Master Subscription Agreement

Effective as of January 1, 2020

THIS MASTER SUBSCRIPTION AGREEMENT ("AGREEMENT") IS BETWEEN TEKION CORP, A CORPORATION DULY ORGANIZED AND EXISTING UNDER THE LAWS OF THE STATE OF DELAWARE, HAVING ITS PRINCIPAL PLACE OF BUSINESS AT 5934 GIBRALTAR DRIVE, PLEASANTON, CALIFORNIA, USA 94588 ("WE," "US," "OUR," OR "TEKION") AND YOU ("CUSTOMER" OR "YOU") AND SETS FORTH THE TERMS AND CONDITIONS GOVERNING ORDERS PLACED UNDER THIS AGREEMENT AND IS EFFECTIVE AS OF THE DATE ACCEPTED BY YOU ("EFFECTIVE DATE").

BY ACCEPTING THIS AGREEMENT, YOU AGREE TO THE TERMS OF THIS AGREEMENT AND ACKNOWLEDGE RECEIPT OF OUR PRIVACY NOTICE IN A LEGALLY BINDING MANNER. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY AND ITS AFFILIATES TO THESE TERMS AND CONDITIONS, IN WHICH CASE THE TERMS "YOU" OR "YOUR" SHALL REFER TO SUCH ENTITY AND ITS AFFILIATES. IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT AGREE WITH THESE TERMS AND CONDITIONS, YOU MUST NOT ACCEPT THIS AGREEMENT AND MAY NOT USE THE SERVICES. NO terms that are conflicting with, or additional to, the terms set forth in this agreement will apply with respect to use under this agreement even if we require that those terms be “accepted” in order to access or use the services.

YOU MAY NOT ACCESS THE SERVICES IF YOU ARE OUR COMPETITOR, EXCEPT WITH OUR PRIOR WRITTEN CONSENT. IN ADDITION, YOU MAY NOT ACCESS THE SERVICES FOR PURPOSES OF BENCHMARKING OR OTHER COMPETITIVE PURPOSES.

  1. DEFINITIONS
    1. Any capitalized terms that are not specifically defined in this Agreement can be found in the supplemental terms and conditions available here.
    2. "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. "Control", for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
    3. "Agreement" means this Master Subscription Agreement, the SLA (as may be updated from time to time in accordance with this Agreement) and includes the Order Forms and User Documentation.
    4. "Beta Service" means any application, feature, function or other technology that We (i) may make available to You to try at Your option at no additional charge, (ii) have not made generally available to Our customers, and (iii) have designated as pilot, beta, limited release, developer preview, non-production, evaluation or by description of similar import.
    5. "Change Order" means any change to an Order Form. Change Orders will be deemed incorporated by reference in the applicable Order Form.
    6. "Cloud Services" means any distinct, subscription-based, on-demand products and services offered by Us under the name "Tekion Cloud" or successor branding that You order under a free trial or an Order Form and We make available to You online via password-protected customer login, including any associated offline and mobile components.
    7. "Content" means information obtained by Us from publicly available sources or Our third-party content providers, including but not limited to Third Party Forms, and made available to You through the Services, or pursuant to an Order Form, as more fully described in the User Documentation.
    8. "Contract Property" means anything developed by Us for You, including Deliverables, under this Agreement.
    9. "Data Protection Laws" means all Laws, in applicable jurisdictions worldwide, that relate to (i) the confidentiality, Processing, privacy, security, protection, transfer or trans-border data flow of Personal Data, or (ii) electronic data privacy; whether such Laws are in place as of the effective date of the Agreement or come into effect during the term. Without limiting the foregoing, Data Protection Laws includes, as applicable, California Consumer Privacy Act, California Privacy Rights Act, Virginia Consumer Data Protection Act, Colorado Privacy Act, and any rules or regulations promulgated under the foregoing.
    10. "DPA" means Our standard data protection addendum attached as EXHIBIT VII.
    11. "Deficiency" means a failure to perform in accordance with the Specifications for a Deliverable which is reproducible.
    12. "Deliverable" means the work product or other materials provided by Us to You in connection with the Services which are listed as deliverables under the applicable Order Form.
    13. "Equipment" means the hardware and other equipment (proprietary and/or third party) provided by Us to You as listed in the Order Forms.
    14. "Exhibits" means exhibits to this Agreement.
    15. "Force Majeure Event" means circumstances beyond either party’s reasonable control, including without limitation acts of God, flood, fire, earthquake or explosion, war, terrorism, invasion, riot or other civil unrest, embargoes or blockades in effect on or after the date of this Agreement, national or regional emergency, passage of Law or any action taken by a governmental or public authority, including imposing an embargo, export or import restriction, quota or other restriction or prohibition or any complete or partial government shutdown, or national or regional shortage of adequate power or telecommunications or transportation, or other similar cause beyond reasonable control of a party such that it could not have been prevented by reasonable precautions.
    16. "Law" means any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, common law, judgment, decree or other requirement of any federal, state, local or foreign government or political subdivision thereof, or any arbitrator, court or tribunal of competent jurisdiction.
    17. "Malicious Code" means viruses, worms, time bombs, Trojan horses, ransomware, spyware, adware, scareware, and any other malicious codes, files, scripts, agents or programs intended to do harm.
    18. "Order Form" means an ordering document or online order specifying the Services to be provided hereunder that is entered into between You and Us or Your Affiliate and Us, including any addenda and supplements thereto.
    19. "Personal Data" means any information that We collect or receive from or on behalf of You or any of Your Users, or otherwise Process (as defined in the DPA) on Your behalf, relating to an identified or identifiable natural person. For the avoidance of doubt, Personal Data includes, without limitation: information that can be used to identify, contact, or locate a specific individual; information that can be combined with other information to identify, contact or locate a specific individual; information about individual Users and Your personnel, directors, officers, agents, suppliers, contractors, investors or customers; all "nonpublic personal information," as defined under the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.); all "protected health information" as defined under the Health and Insurance Portability and Accountability Act of 1996 (42 U.S.C. § 1320d); and all "Personal Data," "Personal Information" and other personally-identifiable information under applicable Data Protection Laws.
    20. "Personal Data Breach" means any actual or reasonably suspected unauthorized, accidental or unlawful access to, or misuse, encrypting or ransoming, compromise, disclosure, acquisition, destruction, loss, or alteration of Personal Data transmitted, stored or otherwise Processed by Us or Our Sub-Processors in connection with this Agreement. "Personal Data Breach" does not include unsuccessful attempts or activities that do not compromise the confidentiality, security, integrity, or availability of Personal Data, such as unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked system.
    21. "Planned Maintenance" means planned maintenance as set forth in SLA.
    22. "Services" means the services and products (including hardware) below provided by Us to You:
      1. the Cloud Services;
      2. the Equipment;
      3. the Tekion Lab Services;
      4. Tekion Forms; and
      5. Tekion CRM.
      "Services" exclude Content and Third Party Applications.
    23. "SLA" means the Tekion Production Support and Service Level Availability Policy enclosed as EXHIBIT I, which may be updated by Us from time to time. No update shall materially diminish Our responsibilities under the SLA.
    24. "Specifications" means the technical requirements set out in the applicable Order Form or User Documentation.
    25. "Sub-Processor" means any third-party engaged by Us or Our affiliates to assist in fulfilling Our obligations with respect to the Agreement, including without limitation any third-party that We or Our affiliate entrust, or a Sub-Processor entrusts at our direction, with the transmission, storage or other Processing of Personal Data. Sub-Processors may include third parties or Our affiliates but will exclude any of Our employees or consultants.
    26. "Tekion CRM" means Our customer relationship management product and related technologies, including technology licensed by Us and incorporated into Our customer relationship management product and related technologies. Tekion CRM does not include Third Party Applications.
    27. "Tekion Forms" means forms and materials that are developed, owned, and licensed to You, by Us and used by motor vehicle dealers to (i) sell, lease, or finance motor vehicles and (ii) sell insurance and warranty products.
    28. "Tekion Lab Services" means the consulting services to be provided by Us as listed in an Order Form such as Tekion Cloud implementation services.
    29. "Third Party Application" means a web-based or offline software application that is provided by a third party and which may interoperate with the Services.
    30. Third Party Forms" means forms and marketing materials that are developed or licensed by a third party to You or to Us and used by motor vehicle dealers to (i) sell, lease, or finance motor vehicles and (ii) sell insurance and warranty products.
    31. "User" means an individual who is authorized by You to use a Service, for whom You have purchased a subscription (or in the case of any Services provided by Us without charge, for whom a Service has been provisioned), and to whom You (or, when applicable, Us at Your request) have supplied a user identification and password. Users may include, for example, Your employees, consultants, contractors and agents, and third parties with whom You transact business.
    32. "User Documentation" means the applicable Service’s technical and functional documentation (including service level agreements and product guides in any form or medium, including training videos) and its usage guides and policies, as updated from time to time (subject to the terms of this Agreement).
    33. "We," "Us" or "Our" means Tekion Corp. and its Affiliates as applicable.
    34. "You" or "Your" means the company or other legal entity for which You are accepting this Agreement, and Affiliates of that company or entity which have signed Order Forms.
    35. "Your Data" means any data or information that is (i) submitted by or for You or Your Users in relation to the Services, excluding (i) Content, (iii) Third Party Applications; and (iv) Contract Property. For the avoidance of doubt, Your Data includes any Personal Data contained therein.
  2. PROVISION OF SERVICES
    1. Provision of Services. We will make the Services and Content available to You pursuant to this Agreement, the SLA, the terms and conditions for the Services, the applicable Order Forms, and User Documentation. By entering into an Order Form hereunder, an Affiliate agrees to be bound by the terms of this Agreement as if it were an original party hereto. Cloud Services are designed to be available 24/7 subject to the Exceptions set forth in the SLA.
    2. Provision of Equipment. We will provide You the Equipment listed in an Order Form and User Documentation to support Your use of the Cloud Services. You will provide any hardware, software, connectivity or licenses necessary to access and use the Cloud Services. We will not be responsible or liable for any errors or issues that arise from the malfunction or failure of any of the foregoing, unless such malfunction or failure was caused by the Services or any instructions provided to You by Us. You will ensure that Your Internet connectivity meets the minimum requirements specified by Us in the User Documentation. You will also provide a suitable installation environment for the Equipment, and provide and install all site-specific wiring, cabling, electrical and other utilities required for installing the Equipment and providing access to the Cloud Services.
    3. Beta Services. From time to time, We may make Beta Services available to You at no charge. You may choose, in Your sole discretion, whether or not to try such Beta Services. Beta Services are intended for evaluation purposes and not for production use, are not supported, and are subject to additional terms. For avoidance of doubt, Beta Services are not considered "Services" under this Agreement and will be governed by a separate agreement to be entered into between You and Us. Unless otherwise stated, any Beta Services trial period will expire upon the earlier of one year from the trial start date or the date that a version of the Beta Services becomes generally available without the applicable Beta Services designation.
  3. USE OF CLOUD SERVICES, EQUIPMENT AND CONTENT
    1. License to Use the Service. We hereby grant You a limited, non-exclusive and non-transferable right and license to use the Services, solely for Your own business purposes, subject to the terms and conditions of this Agreement, the applicable Order Forms and User Documentation. All rights and licenses granted by Tekion under this Agreement are and shall be deemed to be rights and licenses to "intellectual property," and the subject matter of this agreement, including all Services, is and shall be deemed to be "embodiment[s]" of "intellectual property" for purposes of and as such terms are used in and interpreted under section 365(n) of the United States Bankruptcy Code (11 U.SC. § 365(n)).
    2. Subscriptions. Unless otherwise provided in the applicable Order Form or User Documentation, (a) Cloud Services and access to Content are purchased as subscriptions pursuant to an Order Form, (b) subscriptions may be added during a subscription term via an Order Form at the same pricing as the underlying subscription pricing, prorated for the portion of that subscription term remaining at the time the subscriptions are added, and (c) any added subscriptions will terminate on the same date as the underlying subscriptions.
    3. Usage Limits. Cloud Services and Content may be subject to usage limits specified in Order Forms and User Documentation. Access credentials for the Cloud Service may not be used by more than one User, but may be transferred from one User to another if the original User is no longer using, or permitted to use, the Cloud Service. A User’s password cannot be shared with any other individual or entity. We may monitor Your use to verify compliance with usage metrics (if applicable), volume and the Agreement. If You exceed a contractual usage limit, We will work in good faith with You to try to reduce Your usage so that it conforms to that limit. If, notwithstanding Our efforts, You are unable or unwilling to abide by a contractual usage limit, You must enter into an Order Form for additional quantities of the applicable Cloud Services or Content promptly upon Our request, and/or pay any invoice for excess usage in accordance with Section 5.
    4. Security: You must keep Your registration information accurate and complete during the term of the Agreement. You are responsible for the security of passwords of all Users, for all activities that occur in User accounts, and for Your Users' compliance with this Agreement, the User Documentation, Order Forms and applicable laws and regulations. You must use commercially reasonable efforts to prevent unauthorized use of, or access to, the Services and must promptly notify Us: (a) of any unauthorized use of, or access to, a User’s account; or (b) if any password is lost, stolen, disclosed to an unauthorized party or otherwise compromised, of which You become aware.
    5. Acceptable Use: You must not: (a) make the Services or Content available to, or use the Services or Content for the benefit of, anyone other than You, (b) modify, copy or create derivative works based on the Services; (c) disassemble, reverse engineer, or decompile the Services or part thereof; (d) copy any ideas, features, content, functions, user interface or graphics of the Services, or copy any Content other than for the intended use of the Services, (e) use the Service in a way intended to work around the Service’s technical limitations, recurring fees calculation, or usage limits, (f) use the Services or Third Party Application to store or transmit infringing, libelous, offensive, unlawful or tortious material, or material in violation of Law, (g) use the Services or Third Party Application to store or transmit Malicious Code, (h) interfere with or disrupt the integrity or performance of the Services or third-party data contained therein, (i) attempt to gain unauthorized access to any Service or Content or its related systems, platforms or networks, (j) access the Services for purposes of building a competitive product or service; (k) release any results of performance tests related to Services to any third party in violation of Section 8 (Confidential Information); (l) modify, delete or remove any ownership, title, trademark, patent or copyright notices from the Services; (m) use any components of the Services separately from the Services; (n) unless otherwise set forth in this Agreement, sell, distribute, rent, lease, sublicense, display, modify, time share, outsource or otherwise provide the Services or Content to any third party or use it in a service bureau or outsourcing environment, (o) use the Services in violation of this Agreement, the Order Form, or User Documentation, or (p) modify, copy, sublicense, misuse, obscure any trademark, proprietary or similar notices on, or permit the unauthorized use of, any Third Party Forms without prior written consent of the third party that licensed or owns the Third Party Forms. We reserve the right, but have no obligation, to investigate any violation of this provision or misuse of the Services. Any use of the Services or Content by You or a User that: (a) is in breach of this Agreement, User Documentation, Order Forms or our policies, or (b) in Our judgment, threatens the security, integrity or availability of the Services, may result in immediate suspension of the Services; provided that We will provide You with notice and an opportunity to remedy such violation or threat prior to such suspension, and will limit the suspension in time and scope as reasonably possible under the circumstances. We may monitor and access Your account in order to respond to Your requests for technical support, to ensure proper functioning of the Services, and to improve the Services.
    6. Conversions. We will use reasonable efforts to convert data system files of all Your stores (existing and future) converting to Us from your existing dealer management or other systems and such conversion efforts will be covered by our implementation fees agreed in the relevant Order Forms. You will extend all reasonable cooperation to Us in such conversion by providing Us with the back-up tapes, output records, reports and other necessary information and documentation required to perform the above-mentioned conversion. We will use reasonable efforts to complete the data conversion as soon as reasonably practicable (to the extent within our control) and will use reasonable efforts to keep system down time to a minimum during the conversion process.
    7. Your Legal Compliance. You are responsible for ensuring that: (i) You comply with all applicable federal, state, and local laws, rules and regulations, such as, without limitation, those related to advertising, electronic communications and solicitations, telemarketing, "do not call" and "do not contact" compliance, call recording, privacy and consumer protection including but not limited to Section 5 of the FTC Act (15 U.S.C. Section 45), the CAN-SPAM Act (15 U.S.C. Sections 7701-7713), the Telemarketing Consumer Fraud and Abuse Prevention Act (15 U.S.C. Sections 1601-1608), the Federal Trade Commission Telemarketing Sales Rule (16 C.F.R. 310.1, et seq.), and the Federal Communications Commission telemarketing regulations (47 C.F.R. 64.1200 et seq.); and (ii) Your content, materials and information created and transmitted while using the Services complies with applicable law, including, without limitation, email campaigns, telephone scripts, opt-in/opt-out notifications or disclaimers transmitted through the Services by any medium of communication. You bear the sole responsibility for ensuring that proper "unsubscribe", "do not call", "do not contact" and other privacy and consumer protection protocols are in use.
  4. THIRD PARTY PROVIDERS
    1. Third-Party Products and Services. We or third parties may make available third-party products or services, including, for example, Third Party Applications and implementation, other consulting services, and Your use of Third Party Forms. Your use of such third-party products is at Your discretion and at Your own risk and is not required for use of the Services. Any acquisition by You of such products or services, and any exchange of data between You and any third-party provider, product or service is solely between You and the applicable third-party provider. WE DO NOT WARRANT OR SUPPORT THIRD PARTY APPLICATIONS, THIRD PARTY FORMS, OR OTHER THIRD-PARTY PRODUCTS OR SERVICES, WHETHER OR NOT THEY ARE DESIGNATED BY US AS "CERTIFIED", UNLESS EXPRESSLY PROVIDED OTHERWISE.
    2. Integration with Third Party Applications. The Services may contain features designed to interoperate with Third Party Applications and Third Party Forms. To use such features, You may be required to obtain access to such Third Party Applications and Third Party Forms from their providers. These Third Party Applications and Third Party Forms are not part of the Services and the Agreement does not apply to them. We cannot guarantee the continued availability of such Service features, and may cease providing them without entitling You to any refund, credit, or other compensation, if for example and without limitation, the provider of a Third Party Application or Third Party Form ceases to make the Third Party Application or Third Party Form available for interoperation with the corresponding Service features in a manner acceptable to Us.
    3. Third Party Applications and Your Data. If You choose to use a Third Party Application with a Service, You grant Us permission to allow the Third Party Application and its provider to access Your Data as required for the interoperation of that Third Party Application with the Service. We are not responsible for any use, disclosure, modification or deletion of Your Data resulting from access by such Third Party Application or its provider.
    4. Third-Party Content. Any third-party Content, including the Third Party Forms, we make accessible is provided on an "as-is" and "as available" basis without any warranty of any kind. You acknowledge and agree that We are not responsible for, and have no obligation to control, monitor, or correct, third-party Content. We disclaim all liabilities arising from or related to third-party Content.
    5. Removal of Content and Third Party Applications. If We are required by a licensor to remove Content, or receive information that Content provided to You may violate applicable Law or third-party rights, We may so notify You and in such event, You will promptly remove such Content from Your systems. If We receive information that a Third Party Application hosted on a Service or a Third Party Form may violate applicable Law or third-party rights, We may so notify You and in such event, You will promptly either (i) disable such Third Party Application or Third Party Form or (ii) modify the Third Party Application or Third Party Form to resolve the potential violation. If You do not take the required action as aforesaid, We may disable the applicable Content, Service and/or Third Party Application until the potential violation is resolved.
    6. Mobile Access to Cloud Services. You or Your Users may access certain Cloud Services through mobile applications obtained from third-party websites such as Android or Apple app store. The use of mobile applications may be governed by the terms and conditions presented upon download/access to the mobile application and not by the terms of the Agreement.
  5. FEES AND PAYMENT
    1. Cloud Service Fees and Equipment Charges. You will pay all fees specified in Order Forms. Except as otherwise specified in an Order Form or expressly agreed by Us in writing, (a) fees for Cloud Services are based on Cloud Services and Content subscriptions purchased and not actual usage, and (b) quantities purchased cannot be decreased during the relevant subscription term.
    2. Tekion Lab Fees and Incidental Expenses. You will pay Us for the Tekion Lab Services at the rates specified in the applicable Order Form. Tekion Lab Services may be charged on a one-time, recurring, time-and-materials or fixed fee basis as provided in an Order Form. We will periodically update You on the status of the Tekion Lab Services and the fees accrued under Order Forms. You will reimburse Us for reasonable travel and out-of-pocket expenses incurred in connection with Tekion Lab Services. If an estimate of incidental expenses is provided in the applicable Order Form, We will not exceed such estimate without Your written consent.
    3. Invoicing and Payment. All fees will be invoiced and must be paid in advance in accordance with the billing frequency stated in the applicable Order Form except for charges for Tekion Lab Services billed on a time-and-materials basis, which will be invoiced monthly in arrears unless otherwise expressly stated in the applicable Order Form. Unless otherwise stated in an Order Form, invoiced charges are due net 30 days from the invoice date. You are responsible for providing complete and accurate billing and contact information to Us and notifying Us of any changes to such information.
    4. Overdue Charges. If any invoiced amount is not received by Us by the due date, then without limiting Our rights or remedies, (a) those charges may accrue late interest at the rate of 1.5% of the outstanding balance per month, or the maximum rate permitted by Law, whichever is lower, and/or (b) We may condition future renewals and Order Forms on payment terms shorter than those specified in Section 5.3. For all past due invoices, You agree to pay all costs of collection (including collection agency fees), reasonable attorney fees and court costs. You agree to submit any disputes regarding fees in writing to Us within 30 days of the disputed invoice, otherwise the dispute will be waived and the fees therein will be final and not subject to challenge.
    5. Suspension of Service and Acceleration. If any amount owed by You under this Agreement is 90 or more days overdue, We may, without limiting Our other rights and remedies, accelerate Your unpaid fee obligations so that all such obligations become immediately due and payable, and suspend Our services to You until such amounts are paid in full. Other than for customers paying by credit card or direct debit whose payment has been declined, We will give You at least 10 days’ prior written notice that Your account is overdue, before suspending services to You.
    6. Payment Disputes. We will not exercise Our rights under Section 5.4 or Section 5.5 if You are disputing the applicable charges reasonably and in good faith and are cooperating diligently to resolve the dispute.
    7. Taxes. Our fees do not include any taxes, levies, duties or similar governmental assessments of any nature, including, for example, value-added, sales, use or withholding taxes, assessable by any jurisdiction whatsoever (collectively, "Taxes"). You are responsible for paying all Taxes associated with Your purchases hereunder. If We have the legal obligation to pay or collect Taxes for which You are responsible under this Section 5.7, We will invoice You and You will pay that amount unless You provide Us with a valid tax exemption certificate authorized by the appropriate taxing authority.
    8. Future Functionality. You agree that Your purchases are not contingent on the delivery of any future functionality or features, or dependent on any oral or written public comments made by Us regarding future functionality or features.
  6. PROPRIETARY RIGHTS AND LICENSES
    1. Reservation of Rights. We or Our licensors retain all ownership and intellectual property rights in and to the Services and Content, derivative works thereof, and anything developed or delivered by or on behalf of Us under this Agreement. Except as expressly granted to You under this Section 6, all rights to Our assets and properties, including all intellectual property, are hereby reserved by Us.
    2. Your Data. As between You and Us, You retain ownership of Your Data. You are responsible for the accuracy, quality, integrity, legality and reliability of Your Data. Subject to the terms and conditions of this Agreement, You grant Us a limited, worldwide, non-exclusive non-transferable and royalty-free license to access, use, process, copy, distribute, make derivative works of, perform, export and display Your Data, and any Third Party Products created by or for You, only as reasonably necessary (a) to provide, maintain and improve the Services; (b) to prevent or address service, security, support or technical issues; (c) as required by Law; and (d) as expressly permitted in writing by You.
    3. Consents. You represent and warrant that You have secured all rights in and to Your Data and all consents as may be necessary: (a) to grant Us the licenses contained in this Section 6; and (b) for the use of Your Data by Us pursuant to the terms of this Agreement. We represent and warrant that We have secured all rights in and to Content and all consents as may be necessary to share such Content with You through the Services.
    4. Compliance with Data Protection Laws. Each of the parties will comply with applicable Data Protection Laws, including as provided in the Data Processing Addendum attached as EXHIBIT VII.
    5. License for Contract Property. We exclusively own all right, title and interest in and to the Contract Property. Upon Your payment of fees due under an applicable Order Form, We grant You a worldwide, perpetual, non-exclusive, non-transferable, royalty-free license to copy, maintain, use and run (as applicable) Contract Property solely for Your internal business purposes associated with Your use of Our Services. We retain all ownership rights in the Contract Property and no right, title or interest in or to the Contract Property, or any related intellectual property, are licensed or transferred to You except those licenses expressly granted to You herein.
    6. Feedback. You may from time to time provide suggestions, comments, or other feedback to Us with respect to the Services, such as feature requests or bug fixes. You grant to Us a worldwide, perpetual, irrevocable and royalty-free license to use and incorporate into Our products and services any suggestion, enhancement request, recommendation, correction or other feedback provided by You or Users relating to the operation of Our services.
  7. DATA PROTECTION
    1. Protection of Your Data. We will implement administrative, operational, physical, organizational and technical safeguards that, at a minimum, comply with applicable Data Protection Laws, and are designed to preserve and protect the security, integrity and confidentiality of Your Data and protect Your Data against Personal Data Breaches as described in Annex 2 to the DPA attached as EXHIBIT VII. Other than as provided for in this Section 7.1, You acknowledge that You are responsible for properly configuring and using the Service in a manner that will provide appropriate security and protection, and otherwise taking reasonable and appropriate steps to secure Your account credentials and backup any of Your Data that You may give to Us as part of Your use of the Services. We may modify or update Our security measures at any time, provided any such modified or updated security measures meet or exceed the level of protection required by this Section 7.1.
    2. Data Protection Addendum. The terms of our DPA attached as EXHIBIT VII are incorporated by reference and apply to the extent any of Your Data contains Personal Data, the Processing of which is subject to applicable Data Protection Laws.
  8. CONFIDENTIALITY
    1. Confidential Information. "Confidential Information" means all information disclosed by a party ("Disclosing Party") to the other party ("Receiving Party"), whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Your Confidential Information includes Your Data and any Personal Data contained therein; Our Confidential Information includes the Services and Content; and Confidential Information of each party includes the terms and conditions of this Agreement and all Order Forms (including pricing), as well as business and marketing plans, technology and technical information, product plans and designs, and business processes disclosed by such party. However, Confidential Information does not include any information that (i) is or becomes generally known to the public without breach of any obligation owed to the Disclosing Party, (ii) was known to the Receiving Party prior to its disclosure by the Disclosing Party without breach of any obligation owed to the Disclosing Party, (iii) is received from a third party without breach of any obligation owed to the Disclosing Party, or (iv) was independently developed by the Receiving Party; provided that none of the foregoing exclusions will apply to Your Data, including without limitation any Personal Data.
    2. Protection of Confidential Information. The Receiving Party will use the same degree of care that it uses to protect the confidentiality of its own confidential information of like kind (but not less than reasonable care) to (i) not use any Confidential Information of the Disclosing Party for any purpose outside the scope of this Agreement and (ii) except as otherwise authorized by the Disclosing Party in writing, limit access to Confidential Information of the Disclosing Party to those of its and its Affiliates’ employees and contractors who need that access to perform obligations under this Agreement and who have signed confidentiality agreements with the Receiving Party containing protections not materially less protective of the Confidential Information than those herein. Neither party will disclose the terms of this Agreement or any Order Form to any third party other than its Affiliates, legal counsel and accountants without the other party’s prior written consent, provided that a party that makes any such disclosure to its Affiliate, legal counsel or accountants will remain responsible for such Affiliate’s, legal counsel’s or accountant’s compliance with this "Confidentiality" section. Notwithstanding the foregoing, We may disclose the terms of this Agreement and any applicable Order Form under terms of confidentiality materially as protective as set forth herein: (a) to a subcontractor or Third Party Application provider to the extent necessary to perform Our obligations to You under this Agreement, or (b) in connection with a merger, acquisition, bankruptcy, dissolution, reorganization, sale of some or all of Our assets, financing, sale of all or a portion of Our business, a similar transaction or proceeding, or steps in contemplation of such activities.
    3. Compelled Disclosure. The Receiving Party may disclose Confidential Information of the Disclosing Party to the extent compelled by Law to do so, provided the Receiving Party gives the Disclosing Party prior notice of the compelled disclosure (to the extent legally permitted) and reasonable assistance, at the Disclosing Party's cost, if the Disclosing Party wishes to contest the disclosure. If the Receiving Party is compelled by Law to disclose the Disclosing Party’s Confidential Information as part of a civil proceeding to which the Disclosing Party is a party, and the Disclosing Party is not contesting the disclosure, the Disclosing Party will reimburse the Receiving Party for its reasonable cost of compiling and providing secure access to that Confidential Information.
  9. WARRANTIES, EXCLUSIVE REMEDIES AND DISCLAIMERS
    1. Mutual Warranties. Each party represents that (a) it is duly organized and validly existing under the Laws of the state or country of its incorporation or formation, (b) it has validly entered into this Agreement and that it has the power and authority to do so, (c) the Agreement is a valid obligation binding upon both Parties and enforceable in accordance with its terms, and (d) to the best of each party’s respective knowledge, the execution, delivery, and performance of the Agreement by each party does not materially conflict with any agreement that party has with a third party.
    2. Our Warranties. We warrant that during the term of this Agreement, (a) We will perform the Services using care and skill consistent with generally accepted industry standards, (b) We will not materially decrease the overall security of the Services, (c) the Services will perform materially in accordance with the applicable User Documentation, (d) We have the necessary rights to use any open source software embedded into the Services, and Your use of open source software as part of the Services will not result in an obligation to disclose, license or otherwise make available any part of Your Confidential Information to any third party, (e) We will not introduce any Malicious Code into the Services, and (f) We will safeguard Your Data as required by Section 7 of this Agreement and applicable Data Protection Laws. We also make the warranties specifically provided in EXHIBIT III to EXHIBIT VI with respect to the Tekion Lab Services and any Equipment purchased from Us.
    3. Disclaimers. EXCEPT AS EXPRESSLY PROVIDED IN SECTION 9.1 AND SECTION 9.2 AND SUBJECT TO THE PROVISIONS OF SECTION 7 (DATA PROTECTION), THE SERVICES AND CONTENT ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS WITHOUT ANY WARRANTIES OR REPRESENTATIONS OF ANY KIND AND AT YOUR OWN RISK. WE DO NOT WARRANT THAT THE SERVICES WILL BE PERFORMED TIMELY, ERROR-FREE OR UNINTERRUPTED, THAT WE WILL CORRECT ALL SERVICES ERRORS, OR THAT THE SERVICES WILL MEET YOUR REQUIREMENTS OR EXPECTATIONS. WE ALSO EXPRESSLY DISCLAIM ANY AND ALL LIABILITY FOR ANY ISSUES RELATED TO THE PERFORMANCE AND OPERATION OF THE SERVICES THAT ARISE FROM YOUR DATA OR THIRD PARTY CONTENT (INCLUDING THIRD PARTY FORMS) OR PRODUCTS OR SERVICES PROVIDED BY THIRD PARTIES.
    4. Exclusive Remedies. FOR ANY BREACH OF THE SERVICES WARRANTY IN SECTIONS 9.2(A) AND (C), AND EXHIBIT IV SECTION SECTION 1.7 (A), YOUR EXCLUSIVE REMEDY AND OUR ENTIRE LIABILITY SHALL BE THE CORRECTION OF THE DEFICIENT SERVICES THAT CAUSED THE BREACH OF WARRANTY, OR, IF WE CANNOT SUBSTANTIALLY CORRECT THE DEFICIENCY IN A COMMERCIALLY REASONABLE MANNER, YOU MAY END THE DEFICIENT SERVICES AND WE WILL REFUND TO YOU THE FEES FOR THE TERMINATED SERVICES THAT YOU PRE-PAID TO US FOR THE PERIOD FOLLOWING THE EFFECTIVE DATE OF TERMINATION. FOR BREACH OF THE WARRANTY RELATING TO EQUIPMENT IN EXHIBIT III SECTION 1.5 (B), YOUR EXCLUSIVE REMEDY AND OUR ENTIRE LIABILITY SHALL BE TO REPAIR OR REPLACE, AT OUR OPTION, THE DEFECTIVE EQUIPMENT.
    5. Legal Compliance. YOU UNDERSTAND THAT YOUR USE OF THE SERVICE AND COMPLIANCE WITH ANY TERMS HEREUNDER DOES NOT CONSTITUTE COMPLIANCE WITH ANY LAW. YOU UNDERSTAND THAT YOU HAVE AN INDEPENDENT DUTY TO COMPLY WITH ANY AND ALL LAWS APPLICABLE TO YOU.
    6. No Other Warranties. EXCEPT AS EXPRESSLY PROVIDED HEREIN, NEITHER PARTY MAKES ANY WARRANTY, REPRESENTATION OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, ARISING FROM COURSE OF DEALING, USAGE, TRADE OR OTHERWISE, AND EACH PARTY SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING ANY IMPLIED WARRANTY, REPRESENTATION OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW.
  10. INDEMNIFICATION
    1. Indemnification by Us. We will indemnify and defend You against any claim, demand, suit or proceeding made or brought against You by a third party: (a) alleging that any Service infringes or misappropriates such third party’s intellectual property rights, (b) arising out of death, personal injury to the extent caused by Our personnel, subcontractors or authorized agents in their performance of the Services, (c) damage to tangible property to the extent caused by the gross negligence or willful misconduct of Our personnel, subcontractors or authorized agents in their performance of the Services, (d) arising from unauthorized disclosure of Your Data (including Personal Data) that results from a breach of Our obligations under Section 9.2(f), or (e) arising from Our violation of applicable Laws (together referred to as a "Claim Against You"), and will indemnify You from any damages, including actual and statutory damages, fines, and penalties, reasonable attorney fees and costs finally awarded against You as a result of, or for amounts paid by You under a settlement approved by Us in writing of, a Claim Against You, provided You (x) promptly give Us written notice of the Claim Against You, (y) give Us sole control of the defense and settlement of the Claim Against You (except that We may not settle any Claim Against You unless it unconditionally releases You of all liability), and (z) give Us all reasonable assistance, at Our expense. If We receive information about an infringement or misappropriation claim related to a Service, We may in Our discretion and at no cost to You (i) modify the Services so that they are no longer claimed to infringe or misappropriate, without breaching Our warranties under "Warranties, Exclusive Remedies and Disclaimers" above, (ii) obtain a license for Your continued use of that Service in accordance with this Agreement, or (iii) terminate Your subscriptions for that Service upon 30 days’ written notice and refund You any prepaid fees covering the remainder of the term of the terminated subscriptions. The above defense and indemnification obligations do not apply: (I) to the extent a Claim Against You arises from a breach by You or Users of this Agreement, the User Documentation or applicable Order Forms; or (II) to the extent any Claim Against You arises from any reckless misconduct, gross negligence (except with respect to Your selection and use of Us to Process Your Data or Our Processing of Your Data on Your behalf), willful misconduct, illegal act or fraud on the part of You or Your personnel (whether acting alone or in collusion with others), (III) to the extent a Claim Against You arises from Your use of the Service in conjunction with any product or service not provided or authorized by Us, provided, that the exclusion in this subsection (III) only applies to claims, demands, suits or proceedings described in subsection (a), above, or (IV) if after a period of sixty (60) days from when You receive written notice from Us of an update or patch to the Service that requires an action to be taken by You to install the update or patch, You continue to use the Service as-is and do not install the update or patch and such update or patch, if installed, would have prevented the infringement claim from accruing.
    2. Indemnification by You. Except to the extent that any claim, demand, suit or proceeding arises out of or relates to Our obligations under Section 7 (inclusive of the DPA), You will indemnify and defend Us against any claim, demand, suit or proceeding made or brought against Us by a third party: (a) alleging that any of Your Data infringes or misappropriates such third party’s rights, or (b) arising from Your use of the Services or Content in violation of the Agreement, the User Documentation, Order Form or applicable Law, and (c) a breach of the representations contained in Section 6.4, (each a "Claim Against Us"), and You will indemnify Us from any damages, including actual and statutory damages, fines, and penalties, reasonable attorney fees and costs finally awarded against Us as a result of, or for any amounts paid by Us under a settlement approved by You in writing of, a Claim Against Us, provided We (x) promptly give You written notice of the Claim Against Us, (y) give You sole control of the defense and settlement of the Claim Against Us (except that You may not settle any Claim Against Us unless it unconditionally releases Us of all liability), and (z) give You all reasonable assistance, at Your expense.
    3. Exclusive Remedy. This Section 10 states the indemnifying party’s sole liability to, and the indemnified party’s exclusive remedy against, the other party for any type of claim described in Section 10.
  11. LIMITATION OF LIABILITY
    1. Limitation of Liability. SUBJECT TO SECTION 11.3 TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL OUR (OR OUR AFFILIATES’ OR THIRD PARTY LICENSORS’) AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT OR OTHERWISE, EXCEED THE FEES ACTUALLY PAID OR PAYABLE BY YOU UNDER THIS AGREEMENT DURING THE IMMEDIATELY PRECEDING TWELVE (12) MONTH PERIOD FOR THE SERVICE FROM WHICH THE CLAIM AROSE (OR, FOR A CLAIM ARISING BEFORE THE FIRST ANNIVERSARY OF THE EFFECTIVE DATE, THE AMOUNT PAID OR PAYABLE FOR THE FIRST TWELVE (12) MONTH PERIOD) (THE "GENERAL CAP").
    2. Exclusion of Consequential and Related Damages. IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES HAVE ANY LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT FOR ANY LOST PROFITS, REVENUES, GOODWILL, OR INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, WHETHER AN ACTION IS IN CONTRACT OR TORT AND REGARDLESS OF THE THEORY OF LIABILITY, EVEN IF A PARTY OR ITS AFFILIATES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR IF A PARTY’S OR ITS AFFILIATES’ REMEDY OTHERWISE FAILS OF ITS ESSENTIAL PURPOSE. THE FOREGOING DISCLAIMER WILL NOT APPLY TO THE EXTENT PROHIBITED BY LAW.
    3. Exceptions. SECTION 11.1 WILL NOT APPLY TO OR IN ANY WAY LIMIT: (i) OUR INDEMNIFICATION OBLIGATIONS UNDER SECTION 10.1(b), (c), (d) AND (e), (ii) OUR RECKLESS MISCONDUCT, GROSS NEGLIGENCE, WILLFUL MISCONDUCT AND/OR FRAUD, (iii) OUR REMEDIATION OBLIGATIONS IN EXHIBIT VII SECTION 3.5, OR (iv) YOUR PAYMENT OBLIGATIONS. TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL OUR AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO OUR INDEMNIFICATION OBLIGATION IN SECTION 10.1(a), WHETHER IN CONTRACT, TORT, OR OTHERWISE, EXCEED AN AMOUNT EQUAL TO THE LESSER OF: (A) TWO (2) TIMES THE GENERAL CAP; AND (B) $100,000. OTHER THAN LOST PROFITS, REVENUES, GOODWILL, AND EXEMPLARY OR PUNITIVE DAMAGES, WHICH REMAIN EXCLUDED, SECTION 11.2 WILL NOT APPLY IN ANY WAY TO LIMIT OUR INDEMNIFICATION OBLIGATIONS IN SECTION 10 FOR ACTUAL OR STATUTORY DAMAGES OR OR FINES FINALLY ASSESSED OR AWARDED AGAINST YOU IN CONNECTION WITH ANY CLAIM, DEMAND, SUIT OR PROCEEDING, OR SETTLEMENT THEREOF, BY ANY THIRD PARTY ARISING OUT OF OR RELATING TO OUR OBLIGATIONS UNDER SECTION 7 (INCLUSIVE OF THE DPA).
  12. TERM AND TERMINATION
    1. Term of Agreement. This Agreement commences on the Effective Date and continues until all Services hereunder have expired or have been terminated. Termination of one or more of the Services does not automatically terminate the entire Agreement unless all Services have expired or been terminated.
    2. Term of Cloud Services. The term of each Cloud Service subscription shall be as specified in the applicable Order Form and may be terminated as set forth in the Order Form. Except as otherwise specified in an Order Form, Cloud Service subscriptions will automatically renew on a month-to-month basis unless either party gives the other notice of non-renewal at least 30 (thirty) days before the end of the relevant subscription term. Unless otherwise specified in an Order Form, all month-to-month renewals will be at Our applicable list price in effect at the time of the renewal. Upon the renewal of any Cloud Service and unless otherwise agreed, the term for which any Equipment associated with that Cloud Service are provided to Customer shall automatically renew for an additional period corresponding to the renewed Cloud Service subscription term.
    3. Termination. A party may terminate this Agreement for cause: (i) upon 30 (thirty) days written notice to the other party of a material breach of this Agreement by such other party if such breach remains uncured at the expiration of such period, (ii) if the other party becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, liquidation or assignment for the benefit of creditors; or (iii) upon upon 30 (thirty) days written notice to the other party for any reason or no reason whatsoever.
    4. Refund or Payment upon Termination. If this Agreement is terminated by You in accordance with Section 12.3, We will refund You any prepaid fees covering the remainder of the term of all Order Forms after the effective date of termination. If this Agreement is terminated by Us in accordance with Section 12.3, You will pay any unpaid fees covering the remainder of the term of all Order Forms. In no event will termination relieve You of Your obligation to pay any fees payable to Us for the period prior to the effective date of termination.
    5. Your Data Portability and Deletion. Upon request by You made within 30 days after the effective date of termination or expiration of this Agreement, We will make Your Data available to You for export or download by secure file transfer in a format reasonably requested by You, and, at a minimum, in a format that is commercially useable apart from the Cloud Services. After such 30-day period, We will have no obligation to maintain or provide any Your Data. Upon termination or expiration of the Agreement, and subject to applicable Law, We shall delete and procure the deletion of all copies of Your Data Processed by Us or Our Sub-Processors provided, however, that We will not be required to remove copies of Your Data from Our backup media and servers until such time as the backup copies are scheduled to be deleted, provided further that in all cases We will continue to protect Your Data in accordance with this Agreement. The foregoing deletion obligation will be subject to any retention obligations imposed on Us by Law.
    6. Transition Period before Final Termination. Upon any termination of the Agreement, We shall, upon Your request, continue to provide the Services to You pursuant to the terms of this Agreement for a transitional period of up to three (3) months (the "Transition Period"), unless the parties agree to a longer period. Access to the Services during the Transition Period will be subject to the fees set out in the applicable Order Form, prorated on a monthly basis and payable in advance, based on the annual fees for the Services during the calendar period of the Transition Period if the Order Form has fees for such calendar period. During the Transition Period, We will provide cooperation and assistance as You may reasonably request to support an orderly transition to another provider of similar software or services. Such cooperation and assistance will be limited to consulting regarding Our Cloud Services and will be subject to a fee based on Our then-current rates for consulting services and such services will be set out in a statement of work agreed between the parties. Notwithstanding the foregoing, in the event of termination of this Agreement by Us due to a breach by You, We may withhold the provision of Transition Services and condition further performance upon (i) payment of undisputed fees then owed, (ii) prepayment of fees for further services, and (iii) receipt by Us of an officer’s certificate from You certifying ongoing compliance with the terms of this Agreement during the Transition Period.
    7. Surviving Provisions. Sections 1, 5, 6, 7, 8, 9, 10, 11, 12.4, 12.5, 12.6, 12.7 and 13 will survive any termination or expiration of this Agreement.
  13. MISCELLANEOUS PROVISIONS
    1. Entire Agreement and Order of Precedence. This Agreement is the entire agreement between You and Us regarding Your use of Services and Content and supersedes all prior and contemporaneous agreements, proposals or representations, written or oral, concerning its subject matter. Except as otherwise provided herein, no modification, amendment, or waiver of any provision of this Agreement will be effective unless in writing and signed by the party against whom the modification, amendment or waiver is to be asserted. In the event of any conflict or inconsistency among the following documents, the order of precedence shall be: (1) this Agreement, (2) the applicable Order Form and (3) the User Documentation.
    2. Notices. Except as otherwise specified in this Agreement, all notices related to this Agreement, except for notices of termination or an indemnifiable claim ("Legal Notices") which shall clearly be identifiable as Legal Notices and sent to Our Legal Department at legal@tekion.com, will be in writing and will be effective upon: (a) personal delivery, (b) the second business day after mailing, (c) the day of sending by email, or (d) in case of notices through the Services, the same day. Legal Notices will be effective the day of sending by email as required above. Billing-related notices to You will be addressed to the relevant billing contact designated by You. All other notices to You will be addressed to the relevant Services system administrator designated by You.
    3. Modifications. We may from time to time change (a) the Services, (b) the terms of Your access to the Services, or (c) the User Documentation; or (c) any portion of this Agreement; provided, however, no such change shall materially degrade the Services or materially alter Your rights and responsibilities or our rights and responsibilities under the Agreement except to the extent agreed to by You. We will post notice of updates on the Tekion Cloud portal pursuant to our standard policies. If we make a material change pursuant to the above, we will provide You with reasonable notice prior to the change taking effect, either by emailing the email address associated with Your account or by messaging You through the Services. Any material modification permitted under this Agreement will become effective as of the date specified in our notice, and all other changes will become effective upon posting of the change. It is Your responsibility to check the Tekion Cloud portal regularly for updates. Your access or use of the Service after the effective date of any modification will be deemed acceptance of the modified terms.
    4. Withdrawals. We may withdraw a Service by posting a notice at least 12 (twelve) months prior to the effective date of the withdrawal. Upon withdrawal of a Service: (a) all support services relating to that Service will automatically stand withdrawn on the effective date of the withdrawal; and (b) We will continue to provide You the Service for the unexpired term of Your subscription and until the effective date of the withdrawal and work with You during that time to migrate you to another Tekion Cloud offering.
    5. Governing Law. This Agreement, and any disputes arising out of or related hereto, will be governed exclusively by the Laws of the State of California, without regard to its conflicts of laws rules or the United Nations Convention on the International Sale of Goods.
    6. Venue; Waiver of Jury Trial; Fees. The state and federal courts located in San Francisco County, California will have exclusive jurisdiction to adjudicate any dispute arising out of or relating to the Agreement or its formation, interpretation or enforcement. Each party hereby consents and submits to the exclusive jurisdiction of such courts. Each party also hereby waives any right to jury trial in connection with any action or litigation in any way arising out of or related to the Agreement. In any action or proceeding to enforce rights under the Agreement, the prevailing party will be entitled to recover its reasonable costs and attorney’s fees.
    7. Assignment. Except for assignment by Us to Our Affiliates, neither party may assign any of its rights or obligations hereunder, whether by operation of Law or otherwise, without the other party’s prior written consent (not to be unreasonably withheld). Notwithstanding the foregoing, either party may assign this Agreement in its entirety (together with all Order Forms) and Your Data without the other party’s consent in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. Notwithstanding the foregoing, You are acquired by, sell substantially all of Your assets to, or undergo a change of control in favor of, a competitor of Ours, then We may terminate this Agreement upon written notice. In the event of such a termination, We will refund to You any prepaid fees allocable to the remainder of the term of all subscriptions for the period after the effective date of such termination. Any purported assignment in violation of this section is void. Subject to the foregoing, this Agreement will bind and inure to the benefit of the parties, their respective successors and permitted assigns.
    8. Third Party License Terms (MarketScan). Lease, Finance and Cash purchase option calculations are provided to Your dealership by our technology partner, Market Scan. It is Market Scan’s responsibility to ensure the accuracy of the data utilized to calculate the payments options that are reflected in Your Tekion subscription. While Market Scan’s database contains most manufacturer and lender offerings, it might not contain information specific to Your dealership. You agree to be responsible to provide to Market Scan Information Systems, Inc. ("Market Scan"), on a timely, basis all regional and non-regional data regarding manufacturer and vehicle rebate, incentive, lease and or retail finance information as it becomes available. You further agree to provide Market Scan with Your electronic access to rebate, incentive, lease and retail finance data by providing Market Scan with valid login credentials to all applicable manufacturer and lender portals. Every Market Scan customer has a unique account and a unique database. You are providing this login information strictly to allow Market Scan to populate the information contained in Your unique, individual Market Scan database on Your behalf. You also agree to the Data Access Agreement set forth in EXHIBIT VIII in favor of Market Scan.
    9. Relationship of the Parties; Third Party Beneficiaries. The parties are independent contractors. This Agreement does not create a partnership, franchise, joint venture, agency, fiduciary or employment relationship between the parties. There are no third-party beneficiaries under this Agreement.
    10. Force Majeure. Any delay in performance caused by a Force Majeure Event is not a breach of the Agreement, provided that (i) such delay could not have been reasonably prevented or circumvented by the party whose performance is delayed (the "Non-Performing Party") through the use of alternate sources, work-around plans or other means, (ii) the Non-Performing Party uses commercially reasonable efforts to minimize the duration and impact of such delayed performance, and (iii) the Non-Performing Party promptly notifies the other party of any Force Majeure Event. The time for performance will be extended for a period equal to the duration of the conditions preventing performance. Any amounts payable under this Agreement shall be equitably adjusted such that You are not required to pay any amounts for Services that You are not receiving.
    11. Subcontracting. We may subcontract parts of the Services to third parties. We will remain directly and primarily liable to You for the performance of all of Our obligations hereunder, including those assigned to or assumed by subcontractors, and for subcontractors’ compliance with this Agreement. We shall ensure that each subcontractor complies, and that each subcontract includes provisions that require compliance by the applicable subcontractor with, the Our obligations under this Agreement. We shall not disclose to any subcontractor any of Your Confidential Information unless and until such Subcontractor has executed a nondisclosure agreement that is no less protective of Your rights than are the confidentiality provisions set forth in this Agreement.
    12. Anti-Corruption. You agree that You have not received or been offered any illegal or improper bribe, kickback, payment, gift, or thing of value from any of Our employees or agents in connection with this Agreement. Reasonable gifts and entertainment provided in the ordinary course of business do not violate the above restriction. If You learn of any violation of the above restriction, You will use reasonable efforts to promptly notify Our Legal Department at legal@tekion.com.
    13. Publicity. You grant Us the right to use Your company name and logo as a reference for marketing or promotional purposes on Our website and in other public or private communications with Our existing or potential customers subject to Your standard trademark usage guidelines as provided to Us from time-to-time.
    14. Severability. If any provision of the Agreement is held to be invalid or unenforceable, the invalidity or unenforceability will not affect the other provisions of the Agreement.
    15. No Waiver. A waiver of any breach of the Agreement is not deemed a waiver of any other breach.
    16. No Joint and Several Liability. Only the Tekion entity signing this Agreement is responsible and liable for its obligations to You under this Agreement, and nothing in this Agreement should be interpreted to create joint or joint and several liability between Us and our Affiliates for any of the aforementioned Tekion entity’s obligations to You or Your Affiliates.
    17. Acknowledgement of Terms. You acknowledge that you have read this Agreement, You understand the terms of this Agreement, You have had the opportunity to consult, and have consulted, with independent legal counsel in connection with this Agreement, have not relied on any statements by third parties, including without limitation any original equipment manufacturer through whom You hold Your retail franchise, and You have signed this Agreement voluntarily.

EXHIBIT I

Tekion Production Support and Service Level Availability Policy

Our Software as a Service ("Cloud Service") is based on a multi-tenanted operating model that applies common, consistent management practices for all customers using the service. This common operating model allows Us to provide the high level of service reflected in our business agreements. This document communicates Our Production Support and Service Level Availability Policy ("SLA") with its customers. Capitalized terms, unless otherwise defined herein, shall have the same meaning as in the Tekion Master Subscription Agreement.

  1. Availability Commitment. We shall make the Cloud Services for Critical Business Functions Available, as measured over the course of each calendar month, and calculated based on twenty-four (24) hours per day and seven (7) days per week, during the term of the Agreement (each such calendar month, a "Service Period") at least 99.9% of such Service Period, excluding only the time the Cloud Services for Critical Business Functions are not Available solely as a result of one or more Exceptions (the "Availability Requirement").

    "Available" means the Cloud Services for Critical Business Functions are available and operable for access and use by You and Your Users over the Internet in material conformity with the User Documentation during Business Hours and shall be calculated as follows.

    (Actual Uptime for Critical Business Functions ÷ (Scheduled Uptime for Critical Business Functions – Total Minutes in Service Period Cloud Services for Critical Business Functions are not Available Due to an Exception)) x 100 = Percentage Uptime.

    All times will be measured only during Business Hours.

    "Availability" has a correlative meaning. Cloud Services for Critical Business Functions will be deemed Available unless they are: (a) reported by You as being unavailable via a support request; or (b) detected by Us as being unavailable during Business Hours.

    For the purposes of this Agreement: (i) a "Critical Business Function" means a function listed in EXHIBIT II with respect to which a performance or availability issue is qualified by Us as a Severity Level 1 issue in accordance with EXHIBIT II.; and (ii) "Business Hours" means 6 a.m. to 10 p.m. local time at the location of Your dealership.

  2. Exceptions. No period of Cloud Service degradation or inoperability will be included in calculating Availability to the extent that such downtime or degradation is due to any of the following ("Exceptions"):
    1. Planned Maintenance - Currently, Planned Maintenance is four (4) hours for weekly maintenance, four (4) hours for monthly maintenance, five (5) hours for quarterly maintenance. Our current weekly maintenance begins at 1:00 am (Eastern) on Monday; monthly maintenance begins at 1:00 am (Eastern) on Monday; and quarterly maintenance begins at 1:00 am (Eastern) on Monday. For avoidance of doubt, weekly, monthly and quarterly Planned Maintenance will be performed concurrently, so that the aggregate Planned Maintenance period during the days on which the weekly, monthly and quarterly Planned Maintenance coincide will not exceed five (5) hours. All times are subject to change upon thirty (30) days’ notice from Us and any such change shall not lengthen the duration of the associated maintenance window. Any such change shall not lengthen the duration of the associated maintenance window and shall be planned to cause the least disruption to Your business.
    2. Your or Your Users’ use of the Cloud Services in violation of or inconsistent with the applicable User Documentation, failure to adhere to any required configurations, use supported platforms, follow any policies for acceptable use, or use of a Cloud Service in a manner inconsistent with the features and functionalities of the Cloud Service (for example, attempts to perform operations that are not supported);
    3. Failures of Your or Your Users’ Internet connectivity;
    4. Failures of Your or Your Users’ Internet connectivity;
    5. Internet or other network traffic problems other than problems arising in or from networks actually or required to be provided or controlled by Us or one or more of Our suppliers or subcontractors;
    6. Your or any of its Your Users’ failure to meet any minimum hardware or software requirements prescribed by Us; or
    7. a Force Majeure event as described in the Agreement.
  3. Remedies for Service Availability Failures. If the actual Availability of the Cloud Services for Your Critical Business Functions is less than the Availability Requirement for any Service Period, such failure(s) shall constitute one or more Service Errors for which We shall issue to You the corresponding service credits as set forth below ("Service Availability Credits"). Save and except as provided in this SLA and Agreement, Service Availability Credits will be Your sole and exclusive remedy for any performance or availability issues for any Cloud Service and You may not unilaterally offset any payments due from You under the Agreement for any performance or availability issues. "Service Error" means any failure of any Cloud Service to be Available or otherwise materially perform in accordance with this Agreement and the User Documentation.
    Service AvailabilityCredit: % of the Monthly Fee
    MinimumMaximum
    99.900%100%0.00%
    99.400%99.899%5.00%
    98.900%99.399%10.00%
    98.400%98.899%15.00%
    97.900%98.399%20.00%
    97.400% or less97.899%25.00%
  4. Support Requests and Support Service Level Requirements. We shall, in good faith, classify requests for Service Error corrections in accordance with the descriptions set forth in EXHIBIT II (each a "Support Request"). You may notify Us of Support Requests by e-mail, telephone or such other means as we may mutually agree. We shall Respond to and Resolve all Support Requests in accordance with the required times and other terms and conditions set forth in EXHIBIT II.
  5. Response and Resolution Time Service Levels. Our Response and Resolution times will be measured from the time We receive a Support Request until the respective time We have (i) Responded to, in the case of Response time, or (ii) Resolved such Support Request, in the case of Resolution time. "Resolve" (including "Resolved", "Resolution" and correlative capitalized terms) means that, as to any Service Error, We have provided You the corresponding Service Error correction and You have confirmed such correction and Your acceptance thereof. We shall respond to and Resolve all Service Errors within the following times set forth in EXHIBIT II based on the severity of the Service Error.

EXHIBIT II

Support Service Level Requirements

Severity Level 1

Definition: The Cloud Services are unavailable or degraded to a degree where the service is substantially unusable or a non-dealership issue prevents You from using the Cloud Services to execute Critical Business Functions.

For purposes of this Agreement, "Critical Business Functions" means the following only:

  1. Selling a car;
  2. Writing a repair order estimate;
  3. Selling a part;
  4. Providing vehicle service at the service lane;
  5. Actions related to month-end close;
  6. Scheduling an appointment.

Our Response Commitment: We will respond within thirty (30) minutes of receipt of case and shall remain accessible for troubleshooting from the time a Severity 1 issue is logged until such time as it is Resolved.

Resolution: We will work to resolve the problem until the Cloud Service is returned to normal operation. You will be notified of status changes.

Escalation: If the problem has not been resolved within one (1) hour, We will escalate the problem to Our appropriate internal team. The escalated problem will have higher priority than ongoing support, development or operations initiatives.

Your Response Commitment: You shall remain accessible for troubleshooting from the time a Severity 1 issue is logged until such time as it is resolved. If the issue is not resolvable solely due to Your availability, the downtime will cease to count towards "Availability" and the offering of Service Availability Credits.

Severity Level 2

Definition: The Cloud Services contain an issue that prevents You from executing one or more Critical Business Functions (defined above) and a workaround exists but is not optimal.

Our Response Commitment: We will respond within one (1) hour of receipt of case and shall remain accessible for troubleshooting from the time a Severity 2 issue is logged until such time as it is resolved.

Resolution: We will work to resolve the problem until the Cloud Service is returned to normal operation. You will be notified of status changes.

Escalation: If the problem has not been resolved within four (4) hours, You may request that We escalate the problem to Our appropriate internal team where the escalated problem will have higher priority than ongoing development or operations initiatives.

Your Response Commitment: You shall remain accessible for troubleshooting from the time a Severity 2 issue is logged until such time as it is resolved.

Severity Level 3

Definition: The Cloud Services contain an issue that may disrupt non-Critical Business Functions and a workaround is not available. to the dealership.

Our Response Commitment: We will respond within four (4) hours of receipt of case.

Resolution: We will work to resolve the problem until the Cloud Service is returned to normal operation. You will be notified of status changes.

Escalation: If progress is not being made Your satisfaction, You may request that We escalate the problem to Our appropriate internal team.

Your Response Commitment: You will respond to Our requests for additional information and implement recommended solutions in a timely manner.

Severity Level 4

Definition: The Cloud Services contain an issue that may disrupt non-Critical Business Functions and a workaround is available to the dealership but is not optimal.

Our Response Commitment: We will respond within twenty-four (24) hours of receipt of case.

Resolution: If resolution requires Us to do an issue fix, We will add the issue fix to Our development queue for future updates and suggest potential workarounds until the problem is resolved in a future update. You will be notified of status changes.

Escalation: If progress is not being made Your satisfaction, You may request that We escalate the problem to Our appropriate internal team.

Your Response Commitment: You will respond to Our requests for additional information and implement recommended solutions in a timely manner.

Severity Level 5

Definition: Non-system issues such as named support contact change, configuration questions, new feature requests, existing feature modification requests or understanding of a functionality.

Our Response Commitment: We will respond within twenty-four (24) hours of receipt of the case.

Resolution Commitment: We will respond to the request. You will be notified of status changes.

Escalation: If progress is not being made Your satisfaction, You may request that We escalate the problem to Our appropriate internal team.

Your Response Commitment: You will respond to Our requests for additional information and implement recommended solutions in a timely manner.

Severity Level Determination: You shall reasonably self-diagnose each support issue and recommend to Us an appropriate Severity Level designation. We shall validate Your Severity Level designation or notify You of a proposed change in the Severity Level designation to a higher or lower level with justification for the proposal. In the event of a conflict regarding the appropriate Severity Level designation, each party shall promptly escalate such conflict to its management team for resolution through consultation between the parties' management, during which time the parties shall continue to handle the support issue in accordance with Our Severity Level designation. In the rare case a conflict requires a management discussion, both parties shall be available within one hour of the escalation.

EXHIBIT III

Product Terms - Equipment

Product Terms. Our Equipment product terms are available at https://tekion.com/legal/product-terms/equipment.

EXHIBIT IV

Product Terms - Tekion Lab Services

Product Terms. Our Tekion Lab Services terms are available at https://tekion.com/legal/product-terms/tekion-lab-services.

EXHIBIT V

Product Terms - Tekion Forms

Product Terms. Our Tekion Forms terms are available at https://tekion.com/legal/product-terms/tekion-forms.

EXHIBIT VI

Product Terms - CRM

Product Terms. Our CRM product terms are available at https://tekion.com/legal/product-terms/crm.

EXHIBIT VII

Data Processing Addendum

This Data Processing Agreement ("DPA") reflects the parties’ agreement regarding the Processing of Personal Data by Us on Your behalf under the agreement between You and Us by which You access the Services (the "Agreement").

This DPA is supplemental to, and forms an integral part of, the Agreement, and is effective upon its incorporation into the Agreement. In case of any conflict or inconsistency with the terms of the Agreement, this DPA will take precedence over the terms of the Agreement to the extent of such conflict or inconsistency.

The term of this DPA will follow the term of the Agreement. Terms not otherwise defined in this DPA will have the meaning as set forth in the Agreement.

  1. DEFINITIONS
    1. "Approved Country" means a country, such as the countries within the European Economic Area, that has a data localization requirement requiring that Personal Data must either remain within that country’s territory or satisfy certain requirements before the Personal Data can be transferred to a third country.
    2. "CCPA" means the California Consumer Privacy Act of 2018 (Cal Civ Code Div. 3, Pt. 4, Title 1.81.5) and the California Privacy Rights Act of 2020, each as amended and any regulations promulgated under the foregoing.
    3. "California Personal Information" means Personal Data that is subject to the protection of the CCPA.
    4. "Consumer", "Business", "Sell" and "Service Provider" will have the meanings given to them in the CCPA.
    5. "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
    6. "Data Protection Laws" has the definition given to it in the Agreement and shall include, without limitation, the CCPA and European Data Protection Laws.
    7. "Data Subject" means the individual to whom Personal Data relates.
    8. "Data Subject Requests" has the meaning given to it in Section 4.1 of this DPA.
    9. "Europe" means the European Union, the European Economic Area and/or their member states, Switzerland and the United Kingdom.
    10. "European Personal Data" means Personal Data that is subject to the protection of European Data Protection Laws.
    11. "European Data Protection Laws" means data protection laws applicable in Europe, including: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ("GDPR"); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; and (iii) applicable national implementations of (i) and (ii); or (iii) the UK Data Protection Act 2018 ("DPA 2018"); and (iv) Swiss Federal Data Protection Act on 19 June 1992 and its Ordinance; in each case, as may be amended, superseded or replaced.
    12. "Instructions" means the written, documented instructions issued by a Controller to a Processor or Processor to Sub-Processor, and directing the same to perform a specific or general action with regard to Personal Data (including, but not limited to, depersonalizing, blocking, deletion, making available).
    13. "Permitted Affiliates" means any of Your affiliates that (i) are permitted to use Your Data pursuant to the Agreement, but have not signed their own separate agreement with Us and are not an Authorized User as defined under the Agreement, (ii) qualify as a Controller of Personal Data Processed by You, and (iii) are subject to European Data Protection Laws.
    14. "Personal Data Breach" has the definition given to it in the Agreement.
    15. "Personal Data" has the meaning given to it in the Agreement and shall include, without limitation, California Personal Information and European Personal Data.
    16. "Processing" means any operation or set of operations which is performed on Personal Data, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of Personal Data. The terms "Process", "Processes" and "Processed" will be construed accordingly.
    17. "Processor" means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
    18. "Security Measures" means the administrative, operational, physical, organizational and technical measures described in Section 7.1 of the Agreement.
    19. "Standard Contractual Clauses" means the standard contractual clauses for Processors approved by the European Commission; as may be amended, superseded or replaced.
    20. "Sub-Processor" has the meaning given to it in the Agreement.
  2. Your Obligations
    1. Compliance with Laws. Within the scope of the Agreement and in Your use of the Services, You will be responsible for complying with all requirements that apply to You under applicable Data Protection Laws with respect to Your Processing of Personal Data and the Instructions that You issue to Us. In particular, You acknowledge and agree that You will be solely responsible for: (i) the accuracy, quality, and legality of Your Data and any Personal Data that is contained therein; (ii) complying with all necessary transparency and lawfulness requirements under applicable Data Protection Laws for the collection and use of the Personal Data, including obtaining any necessary consents and authorizations; (iii) ensuring that You have the right to transfer or provide access to the Personal Data to Us for Processing in accordance with the Agreement (including this DPA); and (iv) ensuring that Your Instructions to Us regarding the Processing of Personal Data comply with applicable Laws, including Data Protection Laws.
    2. Your Instructions. The parties agree that the Agreement (including this DPA), together with Your use of the Services in accordance with the Agreement, constitute Your complete and final instructions to Us regarding the Processing of Personal Data, and any additional instructions outside of the scope of the Instructions shall require prior written agreement between Us and You.
  3. Tekion Obligations
    1. Compliance with Instructions. We will only Process Personal Data for the purposes described in this DPA or as otherwise agreed within the scope of Your lawful Instructions, except where and to the extent otherwise required by applicable Law.
    2. Conflict of Laws. If We become aware that We cannot Process Personal Data in accordance with Your Instructions due to a legal requirement under any applicable Law, We will (i) promptly notify You of that legal requirement to the extent permitted by the applicable Law; and (ii) where necessary, cease all Processing (other than merely storing and maintaining the security of the affected Personal Data) until such time You issue new Instructions. If this provision is invoked, We will not be liable to You under the Agreement for any failure to perform the applicable Services until You issue new lawful Instructions with regarding to the Processing. However, any amounts payable under the Agreement shall be equitably adjusted such that You are not required to pay any amounts for Services that You are not receiving.
    3. Security. We will implement and maintain appropriate technical and organizational measures to protect Personal Data from Personal Data Breaches as described in Section 7.1of the Agreement.
    4. Confidentiality. We will ensure that any personnel whom We authorize to Process Personal Data on Our behalf is subject to appropriate confidentiality obligations, by contract unless such personnel is covered by an appropriate statutory obligation of confidentiality, and complies with the terms of this DPA in respect of all Processing of Personal Dat.
    5. Personal Data Breaches. We will notify You without undue delay, but in no event later than seventy-two (72) hours after We become aware of any Personal Data Breach and will provide timely information relating to the Personal Data Breach as it becomes known or reasonably requested by You. Such notification shall at a minimum: (i) describe the nature of the Personal Data Breach, including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; (ii) communicate the name and contact details of the data protection officer or other contact point where more information can be obtained; (iii) describe the likely consequences of the Personal Data Breach; and (iv) describe the measures taken or proposed to be taken by Us to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects. We will provide all reasonable cooperation, information and resources that you may request to investigate the Personal Data Breach and to respond to any inquiries from affected individuals, authorities and regulatory bodies. This shall include, without limitation, ensuring that We and Our Sub-Processors, as applicable, promptly take steps as directed by You to remedy the Personal Data Breach and mitigate any harmful effects to Your Data, and to assist in any subsequent investigation, litigation, and provision of notices in relation to any Personal Data Breach.
    6. Deletion or Return of Personal Data. We will delete or return all Data, including Personal Data, (including copies thereof Processed pursuant to this DPA, on termination or expiration of the Agreement in accordance with the procedures and timeframes set out in the Agreement. save that this requirement shall not apply to the extent We are required by applicable law to retain some or all of the Data, or to Data We have archived on back-up systems, which data We will securely isolate and protect from any further Processing and will delete at the earliest possible time (and no later than in accordance with Our deletion practices).
    7. Sub-processors. We will notify You prior to engaging any Sub-Processors to Process Personal Data on Your behalf unless You have provided prior written approval of such Sub-Processors, such consent will not be unreasonably withheld. We have currently appointed, and You have approved, as Sub-Processors the third parties listed in ANNEX 3 to this DPA.

      Where We engage Sub-Processors, We will impose data protection terms on the Sub-Processors that provide at least the same level of protection for Personal Data as those in this DPA (including, where appropriate, the Standard Contractual Clauses) to the extent applicable to the nature of the services provided by such Sub-Processors. We will be responsible for all Processing of Personal Data by each Sub-Processor We engage to Process Personal Data on Your behalf as if all such Processing was performed by Us.

  4. Data Subject Requests
    1. The Service provides You with a number of controls that You can use to retrieve, correct, delete or restrict Personal Data, which You can use to assist You in connection with Your obligations under Data Protection Laws, including Your obligations relating to responding to requests from Data Subjects to exercise their rights under applicable Data Protection Laws ("Data Subject Requests").
    2. To the extent that You are unable to independently address a Data Subject Request through the Service, then upon Your written request, we will provide reasonable assistance to You to respond to any Data Subject Requests or requests from data protection authorities relating to the Processing of Personal Data under the Agreement.
    3. If a Data Subject Request or other communication regarding the Processing of Personal Data under the Agreement is made directly to Us, We will promptly inform You and will advise the Data Subject to submit their request to You. You will be solely responsible for responding substantively to any such Data Subject Requests or communications involving Personal Data.
  5. Data Transfers
    1. You acknowledge and agree that We may access and Process Personal Data on a global basis as necessary to provide the Service in accordance with the Agreement, and in particular that Personal Data will be transferred to and Processed by Tekion Corp. in the United States and to other jurisdictions where Tekion Affiliates and Sub-Processors have operations. We will ensure that such transfers are made in compliance with the requirements of Data Protection Laws.
  6. Additional Provisions for European Personal Data
    1. Scope of Section 6. This section shall apply only with respect to European Personal Data.
    2. Roles of the Parties. When Processing European Personal Data in accordance with Your Instructions, the parties acknowledge and agree that You are the Controller of European Personal Data and We are the Processor.
    3. Notification and Objection to New Sub-Processors. We will notify You of any changes to Sub-Processors by updating ANNEX 3 to this DPA and will give You the opportunity to object to the engagement of the new Sub-Processor on reasonable grounds relating to the protection of Personal Data within thirty (30) days after updating ANNEX 3 to this DPA. If You notify Us of Your objection(s), the parties will discuss Your concerns in good faith with a view to achieving a commercially reasonable resolution. If no such resolution can be reached, We will, at our sole discretion, either not appoint the new Sub-Processor or permit you to suspend or terminate the Agreement in accordance with the termination provisions of the Agreement without liability to either party (but without prejudice to any fees incurred by You prior to suspension or termination).
    4. Data Protection Impact Assessments and Consultation with Supervisory Authorities.To the extent that the required information is reasonably available to Us, We will provide reasonable assistance to You with any data protection impact assessments, and prior consultations with supervisory authorities or other competent data privacy authorities to the extent required by European Personal Data Protection Laws.
    5. Transfer Mechanisms for Data Transfers. We shall not transfer European Personal Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless We first take all such measures as are necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures may include (without limitation) (i) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, (ii) to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, (iii) or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws.
    6. Demonstration of Compliance. We will make all information reasonably necessary to demonstrate compliance with this DPA available to You and allow for and contribute to audits, including inspections by You, no more than once a calendar year during regular business hours with reasonable advance notice to Us in order to assess compliance with this DPA. Any such audit is subject to Our reasonable confidentiality procedures, and You are responsible for all costs and fees related to such audit, including all reasonable costs and fees (including Our time spent) that We incur for the audit. Upon request, We will supply (on a confidential basis) a summary copy of its penetration testing report(s) to You so that You can verify Our compliance with this DPA. Further, at Your written request, We will provide written responses (on a confidential basis) to all reasonable requests for information made by You necessary to confirm Our compliance with this DPA, provided that You will not exercise this right more than once per calendar year. You acknowledge that the Services are hosted by Our data center partners who maintain independently validated security programs (including SOC 2 and ISO 27001) and that Our systems are regularly tested by independent third party penetration testing firms.
  7. Additional Provisions for California Personal Information
    1. Scope of Section 7. This section of the DPA will apply only with respect to California Personal Information.
    2. Roles of the Parties. When processing California Personal Information in accordance with Your Instructions, the parties acknowledge and agree that You are a Business and We are a Service Provider for the purposes of the CCPA.
    3. Responsibilities. The parties agree that We will Process California Personal Information as a Service Provider strictly for the Uses under the Agreement. You do not sell Personal Data to Us because we only use Your Data and any Personal Data contained within it for the purposes specified in the DPA.
  8. General Provisions
    1. Amendments. Notwithstanding anything else to the contrary in the Agreement and subject to section 13.3 of the Agreement, We reserve the right to make any updates and changes to this DPA at any time on not less than 30 days’ notice to You.
    2. Severability. If any individual provisions of this DPA are determined to be invalid or unenforceable, the validity and enforceability of the other provisions of this DPA will not be affected.
    3. Limitation of Liability. The limitations and exclusions of liability and indemnity obligations in the Agreement apply to each party under this DPA.
    4. Governing Law. This DPA will be governed by and construed in accordance with section 13.5 of the Agreement unless required otherwise by Data Protection Laws.

ANNEX 1

Scope of Processing

Please see the details of Our Data processing, which is available at Schedule 1 at https://tekion.com/legal/privacy/dpa.

ANNEX 2

Security Measures

We will implement administrative, operational, physical, organizational and technical safeguards that, at a minimum, comply with applicable Data Protection Laws, are appropriate to the nature of Your Data and are designed to preserve and protect the security, integrity and confidentiality of Your Data and protect Your Data against Personal Data Breaches. Such measures include, without limitation:

  1. requiring all Personal Data stored on any of Our onsite storage devices be accessible via a secured network;
  2. requiring that We encrypt all other transmissions of Personal Data, including over public networks or wireless networks; and
  3. requiring that We encrypt all Personal Data stored on any removable or portable devices or media.

Please see Our full list of Security Measures at Schedule 2 at https://tekion.com/legal/privacy/dpa.

ANNEX 3

List of Subprocessors

The list of legal entities that Tekion uses to store and deliver Personal Data in connection with the Services is available at https://tekion.com/privacy/subprocessor-list. This list will be updated from time to time based on Sub-Processors that we may add or change to deliver the Services:

EXHIBIT VIII

Market Scan Data Access Agreement

The Market Scan Data Access Agreement is available at https://tekion.com/legal/third-party-license-terms/marketscan-flow-down.