Master Services Agreement

1.1 Orders. The specific Services, subscription plan and licence tier, Billable Unit quantities, usage limits, fees, and other commercial terms will be set out in one or more ordering documents executed by the parties or accepted by Customer (each, an "Order"). Sparrowhawk's standard Order is the Pricing Addendum / Order Form, which is a separate document from this Agreement and is executed separately; this Agreement itself contains no pricing, plan, tier, or quantity terms. An Order may reference this Agreement and may include or attach further documents, such as a service level agreement ("SLA") or statements of work ("SOWs").

1.1A Exhibits. Exhibit A (Core Functionality) and Exhibit B (Support and Communications) are attached to and form part of this Agreement. Exhibit A describes the functionality committed under Section 10.2A. Exhibit B describes Sparrowhawk's support and communications commitments. Customer's licence tier, the named contacts referenced in Exhibit B, and any Order-specific variation to either Exhibit are stated in the Order.

1.2 DPA. If Customer processes personal information through the Services, Sparrowhawk's Data Processing Addendum ("DPA") available at https://www.sparrowhawklabs.com/legal/dpa, as updated from time to time, forms part of this Agreement and is incorporated by reference. In the event of any conflict between this Agreement and the DPA regarding the processing of personal information, the DPA will prevail.

1.3 Order of precedence. If there is any conflict between the terms of this Agreement (including its Exhibits), an Order (including the Pricing Addendum / Order Form), the DPA, or Sparrowhawk's online policies, the following order of precedence applies: (a) the DPA (with respect to data protection and privacy matters), (b) the Order, including the Pricing Addendum / Order Form and any SLA or SOW attached to it, (c) the Exhibits to this Agreement, (d) this Agreement, and (e) Sparrowhawk's online terms and policies (including its standard Terms of Use and Privacy Policy).

2.1 Services. Sparrowhawk will provide the Services described in each Order during the applicable subscription term, subject to Customer's payment of all applicable fees and compliance with this Agreement. The Services consist of the Sparrowhawk CRM platform, related APIs, and associated documentation, hosting, and support as described in the Order, Exhibit A (Core Functionality), Exhibit B (Support and Communications), and the SLA (if any).

2.2 Licence grant. Subject to the terms of this Agreement, Sparrowhawk grants Customer a non-exclusive, non-transferable (except as permitted under Section 14.3), limited licence during the applicable subscription term to access and use the Services for Customer's internal business purposes and to permit its authorized users to do the same.

2.3 Use restrictions. Customer shall not, and shall not permit any third party to: (a) use the Services for any illegal or unauthorized purpose; (b) store or transmit any protected health information or other regulated medical records via the Services; (c) copy, modify, or create derivative works of the Services; (d) reverse engineer, decompile, or disassemble the Services, except to the extent permitted by applicable law that cannot be contractually waived; (e) circumvent or attempt to circumvent any security measures of the Services; or (f) use the Services in a way that interferes with or disrupts the integrity or performance of the Services or any third-party systems.

Prohibited Data Categories. In addition to the use restrictions above, Customer shall not submit any of the following categories of data to the Services:

• (i) Protected health information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA), unless Sparrowhawk and Customer have executed a separate Business Associate Agreement;
• (ii) Payment card data (PAN, CVV, expiration date), except as processed through Sparrowhawk's contracted payment providers (FluidPay / PayRio);
• (iii) Third-party personally identifiable information (names, emails, phone numbers, addresses, government ID numbers, Social Security Numbers) unless Customer has obtained informed consent from each individual or has a documented lawful basis under applicable privacy law;
• (iv) Attorney-client privileged communications, attorney work product, or confidential legal advice;
• (v) Third-party confidential information, trade secrets, or proprietary data submitted without the third party's authorization;
• (vi) Biometric data or genetic information; or
• (vii) Financial-account credentials or banking-payment information beyond what Sparrowhawk's payment processors require.

Consequences. If Customer submits Prohibited Data, Sparrowhawk may (i) quarantine the data within Customer's account, (ii) notify Customer of the violation and request remediation within fourteen (14) days, (iii) suspend Customer's access if the violation is not remediated, or (iv) delete the Prohibited Data without liability. If Prohibited Data in Customer's account creates a legal or regulatory risk for Sparrowhawk, Sparrowhawk may terminate Customer's account and any active Order on thirty (30) days' notice.

2.4 B2B and US-only focus. The Services are designed for business-to-business use by commercial operators in the United States and are not intended for consumer use or for storing protected health information. Customer is responsible for ensuring that its use of the Services complies with all applicable federal, state, and local laws and regulations, including those governing Customer's industry and data privacy.

2.5 Regulated Industry Disclaimers.

(a) Not legal or compliance advice. The Services are a software tool designed to support Customer's business operations. Nothing in the Services, documentation, or any communication from Sparrowhawk constitutes legal, regulatory, or compliance advice. Customer should consult qualified legal counsel for guidance on the laws and regulations applicable to Customer's business.

(b) Customer compliance responsibility. Customer is solely responsible for ensuring that its business operations, including its use of the Services, comply with all applicable federal, state, and local laws and regulations, including any licensing, registration, and industry-specific regulatory requirements applicable to Customer and to the markets in which Customer operates.

(c) Third-party data accuracy. The Services may integrate with or display data from third-party sources, including state regulatory and track-and-trace systems, point-of-sale systems, credit and risk data providers, and other industry platforms. Sparrowhawk does not guarantee the accuracy, completeness, or timeliness of any third-party data and is not liable for any errors or omissions in such data.

(d) Regulatory change risk. The markets in which Customer operates are subject to evolving federal, state, and local regulation. Changes in applicable law or regulation may affect the availability, functionality, or legality of the Services or Customer's ability to use the Services. Sparrowhawk will use commercially reasonable efforts to adapt the Services to material regulatory changes but does not guarantee uninterrupted service in the event of regulatory action.

(e) Right to cease service. Sparrowhawk reserves the right to suspend or terminate the Services in any jurisdiction where (i) the provision of the Services, or Customer's operations, become prohibited or unlawful under applicable law, or (ii) a bank, payment processor, insurer, hosting provider, or other counterparty essential to Sparrowhawk's provision of the Services withdraws, restricts, or declines to provide services to Sparrowhawk in respect of that jurisdiction or Customer's industry, such that Sparrowhawk cannot continue to provide the Services on commercially reasonable terms. In such event, Sparrowhawk will provide Customer with reasonable notice and a pro-rata refund of any prepaid, unused fees.

3.1 Accounts. Customer is responsible for maintaining the confidentiality of its account credentials and for all activities that occur under its accounts. Customer will notify Sparrowhawk promptly of any unauthorized access or use of the Services.

3.2 Customer Data. "Customer Data" means any data, content, or information (including personal information) submitted to the Services by Customer or on its behalf, including data about Customer's end-customers and users. As between the parties, Customer retains all rights, title, and interest in and to Customer Data. Customer is responsible for the accuracy, quality, legality, and means of acquiring Customer Data. Customer represents and warrants that it has all rights and consents necessary to submit Customer Data to the Services and to permit Sparrowhawk to process Customer Data as contemplated in this Agreement.

3.2A Customer Data licence to Sparrowhawk. Customer grants Sparrowhawk a worldwide, non-exclusive, royalty-free, sublicensable (only to Subprocessors as permitted under Section 7.3) licence to host, copy, store, transmit, process, and display Customer Data as reasonably necessary to: (a) provide, operate, and maintain the Services for Customer; (b) provide customer support and resolve technical issues for Customer; (c) prevent or address security threats, fraud, abuse, or violations of this Agreement; (d) comply with applicable law or valid legal process; (e) maintain, improve, and develop the Services and related features for Customer's benefit; and (f) generate Aggregated Data as defined and described in Section 9.2. This licence terminates with respect to Customer Data when Customer Data is deleted or anonymised in accordance with Section 7.4, except that Sparrowhawk may continue to use Aggregated Data already generated.

3.3 Compliance with law. Customer will use the Services in compliance with applicable laws and regulations, including those relating to Customer's industry, advertising, and data privacy. Sparrowhawk is not responsible for Customer's compliance with industry-specific regulations or any laws applicable to Customer's business.

4.1 Agreement term. This Agreement commences on the Effective Date (as defined in the initial Order) and continues until terminated in accordance with this Section 4.

4.2 Order term. Each Order will specify the subscription term for the Services under that Order. Unless otherwise stated in an Order, subscriptions renew automatically for successive periods equal in length to the initial term, at Sparrowhawk's then-current rates (provided that any fee increase upon renewal will not exceed ten percent (10%) of the prior term's fees without Customer's prior written consent), unless either party gives written notice of non-renewal at least sixty (60) days before the end of the then-current term.

4.3 Termination for cause. Either party may terminate this Agreement or any affected Order upon written notice if the other party materially breaches this Agreement or the Order and fails to cure such breach within thirty (30) days after receiving written notice describing the breach. Either party may terminate this Agreement immediately if the other party becomes insolvent, enters bankruptcy proceedings, or ceases business operations.

4.4 Effect of termination. Upon expiration or termination of an Order: (a) Customer's right to access and use the Services under that Order will cease; (b) any amounts owed by Customer for the period prior to termination will become immediately due and payable; and (c) Sparrowhawk will make Customer Data available for export as described in Section 7.4. Termination of this Agreement will not automatically terminate any Order then in effect; each such Order will continue for the remainder of its term, unless terminated as provided in this Section.

5.1 Fees. Customer will pay the fees specified in each Order. Fees, licence tier, and Billable Unit quantities are set out in the Pricing Addendum / Order Form, which is a separate document from this Agreement and is executed separately; this Agreement contains no pricing terms. Unless otherwise stated in an Order, fees are quoted and payable in US dollars and are non-refundable except as expressly provided in this Agreement or the relevant Order.

5.2 Invoicing and payment. Unless otherwise specified in an Order, Sparrowhawk will invoice Customer in advance for subscription fees on a monthly or annual basis, as indicated in the Order. Customer will pay all undisputed amounts within thirty (30) days of the invoice date.

5.3 Taxes. Fees do not include any taxes, duties, or similar governmental assessments of any nature, including sales, use, value-added, or withholding taxes ("Taxes"). Customer is responsible for paying all Taxes associated with its purchases hereunder, excluding taxes based on Sparrowhawk's net income.

5.4 Late payments. Sparrowhawk may charge interest on overdue amounts at the lesser of 1.5% per month or the maximum rate permitted by law. Sparrowhawk may suspend Customer's access to the Services for unpaid amounts that are more than fifteen (15) days past due, provided that Sparrowhawk has given Customer at least seven (7) days' prior notice.

5.5 Quantity adjustments and additional units.

(a) Billable Units. Each Order specifies the quantity of each billable unit — Authorized Users, Sales Channels, and Transactional Data Channels (each a "Billable Unit"). The usage records maintained by the Services in the ordinary course of business will be the authoritative record of Billable Units, absent manifest error.

(b) Additions. Customer may add Billable Units at any time through the Services or by written request. Before Customer confirms an addition through the Services, the Services will display the incremental charge, including any proration for the remainder of the then-current billing period. Upon Customer's affirmative confirmation, the added Billable Units are provisioned immediately and Sparrowhawk may bill for them without a further signed Order. Sparrowhawk will include on Customer's next invoice (i) a charge for the added Billable Units at the rates set out in the Order, prorated for the remainder of the then-current billing period, and (ii) the adjusted recurring fee. Only Customer's authorized administrators may add Billable Units on Customer's behalf.

(c) Reductions. Customer may reduce Billable Units effective at the start of the next billing period. Reductions do not take effect mid-period, and Sparrowhawk will not credit or refund fees for Billable Units removed during a billing period.

(d) Reconciliation. If the Order provides for billing based on a stated quantity of Billable Units or includes a usage-based true-up mechanism, Sparrowhawk may, at the end of each billing period, reconcile the Billable Units recorded in the Order against the actual Billable Units used in the Services, based on the usage records described in Section 5.5(a). Sparrowhawk may adjust the recurring fee only to reflect such excess usage or the usage-based pricing agreed in the Order, and no adjustment will exceed the pricing methodology stated in the Order. Sparrowhawk will give Customer at least ten (10) days' notice before billing any adjustment that increases the recurring fee by more than ten percent (10%) for that billing period, and Customer may dispute any reconciliation item in good faith within thirty (30) days after receipt of the invoice.

(e) Rates. Added Billable Units are charged at the per-unit rates set out in the Order, including any discount stated in the Order, for the duration of the then-current term.

5.6 Payment method and authorization.

(a) Payment method on file. Customer will maintain a valid payment method (credit card or ACH bank authorization) with Sparrowhawk's payment processor. Customer authorizes Sparrowhawk to charge that payment method for all amounts due under each Order, including recurring subscription fees, prorated charges for added Billable Units under Section 5.5, reconciliation adjustments, and applicable Taxes.

(b) Timing and precedence. Unless the Order expressly states that Customer will be billed by invoice and pay by wire or other invoice payment method, Sparrowhawk may charge the payment method on file on the invoice date for all amounts then due and payable, including any prorated amounts, usage true-ups, and recurring fees. If the Order expressly provides for payment by invoice, Section 5.2 will govern and Customer will pay all undisputed invoiced amounts within thirty (30) days of the invoice date. In the event of any conflict, the payment method and timing stated in the Order control, followed by this Section 5.6(b), then Section 5.2.

(c) Failed payments. If a charge fails, Sparrowhawk may retry the charge, and Section 5.4 applies to amounts that remain unpaid.

(d) Disputes. Customer must notify Sparrowhawk in writing within thirty (30) days of the invoice date of any disputed amount; undisputed amounts remain payable.

(e) Survival of authorization. The authorization in Section 5.6(a) continues until the Order terminates and all amounts due have been paid.

5.7 Not a HIPAA Business Associate. Sparrowhawk is not a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA) and does not sign Business Associate Agreements as a matter of course. If Customer is a HIPAA covered entity or business associate, or processes protected health information ("PHI"), Customer may not use the Services to store, transmit, or process PHI unless Customer and Sparrowhawk have executed a separate written agreement designating Sparrowhawk as a Business Associate and establishing HIPAA-compliant safeguards. By using the Services, Customer represents and warrants that it will not submit PHI to the Services except as permitted by such a separate BAA.

6.1 Availability target. Sparrowhawk will use commercially reasonable efforts to make the production environment of the Services available at least 99.5% of the time in each calendar month, excluding planned maintenance and excused downtime (including outages caused by force majeure events, third-party service failures, internet provider failures, or Customer's acts or omissions).

6.2 Support. Sparrowhawk will provide support as described in Exhibit B (Support and Communications) and the applicable Order or SLA. Unless otherwise specified in Exhibit B or the Order, Sparrowhawk will acknowledge Priority 1 (P1) support requests within two (2) hours during support hours and will use commercially reasonable efforts to provide an update within twenty-four (24) hours. For all other issues, Sparrowhawk will use commercially reasonable efforts to provide an update within forty-eight (48) hours.

6.3 Service credits. If availability falls materially below the target in a given month, Customer may request service credits as described in Exhibit B, the applicable Order, or the SLA. Service credits are not granted automatically; Customer must submit a written request with reasonable supporting details within thirty (30) days after the end of the affected month. Service credits, if granted, will be applied against future fees and will be Customer's sole and exclusive remedy for failure to meet the availability target. Total service credits in any calendar month will not exceed thirty percent (30%) of that month's fees.

7.1 Data hosting and location. Sparrowhawk hosts the Services in data centres located in the United States, primarily on Google Cloud Platform. Customer Data will be stored and processed in the United States unless otherwise agreed in writing.

7.2 Security. Sparrowhawk will maintain appropriate technical and organizational measures designed to protect the security, confidentiality, and integrity of Customer Data, including encryption of Customer Data in transit and at rest, logical separation of Customer Data between customers, network security controls, logging and monitoring, and periodic penetration testing. Further details are set out in the DPA and, where applicable, the Order.

7.3 Subprocessors. Sparrowhawk may use Subprocessors (such as cloud hosting providers, payment processors, analytics providers, logging and monitoring tools, email providers, and security tools) to provide the Services. Sparrowhawk will enter into written agreements with Subprocessors requiring them to protect Customer Data in accordance with standards substantially similar to those set out in this Agreement. Sparrowhawk will be responsible for its Subprocessors' acts and omissions to the same extent as if performed by Sparrowhawk.

7.4 Data export and deletion. During the term of the applicable Order, Customer may export certain Customer Data via the Services' standard export capabilities. Upon written request within thirty (30) days after termination or expiration of an Order, Sparrowhawk will provide Customer with a one-time export of Customer Data in a reasonable format, unless prohibited by law or this would unreasonably burden Sparrowhawk's systems. Sparrowhawk may delete or anonymize Customer Data in accordance with its data retention practices, but in any event no earlier than ninety (90) days and no later than one hundred eighty (180) days after termination, subject to applicable legal obligations.

7.5 Security incidents. Sparrowhawk will notify Customer without undue delay after becoming aware of a confirmed unauthorized access to Customer Data on Sparrowhawk's systems that results in loss, disclosure, or alteration of Customer Data (a "Security Incident"). The notice will include reasonably available information about the nature of the Security Incident and the measures taken or proposed to be taken by Sparrowhawk to address it.

8.1 Definition. "Confidential Information" means non-public information disclosed by one party ("Discloser") to the other ("Recipient") that is designated as confidential or that should reasonably be understood to be confidential given the nature of the information and the circumstances of disclosure. Customer Data and Sparrowhawk's pricing and product information are Confidential Information.

8.2 Protection. Recipient will use the same degree of care that it uses to protect its own confidential information of similar nature (but not less than reasonable care) to protect Discloser's Confidential Information and will not use Discloser's Confidential Information for any purpose outside the scope of this Agreement. Recipient will not disclose Discloser's Confidential Information to any third party, except to its employees, contractors, and advisors who need to know the information for purposes of this Agreement and are bound by confidentiality obligations no less restrictive than those in this Agreement.

8.3 Exceptions. Confidential Information does not include information that: (a) is or becomes publicly available without breach of this Agreement; (b) was known to Recipient before receipt from Discloser; (c) is received from a third party without breach of any obligation of confidentiality; or (d) was independently developed by Recipient without use of Discloser's Confidential Information.

8.4 Compelled disclosure. Recipient may disclose Confidential Information to the extent required by law or court order, provided that Recipient gives Discloser reasonable prior notice (unless legally prohibited) and cooperates with Discloser's reasonable efforts to limit or protect the disclosure.

8.5 Survival. The obligations in this Section 8 will survive expiration or termination of this Agreement for three (3) years.

9.1 Ownership of Services. As between the parties, Sparrowhawk owns all rights, title, and interest in and to the Services, including all software, technology, Content, Marks, improvements, and related intellectual property. Except for the limited licence expressly granted to Customer under this Agreement, Sparrowhawk does not grant any rights or licences to Customer (whether by implication, estoppel, or otherwise).

9.2 Ownership of Customer Data; Aggregated Data; Model Improvement.

(a) Customer Data ownership. As between the parties, Customer owns all rights, title, and interest in and to Customer Data. Sparrowhawk's rights to process Customer Data are limited to those described in Section 3.2A, this Section 9.2, the DPA, and Customer's documented instructions.

(b) Aggregated Data — definition and ownership. "Aggregated Data" means data, statistics, indicators, benchmarks, models, model parameters, embeddings, or insights derived from Customer Data and/or the operation of the Services that have been de-identified and/or aggregated such that they do not identify, and cannot reasonably be used to re-identify, Customer, any of Customer's end-customers, users, or any individual. Sparrowhawk owns all rights, title, and interest in and to Aggregated Data and may use Aggregated Data, during and after the term of this Agreement, for any lawful purpose, including: (i) operating, maintaining, securing, and improving the Services; (ii) developing new products, features, and services; (iii) producing benchmarks, market intelligence, research, and industry insights, including reports made available to other customers, partners, or the public; and (iv) training, tuning, evaluating, and improving algorithms, machine learning models, and analytical features used in the Services or otherwise.

(c) Model and feature improvement. Sparrowhawk may use Customer Data and Aggregated Data to develop, train, tune, evaluate, and improve algorithms, machine-learning models, analytical features, security and fraud-prevention systems, and operational tooling that power the Services. Sparrowhawk applies access controls and audit logging to internal use of Customer Data for these purposes. The de-identification standards referenced in DPA Section 2.4 apply when Customer Data is used for external purposes (publication of benchmarks or industry reports, or sharing with Subprocessors for purposes other than serving Customer), not to Sparrowhawk's internal model training, evaluation, and improvement.

(d) No sale; no cross-tenant disclosure of identifiable data. Sparrowhawk will not: (i) sell Customer Data (as "sale" is defined under any applicable Data Protection Law). For clarity, disclosures of Contributory Data to Contributory Data Partners under Section 9.3 are disclosures of commercial credit information about business entities, not Personal Data, and are not a sale or sharing of Personal Data; (ii) share Customer Data for cross-context behavioural advertising; (iii) disclose Customer Data to any other Sparrowhawk customer in a form that identifies Customer or any individual; or (iv) use Customer Data for third-party advertising or any purpose unrelated to the Services, the operation of Sparrowhawk's business in providing the Services, the generation of Aggregated Data, or Contributory Data Partnerships under Section 9.3. For clarity, Aggregated Data may be disclosed and licensed to third parties because, by definition, it does not identify Customer or any individual; Contributory Data may be disclosed to Contributory Data Partners solely as, and to the extent, permitted under Section 9.3.

(e) Re-identification prohibited. Sparrowhawk will not attempt to re-identify any Aggregated Data, will not combine Aggregated Data with other data sets in a manner intended to enable re-identification, and will contractually prohibit its Subprocessors and recipients of Aggregated Data from doing so.

(f) Non-Essential Analytics Opt-Out. Customer may, by written notice to privacy@sparrowhawklabs.com, opt out of being included in (i) publishable benchmarks and external industry insights reports, and (ii) Aggregated Data made available to other Sparrowhawk customers, partners, or the public. The opt-out does not apply to: internal model training, tuning, evaluation, or improvement; operating, securing, or supporting the Services; fraud prevention; compliance with applicable law; or Aggregated Data already generated prior to the opt-out. Sparrowhawk will implement an accepted opt-out within thirty (30) days of receipt.

9.3 Contributory Data Partnerships.

(a) Definitions. "Contributory Data" means a minimized subset of Customer Data consisting of (i) accounts-receivable and payment-performance fields (invoice amounts, aging buckets, payment timeliness, and credit-utilization metrics) and (ii) the identity of the retailer or other business debtor to which those receivables relate (its legal and DBA business name, business licence number(s), and business location), which constitutes commercial information about a business and not personal information about an individual. Contributory Data is stripped of all individual Third-Party PII (the names, email addresses, and telephone numbers of natural persons), free-text fields, pricing terms, and any deal records other than the accounts-receivable fields and business-debtor identity described above. Contributory Data identifies the business debtor only — by its business and DBA name, business licence number(s), and business location — and includes no information about any owner, officer, employee, guarantor, or other natural person connected with that business. Sparrowhawk excludes from Contributory Data any receivable where the business debtor's name is, or incorporates, the name of a natural person. "Contributory Data Partner" means a third party listed on Sparrowhawk's published Data Partner registry that receives Contributory Data in order to generate and provide credit scores, risk signals, suggested credit limits, or similar reports. A Contributory Data Partner is not a Subprocessor (it does not process data on Customer's behalf to deliver the Services) and its receipt of Contributory Data is not Aggregated Data (it is not de-identified/aggregated to the standard in Section 9.2(b)). "Credit Reporting Capability" means a credit-reporting, credit-scoring, receivables-risk, or collections-referral feature made available in the Services, which Customer activates.

(b) Permitted disclosure. Notwithstanding Section 9.2(d), Sparrowhawk may disclose Contributory Data to a Contributory Data Partner solely for that partner's generation of credit scores, risk signals, suggested credit limits, or similar reports, which may be provided back to Sparrowhawk and/or Customer, and in connection with which Sparrowhawk may receive fees (including a margin on report resale). Any disclosure under this Section is limited to the Contributory Data fields defined in Section 9.3(a) and to what is reasonably required for that purpose. The Credit Reporting Capability is enabled by default on each Transactional Data Channel and is included in the fees for that channel; no separate tier, add-on, or additional fee is required to receive it.

Customer is enrolled in Contributory Data Partnerships as a default feature of the Services, consistent with the Non-Essential Analytics Opt-Out model in Section 9.2(f), and may opt out at any time under Section 9.3(f). Where Customer has activated a Credit Reporting Capability, disclosure under this Section is also the means by which that capability is delivered to Customer.

Nature of Contributory Data. Contributory Data is commercial credit information about business entities. It consists of Customer's own accounts-receivable record and the identity of the business entity that owes Customer payment. The disclosure is made in order to provide the Services to Customer: the resulting scores and reports are made available back to Customer so that Customer can assess the credit health of the business accounts to which it extends payment terms. It does not include personal information about any natural person, and its disclosure under this Section is accordingly not a sale or sharing of Personal Data under the CCPA/CPRA or comparable US state privacy laws. Sparrowhawk nonetheless provides the opt-out in Section 9.3(f) as a matter of customer control, and the mechanisms described in Sparrowhawk's Privacy Policy continue to apply to any Personal Data Sparrowhawk holds.

(c) Minimization. Contributory Data is limited to the fields defined in Section 9.3(a). Sparrowhawk will not include individual Third-Party PII (the names, email addresses, or telephone numbers of natural persons), free-text notes, pricing terms, or deal records beyond the accounts-receivable fields and business-debtor identity defined in Section 9.3(a) in any disclosure to a Contributory Data Partner, and will disclose only those fields reasonably required for the purpose described in Section 9.3(b).

(d) Partner flow-down obligations. Sparrowhawk will require each Contributory Data Partner, by written agreement, to: (i) use Contributory Data solely for the purpose described in Section 9.3(b); (ii) not resell, license, or further disclose Contributory Data itself (as distinct from scores, signals, or reports the partner derives from it); (iii) not re-identify or attempt to re-identify any individual from Contributory Data; (iv) maintain security measures substantially similar to those required of Subprocessors under Section 7.3; and (v) delete or return Contributory Data upon the earlier of termination of the applicable Data Partner agreement or Customer's opt-out under Section 9.3(f), subject to a reasonable wind-down period.

(e) Advance notice; published registry. Sparrowhawk will maintain a published registry of current Contributory Data Partners at https://www.sparrowhawklabs.com/legal/data-partners and will provide Customer at least thirty (30) days' advance notice (via the registry and email or in-product notice) before including Customer's Contributory Data with a new Contributory Data Partner or a new category of Contributory Data Partner.

(f) Opt-out. Customer may opt out of some or all Contributory Data Partnerships at any time, with prospective effect, by written notice to privacy@sparrowhawklabs.com, or through any opt-out control Sparrowhawk makes available in the Services. Sparrowhawk will honour any opt-out made under this Section. An opt-out received by written notice will be implemented within fifteen (15) business days; an opt-out submitted through an in-product control takes effect on confirmation. From the effective date of the opt-out, Sparrowhawk will exclude Customer's data from Contributory Data disclosures. Opt-out does not require retroactive recall of Contributory Data already disclosed to a Contributory Data Partner before the opt-out's effective date, except that Sparrowhawk will use commercially reasonable efforts to request deletion from the affected partner. Deactivating a Credit Reporting Capability also stops, prospectively, the Contributory Data disclosure associated with that capability. Unless and until Customer opts out, Customer is enrolled in Contributory Data Partnerships as a default feature of the Services, consistent with the Non-Essential Analytics Opt-Out model in Section 9.2(f).

(g) Customer representation. Customer represents and warrants that it has the right to provide Contributory Data to Sparrowhawk and to permit its disclosure to Contributory Data Partners as described in this Section, including any notice, consent, or permission required under Customer's own agreements with, or applicable law relating to, the business debtors to which the Contributory Data relates. Obtaining and maintaining that right is Customer's responsibility. Customer's indemnity under Section 11.2(a) applies to any third-party claim arising from a breach of this representation.

---

9.4 Feedback. If Customer or its users provide Sparrowhawk with suggestions, comments, or other feedback regarding the Services ("Feedback"), Customer hereby grants Sparrowhawk a perpetual, irrevocable, worldwide, royalty-free licence to use, modify, and incorporate such Feedback into the Services or Sparrowhawk's other products and services without restriction or compensation to Customer.

10.1 Mutual warranties. Each party represents and warrants that it has the legal authority and power to enter into this Agreement and that its performance under this Agreement will comply with applicable laws.

10.2 Sparrowhawk warranties. Sparrowhawk warrants that: (a) during the applicable subscription term, the Services will substantially conform in all material respects to the documentation made available by Sparrowhawk as of the Order Effective Date, as that documentation may be updated from time to time, provided that no such update materially reduces the functionality described in Exhibit A; and (b) Sparrowhawk will not materially reduce the overall security of the Services during the term of this Agreement. Customer's exclusive remedy for breach of this warranty is the re-performance of the Services or, if Sparrowhawk cannot substantially correct the non-conformity within a reasonable time, termination of the affected Order with a pro-rata refund of any prepaid, unused fees.

10.2A Core functionality commitment. During the applicable subscription term, Sparrowhawk will not materially reduce or remove the core functionality described in Exhibit A. If Sparrowhawk does so and does not restore substantially equivalent functionality within thirty (30) days after Customer's written notice, Customer may terminate the affected Order and receive a pro-rata refund of any prepaid, unused fees. This is Customer's sole and exclusive remedy under this Section 10.2A. For the avoidance of doubt, changes to the user interface, workflow, design, underlying technology, or the manner in which a capability is delivered are not a reduction in functionality for the purposes of this Section, provided the capability described in Exhibit A remains available to Customer.

10.2B New features and enhancements. Sparrowhawk develops the Services continuously. During the applicable subscription term, Customer will receive, at no additional fee, the new features, enhancements, and improvements that Sparrowhawk makes generally available within Customer's licence tier.

This Section does not entitle Customer to, and expressly excludes: (a) functionality that Sparrowhawk makes generally available only in a higher licence tier than Customer's; (b) additional Transactional Data Channels beyond the quantity stated in the Order, which are added under Section 5.5, and any third-party data or market-intelligence capability that Sparrowhawk makes generally available as a separately priced item; (c) AI-Enabled Seat capabilities beyond those included in Customer's licence tier, including AI capabilities that draft or perform actions on Customer's behalf; and (d) any other module, add-on, integration, or capability that Sparrowhawk makes generally available as a separately priced item. Items in (a) through (d) are available to Customer by executing a new or amended Order at Sparrowhawk's then-current rates. For the avoidance of doubt, the Credit Reporting Capability described in Section 9.3 is included in each Transactional Data Channel at no additional fee and is not excluded by this Section.

Sparrowhawk does not commit to develop or release any particular feature or capability. No roadmap, product plan, presentation, demonstration, statement of direction, or other communication — whether made before or after the Order Effective Date — constitutes a commitment, deliverable, warranty, or condition of this Agreement, and no fee paid under any Order is consideration for any unreleased feature. Customer agrees that its purchasing decision is not contingent on the delivery of any future functionality.

10.3 Customer warranties. Customer represents and warrants that it has all necessary rights and consents to submit Customer Data to the Services and to permit Sparrowhawk to process Customer Data as contemplated by this Agreement, and that Customer's use of the Services will comply with this Agreement and applicable laws.

10.4 Disclaimers. EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE" AND SPARROWHAWK DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. SPARROWHAWK DOES NOT WARRANT THAT THE SERVICES WILL BE ERROR-FREE, UNINTERRUPTED, OR MEET CUSTOMER'S REQUIREMENTS.

11.1 Sparrowhawk indemnity. Sparrowhawk will defend Customer against any third-party claim alleging that Customer's authorized use of the Services infringes a valid US patent, copyright, or registered trademark, and will pay any damages and reasonable attorneys' fees finally awarded against Customer (or any settlement approved by Sparrowhawk) arising out of such claim. Sparrowhawk's obligations do not apply to claims arising from: (a) Customer Data; (b) Customer's use of the Services in violation of this Agreement; (c) combinations of the Services with other products, services, or technology not provided by Sparrowhawk; or (d) Customer's modification of the Services.

If Sparrowhawk believes the Services may infringe, Sparrowhawk may: (i) modify the Services to make them non-infringing; (ii) replace the Services with a non-infringing alternative with substantially similar functionality; or (iii) terminate the affected Order and provide a pro-rata refund of any prepaid, unused fees.

11.2 Customer indemnity. Customer will defend Sparrowhawk and its affiliates, and their respective officers, directors, and employees, against any third-party claim arising out of or related to: (a) Customer Data; (b) Customer's use of the Services in violation of this Agreement or applicable law; or (c) any dispute between Customer and its customers, partners, or users relating to Customer's use of the Services. Customer will pay any damages and reasonable attorneys' fees finally awarded against Sparrowhawk (or any settlement approved by Customer) arising out of such claims; except to the extent the claim arises from Sparrowhawk's material breach of this Agreement or the DPA, or from Sparrowhawk's negligence or wilful misconduct, in which case Sparrowhawk shall defend itself against such claims and Customer's indemnity shall not apply.

11.3 Procedures. The indemnified party will: (a) promptly notify the indemnifying party of any claim; (b) give the indemnifying party sole control of the defence and settlement of the claim (except that the indemnifying party may not settle any claim that imposes any non-monetary obligation on the indemnified party without its consent); and (c) provide the indemnifying party with reasonable cooperation at the indemnifying party's expense.

12.1 Exclusion of certain damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, OR DATA, ARISING OUT OF OR RELATED TO THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

12.2 Cap on liability. EXCEPT FOR (A) CUSTOMER'S PAYMENT OBLIGATIONS AND (B) CUSTOMER'S BREACH OF SPARROWHAWK'S INTELLECTUAL PROPERTY RIGHTS, EACH PARTY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO SPARROWHAWK UNDER THE APPLICABLE ORDER DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

For claims arising from each party's indemnification obligations under Section 11, each party's aggregate liability will not exceed two (2) times the fees paid or payable by Customer under the applicable Order during the twelve (12) month period immediately preceding the event giving rise to the claim.

For claims arising solely from Sparrowhawk's infringement of third-party intellectual property rights in the Services (excluding Customer Data and third-party materials), Sparrowhawk's aggregate liability will not exceed two (2) times the amount of fees paid or payable by Customer under the applicable Order during the same twelve (12) month period.

12.3 Unlimited liability carve-outs. Nothing in this Agreement limits or excludes either party's liability for willful misconduct or fraud.

13.1 Governing law. This Agreement is governed by and construed in accordance with the laws of the State of Oregon and the federal laws of the United States applicable therein, without regard to its conflict of law rules.

13.2 Informal resolution and arbitration. Before initiating formal legal proceedings, the parties will attempt in good faith to resolve any dispute by informal negotiations for at least thirty (30) days after written notice of the dispute. Any dispute not resolved by negotiation will be finally determined by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules. The seat and place of arbitration will be Deschutes County, Oregon, USA, the language will be English, and the tribunal will consist of one (1) arbitrator.

13.3 Courts and injunctive relief. Nothing in this Agreement prevents either party from seeking temporary or preliminary injunctive relief from a court of competent jurisdiction, including the courts located in Deschutes County, Oregon, to protect its rights pending final resolution of a dispute.

14.1 Entire agreement. This Agreement, together with all Orders and the DPA, constitutes the entire agreement between the parties relating to the subject matter hereof and supersedes all prior and contemporaneous understandings, agreements, negotiations, and communications, both written and oral.

14.2 Amendments. Any amendment or modification of this Agreement must be in writing and signed by both parties, except that Sparrowhawk may update the DPA or online policies in accordance with their terms.

14.3 Assignment. Neither party may assign this Agreement without the prior written consent of the other party, except that either party may assign this Agreement in connection with a merger, acquisition, or sale of substantially all of its assets. Any attempted assignment in violation of this Section is void. This Agreement will bind and inure to the benefit of the parties and their respective permitted successors and assigns.

14.4 Force majeure. Neither party will be liable for any delay or failure to perform its obligations under this Agreement due to events beyond its reasonable control, including acts of God, natural disasters, war, terrorism, labour disputes, governmental actions, changes in applicable law or regulation (including regulatory action affecting either party's industry), internet or telecommunication failures, or third-party service failures.

14.5 Independent contractors. The parties are independent contractors, and nothing in this Agreement will be construed as creating a partnership, joint venture, agency, or employment relationship between the parties.

14.6 Severability. If any provision of this Agreement is held invalid or unenforceable by a court of competent jurisdiction, that provision will be enforced to the maximum extent permissible and the remaining provisions of this Agreement will remain in full force and effect.

14.7 Waiver. No waiver by either party of any breach or default under this Agreement will be deemed a waiver of any preceding or subsequent breach or default.

If you have any questions about this Agreement, please contact:

Sparrowhawk Labs, Inc.
1605 NW Galveston Ave
Bend, OR 97703
United States
Email: help@sparrowhawklabs.com

The parties have caused this Agreement to be executed by their duly authorized representatives as of the Effective Date specified in the applicable Order.

Sparrowhawk Labs, Inc.

By: ___________________________
Name: _________________________
Title: __________________________
Date: __________________________

Customer

By: ___________________________
Name: _________________________
Title: __________________________
Date: __________________________

This Exhibit forms part of the Agreement. It describes the core functionality committed under Section 10.2A. Functionality is described at capability level, not feature level: the manner in which a capability is delivered may change (Section 10.2A). Billable Unit quantities and any Order-specific variation to this Exhibit are stated in the Pricing Addendum / Order Form, which is a separate document.

Core platform capabilities

#	Capability	Description
1	Account and contact management	Create, maintain, search, and segment business accounts, locations, and contacts.
2	Sales channel and territory management	Organise accounts and users into sales channels and territories, with visibility scoped accordingly.
3	Pipeline and opportunity tracking	Track opportunities and deals through configurable stages to a won/lost outcome.
4	Order capture and status	Record orders against accounts and track them through fulfilment and invoicing status.
5	Accounts receivable visibility	Record invoices and payments, and view outstanding balances and ageing by account.
6	Task and activity management	Assign, schedule, and complete tasks, visits, and logged activities against accounts and contacts.
7	Insight signals (surfacing)	Surface system-identified signals and recommended next actions at the point of work. Capabilities that perform actions on a user's behalf are not included in this Exhibit (Section 10.2B).
8	Reporting and dashboards	Standard reports and dashboards over the data in capabilities 1–6, filterable by the user's scope.
9	Data import and export	Bulk import at onboarding, self-service export of Customer Data during the term, and the post-termination export described in Section 7.4.
10	Roles and permissions	Role-based access control over records and fields, with administrative management of users.
11	Audit logging	A record of material user and administrative actions, retained per Sparrowhawk's retention practices.
12	Application access	Access via the web application, including on mobile-sized screens, for each Authorized User.
13	API access	Programmatic access to Customer's own data via Sparrowhawk's documented API, subject to published rate limits and fair use.
14	Support and communications	As set out in Exhibit B.

This Exhibit forms part of the Agreement and describes the support and communications commitments referenced at Sections 6.2 and 6.3. Named contacts and any enhanced commitments are stated in the Pricing Addendum / Order Form, which is a separate document. Where an SLA addendum is attached to the Order, it prevails over this Exhibit to the extent of any conflict.

B.1 Support channels and hours

Item	Commitment
Channels	Email to help@sparrowhawklabs.com, and in-application support request.
Support hours	Monday to Friday, 8:00 AM – 6:00 PM Pacific Time, excluding US federal holidays.
Out of hours	A P1 may be raised at any time; the response clock in B.2 runs during support hours unless an enhanced SLA is attached to the Order.
Language	English.

B.2 Priority levels and response targets

Priority	Definition	Acknowledgement	Update cadence
P1 — Critical	The production Services are unavailable, or core functionality is unusable for all of Customer's users, with no reasonable workaround.	2 support hours	At least every 24 hours until resolved or downgraded
P2 — High	Core functionality is materially impaired for a significant group of users, or a workaround exists but is materially burdensome.	1 business day	At least every 48 hours
P3 — Normal	A non-critical defect, question, or configuration issue affecting a limited number of users, with a workaround available.	2 business days	As reasonably required
P4 — Low	Cosmetic issues, documentation questions, and enhancement requests.	5 business days	As reasonably required

Sparrowhawk assigns the initial priority and will discuss it with Customer on request. Response targets are commercially reasonable efforts and are not availability commitments; availability is addressed at Section 6.1 and service credits at Section 6.3. An enhancement request logged as P4 is handled under Sections 9.4 and 10.2B — logging one is not a commitment to build it.

B.3 Escalation

Step	Route
1	Sparrowhawk support, via the channels in B.1
2	Sparrowhawk support lead
3	Customer's named Sparrowhawk contact (stated in the Order)
4	Sparrowhawk engineering leadership

Customer may escalate any P1 immediately to step 3 without waiting for the step 1 or step 2 response window to elapse.

B.4 Named contacts

Each party will name and maintain the following in the Order, and will notify the other party of any change:

Role	Party
Primary commercial / account contact	Sparrowhawk
Primary technical contact	Sparrowhawk
Primary administrator (authorised to add Billable Units under Section 5.5(b))	Customer
Billing contact	Customer
Privacy / data protection contact	Both

B.5 Incident communications

Event	Commitment
Incident affecting availability	Sparrowhawk will post and maintain notice on its status page for the duration of the incident.
Incident materially affecting Customer	Sparrowhawk will notify Customer's named contacts once the incident is confirmed, with periodic updates at the B.2 cadence for the assigned priority.
Post-incident summary	For any P1, a written summary of cause and corrective action within five (5) business days of resolution.
Security incident	Governed by Section 7.5 and the DPA, which prevail over this Exhibit.

B.6 Maintenance

Type	Notice
Planned maintenance expected to cause downtime	At least five (5) business days' advance notice, scheduled outside support hours where reasonably practicable.
Routine maintenance with no expected downtime	No individual notice; performed in low-usage windows.
Emergency maintenance	As much notice as is reasonably practicable in the circumstances, with notice after the fact where advance notice is not possible.

B.7 Change and deprecation notice

Sparrowhawk will give Customer at least thirty (30) days' advance notice before removing or materially changing a documented API endpoint, or a capability described in Exhibit A. This notice obligation is in addition to, and does not limit, the core functionality commitment at Section 10.2A.

B.8 Business reviews

Where stated in the Order, Sparrowhawk will hold a business review with Customer each quarter covering usage and adoption, open support items, and Sparrowhawk's current product direction. Anything discussed about future product direction in a business review is informational only and is subject to Section 10.2B — it is not a commitment to deliver.