Terms of Service

1. Introduction

Parties. This Terms of Service (the “Agreement”) is a legal agreement between Cyber Risk International Ltd, an Irish limited company with its registered office in the Republic of Ireland (referred to as “Cyber Risk International”, “CRI”, “we” or “us”), and the client entity that signs an Order Form or Statement of Work referencing this Agreement (referred to as the “Client” or “you”). This Agreement governs the Client’s access to and use of CRI’s cybersecurity, cyber risk, compliance and resilience services, and the Client’s use of CRI’s software-as-a-service platform known as “CyberPrism” (including all versions and feature-based editions of CyberPrism) in a business-to-business context. Client Status. The Client represents that it is a business entity (not a consumer) acting in the course of business, and is entering this Agreement for commercial purposes only.

Acceptance. By executing an order, statement of work, or other ordering document that references this Agreement, or by using the Services (defined below), the Client agrees to be bound by these Terms of Service. If the Client does not agree, it must not use the Services. This Agreement is effective as of the date of last signature on the initial Order Form or Statement of Work between the parties (the “Effective Date”).

Structure. This Agreement includes the terms and conditions set forth below, any appendices attached hereto, and each Order Form, Statement of Work, schedule or annex executed by the parties that references this Agreement (collectively, the “Contract Documents”). In the event of any conflict between the terms of the main body of this Agreement and any Order Form or Statement of Work, the terms of the Order Form or Statement of Work shall prevail to the extent of that conflict (provided that, unless expressly stated otherwise, a special term in any Order or SOW will not override the general limitations of liability or data protection obligations in this Agreement). The Contract Documents constitute the entire agreement between the parties with respect to the subject matter and supersede any prior proposals or agreements.

2. Definitions

For the purposes of this Agreement, the following capitalised terms have the meanings set forth below. Other terms may be defined in context within this Agreement.

• “Advisory Services” (also called “Professional Services”) means the cybersecurity, cyber risk management, compliance, and resilience consulting, advisory or training services provided by CRI (other than the CyberPrism SaaS platform), which may include strategic consulting, risk assessments, compliance audits, resilience planning, training sessions, or other expert services as described in a Statement of Work or Order Form.
• “CyberPrism” (or the “Platform”) means CRI’s proprietary software-as-a-service platform (including the CyberPrism web application, tools, dashboards, and any related software components) that enables organisations to measure, assess, and manage cyber risk, compliance and resilience. CyberPrism Services refers to the subscription-based services through which CRI provides Client with access to and use of CyberPrism (including any specific editions or versions differentiated by features, such as “Enterprise” or “Audit” versions).
• “Services” means, collectively, all services and products provided by CRI to Client under this Agreement, including (i) the Advisory Services and (ii) the CyberPrism Services, as may be further described in an Order Form or Statement of Work. Services may be provided separately or as part of a combined offering.
• “Order Form” means a document (which may be titled an order, proposal, service order or similar) executed by the parties that describes the Services to be provided, including any subscription to the CyberPrism platform or any Advisory Services, and the associated fees, term, and other key details. An Order Form may also incorporate a Statement of Work (SOW) for Advisory Services if applicable.
• “Authorised Users” means the individuals authorised by Client to access and use the CyberPrism platform under Client’s account, such as Client’s employees, officers, or contractors, and any other persons that the parties agree in writing may have access (for example, personnel of Client’s affiliates or service providers, if permitted in an Order Form). Authorised Users must be bound by obligations of confidentiality and use no less restrictive than those in this Agreement, and Client is responsible for their compliance with this Agreement.
• “Client Data” means all data, information, content, and materials (including any personal data) that the Client or its Authorised Users input into the CyberPrism platform or otherwise provide to CRI in the course of using the Services. Client Data includes any reports, results, metrics, or other output generated by the CyberPrism platform based on Client’s inputs, as well as any materials provided by Client for use in Advisory Services.
• “Confidential Information” means any information, in any form, that is disclosed by one party (the “Disclosing Party”) to the other (the “Receiving Party”) and that is identified as confidential or proprietary, or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information of Client includes Client Data and the Client’s business plans, security information, and strategies. Confidential Information of CRI includes the Services (including the CyberPrism software and algorithms), CRI’s methodologies, and any reports or deliverables provided to Client (subject to Client’s usage rights in such deliverables). Confidential Information does not include information that the Receiving Party can demonstrate: (a) is or becomes publicly available without breach of any obligation; (b) was known to the Receiving Party before disclosure by the Disclosing Party, without confidentiality obligations; (c) is received from a third party without breach of any obligation to the Disclosing Party; or (d) was independently developed by the Receiving Party without use of or reference to the Disclosing Party’s Confidential Information.
• “Data Protection Laws” means all applicable laws and regulations relating to the processing, privacy, and use of personal data, including the EU General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR) and Ireland’s Data Protection Acts 1988 to 2018, and any amendments or successor legislation, as well as any other applicable data protection or privacy laws in any relevant jurisdiction.
• “Fees” means all fees, charges, and amounts payable by Client for the Services, as specified in an Order Form or Statement of Work, or as otherwise agreed in writing. Fees may include subscription fees for CyberPrism (e.g. annual or monthly subscription charges), fees for Advisory Services (which may be on a fixed price, time-and-materials, or retainer basis), and any applicable one-time charges, usage-based fees, or additional service fees.
• “Initial Term” means the initial contract term for the applicable Services as specified in the Order Form or Statement of Work (for example, a twelve (12) month period, or a specific project duration for Advisory Services).
• “Renewal Term” means each successive renewal period for the applicable Services following the Initial Term, as defined in Section 13.1.
• “Acceptable Use Policy” or “AUP” means the acceptable use requirements for the CyberPrism Services set forth in Appendix 1 of this Agreement. The AUP may be updated by CRI from time to time to address emerging threats or changes in law, provided no update will materially diminish Client’s rights under this Agreement.
• “Support Services” means the support and maintenance services provided by CRI for the CyberPrism platform, as described in Appendix 2 (Support and Service Levels) or in the relevant Order Form.
• “Technical Prerequisites” means the minimum technical requirements and client-side systems or resources necessary for Client to access and use the CyberPrism Services, such as supported web browsers, internet connectivity, hardware specifications, or other environment conditions, which may be provided in the documentation or communicated by CRI.
• “Term” means the duration of this Agreement, as defined in Section 13.1, including the Initial Term and all Renewal Terms.
• “Intellectual Property Rights” means all intellectual and industrial property rights throughout the world, whether registered or unregistered, including patents, utility models, trademarks, service marks, trade names, business names, logos, get-up, domain names, design rights, copyright (including rights in computer software and databases), moral rights, rights in Confidential Information (including know-how and trade secrets), and any applications or registrations for the foregoing, as well as all rights of a similar nature or having equivalent effect.

Note: Other capitalised terms are defined elsewhere in this Agreement. Definitions shall apply equally to their singular and plural forms.

3. Scope of Services

This Agreement governs two broad categories of services: (1) Advisory Services provided by CRI’s experts, and (2) CyberPrism SaaS Services (subscription-based access to the CyberPrism platform). The Client may obtain either or both categories of services under this Agreement. Specific details of the Services (such as scope, deliverables, duration, subscription level, and Fees) will be set out in one or more Order Forms or Statements of Work executed by the parties.

3.1 Advisory Services

CRI will provide the Advisory Services described in the applicable Order Form or Statement of Work. Such services may include cybersecurity strategy consulting, cyber risk assessments, compliance and regulatory gap analysis, cyber resilience planning, staff training, incident response planning, or other professional services tailored to the Client’s needs. CRI shall perform all Advisory Services using reasonable skill and care, in accordance with applicable professional standards and the specifications agreed in writing.

Deliverables. If the Advisory Services involve the preparation of reports, assessments, recommendations, training materials or other tangible deliverables (collectively, “Deliverables”), such Deliverables will be described in the Order Form or SOW. Unless otherwise specified, Deliverables are provided for the Client’s internal business use. The Client may use and copy any such Deliverables for its own internal purposes and may disclose them to its affiliates, regulators, or professional advisors as necessary, provided that any third-party recipient is bound to maintain confidentiality of the Deliverables. CRI retains ownership of the Intellectual Property Rights in the Deliverables (including any methodologies, templates, or know-how embedded therein) as set out in Section 9, but grants the Client a licence to use the Deliverables as provided in Section 9.3. The Client acknowledges that the Deliverables (such as risk assessment reports or policy documents) are intended for the Client’s use and are not intended for distribution to or reliance by any third party. If the Client elects to disclose a Deliverable (in whole or part) to a third party, (a) the Client shall notify such third party that the Deliverable was prepared for the Client’s internal use and not for the third party’s benefit, and (b) to the maximum extent permitted by law, CRI shall have no liability whatsoever to any such third party for any use or reliance on the Deliverable.

Collaboration and Dependencies. The Client agrees to reasonably cooperate with CRI in the performance of Advisory Services. The Client will provide in a timely manner any information, resources, access, or decisions reasonably required by CRI to perform the Services. CRI is entitled to rely on all information and data provided by the Client or on the Client’s behalf as being complete and accurate, and CRI shall not be responsible for any delays or failures in the Services caused by inaccurate or incomplete information provided by the Client or by the Client’s failure to fulfil its obligations. If a Statement of Work includes specific milestones, acceptance criteria or delivery dates for Deliverables, both parties will use good faith efforts to meet those milestones and dates. Any changes to the scope or requirements of Advisory Services must be agreed in writing (via a change order or amendment to the SOW) and may be subject to additional fees.

3.2 CyberPrism SaaS Services

Under the CyberPrism Services, CRI grants the Client a limited, non-exclusive, non-transferable right during the Term to access and use the CyberPrism platform (and any related documentation) via a software-as-a-service (SaaS) model, solely for the Client’s internal business purposes and in accordance with this Agreement and the applicable Order Form. The CyberPrism Services may be provided in different editions or plans (for example, editions tailored by features or level of functionality), the specifics of which will be set forth in the Order Form or in the Service description provided to the Client. All such editions are governed by the same terms of this Agreement, unless otherwise expressly stated.

Access and Users. Client’s access to CyberPrism will be provisioned by CRI (for example, by providing login credentials or enabling account access). The Client is responsible for managing access credentials for its Authorised Users and shall ensure that only Authorised Users access the Platform. The Client and Authorised Users may use the CyberPrism platform to input data, respond to cyber risk assessment questions, generate reports, and utilise other features provided. The Client shall not provide access to the CyberPrism platform to any person or entity other than Authorised Users without CRI’s prior written consent. Use of the CyberPrism Services by Authorised Users shall be limited to the scope (such as number of user accounts, business units, or assessments) specified in the Order Form. If the Client’s usage exceeds any limits set forth in the Order (for example, if additional Authorised Users beyond the licensed number access the platform, or if additional modules or assessments are utilised beyond the subscribed level), the Client agrees to pay the applicable additional fees for such overuse, as invoiced by CRI in accordance with Section 5.

Updates and Features. The Client acknowledges that the CyberPrism platform may be updated, upgraded, or enhanced by CRI from time to time. CRI may add new or improved functionalities, apply bug fixes, or make changes to the platform’s user interface or underlying technology, at its discretion, provided that no such update will materially reduce the core functionality of the service subscribed by the Client. Certain new features or modules may be offered to the Client as optional upgrades subject to additional fees. CRI will endeavour to schedule any significant changes or maintenance so as to minimise disruption to the Client, in accordance with the Support and Maintenance terms in Appendix 2.

Usage Restrictions. Client’s use of the CyberPrism Services is subject to the Acceptable Use Policy (Appendix 1). The Client shall not: (a) use the Platform in any manner that violates the AUP or any applicable law or regulation; (b) permit any unauthorised person to access the Platform; (c) use the Platform to process or store any data that is highly sensitive or regulated (such as health or payment card data) unless expressly agreed by CRI; (d) attempt to copy, modify, duplicate, create derivative works from, decompile, reverse engineer, or otherwise attempt to discover or access the source code or underlying trade secrets of CyberPrism (except to the extent such restriction is prohibited by mandatory law); or (e) use the Platform for the benefit of any third party, as a service bureau, or to build a competing product or service.

Technical Prerequisites. The Client is responsible for ensuring that it meets all Technical Prerequisites for use of CyberPrism. This includes obtaining and maintaining adequate internet connectivity, compatible devices or browsers, and any required third-party software. CRI will provide the Client with information about system requirements and supported configurations upon request. The Client’s failure to meet required Technical Prerequisites or to maintain its own IT environment (networks, hardware, software) may affect the performance or availability of the CyberPrism Services, and CRI shall not be responsible for any issues, errors, or delays arising from such Client-side factors. The Client is also responsible for implementing reasonable security measures in its own systems to protect access to the Platform (such as safeguarding login credentials and using up-to-date anti-virus tools).

3.3 Combined Service Packages (Hybrid Services)

If the Client purchases a service package or engagement that includes both Advisory Services and access to the CyberPrism platform (a “Hybrid Services” arrangement), then the respective terms of this Agreement applicable to each component of the Services shall apply to the corresponding components. For example, use of the CyberPrism platform within a hybrid engagement is subject to the same licence rights and restrictions stated in Section 3.2 and Appendix 1, while any consulting or advisory elements are subject to Section 3.1. The Order Form or SOW will specify the details of the hybrid package, including any concurrent term for the CyberPrism subscription and the Advisory Services. Unless otherwise specified, a hybrid package will have a unified term (e.g., a one-year engagement that includes ongoing platform access and periodic advisory consultations), and the auto-renewal provisions of Sections 5.4 and 13.1 will apply to the recurring components (such as the platform subscription or any ongoing advisory retainer).

The Client acknowledges that some Advisory Services in a hybrid package may be delivered through or in conjunction with the CyberPrism platform (for example, CRI’s consultants may use the platform to perform assessments or generate reports for the Client). In such cases, the Client will receive the benefit of the platform output and the expert analysis together. Any support or issues related to the CyberPrism software in a hybrid package will be handled in accordance with the Support terms, and any consulting queries will be handled by CRI’s advisory team. CRI will clarify in the Order Form or SOW any special terms that apply to a combined offering. In the absence of any special terms, all general provisions of this Agreement shall apply to the Hybrid Services.

4. Use of Services and Client Obligations

4.1 Compliance with Law and AUP

The Client agrees to use the Services only for lawful business purposes and in accordance with this Agreement, including the Acceptable Use Policy in Appendix 1. The Client and its Authorised Users shall not use the CyberPrism platform or any Service: (i) in violation of any applicable laws or regulations (including data protection and export control laws); (ii) to transmit or store any content that is illegal, defamatory, obscene, discriminatory, or infringing; or (iii) to engage in any conduct that could harm the security, integrity, or availability of the Services. The Client is responsible for ensuring that all Authorised Users are aware of and abide by the terms of this Agreement and the AUP. If the Client becomes aware of any actual or suspected violation of the AUP or unauthorised use of the Services, it shall promptly notify CRI.

4.2 Account Security and Authorised Use

The Client is responsible for maintaining the confidentiality and security of its account credentials for the CyberPrism platform. Credentials (such as user IDs and passwords or API keys) must not be shared between individuals. The Client will manage its Authorised Users’ access (for example, promptly removing access for users who no longer should have it) and will be responsible for any actions taken under its accounts by its Authorised Users or any other person who gains access due to the Client’s failure to safeguard credentials. CRI employs security measures to protect the Platform, but the Client acknowledges that user account security also depends on the Client’s safe handling of credentials. CRI will not be liable for any unauthorised access or use of the Services resulting from the Client’s failure to protect its credentials. CRI reserves the right to suspend or lock user accounts if unauthorised or suspicious activity is detected, in order to protect both parties, and will inform the Client in such event.

4.3 Client Provided Content and Consents

The Client is solely responsible for all Client Data and any other materials or content that it (or its Authorised Users) provides to CRI or inputs into CyberPrism. The Client represents and warrants that: (a) the Client either owns all right, title and interest in the Client Data, or has obtained all necessary rights, licences, and consents to allow the Client Data to be used as contemplated by this Agreement; (b) the Client Data and CRI’s processing or use of it in accordance with this Agreement will not infringe any intellectual property, privacy, or other rights of any third party, and will not violate any applicable law or regulation (including Data Protection Laws or export control laws); and (c) the Client Data does not contain any viruses, worms, malware or other harmful code. The Client shall not upload or provide any data to CRI that it is not legally permitted to transfer or use in this manner. CRI is not obligated to screen Client Data, but reserves the right to remove or restrict access to any Client Data that violates the foregoing warranties or the Acceptable Use Policy.

4.4 Acceptable Use Violations and Suspension

If the Client or its Authorised Users violate the Acceptable Use Policy or any other provision of Section 4 in a material way, CRI may give the Client a notice to remedy the violation. If the Client fails to cure the violation within thirty (30) days after such notice, or if the violation is such that it poses an imminent threat to CRI’s systems or the security or lawful operations of the Services (in which case CRI may require a more immediate remedy, or temporarily suspend the affected Services to prevent harm), then CRI reserves the right to suspend or terminate (as appropriate) the Client’s access to the Services. Any such suspension by CRI shall be limited to the scope reasonably necessary to address the violation (for example, suspending a specific user account or feature if possible, rather than the entire service, if the issue is isolated), and CRI will promptly restore the Services once the issue is resolved. Suspension of Services for breach does not relieve the Client of its obligation to pay Fees, and no credit or refund will be issued for suspended Services in the case of the Client’s breach. CRI will not be liable for any damages or losses suffered by the Client as a result of a suspension in accordance with this Section.

4.5 Support Cooperation

In relation to any technical support or troubleshooting, the Client agrees to reasonably cooperate with CRI’s support personnel. This may include providing information about the Client’s system environment, enabling remote diagnostic tools if applicable, or implementing temporary measures suggested by CRI to mitigate an issue. The Client should designate a primary contact person for communications regarding support and ensure that only trained or knowledgeable personnel interact with CRI’s support for efficient resolution of issues. Further details on support procedures and service levels are set out in Appendix 2.

5. Fees, Invoicing and Payment

5.1 Fees and Taxes

The Client agrees to pay all Fees as set forth in each Order Form or Statement of Work. Fees for CyberPrism subscription services may be structured as recurring subscription charges (for example, an annual fee, payable upfront or in periodic instalments as stated in the Order Form). Fees for Advisory Services may be structured as a fixed project fee, a time-and-materials rate (with an estimated total), or a recurring retainer fee, as specified in the relevant Order or SOW. All Fees are stated in Euro (EUR) unless otherwise indicated, and are exclusive of any applicable taxes. The Client is responsible for any value-added tax (VAT), sales tax, GST, or similar indirect taxes that are required by law, which will be added to CRI’s invoices at the appropriate rate. If any withholding tax is required by law to be deducted from payments by the Client, the Client shall gross-up the payment such that CRI receives the full amount of Fees owed as if no withholding had occurred (and Client shall provide appropriate documentation to CRI evidencing payment of the withholding tax). The Client shall pay all Fees in full, without any set-off, deduction or counterclaim (except as may be required by law in respect of withholding taxes as noted, or except for any amounts disputed in good faith in accordance with Section 5.3).

In addition to the service Fees, the Client agrees to reimburse CRI for reasonable travel, accommodation, or other out-of-pocket expenses incurred by CRI in the course of performing any Advisory Services on-site or as otherwise necessary, provided that any such expenses are pre-approved by the Client (or provided for in the SOW). CRI shall itemise any reimbursable expenses on its invoices and provide supporting receipts upon request.

5.2 Invoicing and Payment Terms

Unless otherwise specified in the Order Form or SOW, CRI will invoice the Client for Fees as follows:

• CyberPrism Subscription Fees: Subscription fees are typically invoiced in advance (e.g., annually in advance for an annual subscription, or monthly/quarterly in advance if agreed). The initial invoice will be issued promptly upon the Effective Date or the subscription start date (whichever is later), covering the Initial Term or initial billing period. Renewal Term fees will be invoiced as described in Section 5.4.
• Advisory Services Fees: For fixed-fee projects, CRI may invoice according to a payment schedule outlined in the SOW (for example, a percentage upfront and the remainder upon completion or at milestones). For time-and-materials services or retainer services, CRI may invoice monthly in arrears for hours expended and any expenses, or as otherwise specified in the SOW. If not specified, CRI will invoice monthly for work performed in the prior month.

Each invoice will itemise the Services provided and the corresponding Fees, and will include any applicable taxes. The Client shall pay each invoice within thirty (30) days of the invoice date, unless a different payment period is stated in the Order Form or invoice. Payment shall be made via electronic bank transfer to the account specified by CRI (or by other payment methods if agreed, such as credit card or check for smaller amounts). All payments must be made in the currency specified on the invoice (which will be EUR unless otherwise noted). The date of payment shall be when funds are received by CRI in cleared form.

5.3 Disputed Charges and Late Payments

If the Client, in good faith, disputes any portion of an invoice, the Client must notify CRI in writing before the payment due date, specifying the amount in dispute and the reason for the dispute. The Client may withhold payment of the disputed portion until the dispute is resolved, but shall timely pay the undisputed portion. The parties shall negotiate in good faith to resolve any invoice disputes promptly. CRI will not exercise its rights under this Section 5.3 or Section 5.4 for non-payment of disputed amounts, provided the dispute was raised in good faith.

If any undisputed invoice is not paid in full by the due date, CRI reserves the right to charge interest on the overdue amount. Interest will accrue on a daily basis from the day after the due date until payment in full, at the higher of: (i) an annual rate of eight (8) percentage points above the European Central Bank’s main refinancing rate (permitted under Irish law for late payments in commercial transactions), or (ii) the maximum rate allowed by applicable law, whichever is lower. The Client shall also be responsible for any costs of collection (such as reasonable legal fees) incurred by CRI in recovering overdue amounts.

In addition to charging interest, if any payment is more than fifteen (15) days late (and not subject to a good-faith dispute), CRI may, after providing at least fifteen (15) days’ prior written notice to the Client of such late payment, suspend the provision of Services until all overdue amounts are paid. This could include disabling access to the CyberPrism platform or pausing work on Advisory Services. CRI will not suspend services if the Client is actively working with CRI to resolve the delinquency or if the Client has provided a credible commitment to pay by a specific date. However, persistent or significant payment defaults shall constitute a material breach, giving rise to termination rights per Section 13.2.

5.4 Automatic Renewal and Price Adjustments

Auto-Renewal of Term. Except as otherwise specified in an Order Form or SOW, each subscription to CyberPrism and any recurring service under this Agreement shall automatically renew at the end of its Initial Term for an additional term equal in length to the Initial Term (each a “Renewal Term”), unless either party gives written notice of non-renewal at least thirty (30) days before the end of the then-current term. For clarity, if the Client does not provide a written notice of intent not to renew at least 30 days prior to the expiration of the Initial Term (or the current Renewal Term), the subscription or service will renew automatically. CRI may also elect not to renew a Service by providing at least 30 days’ written notice to the Client prior to the end of the current term.

Renewal Pricing Increase. Upon each renewal, the Fees payable for the renewed term shall automatically increase by ten percent (10%) over the Fees applicable in the immediately preceding term, unless otherwise stated in the Order Form or unless the parties mutually agree in writing to a different renewal price. The Client acknowledges and agrees that this 10% increase is a predetermined price adjustment to account for factors such as inflation, increased costs, and service improvements, and shall apply to each Renewal Term by default. CRI may, as a courtesy, remind the Client of an upcoming renewal and any price increase in advance; however, the validity of the auto-renewal and price increase is not contingent on such reminder. If the Client has made a multi-year prepaid commitment, the auto-renewal (with price increase) will take effect after the end of the prepaid period.

CRI will invoice the Client for the Renewal Term on or about the start date of the Renewal Term (or on the schedule otherwise defined in the Order Form), and the Client shall pay the renewal Fees in accordance with Section 5.2. If the Client timely notifies CRI of non-renewal as per above, the Services will expire at the end of the then-current term and CRI will cease billing for subsequent terms.

5.5 Cancellation and Refund Policy for Prepaid CyberPrism Contracts

If the Client has prepaid subscription Fees for a fixed term of the CyberPrism Services (for example, paid upfront for an annual or multi-year subscription) and the Client elects to terminate the CyberPrism Services before the end of the prepaid term for convenience (i.e., for reasons other than CRI’s breach or a cause under Section 13.2), then the Client will not be entitled to any cash refund of the prepaid Fees. However, as a courtesy and subject to the conditions below, CRI will provide the Client with a pro-rata credit for the unused portion of the prepaid term.

The pro-rata credit will be calculated from the effective date of termination through the remainder of the prepaid term, based on the number of full months (or unused service period) that were remaining. The credit amount = (prepaid Fee for the term) × (remaining portion of term unused). This service credit can be applied by the Client towards future purchases of CRI’s services (for example, the Client may apply the credit against renewal fees for CyberPrism if restarting later, or against fees for Advisory Services, as mutually agreed). All credits issued under this policy are non-transferable, have no cash value, and will expire twelve (12) months after issuance if not used.

To exercise an early termination of a prepaid CyberPrism contract under this Section 5.5, the Client must provide at least thirty (30) days’ advance written notice to CRI specifying the effective termination date (which may be any date at least 30 days after the notice, but not later than the original end of the term). CRI will confirm the termination date and the calculated credit amount. CRI will process the issuance of the service credit within ninety (90) days after the effective termination date. During that processing period, CRI may verify the remaining term and ensure all Client obligations (such as any outstanding payments or return of CRI materials) are satisfied.

No Cash Refunds. Except for credits as described above, or in cases of termination due to CRI’s uncured material breach as described in Section 13.3, the Client acknowledges that all Fees are non-refundable. If the Client terminates a prepaid subscription early, the sole compensation to the Client shall be the service credit described, and no refund in cash will be provided for unused services.

Nothing in this Section 5.5 shall limit the Client’s rights to terminate for cause or any remedies in the event of CRI’s breach. If the Client terminates the subscription due to a material breach by CRI (as per Section 13.2) and such breach is not cured, then in lieu of a service credit, the Client will be entitled to a pro-rata refund of any prepaid Fees for the terminated portion of the term (if and as ordered by a court or agreed in a settlement), which CRI shall process within ninety (90) days of termination.

6. Support and Service Levels

CRI will provide technical support and customer service for the CyberPrism platform in accordance with the standards described in this Section and in Appendix 2 (Support and Service Levels). The goal of CRI’s support is to ensure that the CyberPrism platform operates substantially in accordance with its documentation and to assist the Client in resolving any issues that arise during permitted use of the Platform.

Support Hours and Contact. Clients using the CyberPrism platform can log a support request, while logged in, via the CRIBOT chat support module within the Platform, or alternatively by email to [email protected] or by telephone on +353-(0)1-905 3260, during CRI’s normal business hours of 9:00 AM to 5:30 PM Irish time, Monday through Friday (excluding Irish public holidays), or as otherwise set out in Appendix 2. CRI may provide extended or 24/7 emergency support for critical issues as part of a separate support package or at its discretion for urgent incidents.

BETA Features and Bespoke Developments. Any features or functionality made available under a BETA code or as part of a pre-release programme, and any bespoke or custom developments built for the Client, are supported on a best-efforts basis only. Such features and developments fall outside the standard support service levels and target response times described in Appendix 2, and CRI does not warrant their availability, performance, or fitness for any particular purpose. CRI will use reasonable efforts to assist with issues affecting BETA or bespoke functionality, but cannot offer the same SLAs that apply to the generally available Platform.

Incident Response. CRI will use commercially reasonable efforts to respond to support requests within the response times indicated in Appendix 2, which may vary based on the severity level of the issue. For example, critical issues (such as the CyberPrism platform being unavailable) will receive a faster initial response and higher priority than minor issues or general questions. CRI will assign qualified personnel to work with the Client to resolve issues and will keep the Client informed of progress. While CRI cannot guarantee a specific resolution time, it will make good faith efforts to resolve material defects or errors in the Platform and to provide workarounds when feasible.

Maintenance and Updates. CRI may from time to time perform scheduled maintenance or deploy updates to the CyberPrism platform. Whenever possible, CRI will perform scheduled maintenance during off-peak hours (such as nights or weekends) to minimise impact on the Client, and will provide advance notice for any maintenance that is expected to cause significant downtime or disruption. In the event of urgent unscheduled maintenance (for example, to address a security vulnerability or system instability), CRI will endeavour to notify the Client as soon as practicable, although immediate notice may not be possible in all cases. The Client acknowledges that occasional downtime for maintenance or updates is necessary to ensure optimal performance and security of the Services.

Service Levels. CRI aims to achieve high availability for the CyberPrism platform. While CRI does not warrant a specific uptime percentage in this Agreement (unless otherwise agreed in a Service Level Agreement appendix), its target is at least 99% uptime measured on a monthly basis, excluding scheduled maintenance windows and events of force majeure. Appendix 2 may contain further details on service level objectives and any remedies (such as service credits) for extended downtime. The Client’s sole and exclusive remedy for any failure by CRI to meet any service level or support obligation shall be as set forth in Appendix 2 (if any service credit scheme is defined) or to terminate the affected Service as provided in Section 13 if performance issues constitute a material breach.

Support Limitations. Support Services are intended to address issues with the CyberPrism platform itself and to provide guidance on its use. CRI’s support team cannot perform tasks that are the Client’s own responsibility, such as configuring the Client’s network or devices, managing the Client’s internal data, or providing general cybersecurity consulting outside the scope of the Platform’s operation (unless separately engaged under Advisory Services). If an issue is determined to have been caused by the Client’s misuse or modification of the Platform, or by third-party systems (e.g., an internet outage or third-party software integrated by the Client), CRI may charge the Client on a time-and-materials basis for support efforts beyond reasonable troubleshooting, after informing the Client and obtaining consent to such charges.

7. Data Protection and Privacy

Each party shall comply with all applicable Data Protection Laws in connection with the performance of this Agreement. In the course of providing the Services, the parties acknowledge that CRI may process certain personal data on behalf of the Client. For example, Client Data input into CyberPrism or shared during Advisory Services may include personal data such as employee names, contact information, or other identifying information relevant to risk assessments.

Controller and Processor Roles. To the extent CRI processes personal data that is part of Client Data on behalf of the Client (for instance, data about the Client’s employees or customers input into the CyberPrism platform), the Client is deemed the data Controller and CRI is the data Processor (as those terms are defined in GDPR). The Data Processing Addendum attached as Appendix 3 to this Agreement shall govern such processing of personal data and is hereby incorporated by reference. Among other things, Appendix 3 sets out the subject-matter and nature of the processing, the types of personal data and categories of data subjects, and the respective obligations of CRI as a Processor, including implementing appropriate technical and organisational measures to safeguard personal data, only processing data in accordance with Client’s instructions, and assisting the Client in meeting its compliance obligations under Data Protection Laws.

Data Security. CRI shall maintain administrative, physical, and technical safeguards for the security and integrity of Client Data (including personal data) that are reasonably appropriate for a provider of services of similar nature, and as required by Data Protection Laws. This includes measures to protect against unauthorised access, disclosure, or alteration of Client Data. Without limitation to the foregoing, CRI will (a) restrict its personnel and subprocessors from accessing personal data except as necessary to provide the Services and subject to confidentiality obligations; (b) ensure that any subprocessors handling personal data on CRI’s behalf are bound by equivalent obligations and are engaged under a data processing agreement consistent with GDPR Article 28; and (c) notify the Client without undue delay if CRI becomes aware of a personal data breach affecting Client Data, and cooperate with the Client in any investigation and remediation as required by law.

International Transfers. The Client acknowledges that CRI may process and store Client Data (including personal data) on secure cloud servers or data centres which could be located inside the European Economic Area (EEA) or in another jurisdiction, depending on CRI’s infrastructure arrangements. CRI’s primary operations are in Ireland and, to the extent possible, Client Data will be stored within data centres in the EEA. If CRI needs to transfer personal data from the EEA (or other jurisdiction with data transfer restrictions) to a country not recognised as providing an adequate level of data protection (such as to a subprocessor in the United States), CRI will ensure that such transfer is carried out in compliance with Data Protection Laws. This may include implementing European Commission Standard Contractual Clauses or other appropriate safeguards as per GDPR Chapter V. Appendix 3 may specify any such transfer mechanisms.

Data Subject Requests and Cooperation. Taking into account the nature of the Services, CRI shall assist the Client, by appropriate technical and organisational measures and at the Client’s reasonable expense, in fulfilling the Client’s obligations to respond to requests from individuals (data subjects) to exercise their rights under Data Protection Laws (such as rights to access, rectify, or erase their personal data). If CRI directly receives any such request relating to Client Data, it will promptly inform the Client and will not respond directly to the request unless required by law or authorised by the Client. Additionally, upon the Client’s request, CRI will reasonably assist the Client in ensuring compliance with the Client’s obligations regarding data security, data breach notifications, data protection impact assessments, and consultations with supervisory authorities, as relevant to the Services, again at the Client’s expense if the effort is significant.

Use of Anonymised Data. The Client agrees that CRI may collect and use data relating to the performance, use, and operation of the Services in aggregated or anonymised form for the purposes of improving CRI’s services, developing new features, compiling statistical insights, and benchmarking. For example, CRI may track general usage trends or average risk scores across its client base, provided that such analysis does not reveal any Confidential Information or personally identify the Client or any data subject. Data that has been fully anonymised (so that it is not considered personal data under Data Protection Laws) may be retained by CRI beyond the Term for the aforementioned purposes.

Privacy Policy. CRI’s general privacy policy (available on its website) provides additional information on how CRI handles personal data of business contacts and Authorised Users when acting as a data controller (for example, contact information of Client’s personnel for contract management, billing, or marketing purposes). The Client acknowledges that CRI may process such business contact data as a controller for legitimate business interests (e.g., contract administration, service announcements, or promoting similar services to the Client), in compliance with Data Protection Laws. Each party shall ensure that any personal data of the other party’s personnel that it holds (e.g., contact details) is kept secure and used only for the purposes of this Agreement.

8. Confidentiality

8.1 Non-Disclosure and Use

Each Receiving Party shall: (a) use the Disclosing Party’s Confidential Information solely for the purpose of performing its obligations and exercising its rights under this Agreement; and (b) not disclose or make available any Confidential Information of the Disclosing Party to any third party except as permitted in this Section. Each party shall protect the confidentiality of the other’s Confidential Information with at least the same degree of care it uses to protect its own Confidential Information of similar sensitivity, and in no event less than a reasonable standard of care. Access to Confidential Information of the other party shall be restricted to those personnel or authorised contractors or advisors of the Receiving Party who need such access for purposes consistent with this Agreement, and who are bound by confidentiality obligations no less stringent than those herein.

8.2 Permitted Disclosures

Notwithstanding the foregoing, a Receiving Party may disclose Confidential Information of the Disclosing Party if and to the extent required by law, regulation, or court order, provided that (if legally permitted) the Receiving Party gives prompt written notice to the Disclosing Party of such requirement to allow the Disclosing Party an opportunity to seek a protective order or other appropriate remedy. If disclosure is ultimately required, the Receiving Party will disclose only that portion of the Confidential Information which its legal counsel advises is required to disclose. Additionally, either party may disclose the existence of this Agreement and general nature of the business relationship (for example, CRI may list Client’s name and logo in its client lists or marketing materials, unless the Client requests in writing to be excluded).

8.3 Duration of Confidentiality Obligations

The obligations in this Section 8 shall commence on the Effective Date and continue for the Term of the Agreement and for a period of five (5) years after termination or expiration of the Agreement. With respect to any trade secrets or highly sensitive information that are clearly identified as such at the time of disclosure, the obligations of confidentiality shall continue for so long as such information remains a trade secret under applicable law or otherwise confidential and not publicly known, whichever is longer.

8.4 Return or Destruction

Upon termination or expiration of this Agreement (or earlier upon request of the Disclosing Party), each Receiving Party shall promptly return or destroy (at the Disclosing Party’s election) all Confidential Information of the Disclosing Party in its possession or control, and certify in writing that it has done so, except to the extent that the Receiving Party is required by law or valid record-keeping policies (such as archival backup systems) to retain copies. Notwithstanding the foregoing, the Receiving Party shall not be required to delete electronically stored Confidential Information that is maintained as part of routine archival backups, provided that such retained information remains subject to the confidentiality obligations of this Agreement.

8.5 Confidentiality Exceptions

Information shall not be deemed Confidential Information if it falls into one of the exceptions enumerated in the definition in Section 2 (for example, information that becomes public through no breach by the Receiving Party). In addition, nothing in this Agreement shall restrict CRI from using any general know-how, skills or expertise developed in the course of providing the Services, provided that in doing so CRI does not use or disclose the Client’s Confidential Information. For instance, CRI’s consultants may utilise general methodologies or knowledge gained through performing services for the Client in servicing other clients, as long as no Client-specific Confidential Information is shared.

9. Intellectual Property Rights

9.1 CRI Property

All Intellectual Property Rights in and to the Services, the CyberPrism platform (including all software, code, algorithms, user interfaces, documentation, and underlying technology), and any methodologies, templates, tools or proprietary materials used by CRI in performing Advisory Services or creating Deliverables (collectively, “CRI Materials”), are and shall remain owned by CRI or its licensors. Except for the limited rights expressly granted to the Client under this Agreement, no rights or licences to CRI Materials or Intellectual Property Rights are granted or implied. The Client is not acquiring any ownership interest in CyberPrism, the Deliverables, or any other CRI Materials, and CRI reserves all rights that are not expressly granted.

9.2 Licence to Use CyberPrism

Subject to the Client’s payment of all applicable Fees and compliance with the terms of this Agreement, CRI grants to the Client, during the Term, a limited, non-exclusive, non-transferable, revocable licence (without the right to sublicense) to access and use the CyberPrism platform and any related CRI Materials (such as user manuals or online documentation) solely for the Client’s internal business operations. This licence allows use by the Authorised Users within the agreed scope (e.g., number of users or assessments) and is limited to the features and modules of CyberPrism that the Client has subscribed to. Any software components that may be provided by CRI for installation on Client’s premises (if any, such as an optional data connector or agent) are licensed on the same terms for use only in connection with the CyberPrism Services and must be uninstalled upon termination. The Client shall not (and shall not permit any third party to) copy, distribute (except internally as permitted), modify, or create derivative works based on the software or content provided by CRI, except as expressly permitted by this Agreement. All copies of CRI Materials (e.g., downloaded reports or documentation) must include any proprietary notices present on the originals.

9.3 Licence to Deliverables and Work Product

Subject to the Client’s payment in full for the applicable Advisory Services, CRI hereby grants the Client a perpetual, worldwide, royalty-free, non-exclusive licence to use, reproduce, and create derivative works from any Deliverables or other work product delivered to the Client as part of the Advisory Services, solely for the Client’s own internal business purposes. The Client may not resell or publicly distribute such Deliverables to third parties (except disclosure to advisors or regulators as permitted in Section 3.1) without CRI’s prior written consent. CRI retains the right to reuse any general knowledge, skills, experience, ideas, concepts, know-how and techniques acquired in the course of performing the Advisory Services, provided that no Client Confidential Information is used in doing so. If a Deliverable contains CRI’s pre-existing proprietary content or third-party components (for example, a template policy document created by CRI prior to the Client’s engagement), then CRI will identify such portions, and the Client’s licence to those portions is limited to use in connection with the Deliverable as a whole and does not transfer any ownership of such pre-existing materials to the Client. CRI warrants that it has the necessary rights to grant the licence in this Section 9.3 for any Deliverables provided.

9.4 Client Property and Licence to CRI

All Intellectual Property Rights in the Client’s own materials, data and content (including Client Data) are and will remain owned by the Client or its licensors. The Client grants to CRI a non-exclusive, royalty-free, worldwide licence to use, copy, transmit, store, and process Client Data and any other materials provided by the Client to the extent necessary to perform the Services, including to display results within the CyberPrism platform, to generate reports or Deliverables, and otherwise as instructed by the Client. The Client also grants CRI the right to use the Client’s name, logo, and trademarks as needed within the Platform interface (for example, to personalise the dashboard for Client’s users) and in Deliverables. Aside from this usage licence, CRI is not granted any rights in the Client’s intellectual property, and all rights not expressly granted to CRI are reserved by the Client. If the Client provides CRI with feedback, suggestions, or requests for improvements to the CyberPrism platform or Services, CRI shall be free to utilise such feedback without restriction or obligation (the Client hereby licenses any such feedback to CRI on a perpetual, irrevocable basis), provided that CRI shall not disclose the source of feedback or any Client Confidential Information in doing so.

9.5 Third-Party Components

The Services may include software, content, data, or other materials that are licensed from third parties (such as open source software libraries used within CyberPrism). CRI represents that it has obtained the necessary rights to include and use such third-party components in providing the Services. Some third-party components may be subject to additional or alternative licence terms, which, to the extent required by the third-party licensor, will be identified in the documentation or via a notice within the Platform. The Client’s use of those third-party components as part of the Services shall be subject to those licence terms. Nothing in this Agreement limits the Client’s rights under the licence terms for any open source software incorporated into the Platform (if any).

10. Warranties and Disclaimers

10.1 Mutual Authority Warranty

Each party represents and warrants that it is duly organised, validly existing and in good standing under the laws of its jurisdiction of incorporation, and that it has full authority to enter into this Agreement and to perform its obligations hereunder. Each party further warrants that the person signing or accepting this Agreement on its behalf has been properly authorised and that once executed, this Agreement will constitute a legal, valid, and binding obligation of that party.

10.2 CRI Warranties

CRI warrants that: (a) it will perform all Services (both Advisory Services and any support services related to CyberPrism) in a professional and workmanlike manner, using personnel with appropriate skills, qualifications, and experience; and (b) the CyberPrism platform, when used in accordance with its documentation and this Agreement, will materially conform to the service description or specifications provided by CRI in the Order Form or documentation during the Term. In the event of a breach of the warranty in subpart (b), the Client’s sole and exclusive remedy, and CRI’s sole obligation, shall be for CRI to make commercially reasonable efforts to correct or provide a workaround for the non-conformity, or if CRI is unable to do so within a reasonable time, the Client may terminate the affected Service and receive a pro-rata refund or credit for any prepaid Fees covering the unused portion of the term for that Service.

CRI further warrants that to its knowledge, the Services and CRI Materials do not infringe upon any third party’s Intellectual Property Rights. This warranty is subject to Section 12.1 (Indemnification for IP Claims) which provides the Client’s remedies for any breach of this warranty.

Except as expressly provided in this Section 10.2, the Services are provided on an “as is” basis.

10.3 Client Warranties

The Client represents and warrants that: (a) it has the necessary rights and permissions to provide the Client Data to CRI and to authorise CRI to process the Client Data for the purposes of this Agreement; (b) the Client Data and its use in accordance with this Agreement will not violate the rights of any third party (including any intellectual property rights or privacy rights) or any applicable laws; (c) the Client will use the Services in compliance with all applicable laws (including obtaining any regulatory approvals or licences that may be necessary for its use of the Services in its particular industry or jurisdiction, except to the extent CRI has expressly agreed in writing to obtain a specific regulatory clearance as part of the Services); and (d) no Client-provided software or systems interfacing with the CyberPrism platform will introduce any harmful code or vulnerabilities into CRI’s systems.

The Client also warrants that it will not re-sell or make available the Services to any third party (except Authorised Users and affiliates as permitted) and will not use the Services to process data for the benefit of third parties as a service bureau or similar.

10.4 Disclaimer of Warranties

General Disclaimer. Except for the express warranties set forth in Section 10.2 and 10.3 above, and to the maximum extent permitted by applicable law, CRI expressly disclaims all other warranties, representations, or conditions, whether express or implied, oral or written, including any implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, non-infringement, title, and any warranties arising from course of dealing or usage in trade. CRI does not warrant that the Services will meet all of the Client’s requirements, or that operation of the CyberPrism platform will be uninterrupted or error-free, or that all defects will be corrected. CRI does not guarantee any particular results or outcomes from the use of the Services.

Cybersecurity Risk. The Client acknowledges that cybersecurity risk management and regulatory compliance are complex, continually evolving fields, and that no service or tool can guarantee absolute protection or compliance. CRI’s Services (including advice, assessments, and the CyberPrism platform) are intended to assist the Client in identifying and managing cyber risks, but the Client remains solely responsible for the decisions it makes and the actions it takes (or fails to take) in securing its systems and in achieving compliance with applicable laws or standards. CRI does not warrant that use of the Services will prevent all cyber attacks or security incidents, or that the Client will be compliant with every regulatory requirement. For example, CRI cannot guarantee that every vulnerability will be detected or that regulators will accept the Client’s cybersecurity programme. The Client’s use of any recommendations or reports provided by CRI is at the Client’s own discretion and risk.

Third Party Systems. CRI is not responsible for the operation or security of any networks, applications, or services that are not provided by CRI. Any integration or use of the Services in conjunction with third-party systems (such as the Client’s existing IT infrastructure or any third-party software) is at the Client’s risk. CRI makes no representations or warranties about any third-party products or services that the Client may use in connection with the Services. If the CyberPrism platform allows for integration with third-party applications or data sources (e.g., importing data from a third-party tool), CRI does not warrant the functioning or results of such integration unless explicitly stated in the Order Form.

Internet and Data Transmission. The Client acknowledges that the use of internet-based services entails inherent risks. CRI is not responsible for any delays, delivery failures, or other damage resulting from problems inherent in the use of the internet and electronic communications, such as network interruptions, malware that travels through the internet, or data corruption in transit. The Client is responsible for ensuring that it employs appropriate measures (like firewalls and encryption) when transmitting sensitive data to and from the CyberPrism platform.

10.5 No Other Commitments

No advice or information obtained by the Client from CRI or through the Services, whether oral or written, shall create any warranty or condition not expressly stated in this Agreement. The Client has not relied on any representation or warranty regarding the Services except as specifically provided herein. Any estimates or forecasts provided by CRI (for example, of time to complete a project, or potential risk reductions) are for planning purposes only and are not guarantees of actual results.

Some jurisdictions do not allow the exclusion of certain warranties or conditions. To the extent such law applies to this Agreement, the exclusions above shall apply to the fullest extent permitted by law.

11. Limitation of Liability

11.1 Unlimited Liabilities

Nothing in this Agreement shall exclude or limit a party’s liability for: (a) death or personal injury caused by its negligence or that of its employees or agents; (b) fraud or fraudulent misrepresentation; (c) any other liability which cannot be lawfully excluded or limited under applicable law. In addition, Section 11.2 and 11.3 below are subject to Section 12.1 (indemnification for IP claims), which provides separate remedies for certain third-party claims.

11.2 Exclusion of Consequential Damages

Subject to Section 11.1 above, in no event will either party be liable to the other party for any indirect, incidental, special, punitive, exemplary or consequential losses or damages of any kind, arising out of or in connection with this Agreement or the Services, whether in contract, tort (including negligence), strict liability or under any other theory of liability, and even if advised of the possibility of such damages. The foregoing exclusion includes, without limitation, any loss of profits, loss of revenue, loss of business opportunity, loss of anticipated savings, loss of or corruption of data, business interruption, or damage to goodwill or reputation, even if such loss or damage was foreseeable.

11.3 Cap on Liability

Subject to Section 11.1 and except for claims arising from the Client’s payment obligations, each party’s total cumulative liability arising out of or related to this Agreement (whether in contract, tort, breach of statutory duty or otherwise) shall not exceed the total amount of Fees paid or payable by the Client to CRI under this Agreement in the twelve (12) months immediately preceding the first event giving rise to liability. If the duration of Services under this Agreement is less than twelve months or if the claim arises during the Initial Term before twelve months of the term have elapsed, then the liability cap shall be the total Fees that are payable for the first twelve (12) months of the Agreement (as if the full year had been completed). For one-time or project-based Advisory Services with a fixed fee, CRI’s total liability shall not exceed the amount of fees paid for that specific project or SOW.

For clarity, multiple claims or causes of action arising out of the same or substantially similar facts or circumstances shall be considered a single claim for the purpose of the above cap. The parties agree that the pricing and terms of this Agreement have been set with regard to this liability allocation, and they intend that this Section 11.3 will apply regardless of the form or theory of claim.

11.4 Specific Risks

Without prejudice to the general exclusions and limitations above, the Client acknowledges that CRI cannot be responsible for all aspects of cybersecurity risk, some of which are outside of CRI’s control. To the extent permitted by law, CRI shall not be liable for any damages resulting from a cybersecurity incident or data breach at the Client or any third party, even if such incident occurs after the Client utilised CRI’s Services. The Client should maintain its own insurance coverage for cyber incidents, business interruptions, and related losses.

Additionally, any liability of CRI for any claim under this Agreement will be reduced proportionally to the extent that the loss was caused or contributed to by the Client’s own acts or omissions or those of a third party (for example, if the Client failed to implement a recommendation provided by CRI and that failure contributed to the loss, CRI’s liability would be reduced accordingly).

11.5 Application of Limitations

The limitations and exclusions of liability in this Section 11 shall apply to the fullest extent permitted by law. The parties agree that these limitations allocate the risks between them as authorised by applicable law, and that the pricing of Services reflects this allocation of risk and the exclusions and limitations of liability herein. The limitations in this Section shall survive and apply even if any limited remedy specified in this Agreement is found to have failed of its essential purpose.

12. Indemnification

12.1 CRI Indemnity for Intellectual Property Infringement

CRI shall defend, indemnify and hold harmless the Client, its affiliates, and their respective officers, directors, and employees (collectively, “Client Indemnitees”) from and against any and all third-party claims, demands, suits, or proceedings (each, a “Claim”) alleging that the Client’s use of the CyberPrism platform or any other Services (excluding Client Data and third-party materials input by Client) in accordance with this Agreement infringes or misappropriates a valid patent, copyright, trademark, or trade secret of a third party. CRI will further indemnify Client Indemnitees against any damages, losses, and reasonable costs (including court fees and reasonable attorney’s fees) finally awarded against them by a court of competent jurisdiction (or agreed in settlement by CRI) as a result of such Claim.

In the event of any such Claim, or if CRI reasonably anticipates that a Claim is likely, CRI may, at its own expense and option, take one or more of the following actions:

• Procure the Right to Continue: Obtain the right for the Client to continue using the allegedly infringing Service;
• Replace or Modify: Replace the Service (or the infringing part thereof) with a non-infringing alternative, or modify the Service so that it becomes non-infringing (while maintaining materially equivalent functionality);
• Terminate and Refund: If the above options are not commercially feasible, terminate the affected Service (or portion) and refund to the Client any prepaid fees for the unused remainder of the Subscription Term for that Service.

This Section 12.1 states CRI’s sole and exclusive liability, and the Client’s sole and exclusive remedy, for any third-party intellectual property infringement or misappropriation Claims arising from the Client’s use of the Services.

Exceptions: CRI’s indemnification obligations above shall not apply to any Claim that arises from:

• Client Modifications: Modifications to the Service made by any party other than CRI or its authorised agents;
• Combination with Other Products: The combination, operation, or use of the Service with equipment, software, or data not supplied or approved by CRI, if the infringement would have been avoided by using the Service alone;
• Failure to Update: The Client’s failure to use corrections or enhancements made available by CRI that would have avoided the infringement;
• Misuse or Unauthorised Use: Use of the Service in a manner not permitted by this Agreement or for a purpose or in a context for which it was not designed.

12.2 Client Indemnity

The Client shall defend, indemnify and hold harmless CRI, its affiliates, and their respective officers, directors, and employees (collectively, “CRI Indemnitees”) from and against any and all third-party Claims arising out of or relating to:

• Unauthorised Use: The Client’s or any Authorised User’s use of the Services in a manner not authorised by this Agreement or in violation of law, including any use that violates the Acceptable Use Policy;
• Client-Provided Content: Any Client Data or other materials provided by Client that infringe or misappropriate a third party’s intellectual property or privacy rights, or that are defamatory or otherwise illegal;
• Legal/Regulatory Violations: The Client’s violation of any applicable laws or regulations (including data protection laws or export controls) in connection with its use of the Services, or any violation of third-party rights arising from Client’s use of the Services; or
• Breach of Agreement: The Client’s material breach of this Agreement, including any breach of its representations, warranties, or covenants herein.

The Client will indemnify the CRI Indemnitees against any damages, losses and reasonable costs (including court fees and reasonable attorney’s fees) finally awarded against them by a court of competent jurisdiction (or agreed in settlement by Client) as a result of such Claims.

12.3 Indemnification Procedure

Each party’s indemnification obligations are conditioned on the indemnified party: (i) promptly notifying the indemnifying party in writing of the Claim (provided that failure to provide timely notice will not relieve the indemnifier of its obligations except to the extent it was materially prejudiced by the delay); (ii) giving the indemnifying party sole control of the defence and settlement of the Claim (except that the indemnified party’s prior written consent will be required for any settlement that requires any admission of liability by the indemnified party or imposes any non-monetary obligations on the indemnified party, such consent not to be unreasonably withheld or delayed); and (iii) providing to the indemnifying party, at the indemnifying party’s expense, all reasonable assistance in the defence or settlement of such Claim. The indemnified party may, at its own cost, participate in the defence with counsel of its choosing, but the indemnifying party shall have control.

12.4 Additional Exclusions

The indemnities set forth in this Agreement are conditioned on the following: (a) the indemnified party not making any admission or taking any action in connection with the Claim that prejudices the defence, and (b) the indemnified party not entering into any settlement of the Claim without the indemnifying party’s prior written consent (not to be unreasonably withheld). The indemnifying party shall have no liability or obligation under this Section 12 for any Claim to the extent the indemnified party makes an admission in respect of the Claim, or compromises or settles the Claim, without the indemnifying party’s permission. The rights and remedies set forth in this Section 12 shall be the sole remedy of the indemnified party (and exclusive liability of the indemnifying party) as to the Claims covered by the indemnities.

13. Term and Termination

13.1 Term of Agreement and Renewal

This Agreement commences on the Effective Date and will continue in effect for as long as any Order Form or SOW remains in force, unless earlier terminated in accordance with this Section 13. The Initial Term for each Service (e.g., the initial subscription term for CyberPrism, or the expected duration of an Advisory Services project) will be as set forth in the applicable Order Form or SOW. If no duration is specified for a particular Service, a default term of one (1) year shall apply for recurring services, and project-based services shall be deemed to have a term lasting until completion of the services or deliverables.

At the end of each Initial Term for a recurring Service (such as an annual subscription or ongoing retainer), the Service will automatically renew for successive Renewal Terms of equal length to the Initial Term (or as otherwise specified in the Order Form), under the terms of this Agreement, unless either party provides a written notice of its intent not to renew that Service at least thirty (30) days prior to the end of the current term. The Fees for any Renewal Term shall be subject to the price increase specified in Section 5.4 (10% increase) or as otherwise agreed. If either party gives a timely notice of non-renewal, the Service will expire at the end of the then-current term.

If the Client continues to use a Service past the expiration or termination of its term without a formal renewal in writing, such use shall be on a month-to-month basis subject to this Agreement and at the then-current standard Fees charged by CRI (which shall incorporate the applicable 10% increase from the last contracted rate).

13.2 Termination for Cause

Either party may terminate this Agreement (and any or all Order Forms or SOWs) immediately by giving written notice to the other party upon the occurrence of any of the following events:

• Material Breach: The other party commits a material breach of this Agreement (including any Order Form or SOW) and, if the breach is curable, fails to cure that breach within thirty (30) days after receiving written notice detailing the breach. If the breach is of a nature that cannot reasonably be cured within 30 days, the breaching party may submit a plan acceptable to the non-breaching party to cure the breach as soon as practicable, but in any case within 60 days, to avoid termination.
• Insolvency: The other party becomes insolvent, is unable to pay its debts as they fall due, has a receiver or examiner appointed over it or its assets, files for bankruptcy or similar protection, enters into liquidation (other than a voluntary solvent liquidation for reorganisation purposes), or any analogous event occurs under the laws of any relevant jurisdiction that suggests the party is insolvent or nearing insolvency.
• Ceasing Business: The other party ceases to carry on business or announces an intention to cease operations in a manner that would prevent it from performing its obligations under this Agreement.

CRI may additionally terminate or suspend this Agreement (or the affected Service) with immediate effect if the Client is in material breach of the Acceptable Use Policy or data protection obligations and, after written notice from CRI, fails to promptly remedy such breach (taking into account the urgency and potential harm of the situation). In cases where an uncured material breach by the Client relates only to one Order Form or Service (e.g., violation in the use of CyberPrism but not affecting a separate Advisory SOW, or vice versa), CRI may elect to terminate only that specific Order Form/Service, while other unrelated Orders may continue in effect at CRI’s discretion.

13.3 Termination for Convenience of Advisory Services

The Client may terminate any Statement of Work for Advisory Services (excluding any ongoing subscription components) for its convenience and without cause, by giving at least thirty (30) days’ prior written notice to CRI (or a shorter notice period if specified in the SOW). In such event, CRI will cease work on the terminated Services as of the effective termination date and will take reasonable steps to wind down any in-progress work in an orderly manner. The Client shall pay CRI for all Services performed up to the termination date and for any irrevocable commitments made by CRI on the Client’s behalf (such as non-cancellable travel bookings or subcontractor fees), as well as any reasonable additional costs incurred by CRI as a direct result of the early termination (provided CRI takes commercially reasonable steps to mitigate those costs). If the Client had prepaid any fees for Advisory Services that were not yet performed as of termination, CRI will, at the Client’s option, either refund the unused portion of such fees or credit them against future services (except that any non-refundable deposit or minimum fee agreed in the SOW will be retained by CRI). Termination of an Advisory Services SOW under this Section 13.3 does not automatically terminate any related CyberPrism subscription unless specified by the Client and agreed by CRI (in which case Section 5.5 would apply to the prepaid subscription fees).

13.4 Effect of Termination

Upon termination or expiration of this Agreement or any individual Service for any reason:

• Cessation of Services: CRI will stop providing the terminated Services. The Client must immediately discontinue use of any terminated Services, including stopping all access to the CyberPrism platform for terminated subscriptions. Any licences granted to the Client for the terminated Services (such as access to CyberPrism) will cease as of the termination date. The Client shall ensure that CRI’s intellectual property (including any software code or documentation) is removed from its systems if instructed by CRI (excluding any Deliverables or permitted copies under the licence in Section 9.3 that the Client is entitled to retain).
• Payment of Amounts Due: The Client will immediately pay any outstanding Fees and expenses owed for Services rendered up to the termination date. In the event of termination by CRI for the Client’s uncured breach, any unpaid Fees for the remainder of the term of an Order (for recurring services) shall become immediately due and payable as liquidated damages (not as a penalty), in recognition that CRI offered discounted or extended payment terms in reliance on the full term. If termination is by the Client for CRI’s breach, the Client shall pay the prorated Fees up to the effective termination date (and any pre-paid Fees for post-termination period shall be handled as per refund obligation below).
• Refund or Credit: If this Agreement or a particular Service is terminated by the Client for CRI’s uncured material breach under Section 13.2, or by either party due to the other’s insolvency, CRI shall refund to the Client any portion of Fees that were paid in advance for the period after the termination date for that Service (this refund is not applicable if CRI has already provided a credit as per Section 5.5 or if the Fees are non-refundable as per the contract, except where law requires). If the Agreement is terminated by CRI for Client’s breach, Client is not entitled to any refund for prepaid Fees, and any service credits unused are forfeited. If terminated by Client for convenience under Section 13.3 or an early cancellation under Section 5.5, the agreed provisions for credits or refunds in those sections will apply.
• Return of Confidential Information and Data: Each party shall return or, at the Disclosing Party’s request, destroy all Confidential Information of the other party in its possession relating to the terminated Services, in accordance with Section 8.4. For the CyberPrism platform, CRI will make Client Data available for export by the Client upon request. Specifically, if the Client requests in writing within thirty (30) days after termination of a CyberPrism subscription, CRI will provide the Client with a one-time export of the Client’s data from the Platform (for example, exporting assessment results and reports in a common format) or will enable the Client to download its data through the interface, at no additional charge except for any professional services fee if a special format or assistance is requested. After such 30-day period, CRI may, unless legally prohibited, delete the Client’s data associated with the CyberPrism Services, and will have no further obligation to retain it. CRI may retain copies of Client Data as required for legal or regulatory purposes or backup, subject to ongoing confidentiality.
• Survival: The termination or expiration of this Agreement shall not affect any provisions which by their nature are intended to survive, including but not limited to: Section 2 (Definitions, to the extent needed for interpretation), Section 5 (to the extent of any unpaid fees or refund obligations), Section 7 (Data Protection) with respect to ongoing obligations on data handling or deletion, Section 8 (Confidentiality), Section 9.1, 9.3, 9.4 (ownership and licence rights, to the extent perpetual or related to Deliverables and Client’s rights to use them), Section 10.4 (Disclaimers), Section 11 (Limitation of Liability), Section 12 (Indemnification), Section 13.4 (Effects of Termination), Section 14 (Governing Law and Dispute Resolution), and Section 15 (Miscellaneous), as well as any other clause that is expressed to survive or that is necessary to enforce or interpret the rights and obligations of the parties post-termination.

Termination is not an exclusive remedy and the exercise by either party of any remedy under this Agreement will be without prejudice to any other remedies it may have, whether under this Agreement, at law, or in equity.

14. Governing Law and Jurisdiction

This Agreement and any disputes or claims arising out of or in connection with it or its subject matter (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of the Republic of Ireland. The parties agree that the United Nations Convention on Contracts for the International Sale of Goods (CISG) does not apply to this Agreement.

The courts of Ireland shall have exclusive jurisdiction to settle any dispute or claim arising out of or relating to this Agreement or its subject matter. Each party irrevocably submits to the personal jurisdiction of such courts. Notwithstanding the foregoing, CRI reserves the right to seek injunctive or equitable relief in any jurisdiction to protect its intellectual property or confidential information.

Each party agrees to the chosen governing law and jurisdiction regardless of its place of incorporation or the location from which the Services are used, and waives any objection (on the grounds of inconvenient forum or otherwise) to the exercise of jurisdiction by the Irish courts.

15. Miscellaneous Provisions

15.1 Notices

All notices or other communications required or permitted under this Agreement shall be in writing and shall be deemed given: (a) when delivered personally; (b) when sent by commercial courier with tracking; (c) on the fifth business day after being mailed by registered post (airmail if international) to the address of the party as specified in the Order Form or as updated by notice; or (d) on the day of transmission if sent by email to the official notice email address provided by a party, provided that no bounce or error message is received and a confirmation copy is sent by another method. For clarity, routine operational communications (e.g., support requests or account notifications) may be sent by email to the usual contacts. Formal legal notices (such as termination or breach notices) should be marked as such and directed to the party’s legal department or registered address. The initial notice address for CRI is: Cyber Risk International Ltd, ICTTF House – Unit 15, N17 Business Park, Tuam, Co. Galway, H54 H1K2, Ireland, with notices also submitted via CRI’s website contact page at www.cri.ie. The notice address and email for the Client are as set out on the Order Form.

15.2 Force Majeure

Neither party shall be liable for any delay or failure to perform its obligations (except payment obligations) under this Agreement if such delay or failure results from events or circumstances beyond that party’s reasonable control, including but not limited to acts of God, war, terrorism, civil unrest, strikes or labour disputes, epidemics or pandemics, government regulations or orders, fire, explosion, power outages, communications or internet service provider failures, or other force majeure events. The affected party shall notify the other party as soon as practicable of the event and use its reasonable efforts to mitigate the impact and resume performance. If a force majeure event continues for a period exceeding sixty (60) days and materially affects the Services, either party may terminate the affected Services with written notice, without further liability (except that if the Client terminates due to extended force majeure, it shall be entitled to a pro-rata refund of any prepaid Fees for the terminated portion of the Services).

15.3 Assignment

Neither party may assign or transfer this Agreement, in whole or in part, to any third party without the prior written consent of the other party, which consent shall not be unreasonably withheld or delayed. However, either party may assign this Agreement without consent (a) to an Affiliate (an entity controlling, controlled by, or under common control with, the assigning party) as long as the assigning party remains responsible for the affiliate’s performance, or (b) in connection with a merger, acquisition, corporate reorganisation, or sale of all or substantially all of its assets or equity (provided that the assignee agrees in writing to be bound by all terms of this Agreement and is not a direct competitor of the non-assigning party). Any attempted assignment in violation of this section shall be null and void. Subject to the foregoing, this Agreement will bind and inure to the benefit of the parties and their respective successors and permitted assigns.

15.4 Relationship of the Parties

The relationship between the parties is that of independent contractors. Nothing in this Agreement is intended to, or shall be deemed to, create any partnership, joint venture, agency, fiduciary or employment relationship between the parties. Neither party is an agent or representative of the other or is authorised to make any commitments or representations on behalf of the other. Each party remains responsible for its own taxes, employees, and business operations.

15.5 Third-Party Beneficiaries

This Agreement is made for the sole benefit of the signatory parties and their respective successors and permitted assigns. Except as expressly provided in this Agreement (for example, indemnification covering affiliates and officers as described in Section 12), no third party shall be deemed to be a beneficiary of or entitled to enforce any terms of this Agreement. The parties agree that any legislation implementing the concept of third-party beneficiary rights (such as the Contracts (Rights of Third Parties) Act 1999 in the UK, if it were applicable, or any similar law in Ireland if enacted) shall not apply to this Agreement, to the maximum extent permitted by law.

15.6 No Waiver

No failure or delay by either party in exercising any right, power or remedy under this Agreement shall operate as a waiver of that right, power or remedy. No waiver of any provision of this Agreement shall be effective unless in writing and signed by the party against whom the waiver is claimed. A single or partial exercise of any right or remedy shall not preclude any other or further exercise of that or any other right or remedy. A waiver of any breach shall not be deemed a waiver of any subsequent breach of the same or any other provision.

15.7 Severability

If any provision of this Agreement is held by a court of competent jurisdiction or other authority to be invalid, illegal, or unenforceable, that provision (or the offending part thereof) shall be deemed deleted or limited to the minimum extent necessary, and the remainder of the Agreement shall remain in full force and effect. In such case, the parties shall negotiate in good faith to replace the void or unenforceable provision with a valid provision that, as closely as possible, achieves the original intent and economic effect of the invalid provision.

15.8 Amendments

Any amendment or modification to this Agreement (including any Order Form or SOW) must be in writing and signed by authorised representatives of both parties. The parties can mutually agree to modify scopes of work, fees, or other terms through change orders or addenda, which shall become effective when signed by both parties. For clarity, CRI’s updating of Appendices (like the Acceptable Use Policy or Support terms) as contemplated herein (e.g., updating AUP for legal compliance) does not constitute an amendment requiring Client signature, provided that such updates do not materially reduce the Client’s rights. Any material update will be communicated to the Client and if the Client objects with reasonable grounds, the parties will negotiate in good faith to resolve the concern or maintain the prior terms for that Client.

15.9 Counterparts and Signatures

If this Agreement (or any Order Form or SOW) is executed in hard copy, it may be executed in any number of counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument. Signatures delivered by electronic means (such as PDF or via an electronic signature service) shall be deemed binding as if they were original signatures. If this Agreement is presented and accepted online (click-through), the electronic acceptance by the Client or its authorised representative shall constitute a binding execution of the Agreement.

15.10 Headings

The headings in this Agreement (including section and paragraph titles) are for convenience of reference only and have no legal effect in interpreting the provisions. Any section references in this Agreement refer to sections of the main body of this Agreement, unless stated otherwise.

Appendices

The following Appendices are included as part of this Agreement and are incorporated by reference. They provide additional terms and details for specific aspects of the Services.

Cyber Risk International Ltd · ICTTF House – Unit 15, N17 Business Park, Tuam, Co. Galway, H54 H1K2, Ireland · Registered Company: 550801 · VAT: IE 3292853TH · DUNS: 985605977 · www.cri.ie