Master Subscription Agreement

This Master Subscription Agreement ("Agreement") sets forth the terms and conditions governing Customer's use of Provider's Cloud Service. The Agreement incorporates the Bonterms Cloud Terms (Version 1.0), which is available at Bonterms Cloud Terms and a reference copy of which is attached as Attachment 3. By executing an Order that references this Agreement, Customer and Provider agree to be bound by the terms herein.

Key Terms

• Effective Date means the effective date of the first Order executed by the parties that references this Agreement.
• Governing Law means the laws of the state of California.
• Courts means a federal court in the County of San Francisco, California.
• Order means any documented order pursuant to which Customer orders the Cloud Service that is signed by both parties and references this Agreement.

Attachments

The following attachments are incorporated into the Agreement by this reference:

• Attachment 1: Security Measures
• Attachment 2: Data Protection Addendum
• Attachment 3: Reference Copy of Bonterms Cloud Terms

Additional Terms

1. Definitions

The following terms shall have the following meanings:

• Customer Data means all email, calendar and related content and information provided or submitted by Customer or its Users.
• Data Protection Laws has the meaning given in the DPA.
• Email Body Data means any content in the message bodies of emails included in the Customer Data.
• Personal Accounts means Users' personal email accounts controlled by the User individually or by organizations other than Customer.
• Personal Data has the meaning given in the DPA.
• Platform means Provider's proprietary relationship management platform, which is used to provide the Cloud Service.
• Privacy Policy means Provider's privacy policy available at Privacy Policy.
• Processing has the meaning given in the DPA.
• Users' Contacts means information about Users' contacts derived from signature information and headers in the emails of Users.

2. Cloud Service Updates; Beta Features

Provider may update, modify and improve the Cloud Service and the Platform from time to time. From time to time, Provider may make "beta" or other experimental features or tools available to Customer.

3. Users

Each User will create unique account credentials associated with their Customer-controlled email account to access the Cloud Service. Customer is responsible for setting applicable access rights of Users.

4. Users' Contacts

The Platform is designed to enable users to utilize information about their interactions with both their personal and professional contacts.

5. Privacy

The parties shall comply with all Data Protection Laws in the performance of their respective obligations under this Agreement. Customer shall ensure that Customer Data does not include any prohibited data as specified in this section.

6. Customer Data Responsibility

Customer and its Users will have access to the Customer Data and will be responsible for all changes to and/or deletions of Customer Data.

7. Third-Party Platforms

Customer is responsible for enabling the integration of Third-Party Platforms and for notifying such providers of the integration.

8. AI Features

The Cloud Service may include AI features that utilize third party AI companies' technology and/or Provider's proprietary machine learning technology.

9. Support

Provider makes Cloud Service support available via email at support@ctd.ai.

10. Service Level Agreement

The Cloud Service shall be available 99.5% of each calendar month during the Order Term, excluding portions during which the Cloud Service is undergoing Scheduled Maintenance.

Attachment 1: Security Measures

1. Organizational management and dedicated staff responsible for the development, implementation and maintenance of the Provider's information security program.
2. Audit and risk assessment procedures for periodic review and assessment of risks.
3. Data security controls including logical segregation of data and utilization of encryption technologies for Customer Personal Data.
4. Logical access controls based on authority levels and job functions.
5. Password controls designed to manage and control password strength.
6. System audit or event logging and related monitoring procedures.
7. Physical and environmental security of data centers.
8. Operational procedures and controls to provide for configuration, monitoring and maintenance of technology.
9. Change management procedures designed to test, approve and monitor all material changes.
10. Incident management procedures designed to allow Provider to investigate and respond to incidents.
11. Network security controls designed to protect systems from intrusion.
12. Vulnerability assessment, patch management and threat protection technologies.
13. Business resiliency/continuity and disaster recovery procedures.

Attachment 2: Data Protection Addendum

This DPA Setup Page is incorporated into the Agreement by reference. The DPA includes the contents of this DPA Setup Page, including the Key Terms and Schedules set forth below.

KEY TERMS

• DPA Effective Date means the date Customer first used the Cloud Service.
• Subprocessor List means the list available at Subprocessors List.

SCHEDULES

• Schedule 1: Subject Matter and Details of Processing
• Schedule 2: Technical and Organizational Measures
• Schedule 3: Cross-Border Transfer Mechanisms
• Schedule 4: Region-Specific Terms

Schedule 1: Subject Matter and Details of Data Processing

• Activities: Activities associated with the email domain identified in the Order.
• Role: Customer is Data Exporter and Controller and Provider is Data Importer and Processor.
• Categories of Data Subjects: Users.
• Categories of Customer Personal Data: Users' emails and data derived from them.
• Nature of the Processing: Provision of digital relationship analytics platform.
• Purpose of the Processing: To provide the Services as initiated by Customer.
• Duration of Processing / retention period: Duration of the term of the Agreement.

Schedule 2: Technical and Organizational Measures

The Security Measures are incorporated into this Schedule 2 by reference.

Schedule 3: Cross-Border Transfer Mechanisms

• EU Transfers: The EU SCCs are hereby incorporated by reference.
• UK Transfers: The EU SCCs apply with modifications as set forth in this Schedule.

Schedule 4: Region-Specific Terms

A. CALIFORNIA

1. Obligations: Provider will comply with its applicable obligations under the CCPA.
2. Provider will not sell or share Customer Personal Data received under the Agreement.

Attachment 3: Reference Copy of Bonterms Cloud Terms

1. The Agreement. To use the Bonterms Cloud Terms, Customer and Provider complete and execute a Cover Page that specifies Key Terms and Attachments. 2. Cloud Service. Subject to this Agreement, Customer may use the Cloud Service for its own business purposes. 3. Users. Customer may permit Users to use the Cloud Service on its behalf. 4. Data. Subject to this Agreement, Provider will access and use Customer Data solely to provide and maintain the Cloud Service.