End User License Agreement

OutThink Limited

May 2019

Pag

e2

Pag

e3

THE PARTIES AGREE:

1 Definitions and interpretation

1.1 In this Agreement:

Applicable Law means any and all applicable laws, statutes, orders, rules, treaties,

decree, regulations, directives, edicts, bye-laws, schemes, warrants,

other instruments made under or to be made under any statute;

Business Day means a day other than a Saturday, Sunday or bank or public holiday

in England;

Commencement

Date

means the date of this Agreement;

Confidential

Information

means any and all confidential information, (whether in oral, written

or electronic form) including technical or other information imparted

in confidence or disclosed by one party to the other or otherwise

obtained by one party relating to the other’s business, finance or

technology, know-how, Intellectual Property Rights, assets, strategy,

products and clients, including information relating to management,

financial, marketing, technical and other arrangements or operations

of any person, firm or organisation associated with that party;

Client Data means all information provided by the Client to OutThink when using

the Service;

Client Marks means the Client’s name and logo together with any trademarks

registered or unregistered belonging to the Client;

Documentation means the documents (in whatever media) provided to the Client to

facilitate use of the Service by Users;

Force Majeure means events beyond a party’s reasonable control (preventing or

delaying it from performing its obligations, including war, revolution,

terrorism, riot or civil commotion, strikes, lock outs or other industrial

action, blockage or embargo; acts of or restrictions imposed by

government or public authority; explosion, fire, corrosion, flood,

natural disaster or adverse weather conditions. Force Majeure does

not include inability to pay, mechanical difficulties, shortage or

increase of price of raw materials;

Infringing Data means information or data that (i) infringes Applicable Law; or (ii)

infringes any third party Intellectual Property Rights; or (iii) includes any

material which is obscene, indecent, pornographic, seditious,

offensive, defamatory, threatening, liable to incite racial hatred,

menacing or blasphemous;

Intellectual

Property Rights

means copyright, patents, rights in inventions, rights in confidential

information, know-how, trade secrets, trademarks, service marks,

Pag

e4

trade names, design rights, database rights, rights in data, semi-

conductor chip topography rights, utility models, domain names,

rights in computer software and all similar rights of whatever nature;

Platform means the software or applications listed in Appendix 1;

Service means the remote provision of the Platform to the Client for the

benefit of Users;

Service Hours means 24 hours a day, five days a week (Monday to Friday) GMT;

Subscription Fee means the fee referred to in clause 0 and set out in Appendix 1

(Service);

Support Services means the support services provided by OutThink to the Client and

described in the Schedule;

Uptime means 99.5% of Service Hours;

Users means the employees, contractors, contingent workers, third parties,

etc. allowed access to the OutThink solution by the Client, that are

authorised to use the Service as specified in Appendix 1 (Service);

and

Year means each successive period of 12 months beginning on the

Commencement Date.

2 Service and availability

2.1 OutThink shall make the Service available to Client during the Service Hours to

achieve uptime of 99.5% but excluding:

2.1.1 scheduled maintenance which OutThink shall use reasonable endeavours to

undertake at weekends (Saturday and Sunday);

2.1.2 emergency maintenance; or

2.1.3 downtime caused in whole or part by Force Majeure.

2.2 OutThink will use reasonable endeavours to notify the Client 72 hours in advance of

scheduled maintenance but the Client acknowledges that it may receive no

advance notification.

2.3 Support Services will be available to the Client through the helpdesk during the hours

specified in Appendix 1.

2.4 The Client acknowledges that OutThink shall be entitled to modify the features and

functionality of the Service as part of its ongoing development of the Platform.

OutThink shall use reasonable endeavours to ensure that any such modification does

not adversely affect the Client’s use of the Service.

Pag

e5

3 OutThink warranties

3.1 OutThink warrants to the Client that:

3.1.1 OutThink has the right, power and authority to enter into this Agreement and

grant to the Client the rights contemplated in this Agreement and to supply

the Service; and

3.1.2 the Service will be supplied:

(a) with reasonable care and skill; and

(b) subject to clause 2.4, in accordance in all material respects with the

description of the Service provided in the Documentation;

3.2 OutThink does not warrant or represent that the Service will be free from errors and

interruptions.

3.3 The warranties in this clause are subject to the Client giving notice to OutThink as soon

as it is reasonably able upon becoming aware of the breach of warranty.

3.4 OutThink will not be liable under this clause or be required to remedy any problem

arising from or caused by the Client’s use of the Service in a manner other than as

directed by OutThink.

3.5 The Client acknowledges and agrees that:

3.5.1 OutThink is not and cannot be aware of the extent of any potential loss

resulting from any failure by OutThink to discharge its obligations under this

Agreement;

3.5.2 the Service has not been designed to meet the Client’s individual

requirements and cannot be tested in every operating environment; and

3.5.3 it is the Client’s responsibility to ensure the facilities and functions of the

Service meet the Client’s requirements.

4 Use of the Service

4.1 OutThink grants the Client a non-transferable, non-exclusive right for the term of this

Agreement to allow Users access to the Service.

4.2 Prior to providing Users with access to the Service, the Client shall:

4.2.1 Supply OutThink with the information required during the on boarding process,

such as logo, background image, colour palette, a list of Users (or equivalent if

single sign-on is used), in agreed format, authorised to receive access to the

Service; and

4.2.2 sign-off, once Client’s branding and customisations have been applied; and

4.2.3 configure DNS records, white list OutThink IP address, set up subdomain (e.g.

securityawareness.clientdomain.com), create email addresses or set up email

server to provide Users with a login page and enable communications

between Users and Client’s Administrator, as required; and

4.2.4 ensure that all relevant Users are aware of the terms of this Agreement,

including their obligation to comply with any other user terms applicable to

the Service and notified to the Client.

Pag

e6

4.3 The Client shall comply, and shall procure that Users comply, with the following

conditions of use:

4.3.1 the Service may only be used in connection with the Client’s own business

purposes; and

4.3.2 to ensure optimal User experience and for all functionality to work as

intended, the Service may only be used with compatible, up-to date Internet

browsers as recommended by OutThink: ΙΕ, Firefox, Chrome, Safari, Opera.

4.4 The Client’s rights to benefit from the Service does not permit the Client, or the Users,

to:

4.4.1 copy, cut and paste, email, reproduce, publish, distribute, modify, create

derivative works of, sell or in any way commercially exploit any part of the

Service;

4.4.2 use the Service to provide outsourced services to third parties or make it

available to any third party;

4.4.3 attempt to decompile (as defined in section 50B of the Copyright, Designs

and Patents Act 1988) the underlying software (or any part of it) that is used to

provide the Service, except and only to the extent that such restriction is

prohibited pursuant to section 50B of the Copyright, Designs and Patents Act

1988; and

4.4.4 to observe, study or test the functioning of the underlying software (or any

part of it) that is used to provide the Service, except and only to the extent

that such restriction is prohibited pursuant to section 50B of the Copyright,

Designs and Patents Act 1988.

4.5 The Client warrants that it shall, and ensure that Users shall, keep confidential and not

share with any third party their passwords or access details provided to facilitate

access to the Service. OutThink shall provide training and support the Client

Administrator to upload the initial list of Users. Thereafter it is the responsibility of the

Client to disable former Users and enable new Users using the Platform’s User

management functionality. OutThink will assist with importing new Users as required.

4.6 The Client shall not, and shall ensure that the Users shall not, introduce any malicious

code that may infect or cause damage to the Service or OutThink’s systems, or other

Users or otherwise disrupt the provision of the Service.

4.7 The Client shall not be permitted to frame or mirror any part of the Service other than

as permitted by the Documentation or with OutThink’s express written consent.

4.8 OutThink reserves the right to monitor usage by all Users during the term of this

Agreement for the purpose of ensuring compliance with the terms of this Agreement.

Any audit may be carried out by OutThink or a third party authorised by OutThink. If

any audit reveals that the Client or any User performing activities that are in breach

of this agreement, OutThink reserves the right to remove such account(s).

4.9 In the event of unauthorised use of the Service by the Client or Users, OutThink

reserves the right to suspend the Client or Users’ access to the Service by disabling,

without prior notification, the account(s) that the Client or Users used to access the

Service.

Pag

e7

5 Suspension of access

5.1 OutThink may suspend access to the Service to all or some of the Users if:

5.1.1 OutThink suspects that there has been any misuse of the Service or breach of

this Agreement; or

5.1.2 Following thirty (30) business days from a written warning sent by OutThink to

the Client Accounts Payable and Information Security team, the Client fails to

pay any sums due to OutThink by the due date for payment.

5.2 OutThink will notify the Client immediately after suspending the Service.

5.3 Where the reason for the suspension is suspected misuse of the Service or breach of

this Agreement, OutThink will take steps to investigate the issue and may restore or

permanently suspend access at its discretion.

5.4 In relation to suspensions under clause 5.1.2, access to the Service will be restored

promptly after OutThink receives payment in full and cleared funds.

6 Subscription Fee

6.1 The Client shall pay OutThink the specified Subscription Fee for use of the Service.

6.2 OutThink shall be entitled to review and, if appropriate, increase the Subscription Fee

each year. The increase will take effect from the end of the Initial Licence Term or an

anniversary of that date but OutThink must give at least 60 days’ notice before such

anniversary of the increase in the Subscription Fee if appropriate. The term will then

renew for a further 12 months unless cancelled by either provisions of clause 14.1.

7 Invoicing

7.1 OutThink shall invoice the Client annually for all sums due under this Agreement.

7.2 All prices are inclusive of value added tax (if any) or any other locally applicable

equivalent sales taxes (VAT)

7.3 The Client shall pay such sums in full within 30 days from the date of invoice.

7.4 Amounts payable to OutThink under this Agreement shall be paid into OutThink’s

bank account by electronic funds transfer unless otherwise notified by OutThink to the

Client in writing in accordance with this Agreement.

7.5 If sums due under this Agreement are not paid in full by the due date:

7.5.1 OutThink may, without limiting its other rights, charge interest on such sums at

5% a year above the Bank of England base rate, and

7.5.2 interest shall accrue on a daily basis, and apply from the due date for

payment until actual payment in full, whether before or after judgment.

8 Intellectual Property Rights

8.1 All Intellectual Property Rights in and to the Platform and any part of the Service

belong to and shall remain vested in OutThink.

Pag

e8

8.2 OutThink shall indemnify the Client from and against all losses which are suffered by

the Client in the event that its use of the Service infringes the Intellectual Property

Rights of any third party (OutThink IPR Claim) provided that OutThink shall have no

such liability if the Client:

8.2.1 has caused or contributed in any material way to OutThink IPR Claim by not

using the Service in accordance with this Agreement;

8.2.2 does not notify OutThink in writing setting out full details of any OutThink IPR

Claim of which it has notice as soon as is reasonably possible;

8.2.3 makes any admission of liability or agrees any settlement or compromise of

the relevant OutThink IPR Claim without the prior written consent of OutThink;

8.2.4 does not let OutThink at its request and own expense have the conduct of or

settle all negotiations and litigation arising from the relevant OutThink IPR

Claim; or

8.2.5 does not, at OutThink’s request and own expense, give OutThink all

reasonable assistance in the circumstances described above.

8.3 If any OutThink IPR Claim is made or is reasonably likely to be made against the

Client, OutThink shall promptly and at its own expense either:

8.3.1 procure for the Client the right to continue using the Service; or

8.3.2 modify or replace the infringing part of the Service, and without adversely

affecting the functionality of the Service so as to avoid the infringement,

provided that if OutThink having used its reasonable endeavours, neither of

the above can be accomplished on reasonable terms, OutThink shall refund

the Subscription Fee paid by the Client in respect of the Service. Together with

the indemnity given above, this shall be the Client’s sole and exclusive

remedy in respect of the Service infringing Intellectual Property Rights.

8.4 Client grants to OutThink a non-exclusive revocable licence to use Client Marks solely

for customisation of the Service, solely for the duration of this Agreement.

9 Client Data

9.1 The Client shall not use Infringing Data on the Service.

9.2 The Client grants a royalty-free, non-transferable, non-exclusive licence for the term of

this Agreement to OutThink to use the Client Data to the extent necessary to perform

the Service.

9.3 The Client acknowledges that OutThink has no control over any Client Data hosted as

part of the provision of the Service and does not actively monitor the content of the

Client Data.

9.4 OutThink shall notify the Client immediately if it becomes aware of any allegation that

any Client Data may be Infringing Data and OutThink shall have the right to remove

Client Data from the Service without the need to consult the Client.

9.5 The Client shall indemnify OutThink from and against all loss caused to OutThink as a

result of the Client’s use of Infringing Data on the Service.

Pag

e9

9.6 The Client agrees that OutThink may use aggregated and anonymised Client Data

(whereby no living individual can be identified) for billing and training content

improvement purposes.

10 Information security

10.1 OutThink shall be responsible for taking reasonable and prudent measures to

safeguard the security of the Client Data in its possession, including operating in line

with ISO/IEC 27001 including maintaining appropriate information security controls

such as firewalls, encryption and anti-virus protection, as set out in Appendix 1

(“Service”).

10.2 OutThink shall notify the Client as soon as possible upon discovery of a potential

data security breach impacting the Client Data.

10.3 OutThink shall not be responsible for any loss or damage to Client Data to the extent

that such loss or damage was caused by the Client or a third party.

11 Data protection

11.1 Each party agrees that, in the performance of its respective obligations under this

Agreement, it shall comply with the provisions of the European Union General Data

Protection Regulation (GDPR)to the extent it applies to each of them.

11.2 For the purpose of this clause ‘data controller’, ‘data processor’, ‘data subject’,

‘Information Commissioner’, ‘personal data’ and ‘processing’ shall have the

meanings given to them in the 1998 Act.

11.3 The parties agree that the Client is the data controller in respect of any personal data

that OutThink, the data processor, handles in the course of providing services for the

Client. This does not include the business contact data processed by OutThink to

allow it to manage the Client’s account).

11.4 Accordingly, OutThink agrees that it shall:

11.4.1 only carry out processing of the Client’s personal data on the Client’s

instructions, such instructions at the date of this Agreement are to process the

personal data in order to provide the Services to the Client and the Users and

to enable the Service to respond to automated requests by Users as part of

their normal use of the Service;

11.4.2 implement appropriate technical and organisational measures to protect

personal data against unauthorised or unlawful processing and accidental

destruction or loss, so as to allow the Client to comply with the seventh data

protection principle;

11.4.3 refer to the Client, as soon as reasonably practicable, any requests, notices or

other communication from data subjects, the Information Commissioner or

any other law enforcement authority, for the Client to resolve.

11.5 OutThink, as data processor, will not transfer personal data processes on the Client’s

behalf to countries outside the European Economic Area (EEA). However, where the

Platform is accessed by the Client from a country outside EEA, such a transfer of

personal data outside the EEA may take place by reason of the Client’s actions and

the Client consents to such a transfer.

Pag

e10

12 Confidentiality

12.1 Each party agrees that it may use the other party’s Confidential Information only in

the performance of its rights and obligations under this Agreement and that it shall

not disclose the other party’s confidential information except in accordance with this

clause 12.

12.2 Each party may disclose the other party’s Confidential Information to those of its

employees, officers, advisers, agents or representatives who need to know the other

party’s confidential information in order to perform the disclosing party’s rights and

obligations under this Agreement provided that the disclosing party shall ensure that

each of its employees, officers, advisers, agents or representatives to whom

confidential information is disclosed is aware of its confidential nature and complies

with this clause 12 as if it were a party.

12.3 Each party may disclose any Confidential Information required by law, any court, any

governmental, regulatory or supervisory authority (including any regulated investment

exchange) or any other authority of competent jurisdiction.

12.4 The Client may use Deliverables derived from the Platform and share them with any

holding company or subsidiary of the Client (as defined by Section 1159 of the

Companies Act 2006). Client will not share such Deliverables with third parties without

the written consent of OutThink, such consent not to be unreasonably withheld.

13 Limitation of liability

13.1 The extent of the parties’ liability under or in connection with this Agreement

(regardless of whether such liability arises in tort, contract or in any other way and

whether or not caused by negligence or misrepresentation) shall be as set out in this

clause 13.

13.2 Subject to clause 13.5, OutThink’s total liability shall not exceed:

13.2.1 100% of the Subscription Fees paid to OutThink in the 12–month period

immediately preceding the first incident giving rise to the loss, or

13.2.2 for incidents occurring in the first 12 months of this Agreement, an amount

equal to 100% of the projected Subscription Fees for that period.

13.3 Subject to clause 13.5, OutThink shall not be liable for consequential, indirect or

special losses.

13.4 Subject to clause 13.5, OutThink shall not be liable for any of the following: loss of

profit, loss of data, loss of use, loss of production, loss of contract, loss of opportunity,

loss of savings, discount or rebate (whether actual or anticipated) and harm to

reputation or loss of goodwill.

13.5 Notwithstanding any other provision of this Agreement, the liability of the parties shall

not be limited in any way in respect of the following:

13.5.1 death or personal injury caused by negligence;

13.5.2 fraud or fraudulent misrepresentation;

13.5.3 any other losses which cannot be excluded or limited by applicable law;

Pag

e11

14 Term and termination

14.1 This Agreement will begin on the Commencement Date and continue for a period of

twelve months (the Initial Licence Term), unless otherwise terminated earlier in

accordance with the provisions of this Agreement. Following the Initial Licence Term

and any renewed term, this licence shall automatically renew for successive one-year

term including any fee increase notified by OutThink to the Client in accordance with

the provisions of clause 6.2 unless either party provides written notice of its decision

not to renew the licence to the other at least 30 days prior to the expiry of the then

current term.

14.2 OutThink may terminate this Agreement at any time by giving notice in writing to the

Client if:

14.2.1 the Client or any User commits a material breach of this Agreement and such

breach is not remediable;

14.2.2 the Client or any User commits a material breach of this Agreement which is

not remedied within 30 days of receiving written notice of such breach;

14.2.3 the Client has failed to pay any amount due under this Agreement on the

due date and such amount remains unpaid within 30 days after the Client has

received notification that the payment is overdue; or

14.3 Either party may terminate this Agreement at any time by giving notice in writing to

the other party if that other party ceases carrying on business, enters into

administration, receivership, liquidation or company voluntary arrangement or is

unable to pay its debts as they fall due.

14.4 Termination or expiry of this Agreement shall not affect any accrued rights and

liabilities of either party at any time up to the date of termination.

15 Exit and return of Client Data

15.1 In the event of termination of this Agreement for any reason:

15.1.1 the right to access the Service provided under this Agreement shall terminate

immediately; and

15.1.2 The Client shall, within thirty days, destroy all OutThink’s Confidential

Information or Documentation in its possession or under its control.

15.2 On the termination or expiry of this Agreement, OutThink shall destroy all Client Data

from its production systems within 30 days from such termination or expiry. Client Data

will continue to reside in backups for up to 12 months after termination. Such data

will be retained for the life of the backup of 12 months and then destroyed.

16 Entire agreement

16.1 The parties agree that this Agreement constitutes the entire agreement between

them and supersedes all previous agreements, understandings and arrangements

between them, whether in writing or oral in respect of its subject matter.

Pag

e12

16.2 Each party acknowledges that it has not entered into this Agreement in reliance on,

and shall have no remedies in respect of, any representation or warranty that is not

expressly set out in this Agreement. No party shall have any claim for innocent or

negligent misrepresentation on the basis of any statement in this Agreement.

17 Force majeure

Neither party shall have any liability under or be deemed to be in breach of this

Agreement for any delays or failures in performance of this Agreement which result

from any event beyond the reasonable control of that party. The party affected by

such an event shall promptly notify the other party in writing when such an event

causes a delay or failure in performance and when it ceases to do so. If such an

event continues for a continuous period of more than 3 months, either party may

terminate this Agreement by written notice to the other party.

18 Notices

18.1 Notices under this Agreement shall be in writing and sent to a party's address as set

out on the first page of this Agreement [or email address] set out below). Notices may

be given, and shall be deemed received:

18.1.1 by first-class post: seven Business Days after posting; and

18.1.2 by airmail: seven Business Days after posting; and

18.1.3 by hand: on delivery; and

18.1.4 by email to hello@outthinkthreats.com: on delivery; and

18.2 This clause does not apply to notices given in legal proceedings or arbitration.

19 Severability

19.1 Each clause of this Agreement is severable and distinct from the others. If any clause

in this Agreement (or part thereof) is or becomes illegal, invalid or unenforceable

under applicable law, but would be legal, valid and enforceable if the clause or

some part of it was deleted or modified (or the duration of the relevant clause

reduced):

19.1.1 the relevant clause (or part thereof) will apply with such deletion or

modification as may be required to make it legal, valid and enforceable; and

19.1.2 without limiting the foregoing, in such circumstances the parties will promptly

and in good faith seek to negotiate a replacement provision consistent with

the original intent of this Agreement as soon as possible.

20 Waiver

No failure, delay or omission by either party in exercising any right, power or remedy

provided by law or under this Agreement shall operate as a waiver of that right,

power or remedy, nor shall it preclude or restrict any future exercise of that or any

other right or remedy. No single or partial exercise of any right, power or remedy

Pag

e13

provided by law or under this Agreement shall prevent any future exercise of it or the

exercise of any other right, power or remedy.

21 Set off

Each party must pay all sums that it owes to the other party under this Agreement

without any set-off, counterclaim, deduction or withholding of any kind, save as may

be required by law.

22 Assignment

No party may assign, subcontract or encumber any right or obligation under this

Agreement, in whole or in part, without the other’s prior written consent [(such

consent not to be unreasonably withheld or delayed)].

23 Third party rights

Except as expressly provided for in this Agreement, a person who is not a party to this

Agreement shall not have any rights under the Contracts (Rights of Third Parties) Act

1999 to enforce any of the provisions of this Agreement.

24 Governing law

This Agreement and any dispute or claim arising out of, or in connection with, it, its

subject matter or formation (including non-contractual disputes or claims) shall be

governed by, and construed in accordance with, the laws of England and Wales.

25 Jurisdiction

The parties irrevocably agree that the courts of England and Wales shall have

exclusive jurisdiction to settle any dispute or claim arising out of, or in connection with,

this Agreement, its subject matter or formation (including non-contractual disputes or

claims).

Pag

e14

APPENDIX 1

Service

1. Services

OutThink Solution (SaaS)

OutThink Solution delivered as a Managed Service

OutThink Security Awareness Learning Content

2. Users

OutThink shall provide training and support the Client to upload the initial list of Users.

User identities will be created and authentication managed (please select one):

Manually and credentials sent via email to each user

CSV import and credentials sent via email to each user

Integration with Active Directory and authentication via SSO (e.g. SAML)

User identities can be created, modified or removed by using the Platform’s user

management functionality available to Administrators.

3. Usage limits

The annual licence granted to the Client is for an agreed number of Users.

The Platform will tolerate additional 10% of Users, to accommodate Client’s

immediate needs (e.g. joiners). OutThink will review usage every 90 days and invoice

the Client the agreed prce per User, when the Client goes over the agreed number

of Users.

When the Client’s use of the Platform exceeds 110% of the number of licensed Users,

OutThink will notify the Client. OutThink will offer an increased Subscription Fee on a

pro-rata basis.

Pag

e15

4. Support services

OutThink’s support can be reached via email to support@outthinkthreats.com or via

telephone to OutThink in the United Kingdom, +44 20 3389 5669.

Live support staff work 8 hours a day, 08:00 – 16:00 GMT (core hours), Monday to

Friday. Special cases that require support outside of those hours can be scheduled.

Additionally, support requests may be submitted by e-mail or web 24/7. Outside

working hours support requests are placed in a queue for processing by the team

during working hours.

For emergency support, Enterprise clients can email support@outthinkthreats.com

with Emergency Support in subject and emails will be responded by a member of

OutThink’s team, in under 10 minutes.

5. Resolution Time

Every support request that comes in during core hours is entered on to the tracking

system and processed on that shift. If a request comes in outside core hours, then it is

processed the following business day. We generally try to fulfil general account

maintenance requests on the same day. The main registration requests take two

days to complete, other issues may take longer but the Client will receive timely

updates. Sometimes issues require co-operation and testing between OutThink

support and the Client.

All requests will be acknowledged within 4 working hours during core hours.

Resolution times will vary depending on the nature of the request.

6. Information security measures

OutThink is responsible to ensure adequate information security controls that meet or

exceed ISO/IEC 27001 requirements.