection team. However, if the audit shows Supplier overcharged Microsoft by 5% or more during such audit period, Supplier will reimburse Microsoft for such expenses. Nothing in this Section limits Microsoft’s right to audit Supplier under any other Section of these PO Terms, including Exhibit A.

26.

Assignments. No right or obligation under these PO Terms (including the right to receive monies due) will be assigned without the prior written consent of Microsoft. Any assignment without such consent will be void. Microsoft may assign its rights under these PO Terms.

27.

Notice of Labor Disputes. Whenever an actual or potential labor dispute delays or threatens to delay the timely performance of these PO Terms, Supplier will immediately notify Microsoft in writing of such dispute and furnish all relevant details. Supplier will include a provision identical to the above in each subcontract and, immediately upon receipt of such notice, give written notice to Microsoft.

28.

Patent License. Notwithstanding other conditions stated herein, if Supplier fails in performance according to the terms of these PO Terms, Supplier, as part of the consideration for these PO Terms and without further cost to Microsoft, automatically grants to Microsoft an irrevocable, non‑exclusive, royalty‑free right and license to use, sell, manufacture, and cause to be manufactured any and all products, which embody any and all inventions and discoveries made, conceived, or actually reduced to practice by or on behalf of Supplier in connection with a Deliverable under these PO Terms.

29.

Jurisdiction and Governing Law. Where Goods, Services, Deliverables, or Cloud Services are provided to Microsoft in the United States, these PO Terms are governed by Washington State Law (disregarding conflicts of law principles), and the parties consent to exclusive jurisdiction and venue in the state and federal courts in King County, Washington. All Cloud Services are deemed provided in the United States if any access or use of Cloud Services by Microsoft occurs in the United States. In all other instances, these PO Terms are governed by the Laws of the country where Microsoft (i.e., the entity other than Supplier who is the contracting entity to these PO Terms) is incorporated or otherwise formed and the parties consent to exclusive jurisdiction and venue in that country. Neither party will claim lack of personal jurisdiction or forum non conveniens in the courts agreed above. In any action or suit related to these PO Terms, the prevailing party is entitled to recover its costs including reasonable attorneys’ fees.

30.

Publicity; Use of Trademarks. Supplier will not issue press releases or other publicity related to Supplier’s relationship with Microsoft or these PO Terms without prior written approval from Microsoft. If written approval is granted, Supplier may only use Trademarks for Services, Cloud Services and Deliverables in compliance with the guidelines at https://www.microsoft.com/en‑us/legal/intellectualproperty/Trademarks/Usage/General.aspx.

31.

Severability, URLs. If a court of competent jurisdiction determines that any provision of these PO Terms is illegal, invalid, or unenforceable, the remaining provisions will remain in full force and effect. URLs also refer to successors, localizations, and information or resources linked from within websites at those URLs. Neither party has entered into these PO Terms in reliance on anything not contained or incorporated in these PO Terms. These PO Terms will be interpreted according to their plain meaning without presuming that they should favor either party.

32.

Survival. The provisions of these PO Terms which, by their terms, require performance after the termination or expiration or have application to events that may occur after the termination or expiration of these PO Terms or the applicable SOW, will survive the termination or expiration of these PO Terms and the applicable SOW. All indemnity obligations and indemnification procedures will survive the termination or expiration of these PO Terms and the applicable SOW.

[Remainder of this page is intentionally left blank]

Exhibit A – Data Protection

SECTION 1 Scope, Order of Precedence, and Term

(a)

This Exhibit modifies and supplements the terms and conditions in the PO Terms as they relate to Supplier’s Processing of Personal Data and compliance with Data Protection Law. The SOW (if any) designates the Supplier’s status as a Controller or a Processor. Notwithstanding anything to the contrary in the PO Terms, if there is a conflict between this Exhibit and the PO Terms, this Exhibit will control. This Exhibit will be attached to and incorporated into the PO Terms.

(b)

This Exhibit applies only to the extent that Supplier receives, stores, or Processes Personal in connection with the Goods, Services, Deliverables, or Cloud Services.

SECTION 2 Definitions

(a)

All capitalized terms not defined in this Exhibit will have the meanings set forth in the PO Terms.

(b)

The following terms have the definitions given to them in the CCPA: “Business,” “Business Purpose,” “Sale,” “Share,” “Service Provider,” “Contractor,” and “Third Party.”

(c)

“Controller” means the entity that determines the purposes and means of the Processing of Personal Data. “Controller” includes a Business, Controller (as that term is defined in the GDPR), and equivalent terms in Data Protection Laws, as context requires.

(d)

“Data Exporter” means the party that (1) has a corporate presence or other stable arrangement in a jurisdiction that requires an International Data Transfer Mechanism and (2) transfers Personal Data, or makes Personal Data available to, the Data Importer.

(e)

“Data Importer” means the party that is (1) located in a jurisdiction that is not the same as the Data Exporter’s jurisdiction and (2) receives Personal Data from the Data Exporter or is able to access Personal Data made available by the Data Exporter.

(f)

“Personal Data Incident” means any:

(1)

destruction, alteration, use, loss, disclosure of, or access to Personal Data transmitted, stored, or otherwise processed by Supplier or its subcontractors that is not authorized by law or these PO Terms or any other breach of the protection of Personal Data; or

(2)

Security Vulnerability related to Supplier’s handling of Personal Data. “Security Vulnerability” means a weakness, flaw, or error found within a security system of Supplier or its subcontractors that has a reasonable likelihood to be leveraged by a threat agent in an impactful way.

(g)

“Data Protection Law” means any Law applicable to Supplier or Microsoft, relating to data security, data protection, and/or privacy, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to processing of personal data and the free movement of that data (“GDPR”), Cal. Civ. Code Title 1.81.5, § 1798.100 et seq. (California Consumer Privacy Act) (“CCPA”), and any other U.S. federal, U.S. state, or foreign data privacy laws, and any implementing, derivative or related legislation, rule, regulation, and regulatory guidance, as amended, extended, repealed and replaced, or re‑enacted.

(h)

“Data Subject” means an identifiable natural person who can be identified, directly or indirectly, in particular by referencing an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

(i)

“De‑identified Data” means information that cannot reasonably be linked to an identified or identifiable individual.

(j)

“EEA” means the European Economic Area.

(k)

“Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”) and any other data or information that constitutes personal data or personal information under any applicable Data Protection Law. An identifiable natural person is one who can be identified, directly or indirectly, in particular by referencing an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

(l)

“Process” or “Processing” means any operation or set of operations that a party performs on Personal Data, whether or not by automated means, including collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

(m)

“Processor” means an entity that processes Personal Data on behalf of another entity. “Processor” includes Service Provider, Contractor, Processor (as that term is defined in the GDPR), and equivalent terms in Data Protection Laws, as context requires.

(n)

“Protected Health Information” or “PHI” means Microsoft Personal Data that is protected by the Health Information Portability and Accountability Act (HIPAA).

(o)

“Pseudonymous Data” means information that cannot be attributed to a specific individual without the use of additional information provided that it is kept separately and subject to appropriate technical and organizational measures to ensure that it is not attributed to the individual.

(p)

“Sensitive Data” means the following types and categories of data: (1) data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, immigration or citizenship status, or trade union membership; genetic data; (2) biometric data; (3) data concerning health, including protected health information governed by the Health Insurance Portability and Accountability Act; (4) data concerning a natural person’s sex life or sexual orientation; (5) government identification numbers (e.g., SSNs, driver’s license); (6) payment card information; (7) nonpublic personal information governed by the Gramm Leach Bliley Act; (8) an unencrypted identifier in combination with a password or other access code that would permit access to a data subject’s account; (9) personal bank account numbers; (10) data related to children; (11) precise geolocation; and (12) any other data defined as “sensitive data,” “sensitive information,” or similar terms under Data Protection Law.

(q)

“Standard Contractual Clauses” means the European Union standard contractual clauses for international transfers from the European Economic Area to third countries, Commission Implementing Decision (EU) 2021/914 of 4 June 2021, available at https://ec.europa.eu/info/law/law‑topic/data‑protection/international‑dimension‑data‑protection/standard‑contractual‑clauses‑scc en or other applicable country‑specific standard contractual clauses or equivalent.

(r)

“Subprocessor” means a Processor engaged by a party who is acting as a Processor.

SECTION 3 Description of the Parties’ Personal Data Processing Activities and Statuses of the Parties

(a)

Schedule 1 describes the purposes of the parties’ Processing, the types or categories of Personal Data involved in the Processing, and the categories of Data Subjects affected by the Processing.

(b)

Schedule 1 lists the parties’ statuses under relevant Data Protection Law.

(c)

The subject matter and duration of the Processing, the nature and purpose of the Processing, and the type of Personal Data and categories of Data Subjects may be more specifically described in a statement of work, Microsoft purchase order, or written agreement signed by the parties’ authorized representatives, which forms an integral part of the PO Terms; if this is the case, the more specific description will control over Schedule 1.

SECTION 4 International Data Transfer

(a)

Some jurisdictions require that an entity transferring Personal Data to a recipient in another jurisdiction take extra measures to ensure that the Personal Data has special protections if the law of the recipient’s jurisdiction does not protect Personal Data in a manner equivalent to the transferring entity’s jurisdiction (an “International Data Transfer Mechanism”). The parties will comply with any International Data Transfer Mechanism that may be required by applicable Data Protection Law, or agreed upon by the parties, including the Standard Contractual Clauses, the Data Privacy Framework and Binding Corporate Rules.

(b)

If the International Data Transfer Mechanism on which the parties rely is invalidated or superseded, the parties will work together in good faith to find a suitable alternative.

(c)

With respect to Personal Data of Data Subjects located in a jurisdiction that requires an International Data Transfer Mechanism, (e.g., the EEA, Switzerland, or the United Kingdom) that Microsoft transfers to Supplier or permits Supplier to access, the parties agree upon these PO Terms becoming effective they also execute the Standard Contractual Clauses, which will be incorporated by reference and form an integral part of the PO Terms. The parties agree that, with respect to the elements of the Standard Contractual Clauses that require the parties’ input, Schedules 1 and 2 contain information relevant to the Standard Contractual Clauses’ Annexes. The parties agree that, for Personal Data of Data Subjects in the United Kingdom, Switzerland, or another country specified in Schedule 1, they adopt the modifications to the Standard Contractual Clauses listed in Schedule 1 to adapt the Standard Contractual Clauses to local law, as applicable.

SECTION 5 Mutual Obligations of the Parties

(a)

Compliance. The parties will comply with their respective obligations under applicable Data Protection Laws and their privacy notices, including by providing the same level of privacy protection that is required by applicable Data Protection Laws, when acting as Controllers or Processors.

(b)

Information. Upon request, Supplier will provide reasonably relevant information to demonstrate Supplier’s compliance with its obligations under applicable Data Protection Law, and to enable Microsoft to demonstrate Supplier’s compliance with its obligations under applicable Data Protection Law, and fulfill its obligations (if any) to conduct data protection assessments or prior consultations with data protection authorities and any other regulatory bodies.

(c)

Notification. Supplier will notify Microsoft if it determines that it can no longer meet its obligations under applicable Data Protection Law.

(d)

Cooperation. If Supplier receives any type of request or inquiry from a governmental, legislative, judicial, law enforcement, or regulatory authority, or faces an actual or potential claim, inquiry, or complaint in connection with Parties’ Processing of Personal Data provided to Supplier by or on behalf of Microsoft, its affiliates, or its respective end users, or obtained or collected by Supplier in connection with the purposes described in Schedule 1 (collectively, an “Inquiry”), then Supplier will notify Microsoft without undue delay, but in no event later than ten (10) business days, unless such notification is prohibited by applicable law. Supplier will promptly provide Microsoft with information relevant to the Inquiry, including any information relevant to the defense of a claim, to enable Microsoft to respond to the Inquiry.

(e)

Confidentiality. Supplier will ensure that persons authorized to Process the Personal Data have committed themselves to confidentiality obligations no less protective than those set forth in the PO Terms or are under an appropriate statutory obligation of confidentiality.

(f)

Security Controls. Supplier will abide by Schedule 2 and take all measures required in accordance with good industry practice and by Data Protection Law relating to data security (including pursuant to Article 32 of the GDPR). Supplier will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, considering as well any additional measures to ensure an appropriate level of protection with regards to Sensitive Data that may be subject to these PO Terms.

(g)

Obligations Related to PHI. If Supplier’s engagement involves the Processing of PHI, Supplier must have a Business Associate Agreement and/or other required agreement in place with Microsoft.

SECTION 6 Supplier’s Obligations as Independent Controller (if applicable). If Supplier is a Controller of Personal Data that is collected, exchanged, or otherwise Processed in connection with Supplier’s performance of the PO Terms (see Schedule 1), then:

(a)

Supplier acknowledges and agrees that Supplier is independently responsible for compliance and will comply with applicable Data Protection Law (e.g., obligations of Controllers);

(b)

Supplier will not Sell or Share Personal Data;

(c)

Supplier agrees to be responsible for providing notice to Data Subjects as may be required by applicable Data Protection Law (e.g., GDPR Articles 13 and 14, as applicable) and responding, as required by Data Protection Laws such as Chapter III of GDPR, to Data Subject’s requests to exercise their rights and identifying the lawful basis on which Processing of their personal data is based (e.g., consent or legitimate interest);

(d)

Supplier agrees that it will keep Pseudonymous Data separate from any additional information necessary to prevent such Pseudonymous Data from being attributable to a specific individual and will subject such Pseudonymous Data to appropriate technical and organizational measures to ensure that it is not attributed to specific individual; and

(e)

Supplier agrees that it will take reasonable measures to ensure that De‑identified Data and Pseudonymous Data cannot be associated with a specific individual or household, publicly commit to maintain the De‑identified Data and Pseudonymous Data in de‑identified form and not attempt to reidentify it, implement technical and organizational measures as required by these PO Terms, and contractually commit any Subprocessors to do the same and take all other actions necessary to maintain the information’s status as De‑identified Data or Pseudonymous Data under Data Protection Laws.

SECTION 7 Supplier’s Obligations as Third Party (if applicable). If Supplier Processes Personal Data as a Third Party under the CCPA or equivalent term under applicable U.S. state data privacy laws and other Data Protection Laws in connection with Supplier’s performance of the PO Terms (see Schedule 1), then:

(a)

Supplier will Process Personal Data only for the limited and specific business purpose(s) described in Schedule 1.

(b)

Supplier agrees that the Personal Data is made available only for the limited and specified purpose(s) set forth in the contract, and that Supplier may use the information only for those purposes;

(c)

Supplier will not Sell or Share Personal Data made available to it by Microsoft;

(d)

Supplier will allow Microsoft to take reasonable and appropriate steps to ensure that Supplier uses the Personal Data that it received from, or on behalf of, Microsoft in a manner consistent with Microsoft’s obligations under the CCPA and applicable U.S. state data privacy laws and other Data Protection Laws; and

(e)

Supplier will allow Microsoft, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data.

SECTION 8 Supplier’s Obligations as a Processor, Contractor, Subprocessor, or Service Provider.

Supplier will have the obligations set forth in this Section 8 if it Processes the Personal Data of Data Subjects in its capacity as Microsoft’s Processor, Contractor, or Service Provider; for clarity, these obligations do not apply to Supplier in its capacity as an Independent Controller, Business, or Third Party.

(a)

Scope of Processing

(1)

Supplier will Process Personal Data solely to (i) provide Services to Microsoft (and where applicable for the Business Purposes specified in the applicable SOW, (ii) carry out its obligations under the PO Terms, and (iii) carry out Microsoft’s documented instructions. Supplier will not Process Personal Data for any other purpose, unless required by applicable law, and will not Sell or Share Personal Data that it collects or obtains pursuant to the PO Terms.

(2)

Processing any Personal Data outside the scope of the PO Terms and this Exhibit will require prior written PO Terms between Supplier and Microsoft by way of written amendment to the PO Terms.

(3)

Supplier will notify Microsoft if it believes that it cannot follow Microsoft’s instructions or fulfill its obligations under the PO Terms because of a legal obligation to which Supplier is subject, unless Supplier is prohibited by law from making such notification.

(4)

Supplier is prohibited from retaining, using, or disclosing the Personal Data (1) for any purpose other than the Business Purposes specified in Schedule 1, including retaining, using, or disclosing the Personal Data for a commercial purpose other than carrying out Microsoft’s instructions; (2) outside of the Parties’ direct business relationship, unless permitted by applicable Data Protection Law, or (3) by combining Personal data that Supplier receives from, or on behalf of, Microsoft with Personal Data that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the Data Subject, provided that Supplier may combine Personal Data to perform any Business Purposes permitted by applicable Data Protection Law. Supplier certifies that it understands with and will comply with the prohibitions set forth in this Section (8)(a)(4).

(5)

Supplier will allow Microsoft, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data.

(b)

Obligations Regarding Pseudonymous Data and De‑identified Data

(1)

Supplier agrees that will keep Pseudonymous Data separate from any additional information necessary to prevent such Pseudonymous Data from being attributable to a specific individual and will subject such Pseudonymous Data to appropriate technical and organizational measures to ensure that it is not attributed to specific individual;

(2)

Supplier agrees that it will (i) take reasonable measures to ensure that De‑identified Data and Pseudonymous Data cannot be associated with a specific individual or household, (ii) publicly commit to maintain the De‑identified Data and Pseudonymous Data in de‑identified form and not attempt to reidentify it, (iii) implement technical and organizational measures as required by these PO Terms (iv) contractually commit any Subprocessors to do the same and (v) take all other actions necessary to maintain the information’s status as De‑identified Data or Pseudonymous Data under Data Protection Laws.

(c)

Data Subjects’ Requests to Exercise Rights. Supplier will promptly inform Microsoft if Supplier receives a request from a Data Subject to exercise their rights with respect to their Personal Data under applicable Data Protection Law. Supplier will not respond to such Data Subjects except to acknowledge their requests. Supplier will provide Microsoft with assistance, upon request, to help Microsoft to respond to a Data Subject’s request, including by stopping the Processing of Personal Data where required in accordance with a Data Subject’s request. Microsoft will notify the Supplier of any Data Subject request that the Supplier must comply with and will provide information necessary for compliance.

(d)

Supplier’s Subprocessors. Supplier will not engage a Subprocessor without Microsoft’s prior written authorization. Supplier will be liable for the acts or omissions of its Subprocessors to the same extent as Supplier would be liable if performing the services of the Subprocessor directly under this Exhibit, except as otherwise set forth in the PO Terms. Supplier will require Subprocessors to agree in writing to terms no less protective than the terms in this Exhibit.

(e)

Personal Data Incident

(1)

Without limiting Supplier’s obligations under the PO Terms, including the DPR and this Exhibit with respect to Personal Data, on becoming aware of any Personal Data Incident, Supplier will:

(i)

keep a register of all Personal Data Incidents;

(ii)

notify Microsoft without undue delay of the Personal Data Incident (in any case no later than it notifies any similarly situated customers of Supplier and in all cases before Supplier makes any general public disclosure (e.g., a press release));

(iii)

promptly investigate or perform required assistance in the investigation of the Data Incident and provide Microsoft with detailed information about the Personal Data Incident, including a description of the nature of the Personal Data Incident, the approximate number of Data Subjects affected, the Personal Data Incident’s current and foreseeable impact, and the measures Supplier is taking to address the Personal Data Incident and mitigate its effects; and

(iv)

promptly take all commercially reasonable steps to mitigate the effects of the Data Incident, or assist Microsoft in doing so.

(2)

Supplier will comply with this Section 8(e) at Supplier’s cost unless the Personal Data Incident arose from Microsoft’s negligent or willful acts or Supplier’s compliance with Microsoft’s express written instructions.

(3)

Supplier must obtain Microsoft’s written approval before notifying any governmental entity, individual, the press, or other third party of a Data Incident that affected or reasonably could affect Personal Data that Supplier received from Microsoft or Processed on behalf of Microsoft. Notwithstanding anything to the contrary in this Exhibit, Supplier may notify a third party about a Personal Data Incident affecting Personal Data if it is under a legal obligation to do so, provided that Supplier must: (i) make every effort to give Microsoft prior notification, as soon as possible, if it intends to disclose the Personal Data Incident to a third party; and (ii) if it is not possible to give Microsoft such prior notification, notify Microsoft immediately once it becomes possible to give notification. For any disclosure of a Personal Data Incident to a third party, Supplier will, as part of its notification to Microsoft, disclose the identity of the third party and a copy of the notification (if the notification to the third party has not been sent, Supplier will provide a draft to Microsoft). Supplier will permit Microsoft to offer edits or updates to the notification.

(f)

Deletion and Return of Personal Data. On expiration or termination of the applicable statement of work, cloud order, purchase order, or other written agreement between the parties, or upon request by Microsoft or Microsoft’s Affiliate, Supplier will, without undue delay: (1) return all Personal Data (including copies thereof) to Microsoft or the applicable Microsoft Affiliate; or (2) on request by Microsoft or its Affiliate, destroy all Microsoft Personal Data (including copies thereof), and certify its destruction, in each case unless the Law expressly requires otherwise. For any Microsoft Personal Data that Supplier retains after expiration or termination of the applicable statement of work, cloud order, purchase order, or other written agreement between the parties (for example, because Supplier is legally required to retain the information), (A) Supplier will continue to comply all terms of the PO Terms applicable to that Personal Data, including all with the data security and privacy provisions in this Exhibit and those applicable terms will survive such expiration or termination and (B) Supplier must De‑identify or aggregate Personal Data (if any) to the extent feasible. All Personal Data is Microsoft Confidential Information.


“Microsoft”	“Partner” or “Supplier”
Company Name: Microsoft Ireland Operations Limited	Company Name: Nscale Ventures Holdings Norway AS
Primary Contact:	Primary Contact: Josh Payne
Address: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland	Address: Sam Eydes vei 47, 8160 Glomfjord, Norway
Email:	Email: [***]
CC: Jon Tinter One Microsoft Way, Redmond, Washington 98052 [***]	Microsoft Supplier Number:
SOW Effective Date:
SOW Expiration Date:
Contract ID for Master Agreement:


Processing Activity	Status of the Parties	Categories of Personal Data that May Be Processed	Categories of Sensitive Data that May Be Processed	Applicable SCCs Module
Supplier Processes Personal Data to provide the Goods, Services, Deliverables, or Cloud Services.	Microsoft is a Controller. Supplier is a Processor.	Captured in SOW	Captured in SOW	Module 2 Module 3, if Microsoft acts as a Processor to another Controller
The parties Process Personal Data of their employees to, e.g., administer and provide the Goods, Services, Deliverables, or Cloud Services; manage invoices; manage the PO Terms and resolve any disputes relating to it; respond and/or raise general queries; comply with their respective regulatory obligations; and create and administer web‑based accounts.	Microsoft is a Controller. Supplier is a Processor.	Captured in SOW	Captured in SOW	Module 2 Module 3, if Microsoft acts as a Processor to another Controller
Supplier collects or receives Personal Data as a Controller/Third Party.	Microsoft is a Controller. Supplier is a Controller/ Third Party.	Captured in SOW	Captured in SOW	Module 1


Microsoft PO#