Terms of Service and Online SaaS Subscription Agreement

Terms of Service and Online SaaS Subscription Agreement

These Terms of Service and Online SaaS Subscription Agreement (the "Terms") are a binding agreement between Virtik USA, Inc., a Delaware corporation with its business address at 113 N San Vicente Blvd, Beverly Hills, CA 90211, United States ("Virtik", "we", "us"), and the legal entity or other organization on whose behalf the Service is accessed ("Customer", "you"). They govern access to and use of the Virtik platform, including every Plan sold online.

These Terms apply to self-service and online subscriptions. Where Customer and Virtik execute a Master Services Agreement (LEG-011), an Order Form, or a negotiated enterprise, government, public safety or security-provider agreement, that executed agreement governs to the extent provided in Section 26.11 (Order of Precedence).

How you accept these Terms. By clicking to accept these Terms, creating an Organization, activating an evaluation or the Free Plan, placing an Online Order, or accessing or using the Service, you agree to these Terms and to the Commercial Terms (LEG-013) on behalf of Customer. Where the Service presents these Terms for acceptance, including before an Online Order, the acceptance is recorded as Section 2.4 states; where you accept by creating an Organization, activating an evaluation or the Free Plan, or accessing or using the Service, your conduct is your acceptance. The individual who accepts represents and warrants that they are authorized to bind Customer to this Agreement. If you do not have that authority, or Customer does not agree, do not accept these Terms and do not access or use the Service.

1. Definitions and Interpretation

1.1 "Administrator" means an Authorized User who holds the administrator role within an Organization, including the rights to invite and remove Authorized Users, assign roles and permissions, configure Sites, devices, integrations and notification behavior, manage the subscription and billing, and accept legal terms on Customer's behalf where the Service permits. Other Virtik instruments may refer to an Administrator as a "Customer Administrator"; the terms mean the same thing.

1.2 "Agreement" means these Terms together with the documents they incorporate or are stated to form part of: the Commercial Terms (LEG-013), the Acceptable Use Policy (LEG-006), the AI Use and Human Oversight Terms (LEG-007), the DPA, each Order, the Security Addendum (LEG-015), the Subprocessor List (LEG-009) and the Privacy Policy (LEG-002), which is a notice and not a term of the Agreement (Section 11.2), the Data Retention and Deletion Schedule (LEG-022) as to retention and deletion, the SMS Terms and Consent Notice (LEG-008) where SMS is enabled, and, where executed, any Order Form, Master Services Agreement, Provider Order or other negotiated enterprise, government, public safety or security-provider agreement or addendum, Service Level Agreement, professional services terms or government addendum. A document that Section 26.11 ranks and that this Section does not list is not part of the Agreement, other than the Documentation and, where an Order incorporates it, the Support Policy.

1.3 "AI Features" means features of the Service that apply machine learning, computer vision, statistical or generative models, or other algorithmic analysis to produce classifications, detections, summaries, recommendations, guidance, alerts or other Output. "Output" means content or data generated by AI Features.

1.4 "Authorized User" means an individual whom Customer permits to access the Service under Customer's Organization, including employees, contractors and agents of Customer.

1.5 "Commercial Terms" means the License and Commercial Terms (LEG-013), which set out the licensing scope, entitlements, Plans, prices and commercial mechanics of the Service and which Customer accepts together with these Terms.

1.6 "Customer Data" means all data, content and information that Customer, its Authorized Users, or Customer Systems submit to, generate within, or make available to the Service, including camera and video data, audio, still images, detections and detection metadata, alerts, spatial models, geolocation and patrol data, communications content, incident records, personnel records, configuration, and Output generated for Customer's Organization, together with analytics derived from any of the foregoing. Customer Data does not include Virtik's own account, billing, security and business-operations records, which are described in Section 11.

1.7 "Customer Systems" means networks, hardware, cameras, sensors, access control systems, radios, mobile devices, third-party software and other equipment or services owned, licensed, leased or operated by Customer or its suppliers that Customer connects to or uses with the Service.

1.8 "Documentation" means the operating documentation Virtik makes generally available for the Service, including product guides and the descriptions of Plans and features published in the Service. Documentation does not include marketing materials, sales proposals or statements of expected accuracy, detection performance or response.

1.9 "DPA" means the Virtik Data Processing Addendum (LEG-010).

1.10 "Fees" means the amounts payable for a Subscription, including recurring Plan fees, Additional Site fees, installment payments, and any other amount stated in an Order or presented at purchase.

1.11 "Order" means an Online Order or an Order Form. "Online Order" means a purchase of a Plan completed through the Service and the Payment Processor's checkout. "Order Form" means a document signed or otherwise expressly accepted by both parties that states the Plan, quantities, term, price or other commercial particulars of a Subscription.

1.12 "Organization" means the tenant boundary within the Service under which Customer's Sites, Authorized Users, configuration and Customer Data are held.

1.13 "Payment Processor" means Stripe, Inc. and its affiliates, or another payment processor that Virtik designates and discloses at checkout or in the Service.

1.14 "Personal Data" means information relating to an identified or identifiable individual that is processed in connection with the Service and that is regulated as personal data, personal information or an equivalent term under applicable data protection law.

1.15 "Plan" means the subscription tier and configuration that Customer purchases, including the entitlements and limits attached to it as stated in the Commercial Terms, the Order, or the Service at the point of purchase.

1.16 "Platform" means the software, models, infrastructure, interfaces and technology, owned or licensed by Virtik, from which the Service is delivered. "Service" means the Virtik software-as-a-service offering made available to Customer under a Subscription, including the modules enabled by Customer's Plan, the web application, the mobile and progressive web applications, application programming interfaces, AI Features, and Documentation. "Service Level Agreement" means a service level agreement in the form of LEG-014 that is executed by Virtik and Customer.

1.17 "Security Incident" means a breach of the security of the Platform, or of the systems of a Virtik Supplier, that has resulted in, or that Virtik reasonably believes has resulted in, unauthorized access to, or the accidental or unlawful acquisition, disclosure, loss, destruction or alteration of, Customer Data in the possession or control of Virtik or a Virtik Supplier. A Security Incident does not include an unsuccessful attempt or an event that does not compromise the security of Customer Data (such as pings, port scans, failed log-ins or denial-of-service attempts that do not result in access), or an event caused by Customer, its Authorized Users or Customer Systems. A Security Incident is defined by the event and without regard to fault. Section 21.3 states when a Security Incident is a Qualifying Security Incident.

1.18 "Site" means a physical or logical location that Customer configures in the Service, such as a building, campus, facility, area or operational zone. "Additional Site" means a Site that is licensed in addition to the Site included in a Plan, as the Commercial Terms describe. "Virtual Site" means a spatial model, digital twin, 360-degree capture, floor plan or other spatial representation of a Site that is created, uploaded or configured in the Service.

1.19 "Subscription" means Customer's right to access and use the Service under a Plan for a Subscription Term. "Subscription Term" means the period for which a Subscription is purchased and, where it renews, each renewal period, as stated in the Order or at purchase and as further described in Section 16. "Annual Subscription", "Monthly Flex Subscription" and "Enterprise Installment Subscription" have the meanings given in Section 16.10. "Enterprise Subscription" means a Subscription to the Enterprise Plan under an Order Form. "evaluation" has the meaning given in Section 5.6.

1.20 "Third-Party Services" means services, software, content, networks and infrastructure that are not owned or operated by Virtik and that interoperate with, or are used in delivering, the Service, including mapping, messaging, identity, payment, model-provider and hosting services and any integration that Customer enables. "Virtik Supplier" means (a) a subprocessor listed in the Subprocessor List (LEG-009) for a use that the list identifies as Virtik-managed, to the extent of that use, or (b) another provider that Virtik engages to host, store, process or transmit Customer Data or to supply a model that an AI Feature uses to deliver the Service to Customer. A vendor whose account or credential Customer's Organization connects itself (a use that the Subprocessor List identifies as Customer-connected), and a connector that Customer directs, is a Third-Party Service and is not a Virtik Supplier. A Virtik Supplier is not a Third-Party Service for purposes of Sections 15.2, 20.8 and 22.2(a).

1.21 Capitalized terms that these Terms use but do not define, including Included Site, Site License, Portfolio Slot, Provider and Provider Order, have the meanings given in the Commercial Terms. Headings are for convenience. "Including" means "including without limitation". References to a "Section" are to a section of these Terms unless stated otherwise. References to "LEG-" numbers are to Virtik's legal instruments. Virtik makes prior versions of each published instrument available on request to legal@virtik.ai and, where Virtik publishes a version-history page, on that page.

1.22 "Business day" means a day other than a Saturday, a Sunday or a public holiday in California. "Master Services Agreement" means the Virtik Master Services Agreement (LEG-011) or another master services agreement for the Service that is executed by both parties.

2. Agreement, Acceptance, Eligibility and Authority

2.1 Business use. The Service is offered for business and organizational use. It is not offered to consumers for personal, family or household purposes.

2.2 Eligibility. The individual accepting these Terms must be at least 18 years of age and capable of forming a binding contract. Customer must not be barred from using the Service under applicable law, including as set out in Section 24.

2.3 Authority to bind Customer. The individual who accepts these Terms on behalf of an organization represents and warrants that they have authority to bind that organization. Where an individual creates an Organization, or places an Online Order, in the name of an entity, "Customer" means that entity. The individual accepting also represents that Customer is acquiring the Service for business or professional purposes and not as a consumer. If the individual lacks that authority, they are personally responsible for the Fees and for compliance with the Agreement, and the individual's acceptance does not make the Service a consumer purchase. Customer is in any event bound where Customer subsequently uses, or pays for, the Service.

2.4 Acceptance record. Acceptance of these Terms and of the Commercial Terms is made electronically. Where the Service presents these Terms or the Commercial Terms for acceptance, including before an Online Order, Virtik records each such acceptance, including the identity of the accepting individual, the Organization concerned, the document identifier, the exact version and content hash that was presented, the date and time, and the surface through which it was given. Customer agrees that these electronic records are valid evidence of acceptance and that no handwritten signature is required. Where Customer accepts by conduct, as the introduction to these Terms provides, Virtik does not state that it has recorded a separate acceptance, and Customer's conduct is its acceptance.

2.5 Acceptance before purchase. Before an Online Order can be submitted to the Payment Processor, the individual placing it must have accepted the then-current published versions of these Terms and of the Commercial Terms. Virtik does not create a checkout session for an individual who has not done so.

2.6 Re-acceptance. Where Virtik publishes a new version of these Terms or of the Commercial Terms and designates it as requiring re-acceptance, the acceptance recorded for an earlier version does not cover it. A new acceptance is required before the next Online Order and, where the notice under Section 25 says so and the Service presents the new version for acceptance, before continued use of the Service. Re-acceptance generates its own acceptance record.

2.7 Contract documents. The Agreement is formed by the documents listed in Section 1.2. These Terms and the Commercial Terms (LEG-013) are accepted together at checkout, and the Agreement is formed by both. The Acceptable Use Policy and the AI Use and Human Oversight Terms are accepted through these Terms and are not separately accepted. The DPA applies as stated in Section 11.4. Each document incorporated under Section 1.2 applies in the version that was published and in effect on the date of Customer's acceptance of these Terms, as shown in Virtik's version records, which Virtik makes available on request to legal@virtik.ai and, where Virtik publishes a version-history page, on that page, and a later version applies as Section 25 provides. Despite the preceding sentence, the Subprocessor List (LEG-009) applies in the version that Section 8 of the DPA makes current from time to time, so that a change that Section 8 of the DPA permits applies to Customer from the date that Section states and without a new acceptance.

3. Account Registration and Security

3.1 Customer must provide accurate and complete registration and billing information, including its legal name and billing country, and keep it current. The billing country determines the market, and therefore the currency and price list, that applies to Customer's Online Orders, as set out in the Commercial Terms.

3.2 Customer is responsible for maintaining the confidentiality of authentication credentials and for all activity occurring under its Organization, whether or not authorized by Customer.

3.3 Customer must require multi-factor authentication where the Service makes it available for Administrator access, and must notify Virtik promptly by email to security@virtik.ai on becoming aware of any unauthorized access to or use of the Service.

3.4 Virtik may refuse, suspend or reclaim any account identifier that impersonates another party, infringes a third party's rights, or is used in breach of these Terms.

4. Organizations, Authorized Users and Administrators

4.1 Customer's Organization is a distinct tenant. Customer is responsible for determining which individuals become Authorized Users and what permissions they hold.

4.2 Administrators may, subject to Plan entitlements, invite and remove Authorized Users, assign roles and permissions, configure Sites, devices, integrations and notification behavior, manage the subscription and billing, and access Customer Data within the Organization. Customer is responsible for the acts and omissions of its Authorized Users and Administrators as if they were Customer's own. Customer will not bring, and will procure that its Authorized Users do not bring, a claim against Virtik's personnel or Virtik Suppliers arising out of the Service other than as the Agreement permits, except to the extent applicable law does not permit that restriction.

4.3 Customer acknowledges that an Administrator's configuration choices determine what data the Service collects, who within Customer's Organization can view it, and how alerts are routed. Virtik does not make those choices on Customer's behalf.

4.4 Where Customer permits a third party, such as a security services provider, integrator or managed service provider, to act as an Administrator or to operate the Service on its behalf, Customer remains responsible under these Terms for that party's access and use. A third party that operates the Service for more than one customer of Virtik, or that provides the Service or Output to others as part of its own service offering, is a Provider and requires Virtik's approval under the Commercial Terms. Customer must tell Virtik, on request, whether a third party operating its Organization acts for other customers, and Virtik may require that third party to become a Provider.

4.5 Authorized User credentials are personal and must not be shared. Access entitlements may not be circumvented by sharing a single credential among multiple individuals.

4.6 The number of Authorized Users, Sites and connected devices is limited by the Plan, as set out in Section 7 and the Commercial Terms.

5. Subscription Plans, Orders, Evaluation and Provisioning

5.1 Plans. Virtik makes the Service available under Plans. The Plan that Customer purchases determines the modules, entitlements and limits available to Customer's Organization. The Plans, their entitlements and their prices are stated in the Commercial Terms. Virtik offers the Free Plan for online activation and, where the Service offers online purchase for Customer's market, the Essential and Professional Plans; the Enterprise, Security Provider and Government, Public Safety and Federal Plans are provided only under a separate Order Form or agreement.

5.2 Online Orders. An Online Order is placed through the Service. It is complete when the Payment Processor confirms payment authorization and Virtik provisions the Subscription. The Plan, billing cadence, site quantity, market, currency and Fees shown at checkout are those that apply to the Online Order, subject to these Terms. Virtik may decline or cancel an Online Order that contains an evident pricing or configuration error, that fails fraud or sanctions screening, or that would breach these Terms.

5.3 Order Forms. Where an Order Form is used, it governs the particulars it states. An Order Form modifies the Agreement only to the extent it expressly identifies the provision modified. A provision of an Order Form that conflicts with a provision of the Agreement does not displace the remainder of the Agreement, and the Agreement does not become invalid, unenforceable or unavailable to either party because an Order Form is incomplete, invalid or silent. An Order Form supersedes the Agreement as a whole only if it says so in express terms.

5.4 No professional services. Provisioning of a Plan does not itself constitute delivery of professional services, configuration, installation, migration, training delivery or integration work, which are provided only under separately agreed Professional Services Terms (LEG-016).

5.5 Free Plan. The Free Plan is provided at no charge, within the entitlements stated in the Commercial Terms, AS IS and without any service level, availability commitment or warranty. Virtik may modify the Free Plan prospectively, and may limit, suspend or discontinue it for any Organization that breaches the Agreement or that Virtik reasonably believes is being abused. Virtik will give notice of a material change to the Free Plan as provided in Section 25.

5.6 Evaluation. Virtik may make a time-limited evaluation available. The evaluation period is 120 days from activation unless the Service states a different period when the evaluation is activated, and it provides access to the capabilities of the Plan that the Service designates for evaluation at activation. At the end of the evaluation, the Organization continues on the Plan that Customer has purchased if a paid Subscription exists, and otherwise moves to the Free Plan. Evaluation access is provided AS IS, carries no service level or availability commitment, and may be modified or withdrawn for abuse. Customer Data that exceeds the limits of the Plan to which the Organization moves may be restricted in accordance with Section 7. Customer is responsible for exporting, before the end of the evaluation, any Customer Data that it wishes to keep and that exceeds the limits of the Free Plan, and Section 10.7 applies to Customer Data that is restricted at the end of the evaluation as if the evaluation were a Subscription that had expired on that date.

5.7 Plan composition. Virtik may modify the composition of Plans and the features within them. Where a modification materially reduces the functionality of a Plan during a paid Subscription Term, Section 25.5 applies.

5.8 Security Provider Plan. Security Provider commercial activation requires Virtik's prior written approval and a Provider Order executed by Virtik and the Provider. Virtik does not represent that a Provider Order template, an application process or automated activation exists. Unless and until a Provider Order has been executed, no Security Provider commercial terms apply, including resale, volume pricing and Provider-managed Sites, and nothing in these Terms, in the Commercial Terms or in the Service grants them. Section 11 of the Commercial Terms applies.

6. License Grant and Scope

6.1 Grant. Subject to these Terms and payment of the applicable Fees, Virtik grants Customer a non-exclusive, non-transferable, non-sublicensable right, revocable only as these Terms permit, during the Subscription Term to access and use the Service for Customer's internal business and operational security purposes, within the entitlements of Customer's Plan. The scope of the license is further defined in the Commercial Terms.

6.2 Reservation. The Service is licensed, not sold. No rights are granted other than those expressly stated. Virtik reserves all other rights.

6.3 Restrictions. Customer must not, and must not permit any person to:

(a) copy, modify, translate or create derivative works of the Service;

(b) reverse engineer, decompile or disassemble the Service, or attempt to derive its source code, model weights, architecture or training data, except to the extent such restriction is unenforceable under applicable law;

(c) rent, lease, resell, sublicense, time-share or provide the Service as a service bureau to any third party, except as expressly permitted for an approved Security Provider under the Commercial Terms and an executed Provider Order (Section 5.8) or by an Order Form;

(d) access the Service to build or benchmark a competing product or service;

(e) circumvent or attempt to circumvent any usage limit, entitlement, authentication, rate limit or tenant boundary;

(f) remove or obscure any proprietary notice;

(g) use the Service in breach of the Acceptable Use Policy referenced in Section 8; or

(h) introduce malicious code into the Service.

6.4 Documentation. Customer may reproduce Documentation internally as reasonably necessary to use the Service.

7. Plan Limits, Site Licensing and Metering

7.1 Limits. Customer's Plan states entitlements and limits, which may include limits on Sites, Authorized Users, connected cameras and devices, storage volume, Virtual Sites and spatial models, AI Feature consumption, outbound messaging, and support entitlements. The limits for each Plan are stated in the Commercial Terms.

7.2 Site licensing. Each Site that Customer operates in the Service must be covered by a Site entitlement. An Essential or Professional Plan includes one Site; a Free Plan Organization has one Site; an Enterprise Plan licenses Sites through Site Licenses. Additional Sites are licensed separately, are available only up to the site cap of the Plan, and are priced as stated in the Commercial Terms. The Plan cap on directly licensed Sites is three for the Essential Plan and ten for the Professional Plan; larger or mixed estates require an Enterprise Order Form. A Monthly Flex Subscription covers a single Site. Under an Enterprise Order Form, Sites are licensed through Site Licenses and Portfolio Slots as described in the Commercial Terms.

7.3 Enforcement. The Service enforces Site limits and may prevent the creation or activation of a Site that exceeds Customer's licensed Site quantity. A technical limit that fails to enforce a commercial limit does not enlarge the license: use beyond a purchased entitlement is outside the license even if the Service does not prevent it. To add Sites, Customer must purchase additional entitlements or upgrade.

7.4 Measurement. Virtik measures usage against limits using the metering and records that the Service maintains for the relevant limit. Where Customer disputes a measurement, the parties will review the Service records in good faith; absent manifest error, the Service records are determinative.

7.5 Excess use. The Service does not bill usage-based overages. Where Customer's use reaches a limit, Virtik may (a) restrict further use of the limited resource until Customer purchases additional entitlements or reduces use, (b) require Customer to upgrade, or (c) apply a true-up that is expressly stated in Customer's Order Form. Virtik will not retroactively invoice for use within a period already invoiced except where an Order Form provides for a true-up. Use beyond an entitlement that Customer cures or purchases within 30 days after Virtik's notice is not a material breach of Section 6.3. Customer is responsible for monitoring its use against its limits and for keeping any alerting, detection or notification function on which it relies within its entitlements.

7.6 Fair use. Limits exist to define commercial scope and to protect platform stability and tenant isolation. Virtik may apply rate limiting and fair-use controls where usage threatens availability for other customers, and doing so does not reduce Customer's entitlements.

8. Acceptable Use and Lawful Deployment

8.1 Customer must use the Service in accordance with the Virtik Acceptable Use Policy (LEG-006), which is incorporated into these Terms by reference and available at /legal/acceptable-use.

8.2 Without limiting that policy, Customer must not use the Service:

(a) to conduct surveillance in a location or manner that is unlawful in the applicable jurisdiction, including in areas where individuals have a reasonable expectation of privacy such as restrooms, changing areas, medical treatment areas and residential interiors that Customer does not lawfully control;

(b) to monitor, profile or target individuals on the basis of race, ethnicity, religion, national origin, disability, sexual orientation, gender identity, immigration status, union membership or political affiliation;

(c) to conduct covert monitoring of employees where notice or consultation is required by applicable law;

(d) to track the location of an individual outside the scope of that individual's duties, or after the individual has ceased to be within Customer's lawful operational control;

(e) to harass, stalk, intimidate or retaliate against any individual; or

(f) in support of any activity that is unlawful in the jurisdiction where it occurs.

8.3 Biometric and facial recognition. Customer must not use the Service to perform biometric identification or verification, facial recognition, gait recognition, or any other biometric inference (other than an inference that the last sentence of this Section prohibits), unless (i) the capability is expressly enabled for Customer in writing by Virtik, (ii) Customer has a lawful basis and has obtained every consent, notice, written policy, retention schedule or authorization required by applicable law, including biometric privacy statutes, and (iii) Customer complies with all conditions Virtik imposes on that use. An Administrator's self-service selection of a capability, setting or configuration option that the Service makes technically available, including a policy that an Administrator can record in the Service, is not enablement by Virtik in writing for the purposes of this Section. Virtik does not enable biometric identification, verification or facial recognition by default or by purchase of a Plan, and nothing in this Section is a representation that the Service performs biometric identification, verification or facial recognition. Customer must not use the Service to infer emotion, intent, deception, aggression, mental state or propensity to offend, to infer a protected characteristic, to assess whether a specific individual is likely to commit an offense, or to track an identified individual persistently for a purpose unrelated to a specific operational security incident; those prohibitions, which Section 11 of the AI Use and Human Oversight Terms and Section 4 of the Acceptable Use Policy also state, are absolute and are not subject to enablement.

8.4 Camera installation and use. Customer is solely responsible for the lawful installation, positioning, orientation, field of view, recording configuration and operation of all cameras and sensors that Customer connects to the Service, including any permits, registrations, signage, works council consultation or notices required by applicable law.

8.5 Notices to employees and visitors. Customer is solely responsible for providing any notice, obtaining any consent, and conducting any assessment required by applicable law in respect of individuals whose personal information may be captured by Customer Systems or processed in the Service, including employees, contractors, visitors and members of the public.

8.6 Audio. Recording of audio is subject to jurisdiction-specific consent requirements that differ materially from those applying to video. Customer must not enable audio capture without confirming the applicable requirements and satisfying them.

8.7 Other monitored data. Sections 8.4 to 8.6 apply equally to location and patrol tracking of personnel, monitoring of visitors, access events, and any other data about individuals that Customer collects through Customer Systems or the Service.

8.8 Customer's determination. As between the parties, Customer alone determines whether its deployment and use of the Service, including of cameras, video, audio, sensors, location tracking, employee monitoring and visitor monitoring, complies with applicable law. Virtik does not assess, and does not represent, the lawfulness of any Customer deployment or configuration.

8.9 Virtik may suspend access under Section 17 where Customer's use breaches this Section.

9. Customer Systems, Cameras, Sensors and Third-Party Equipment

9.1 Customer is responsible for procuring, installing, configuring, securing, maintaining and lawfully operating Customer Systems, and for all network connectivity and power required for the Service to interoperate with them.

9.2 Virtik does not warrant that the Service will interoperate with any particular camera, sensor, access control system, radio system, mobile device, network configuration or third-party software, whether or not such interoperability has previously functioned.

9.3 Where Customer connects a third-party service or device to the Service, Customer authorizes the resulting data flows and is responsible for confirming that they are permitted under Customer's agreements with that third party.

9.4 Virtik is not responsible for the availability, accuracy, security or performance of Customer Systems, or for any failure of the Service arising from them, including camera and sensor outages, network loss, power loss, device misconfiguration, or expired third-party credentials.

9.5 Video, images, audio and sensor data. Customer Data that originates from cameras and sensors is submitted and processed at Customer's direction. Customer is responsible for the content, quality, lawfulness and retention settings of that data, and acknowledges that image quality, lighting, field of view, occlusion, weather, bandwidth, calibration and device condition affect the Service and any Output derived from it.

9.6 Location and geospatial data. Where Customer enables location tracking, patrol, mapping, Virtual Sites or other geospatial functionality, location and geospatial data may be inaccurate, delayed or unavailable because of device, network, satellite or map-data limitations, and map and spatial content from Third-Party Services is provided by those services. Customer must not rely on location or geospatial data as the sole basis for a safety-critical decision.

10. Customer Data and Ownership

10.1 Ownership. As between the parties, Customer retains all right, title and interest in and to Customer Data. Virtik acquires no ownership of Customer Data by reason of these Terms.

10.2 License to Virtik. Customer grants Virtik a non-exclusive, worldwide, royalty-free right to host, store, transmit, display, process and otherwise use Customer Data solely as necessary to (a) provide, maintain, secure and support the Service for Customer, (b) prevent or address service, security or technical problems, (c) comply with law, (d) act on Customer's instructions, and (e) create the aggregated and de-identified information described in Section 10.5.

10.3 Customer responsibility for content. Customer represents that it has all rights, consents and lawful bases necessary for Customer Data to be submitted to and processed in the Service for the purposes Customer configures, and that Customer Data and its use as contemplated by the Agreement do not infringe or violate any third-party right or applicable law.

10.4 Accuracy. Virtik does not verify the accuracy of Customer Data, including personnel records, Site configuration, spatial models, or incident records entered by Authorized Users.

10.5 Aggregate and derived data. Virtik may generate aggregated and de-identified statistical information about use of the Service, provided that such information does not identify Customer, any Authorized User, any individual, or any Site, and is not derived in a manner that would permit re-identification. Aggregated and de-identified information does not include images, video, audio or location data, or features extracted from them, from which an individual or Site could be identified. Virtik will not attempt to re-identify that information and will not disclose it in a form that permits re-identification. Virtik may use such information to operate, secure, support and improve the Service.

10.6 AI training. Virtik will not use Customer Data to train generalized or shared AI models offered to other customers without an express contractual authorization permitting that use. Virtik does not control or represent the data retention or training practices of a third-party model provider whose account Customer's Organization connects itself, and Customer Data sent to that provider is handled by it under Customer's own agreement with it. Where an AI Feature sends inputs to a model provider through a credential that Virtik manages, that provider is a Virtik Supplier, Section 19.1 applies to its acts and omissions in relation to Customer Data, and Virtik makes no representation about the provider's practices beyond the commitments in the Agreement and the Subprocessor List. Where Customer enables an AI Feature that transmits inputs to a model provider, Section 13 and the DPA apply.

10.7 Export and deletion. For 30 days after expiry or termination of the Subscription, Virtik will, on the request of an Administrator, make Customer Data available for export through the export functionality that the Service then provides and otherwise provide reasonable assistance (including, where technically feasible, in a commonly used machine-readable format) by a secure means that Virtik then supports, provided that, where the Organization is suspended for non-payment or for a breach of Section 8, Virtik may defer export until the cause of suspension is resolved, except that Virtik will not withhold the export of Personal Data that is Customer Data to the extent applicable law requires Virtik to return that data. The export is subject to technical availability and to the formats that Virtik supports, to applicable law, to Virtik's security requirements (including verification that the request comes from an Administrator), and, where applicable, to the DPA and the Privacy Policy. Virtik does not represent that the Service has a self-service export for any category of Customer Data. Section 16.18 applies in addition where the Data Act applies, and where it requires a longer export period or a different start date for that period, Section 16.18(e) applies. After the applicable export period, Customer Data is handled in accordance with the retention and deletion obligations that apply under the DPA, the Data Retention and Deletion Schedule (LEG-022) and applicable law, including legal holds. This Agreement states no universal deletion deadline. Customer is responsible for exporting and keeping any records it requires, and Virtik does not warrant that Customer Data that has been deleted can be recovered. On Customer's written request, once Virtik has deleted or de-identified Customer Data in accordance with the DPA, Virtik will confirm that in writing. The confirmation is a manual act and does not state that no copy remains in backups, in which deleted data may persist until the backups expire. Where the Standard Contractual Clauses apply, Section 13.4 of the DPA provides the certification that Clause 8.5 requires.

11. Privacy, Roles and Data Processing

11.1 Different roles for different data. Virtik's role depends on the data. For Customer Data that Customer controls through its use of the Service, Virtik acts as a processor or service provider on Customer's instructions. For Virtik's own account, billing, security and business-operations records, including account data of Authorized Users, billing and tax records, support correspondence (other than attachments or content that contain Customer Data, which Virtik processes as a processor or service provider) and Virtik's own security telemetry and audit records, Virtik acts as an independent controller. The roles are stated in full in the DPA and the Privacy Policy and do not make the parties joint controllers.

11.2 Privacy Policy. Virtik's processing of personal information as a controller is described in the Privacy Policy (LEG-002), including the notices required by California law. Nothing in these Terms replaces the Privacy Policy. The Privacy Policy is a notice and is not a term of this Agreement.

11.3 Customer responsibilities. Customer determines the purposes and means of processing Customer Data. Customer is responsible for establishing a lawful basis, providing notices, obtaining consents, responding to individuals' requests directed to it, and completing any assessment or consultation that applicable data protection law requires for its deployment. Section 8 applies.

11.4 Data Processing Addendum. The DPA is incorporated into and forms part of the Agreement. Where Customer contracts online, the DPA applies without separate signature, and Virtik will provide an executed copy on request. Where Virtik processes Personal Data on Customer's behalf as a processor or service provider, the DPA governs that processing and prevails over these Terms as to the processing of Personal Data. Where Virtik acts as a service provider or contractor under the California Consumer Privacy Act, the DPA contains the contractual restrictions that statute requires.

11.5 Europe and other regions. Where Customer is established in, or Customer's use of the Service involves personal data of individuals in, the European Economic Area, the United Kingdom or Switzerland, the DPA's transfer provisions apply to transfers of that personal data. This Agreement is a business-to-business commercial agreement; it does not resolve, and does not purport to resolve, every question of European data protection law, and Customer remains responsible for determining the legal requirements applicable to its own processing.

11.6 Subprocessors. Virtik uses subprocessors, which are listed in the Subprocessor List (LEG-009) and governed by the DPA. Customer's rights on a new or replacement Material Subprocessor, including the objection and termination right, are in Section 8 of the DPA and Section 16.6(g).

11.7 Legal process. Virtik handles legal process directed at Customer Data in accordance with applicable law and the DPA. The Law Enforcement Request Guidelines (LEG-020) state Virtik's procedure for legal process requests; they are informational and are not part of the Agreement.

11.8 No unqualified compliance statements. Virtik makes no representation that the Service or Virtik complies with every privacy or data protection law. Virtik's commitments are those stated in the Agreement, the DPA and the Privacy Policy.

12. Feedback

12.1 Customer and its Authorized Users may submit suggestions, enhancement requests, recommendations and other feedback regarding the Service ("Feedback").

12.2 Customer grants Virtik a perpetual, irrevocable, worldwide, royalty-free, fully paid, sublicensable right to use and exploit Feedback for any purpose without obligation or attribution. Feedback is provided voluntarily and is not Customer's Confidential Information. Customer must not include Customer Data or any third party's confidential information in Feedback.

13. AI Features, Computer Vision and Human Oversight

13.1 Governing terms. The Service includes AI Features. Their operation, limitations and the oversight obligations that attach to them are further governed by the AI Use and Human Oversight Terms (LEG-007), which are incorporated into these Terms by reference and available at /legal/ai-terms.

13.2 Inherent limitations. AI Features, computer vision and automated detection are probabilistic. Their results depend on the quality and availability of inputs, on configuration and thresholds, on environmental conditions and on the models in use. Customer acknowledges and agrees that, as an inherent operational characteristic of AI-assisted security technology:

(a) AI Features can produce false positives (a detection, alert or classification where the underlying event or condition is not present) and false negatives (a failure to detect, flag or classify an event or condition that is present);

(b) Output can be incorrect, incomplete, delayed, inconsistent between runs, or misclassified, and can change when models, providers or versions change;

(c) Output is decision support. It is not a determination of fact, a legal conclusion, an identification of any person, a forensic finding or a professional judgment; and

(d) detection, classification and alerting can be affected by video and sensor quality, lighting, weather, occlusion, camera placement, network conditions, device availability and Customer's configuration.

13.3 Human review. Customer must ensure that a competent human reviews Output before any consequential action is taken in reliance on it, and must use appropriate human judgment in every operational and security decision. Customer must not configure the Service so that an Output alone, without human review, causes a consequential decision about an individual, including a decision affecting employment, access rights, detention or referral to law enforcement.

13.4 Customer configuration and decision-making. Customer is responsible for configuring thresholds, zones, schedules, escalation rules, notification routing and recipients; for testing that alerts reach the intended recipients; for training the personnel who receive and act on Output; and for every decision and action taken by Customer, its Authorized Users, its security personnel and its contractors, whether or not informed by Output.

13.5 No guarantee of detection. Virtik does not guarantee that the Service or any AI Feature will detect or classify every person, object, event, threat, hazard or operational security incident, or will detect or classify any of them correctly or in time. Nothing in this Section is a representation that the Service identifies any individual.

13.6 Model providers. AI Features may rely on third-party model providers. Virtik may change model providers and model versions, which may change Output characteristics, latency or availability. A provider that processes Personal Data through a credential that Virtik manages is a Subprocessor governed by the DPA and listed in the Subprocessor List (LEG-009); a provider whose account Customer's Organization connects itself is a Third-Party Service, as Section 10.6 and the Subprocessor List state. Customer must not submit data to an AI Feature that the AI Use and Human Oversight Terms prohibit.

13.7 Responsibility for Output. As between the parties, Customer is responsible for its use of Output. Virtik makes no warranty as to the accuracy, completeness, reliability or fitness of Output, and Section 20 applies.

13.8 Reporting. Customer should report unsafe or incorrect Output by email to security@virtik.ai. Virtik may use reports to improve the Service but has no obligation to correct any particular Output.

14. Operational Safety, Emergency Events and Service Limitations

14.1 Virtik is a software platform that supports situational awareness, coordination, visualization, detection, training and decision support. Unless expressly stated otherwise in an Order Form executed by Virtik, Virtik is NOT:

(a) an emergency service;

(b) a law enforcement agency or police department;

(c) a fire department or fire service, an emergency medical service, or an emergency dispatch service;

(d) a licensed alarm monitoring company or central station;

(e) a security guard, patrol or response service;

(f) an insurer or a guarantor of security, safety or loss prevention;

(g) a substitute for licensed or trained security, safety, medical or emergency personnel; or

(h) a guarantee that any incident, threat, hazard or unlawful act will be detected, prevented, interrupted, responded to or resolved.

14.2 No guarantee. Virtik does not guarantee detection, prevention or response. The Service supplements Customer's security operations and does not guarantee physical security. Detection, classification, alerting and delivery can fail or be delayed because cameras or sensors are unavailable or degraded, because networks, power or connectivity fail, because a Third-Party Service is interrupted, or because an AI model, provider or feature is limited, changed or unavailable. Customer remains responsible for its security procedures, staffing, response protocols and operational decisions.

14.3 Emergencies. In an emergency, Customer and its personnel must contact emergency services through the appropriate emergency channels. The Service does not place calls to emergency services and does not guarantee delivery of any alert, notification or message. Notification delivery depends on Customer Systems, carrier networks, device configuration and factors outside Virtik's control.

14.4 Independent procedures. Customer must not rely on the Service as its sole or primary means of detecting or responding to any emergency, and must maintain procedures and communication paths that function when the Service, Customer Systems, network connectivity or power are unavailable.

14.5 Deployment. Customer is responsible for the deployment of cameras, sensors and other Customer Systems, including their placement, coverage, redundancy and maintenance, and for the consequences of gaps in coverage.

14.6 Capability descriptions. Where Documentation or a Plan describes a module or capability as detecting or analyzing events, the description refers to the capability as configured and enabled for Customer. Availability of any particular detection capability depends on Customer's Plan, Customer Systems, Customer's configuration and Virtik's then-current generally available functionality, and some features may be in preview or may depend on integrations Customer has not enabled. Virtik does not represent that any capability that depends on live camera media or an AI provider is available to Customer unless Customer's Order or the Service confirms that it has been enabled.

14.7 Nothing in this Section limits or reduces any commitment Virtik has expressly undertaken in an executed Order Form or Service Level Agreement.

15. Third-Party Services, Integrations and Communications

15.1 The Service may interoperate with Third-Party Services, including mapping, messaging, identity, payment, model and infrastructure providers.

15.2 Third-Party Services are governed by their own terms. Virtik does not control, and is not responsible for, them, and their availability and terms may change.

15.3 Where Customer enables an integration, Customer authorizes the exchange of data that it entails and is responsible for its credentials, permissions and compliance with the third party's terms.

15.4 Communications. The Service includes messaging and communication features, which may include in-application messaging, push notifications, email and, where Customer enables it, SMS. Delivery of any message depends on carriers, networks, devices and recipients' settings and is not guaranteed. Customer is responsible for the content of its communications, for obtaining any consent and providing any notice that applicable law requires for the messages it causes to be sent, and for complying with the SMS Terms and Consent Notice (LEG-008) where SMS is used.

15.5 Payments are processed by the Payment Processor as described in Section 16.

16. Fees, Billing, Taxes, Renewal and Cancellation

16.1 Fees. Customer will pay the Fees for its Plan as presented at the time of purchase or as stated in an Order Form. Except as expressly stated in the Agreement or required by law, Fees are non-cancellable.

16.2 Payment processing. Online payments are processed by the Payment Processor, whose terms and privacy practices apply to the processing of payment details. Virtik does not store full payment card numbers. Customer authorizes Virtik and the Payment Processor to charge the payment method Customer provides for all Fees when due, including the recurring Fees and renewals described in this Section, and for taxes. Customer must keep its payment details current. For an Online Order, Fees are due at checkout and at each renewal, through the checkout and payment flow of the Payment Processor. For an Order Form that provides for invoicing, including an Enterprise Order Form, Fees are payable within 30 days of the invoice date unless the Order Form states otherwise.

16.3 Taxes and currency. Fees are stated exclusive of taxes. Customer is responsible for all sales, use, value added, goods and services, withholding and similar taxes, excluding taxes on Virtik's net income, and must provide any valid tax identification that it wishes to rely on. Where Virtik is required to collect a tax, it will add it to the amount charged. Fees are charged in the currency of the market that applies to Customer: United States dollars for the United States market and euros for the Europe market, as determined by Customer's billing country and stated in the Commercial Terms. Customer may not select a market other than the one that its billing country determines.

16.4 Automatic renewal. Unless an Order Form states otherwise, each Subscription renews automatically at the end of its Subscription Term for a successive term of the same length, at the then-current Fees stated in the Commercial Terms or the Order Form (subject to Section 16.7), until Customer cancels renewal as provided in Section 16.5. Customer authorizes the recurring charge for each renewal.

16.5 Cancellation. An Administrator may cancel renewal at any time through the subscription management interface of the Service, or as an Order Form provides. Cancellation prevents the next renewal and takes effect at the end of the then-current Subscription Term or, for a Monthly Flex Subscription, at the end of the then-current monthly billing period. To prevent a renewal, cancellation must be completed before 11:59 p.m. Pacific Time on the day before the renewal date, which is the date on which the next Subscription Term would begin, or by such later time as the subscription management interface of the Service permits cancellation before the renewal charge is made. Renewal notice. Virtik gives notice of an upcoming renewal where applicable law, the applicable Order Form or the applicable subscription terms require it, in the manner and at the time that source requires. Virtik does not otherwise undertake to send renewal reminders or upcoming-charge notices. Customer is responsible for noting the renewal date, which is stated in the Order or, for an Online Order, is the anniversary of the date on which the Subscription Term began (the monthly anniversary for a Monthly Flex Subscription), and for cancelling renewal under this Section before the cut-off. Section 16.10 explains the effect for each type of Subscription.

16.6 Refunds. Fees are non-refundable and non-creditable, and Virtik does not provide prorated refunds or credits for unused time, for cancellation, or for a downgrade or a reduction in quantity, except: (a) where applicable law requires; (b) as the warranty remedy in Section 20.7 (including the refund that Section 25.5 provides for a withdrawn feature) expressly provides; (c) as the intellectual property remedy in Section 22.5 expressly provides; (d) to correct a billing error, in which case Virtik will refund or credit the amount charged in error after Customer notifies it and Virtik confirms the error; (e) where an applicable Order Form expressly provides otherwise; (f) where Customer validly terminates under Section 23.2 (or under Section 5.2 of a Master Services Agreement) for Virtik's material breach that remains uncured 30 days after written notice, in which case Virtik will refund the Subscription Fees paid for the period after the effective termination date and Customer is released from the Fees for that period, as Section 16.19 provides; or (g) where Customer terminates under Section 8.4 of the DPA after an unresolved objection to a new or replacement Material Subprocessor (as Section 8.1 of the DPA defines it), in which case Virtik will refund the prepaid Fees allocable to the period after the effective termination date for the terminated Service component, as that Section and Section 16.19 provide. Sections 16.6(f) and 16.6(g) are express exceptions to the general rule in this Section 16.6.

16.7 Price changes. Virtik may change the prices of its Plans, Additional Sites and other Fees on at least 30 days' prior notice, given by email to an Administrator or through the Service. A price increase does not apply to a Subscription Term that has begun and has been paid for or committed to. It applies no earlier than the first renewal term that begins after the notice period, which for a Monthly Flex Subscription is the first monthly renewal that begins after the notice period, unless (a) Customer expressly agrees otherwise in writing or through the Service, (b) an Order Form provides otherwise, or (c) the change results from a tax or another charge that this Agreement separately permits Virtik to add. Customer may cancel renewal under Section 16.5 before an increase takes effect, and Virtik may not apply an increase to Fees for a committed term in any other way.

16.8 Failed and late payments. If a payment fails or is declined, Virtik or the Payment Processor may retry the charge, and Virtik may notify Customer's Administrators. Where an amount remains unpaid, Virtik may suspend the Service under Section 17 after notice and a reasonable opportunity to cure. Customer will contact Virtik before it initiates a payment dispute with its card issuer for Fees that it has authorized. Suspension for non-payment does not terminate the Subscription Term and does not relieve Customer of Fees for the suspended period. On overdue invoiced amounts that are lawfully collectible, Virtik may charge interest at the lesser of one percent per month and the maximum rate permitted by applicable law, and Customer will reimburse reasonable collection costs to the extent the law permits. A payment dispute does not excuse payment of amounts that are not in good faith dispute.

16.9 Order of authority for commercial terms. Where an Order Form states a Plan, term, quantity, currency or price, that Order Form governs over any figure displayed in the Service interface.

16.10 Renewal and commitment disclosures. In this Agreement, an "Annual Subscription" is a Subscription purchased for a 12-month Subscription Term that is billed annually; a "Monthly Flex Subscription" is a Subscription for a single Site that is billed and renews monthly; and an "Enterprise Installment Subscription" is an Enterprise Subscription whose Organization fee is paid in monthly installments under a minimum commitment (the monthly installment applies to the Organization fee only, and Site Licenses are billed as Section 16.13 states). The following disclosures describe each type. They apply to Customer's Subscription as of the Order, and the Commercial Terms and the Order give further detail.

The cadence, term, Fees, and renewal and cancellation summary presented to Customer at checkout, and in an Order Form, form part of the Order. If they differ from this Section 16.10, the Order governs as to cadence, term and Fees, and this Section governs as to everything else. Customer is responsible for noting the renewal date stated in the Order or presented at purchase, including the renewal and cancellation summary in the checkout; Section 16.5 states when Virtik gives notice of renewal.

16.11 Annual Subscriptions. An Annual Subscription is a commitment to the full Subscription Term. Cancellation prevents renewal but does not terminate, shorten, or retroactively eliminate the Subscription Term then in progress, and Customer is not entitled to a refund or credit of Fees for the remainder of that term, except where required by law or expressly provided by this Agreement (including Sections 16.6(f), 16.6(g) and 16.19) or an applicable Order Form.

16.12 Monthly Flex Subscriptions. A Monthly Flex Subscription is a month-to-month recurring Subscription for a single Site. Customer may cancel future renewal at any time. Cancellation prevents the next monthly renewal, and access continues through the end of the monthly billing period already paid unless applicable law requires otherwise. No general prorated refund is made for the current month. A Monthly Flex Subscription cannot include Additional Sites. Customer may instead purchase an Annual Subscription to license more than one Site.

16.13 Enterprise installments. Where an Order Form provides for payment of the Organization fee in monthly installments, the installments are a payment mechanism for a minimum contractual commitment. They are not a month-to-month Subscription, and the Subscription cannot be cancelled so as to avoid the installments due for the committed term, except as Section 16.19 provides or on a termination under Section 20.7, Section 22.5 or Section 8.4 of the DPA, on which the Fees allocable to the period after the effective termination date are not due and any such Fees already paid, including Site License fees, are refunded as those Sections provide. The monthly installment applies to the Organization fee only. Unless an executed Order Form expressly states otherwise, Site License fees are billed annually in advance, are co-terminous with the Subscription Term for the Organization subscription, and are non-cancellable except as the Agreement expressly provides. A Site License added during a term is billed in advance for the remainder of that term, pro rated by day, at the annual price in the Commercial Terms or the Order Form. Where Customer validly terminates under Section 16.19, the prepaid Site License fees allocable to the period after the effective termination date are refunded under Sections 16.6(f) and 16.19(b), and no Site License fee for that period is unpaid.

16.14 Upgrades. Customer may upgrade to a higher Plan, and increase its licensed Sites within the Plan cap, at any time. An upgrade takes effect when Virtik provisions it, and Fees for the difference are charged for the remainder of the current billing period at the rate presented at the time, which may include a charge pro rated by day. An upgrade does not restart or extend a committed Subscription Term unless Virtik states otherwise.

16.15 Downgrades and reductions. A downgrade to a lower Plan, or a reduction in licensed Sites, takes effect at the end of the then-current Subscription Term or, for a Monthly Flex Subscription, at the end of the then-current monthly billing period, and not earlier. For an Annual Subscription or an Enterprise Installment Subscription, a monthly installment period is not a billing period for this purpose. A downgrade is not available while Customer's use exceeds the entitlements of the lower Plan, in which case Customer must first reduce its use. Customer must reduce its use before the downgrade takes effect or the Service may restrict the excess. A reduction in licensed Sites for the next Subscription Term must be requested by an Administrator through the subscription management interface of the Service or, under an Order Form, by notice to Virtik, before the cut-off that Section 16.5 states for the renewal date. A reduction not requested by then takes effect only at the end of the following Subscription Term.

16.16 Changes of cadence. A change between an Annual Subscription and a Monthly Flex Subscription is not available through the Service and requires Virtik's agreement.

16.17 Effect of cancellation. Cancellation of renewal does not itself delete Customer Data. On expiry of the Subscription Term, Section 23 applies.

16.18 Switching and data portability under the EU Data Act. (a) Application. This Section applies only to the extent that Regulation (EU) 2023/2854 (the "Data Act"), which applies from 12 September 2025, applies to the Service as a data processing service and to Customer, including where Customer is a customer of a data processing service in the European Union to which Chapter VI of the Data Act (Articles 23 to 31) applies. Where the Data Act does not apply, including where Article 31 of the Data Act excludes it, this Section confers no right. Where it applies, this Section applies in addition to the rest of the Agreement and prevails over any provision of the Agreement that would limit a right that the Data Act gives Customer and that cannot be excluded by agreement.

(b) Right to switch or to terminate; notice period. Customer may, by written notice to Virtik given as Section 26.1 provides, request (i) to switch to a data processing service offered by a different provider, (ii) to port its exportable data and digital assets to Customer's own on-premises ICT infrastructure, or (iii) to terminate the Subscription and have its exportable data and digital assets erased. The maximum notice period for the initiation of the switching process is two months, which runs from Virtik's receipt of the request. By the end of that notice period Customer will notify Virtik of its decision to switch to a different provider (and will provide the necessary details of that provider), to switch to on-premises ICT infrastructure, or to erase its exportable data and digital assets (Article 25(2)(d) and (3) of the Data Act). Customer may state a later date for the switching to start, and the parties may agree an earlier date.

(c) Transition period. After the notice period, Virtik will switch Customer, or port Customer's exportable data and digital assets, without undue delay and in any event within a mandatory maximum transition period of 30 calendar days, during which the Agreement remains in force. During the transition period Virtik will provide reasonable assistance to Customer and to third parties that Customer authorizes, act with due care to maintain business continuity and continue to provide the functions or services under the Agreement, give Customer clear information on known risks to the continuity of the Service, and maintain a high level of security throughout the switching, including the security of the data during transfer and during the retrieval period (Article 25(2)(a) of the Data Act). Virtik will support Customer's exit strategy for the Service, including by providing all relevant information (Article 25(2)(b)). If Virtik considers the 30-day period technically unfeasible, it will notify Customer within 14 working days after the switching request, with a justification of the technical unfeasibility and an alternative transition period that does not exceed seven months, and the Service continues throughout that period (Article 25(4)). Customer may extend the transition period once, for the period it considers more appropriate for its own purposes (Article 25(5)).

(d) End of the Subscription. The Subscription is terminated, and Virtik will notify Customer of the termination, on successful completion of the switching or, where Customer does not wish to switch but to have its exportable data and digital assets erased, at the end of the notice period (Article 25(2)(c)).

(e) Data retrieval period. Customer has a minimum period of at least 30 calendar days, starting after the end of the transition period, in which to retrieve its exportable data and digital assets (Article 25(2)(g)). To the extent that the period in Section 10.7 would be shorter, or would start earlier, this paragraph applies instead of Section 10.7.

(f) What Virtik makes available. The categories of data and digital assets that can be ported during the switching are all exportable data, which are the input and output data, including metadata, that Customer's use of the Service directly or indirectly generates or co-generates and that are not protected by intellectual property rights of Virtik or of a third party or a trade secret of Virtik or of a third party, together with Customer's digital assets, which are the elements in digital form for which Customer has the right of use independently of its contract with Virtik. In practice these are Customer Data and the configuration of Customer's Organization that Customer or its Authorized Users created. The following categories are specific to the internal functioning of the Service and are exempt from the exportable data because exporting them would risk a breach of Virtik's trade secrets: the software, models, model weights and configurations, prompts and workflows of the Platform, Virtik's own security telemetry and Virtik's own account and billing records, and the data of any other customer. Virtik will not apply those exemptions so as to impede or delay the switching (Article 25(2)(e) and (f)). Virtik will make Customer Data available through the export functionality that the Service then provides and otherwise will provide reasonable assistance, including, where technically feasible, in a commonly used machine-readable format. Subject to what the Data Act requires, including Article 30(6) (which does not require Virtik to develop new technologies or services, to disclose or transfer digital assets that are protected by intellectual property rights or that constitute a trade secret, or to compromise the security and integrity of the Service), nothing in this Section promises a particular export function, file format, interface, interoperability or functional equivalence that the Service does not then provide, or the compatibility of the Service or of Customer Data with the service or infrastructure to which Customer switches.

(g) Erasure. After the data retrieval period has ended, or after an alternative period agreed in writing that ends later, and provided that the switching has been completed successfully, Virtik will erase the exportable data and digital assets that Customer generated directly or that relate directly to Customer (Article 25(2)(h)). Section 10.7, the DPA and the Data Retention and Deletion Schedule (LEG-022) apply to that erasure, subject to legal holds and to any retention that applicable law requires; deleted data may persist in backups until they expire. On Customer's written request, after Virtik has erased the data, Virtik will confirm in writing that it has deleted or de-identified the data in accordance with the DPA. Where the Standard Contractual Clauses apply, Section 13.4 of the DPA provides the certification that Clause 8.5 requires.

(h) Fees and charges. Standard service fees are not switching charges. The Fees for the Service remain payable until the Subscription ends under paragraph (d), including during the notice period and the transition period. The Agreement states no switching charge: from 12 January 2027 Article 29(1) of the Data Act prohibits switching charges, and until then Article 29(2) and (3) allow only reduced charges that do not exceed the costs that Virtik incurs that are directly linked to the switching process. If Customer asks for support that goes beyond the switching obligations that the Data Act places on Virtik, Virtik may perform and charge for that support only where Customer has agreed the price in advance in writing. A committed Subscription Term, and any early-termination consequence of a fixed-term contract, are not switching charges. The Fees for the committed Subscription Term, and the rules on Fees paid in advance, are those that Sections 16.6, 16.11 and 16.13 state, including Section 16.6(a) where applicable law requires a refund, and Virtik will not claim an amount that Article 29 or other applicable law prohibits. The Data Act does not prevent the parties from agreeing contracts of fixed duration that include proportionate early termination penalties, in accordance with Union or national law (recital 89 of the Data Act). The information on standard service fees and early termination provisions that Article 29(4) of the Data Act requires before a contract is concluded is in Sections 16.6, 16.10, 16.11 and 16.13 and in the Commercial Terms.

16.19 Refund and release on termination for Virtik's material breach. (a) Termination right and effective date. Customer may terminate the Agreement or an affected Subscription under Section 23.2 (or, under a Master Services Agreement, Section 5.2 of that agreement) for Virtik's material breach that remains uncured 30 days after Customer's written notice describing the breach in reasonable detail. The effective termination date is the date stated in Customer's termination notice, which is not earlier than the day after that 30-day period ends.

(b) Refund. On a valid termination of that kind, Virtik will refund the Subscription Fees that Customer has actually paid for the Subscription Term in progress on the effective termination date and that are allocable to the period after the effective termination date, calculated daily pro rata over the period for which they were paid (each Additional Site Fee and Site License fee being pro rated from its own start date). Virtik will pay the refund within 30 days after the effective termination date, in the currency of the original payment and to the original payment method where practicable, without interest. Where Virtik has refunded the tax on those Fees to the tax authority, or may do so, the tax is refunded in proportion.

(c) Release. Customer is not liable for Fees allocable to the period after the effective termination date, including unpaid installments of the Organization fee and any Additional Site Fee or Site License fee that has not been paid (a Site License fee being ordinarily billed and paid annually in advance, in which case paragraph (b) refunds it), and Sections 16.11, 16.13 and 23.5 do not make the remainder of the committed Subscription Term payable. Fees that accrued before the effective termination date remain payable and may be set off against the refund.

(d) Refund under Section 16.6(g). Paragraphs (b) (as to calculation and payment) and (c) also apply to a termination under Section 8.4 of the DPA on which Section 16.6(g) provides a refund, and paragraph (f) applies to that refund as it applies to a refund under Section 16.6(f). They do not extend the entitlement to a refund to a termination under Section 20.7 or Section 22.5, which those Sections and Section 16.6(b) and (c) govern, but a refund under those Sections is calculated and paid as paragraph (b) provides; on such a termination the release in Section 16.13 applies.

(e) Limits. No refund or release is given under Section 16.6(f) (i) to the extent the breach is caused by Customer, its Authorized Users or Customer Systems, or by an event described in Section 26.3; (ii) on termination under Section 23.3 or on cancellation of renewal; or (iii) for a failure to conform to a warranty in Section 20.2 as such, for which Section 20.7 is the sole and exclusive remedy. Customer has no right to terminate immediately for Virtik's breach. No refund under this Section covers professional services, one-time, usage-based or third-party pass-through Fees.

(f) Liability caps. A refund under Section 16.6(f) is a return of Fees and not damages and is not excluded by Section 21.1, but it counts toward, and reduces, the General Cap or, where the breach is a Qualifying Security Incident, the Enhanced Cap, and does not increase either.

(g) Disputed termination. A dispute about whether a termination is valid is resolved under Section 26.10, and the refund is payable within 30 days after validity is agreed or finally determined.

(h) No double recovery. A Fee is refunded or released only once. A refund under Section 16.6(b), (c), (f) or (g) is reduced by any amount already refunded or credited for the same Fees, and a Fee that is released under paragraph (c) is not also refunded.

17. Suspension

17.1 Virtik may suspend Customer's access to all or part of the Service where:

(a) Customer materially breaches these Terms, the Acceptable Use Policy or the AI Use and Human Oversight Terms;

(b) Customer's use presents a security risk to the Service, to Virtik, or to another customer;

(c) Customer's use is reasonably likely to subject Virtik or a third party to material liability;

(d) an amount is overdue under Section 16.8; or

(e) suspension is required by law or by a competent authority.

17.2 Virtik will use reasonable efforts to give notice before suspending and to limit suspension in scope and duration, except where immediate suspension is necessary to prevent harm.

17.3 Suspension does not relieve Customer of its payment obligations for the suspended period unless the suspension resulted from Virtik's error.

17.4 Virtik will restore access promptly after the cause of suspension is resolved.

18. Confidentiality

18.1 "Confidential Information" means non-public information disclosed by one party to the other that is designated confidential or would reasonably be understood to be confidential, including the Service's non-public features, security information, Customer Data, and pricing not publicly listed.

18.2 The receiving party will protect Confidential Information using at least reasonable care, use it only to perform under the Agreement, and disclose it only to personnel and contractors who need it and are bound by confidentiality obligations no less protective.

18.3 Confidential Information does not include information that is or becomes public without breach, was known to the recipient without obligation, is independently developed without use of the discloser's information, or is rightfully received from a third party without restriction.

18.4 A party may disclose Confidential Information where legally compelled, provided it gives prompt notice where lawful and reasonably cooperates in any effort to limit the disclosure. Virtik's procedure for legal process requests is stated in the Law Enforcement Request Guidelines (LEG-020), which are informational and are not part of the Agreement.

18.5 Confidentiality obligations continue for five years after the Agreement ends and, for Customer Data and trade secrets, for as long as the information remains confidential.

19. Security, Privacy and Data Processing

19.1 Allocation of responsibility. Virtik is responsible for the security measures that the Security Addendum states for the Platform, and is responsible to Customer for the acts and omissions of its Virtik Suppliers in relation to Customer Data as if they were Virtik's own, subject to Section 21. Customer is responsible for the security of Customer Systems, credentials, permission configuration, device management, and the choices Customer makes about what data enters the Service and who may see it.

19.2 Security measures. The security measures that Virtik makes representations about are those that the Security Addendum (LEG-015) and Schedule 6 of the DPA state. Virtik implements and maintains the administrative, technical and physical safeguards described in the Security Addendum, only to the extent that the Security Addendum describes them, and applies them with the care that is reasonable for the nature of the Service and the risk. The Security Addendum also lists matters about which Virtik makes no representation, and that list limits this commitment: Virtik does not promise, in this Section or elsewhere in the Agreement, any measure, standard, program or certification that the Security Addendum does not state, except the obligation in Section 6.1 of the DPA to take the measures that Article 32 of GDPR (or the equivalent provision of the law that applies) requires of a Processor, which that Section states as a legal duty and which neither this Section nor the Security Addendum limits. No security measure can prevent every incident.

19.3 No certification representation. Virtik does not currently hold SOC 2 attestation, ISO 27001 certification, HIPAA compliance certification, or FedRAMP authorization, and makes no representation that it does. Customer must not represent otherwise to any third party. Where Customer's own regulatory obligations require a certification that Virtik does not hold, Customer is responsible for determining whether the Service is appropriate for its use.

19.4 Customer security responsibilities. Customer must protect its credentials, enable and enforce multi-factor authentication for Administrators where available, configure roles on the principle of least privilege, remove access promptly when an Authorized User leaves, keep Customer Systems updated and secured, and not submit to the Service data that the Agreement prohibits.

19.5 Security Incident notification. Virtik will notify Customer of a Security Incident that affects Customer Data, irrespective of fault, without undue delay after Virtik confirms it. Virtik confirms a Security Incident when, acting reasonably and without delaying its investigation, it determines that the Security Incident has occurred or reasonably believes, as Section 1.17 provides, that it has occurred. For a Security Incident that affects Personal Data that is Customer Data, the DPA (Section 10) states the notice and the assistance Virtik provides, and where they apply the Standard Contractual Clauses (as the DPA defines them; Clause 8.6(c)) and applicable data protection law control to the extent they require a stricter formulation. Notification objective. Where reasonably practicable, Virtik's operational objective is to give that notice within 72 hours after it confirms the Security Incident. That 72-hour period is an operational notification objective only. It is not an unconditional contractual guarantee or a warranty, and a notice given after 72 hours is not by itself a breach of the Agreement. A failure to notify without undue delay is a breach of this Section and of the DPA, and Virtik's liability for the loss that failure causes is subject to the Enhanced Cap under Section 21.3(b); it does not make the underlying Security Incident a Qualifying Security Incident. Customer's own obligations. Virtik's notice to Customer is separate from any notification that Customer must give to a regulator, to individuals or to others as a controller or otherwise. Customer's obligations, and the periods in which it must meet them, are determined by applicable law and run from Customer's own awareness, and they are Customer's responsibility. Notification of, or assistance with, a Security Incident is not an admission of fault or liability.

19.6 Payment security. Payment card data is collected and processed by the Payment Processor, and Virtik does not receive or store full card numbers.

20. Warranties and Disclaimers

20.1 Each party represents that it has the legal capacity and authority to enter into these Terms.

20.2 Virtik warrants that, during the Subscription Term, (a) the Service will perform materially in accordance with the Documentation, (b) Virtik will provide the Service in a manner consistent with generally accepted industry practice for comparable software-as-a-service offerings, except that this paragraph (b) does not state or add any security measure, which Section 19.2 and the Security Addendum govern, and (c) Virtik will use reasonable care to avoid introducing malicious code into the Service. This warranty concerns the functioning of the Service; it is not a warranty as to the accuracy, completeness or timeliness of any Output, which Section 20.4 addresses.

20.3 EXCEPT AS EXPRESSLY STATED IN SECTION 20.2 AND IN ANY SERVICE LEVEL AGREEMENT, THE SERVICE, ALL OUTPUT, AND ALL FREE PLAN AND EVALUATION ACCESS ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTY OF ANY KIND. VIRTIK DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, ACCURACY AND NON-INFRINGEMENT.

20.4 VIRTIK DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR FREE, OR SECURE AGAINST ALL THREATS; THAT IT WILL DETECT ANY PARTICULAR EVENT OR CONDITION; THAT ANY ALERT OR NOTIFICATION WILL BE GENERATED, DELIVERED OR RECEIVED; OR THAT OUTPUT WILL BE ACCURATE OR COMPLETE.

20.5 Virtik makes no availability commitment under these Terms. Virtik will use commercially reasonable efforts to keep the Service available and to give reasonable notice of planned maintenance, and may modify the Service as Section 25.5 provides. Any availability commitment, and any remedy for unavailability, exists only in a Service Level Agreement or an executed Order Form that expressly states it.

20.6 Some jurisdictions do not permit the exclusion of certain warranties. Where that applies, the exclusions in this Section apply to the maximum extent permitted.

20.7 Remedy for breach of warranty. If the Service does not conform to a warranty in Section 20.2, Customer must notify Virtik, and Virtik will use commercially reasonable efforts to correct the non-conformity. If Virtik cannot correct it within a reasonable period, either party may terminate the affected Subscription, and Virtik will refund the prepaid Fees for the period after termination, calculated and paid as Section 16.19(b) provides. Where Section 25.5 requires a refund for a withdrawn feature, that refund is the remedy under this Section for the withdrawal and does not require termination. This is Customer's sole and exclusive remedy, and Virtik's sole liability, for breach of the warranties in Section 20.2, except as Section 21.3 provides for a Qualifying Security Incident. The termination right in Section 23.2 and the refund in Section 16.6(f) do not apply to a failure to conform to a warranty in Section 20.2 as such, but they remain available for a material breach of the Agreement that is not merely such a failure.

20.8 Third-Party Services and beta features. Third-Party Services, and any feature that Virtik designates as beta, preview or experimental, are provided without warranty, may be changed or withdrawn at any time, and are used at Customer's own risk.

21. Limitation of Liability

21.1 EXCLUDED DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST BUSINESS OR BUSINESS INTERRUPTION, LOSS OF GOODWILL, OR LOSS OR CORRUPTION OF DATA, WHETHER OR NOT FORESEEABLE AND REGARDLESS OF THE THEORY OF LIABILITY, EXCEPT TO THE EXTENT SECTION 21.3 OR SECTION 21.4 PROVIDES OTHERWISE.

21.2 GENERAL CAP. TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE OR OTHERWISE, WILL NOT EXCEED THE AGGREGATE FEES PAID AND PAYABLE BY CUSTOMER FOR THE SERVICE DURING THE 12 MONTHS PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY, BUT NEVER LESS THAN US$100 (THE "GENERAL CAP"). WHERE CUSTOMER HAS PAID OR OWES NO FEES, INCLUDING ON THE FREE PLAN OR DURING AN EVALUATION, THE GENERAL CAP IS US$100. Where Fees are charged in euros (the Europe market, Section 16.3), the floor of the General Cap is EUR 100 and the floor of the Enhanced Cap is EUR 200, in place of US$100 and US$200 wherever this Section 21 states them, and no currency conversion applies to either floor. The General Cap is calculated on the Fees for the 12 months before the first event giving rise to liability. "Payable" means Fees that fell due in that 12-month period. The General Cap is not annualised, projected or trued up for a Subscription that began less than 12 months before that event, and Fees that fall due after that event are not counted. The General Cap is a single aggregate limit for all claims, and multiple claims do not enlarge it.

21.3 ENHANCED CAP FOR DATA AND IP CLAIMS. VIRTIK'S TOTAL AGGREGATE LIABILITY FOR (a) A SECURITY INCIDENT TO THE EXTENT CAUSED BY VIRTIK'S BREACH OF SECTION 19 OR OF ITS DATA PROTECTION OBLIGATIONS UNDER THE DPA (A "QUALIFYING SECURITY INCIDENT"), (b) VIRTIK'S BREACH OF SECTION 18 (CONFIDENTIALITY) (OTHER THAN A SECURITY INCIDENT, WHICH CLAUSE (a) GOVERNS), OF SECTION 19.5 (SECURITY INCIDENT NOTIFICATION) OR OF ITS DATA PROTECTION OBLIGATIONS UNDER THE DPA, AND (c) VIRTIK'S OBLIGATIONS UNDER SECTION 22.2 (INTELLECTUAL PROPERTY INDEMNITY), WILL NOT EXCEED TWO TIMES THE GENERAL CAP, WHICH IS NEVER LESS THAN US$200 (THE "ENHANCED CAP"), AS A SINGLE AGGREGATE LIMIT FOR ALL MATTERS IN (a) TO (c). The Enhanced Cap is inclusive of, and not in addition to, the General Cap: amounts paid under the General Cap reduce the Enhanced Cap. For a Qualifying Security Incident, the following reasonable and documented costs are direct damages that Customer may recover, subject to the Enhanced Cap, and are not excluded by Section 21.1: costs of investigating the Security Incident, of notifying affected individuals and regulators where law requires notice, of credit or identity monitoring services where law requires them or that regulators require, and fines and penalties assessed against Customer, to the extent applicable law permits them to be recovered and to the extent caused by Virtik's breach of its obligations.

21.4 EXCLUSIONS FROM THE CAPS. The General Cap, the Enhanced Cap and Section 21.1 do not limit: (a) Customer's obligation to pay Fees; (b) Customer's liability for a material breach of Section 6.3, including use of the Service outside a purchased entitlement that Customer has not cured, or paid for, within 30 days after Virtik's notice, and for the infringement or misappropriation of Virtik's intellectual property that results from such a breach; (c) Customer's obligations under Section 22.1; (d) either party's liability for fraud, fraudulent misrepresentation or willful misconduct; or (e) any liability that cannot be limited or excluded under applicable law, including liability to a data subject under Clause 12 of the Standard Contractual Clauses (as the DPA defines them) and, where that law so provides, liability for gross negligence or intentional acts, liability for death or personal injury caused by negligence, and liability under mandatory product liability law. In this Section 21.4, "willful misconduct" means an intentional act or omission by a party's personnel, taken with knowledge that it is wrongful or will cause harm, and does not include a failure to detect, or a failure to prevent, an event.

21.5 Security operations risk. Customer acknowledges that the Service supports security operations in which losses, including property damage, injury, theft, trespass and loss of life, can result from events that no software can prevent, and that the Fees are set on the basis that Virtik does not assume the risk of those losses. A failure of the Service or an AI Feature to detect, correctly classify or timely report an event, threat or incident, and the generation of a false positive, a missed alert or a delayed alert, are inherent limitations described in Sections 13 and 14 and do not by themselves constitute a breach of the Agreement or of the warranty in Section 20.2. Subject to Sections 21.3, 21.4(d) and 21.4(e) and to Virtik's obligations under Section 22.2, Virtik is not liable for loss or damage to the extent it is caused by (i) a decision, action, omission or failure to respond (including a failure to act on, or to receive, an alert) of Customer, its Authorized Users, its security personnel or its contractors, or (ii) the act of a trespasser, thief or other wrongdoer, or of any other third party that responds to the event, threat or incident that the Service or an AI Feature did not detect, correctly classify or timely report. A Virtik Supplier is not a third party for this purpose. This Section does not limit Customer's remedy under Section 20.7 where the Service does not conform to a warranty in Section 20.2, and any liability of Virtik that this Section does not exclude remains subject to Sections 21.1 to 21.4.

21.6 Allocation of risk. Customer acknowledges that the limitations in this Section reflect the allocation of risk between the parties, that the Fees reflect that allocation, and that Virtik would not provide the Service on these terms without them. Each limitation applies even if a remedy fails of its essential purpose.

21.7 Indemnities and the caps. Virtik's obligations under Section 22.2 are subject to the Enhanced Cap and Customer's obligations under Section 22.1 are as Section 21.4(c) provides. Liability under the DPA is subject to this Section as DPA Section 20.3 provides.

21.8 Relationship to the structure of this Section. The following table summarizes how this Section treats each category of loss. It is for convenience, and the text of Sections 21.1 to 21.7 prevails.

21.9 Section 14 (Operational Safety, Emergency Events and Service Limitations) is material to this allocation of risk.

22. Indemnification

22.1 By Customer. Customer will defend Virtik, its affiliates and their directors, officers and employees against any claim, suit or proceeding brought by a third party, including a governmental authority, and will indemnify them against the resulting damages, penalties (to the extent applicable law permits), settlements, costs and reasonable attorneys' fees finally awarded or agreed, to the extent arising from: (a) Customer Data, including any allegation that Customer Data or its collection or use infringes or violates a right of, or law protecting, any person; (b) the installation, configuration, placement or operation of Customer Systems, or Customer's deployment of cameras, audio, sensors, location tracking, or employee or visitor monitoring; (c) Customer's failure to provide a notice, obtain a consent or conduct an assessment required by law, including under Section 8; (d) the use of the Service by Customer or its Authorized Users in breach of the Agreement or the Acceptable Use Policy; or (e) a decision, action or omission of Customer, its Authorized Users, its security personnel or its contractors, including any response to an alert, any use of force, detention, exclusion or referral, and any employment or access decision, whether or not informed by Output. Customer's obligations under this Section apply even where the third party's claim alleges that Virtik was negligent, to the extent that the claim arises from a matter in (a) to (e). Customer has no obligation under this Section to the extent the claim is caused by Virtik's gross negligence or willful misconduct, or by a breach of the Agreement by Virtik that causes the claim.

22.2 By Virtik. Virtik will defend Customer against any claim, suit or proceeding brought by a third party alleging that the Service (including Output, to the extent that clause (e) below does not exclude it), as provided by Virtik and used by Customer in accordance with the Agreement, infringes or misappropriates that third party's patent, copyright, trademark or trade secret rights that are enforceable in the Indemnity Territory, and will indemnify Customer against the resulting damages, settlements, costs and reasonable attorneys' fees finally awarded or agreed. The "Indemnity Territory" is the territory that the applicable Order Form specifies under "Territory for IP indemnity" and, where no Order Form specifies one, the United States. This Section does not extend to the European Economic Area, the United Kingdom or any other territory unless an Order Form specifies it. Virtik has no obligation under this Section to the extent a claim arises from (a) Customer Data, Customer Systems or Third-Party Services (other than a Virtik Supplier), (b) a combination of the Service with items not supplied by Virtik, (c) a modification of the Service not made by Virtik, (d) use of the Service in breach of the Agreement or after Virtik has made available a non-infringing alternative, (e) Output, to the extent the claim arises from Customer Data or from inputs provided by Customer rather than from the model or the Service, or (f) the Free Plan, an evaluation, or a beta or preview feature.

22.3 Procedure. The indemnified party will give prompt written notice of the claim, allow the indemnifying party to control the defense and settlement, and provide reasonable cooperation at the indemnifying party's expense. A settlement that imposes an obligation or admission on the indemnified party may not be made without its written consent, which will not be unreasonably withheld. Failure to give prompt notice relieves the indemnifying party only to the extent it is prejudiced.

22.4 Mitigation. If the Service becomes, or in Virtik's reasonable opinion is likely to become, the subject of a claim under Section 22.2, Virtik may at its option and expense procure the right for Customer to continue using it, modify it so that it is not infringing, or replace it with a functionally equivalent service.

22.5 Termination and refund. If Virtik is unable to procure, modify or replace the Service as Section 22.4 describes on commercially reasonable terms, either party may terminate the affected Subscription on notice, and Virtik will refund the prepaid Fees for the period after termination, calculated and paid as Section 16.19(b) provides.

22.6 Exclusive remedy. This Section states each party's entire liability, and the other party's sole remedy, for third-party claims of the kind it covers, subject to Section 21.

23. Term, Termination and Post-Termination

23.1 These Terms apply from the date Customer first accepts them until all Subscription Terms have expired or been terminated.

23.2 Termination for cause. Either party may terminate the Agreement or an affected Subscription for the other's material breach that remains uncured 30 days after written notice that describes the breach in reasonable detail. Virtik may terminate immediately on notice where Customer's breach of Section 6.3, Section 8 or Section 24 is not capable of cure. Where Customer terminates for Virtik's material breach, Customer's refund and release are as Sections 16.6(f) and 16.19 provide. Customer has no right to terminate immediately for Virtik's breach, and this Section does not give Customer a right to terminate for a failure to conform to a warranty in Section 20.2 as such, for which Section 20.7 states the remedy.

23.3 Termination for insolvency. To the extent applicable law permits, either party may terminate immediately on the other's insolvency, assignment for the benefit of creditors, or appointment of a receiver.

23.4 Non-renewal. A Subscription ends at the end of its Subscription Term if renewal has been cancelled under Section 16.5.

23.5 Effect. On termination or expiry, Customer's right to access the Service ceases. Fees that have accrued, and for a Subscription terminated by Virtik for Customer's breach, the unpaid Fees for the remainder of the committed Subscription Term, become due. The parties agree that the unpaid Fees for the remainder of the committed Subscription Term are a reasonable pre-estimate of Virtik's loss from the early termination and not a penalty. Termination does not entitle Customer to a refund of Fees except as Section 16.6 provides. Where Customer terminates under Section 23.2 for Virtik's breach, or terminates under Section 8.4 of the DPA with a refund under Section 16.6(g), Section 16.19 applies and the unpaid Fees for the remainder of the committed Subscription Term do not become due. Section 10.7 governs export and deletion of Customer Data.

23.6 Deletion. After the export period, Virtik will delete or de-identify Customer Data as Section 10.7 states.

23.7 Survival. Sections 1, 6.2, 6.3, 10.1, 10.5, 10.7, 11 (as to the DPA's surviving provisions), 12, 14, 16.6, 16.8, 16.18, 16.19, 17.3, 18, 19 (for so long as Virtik holds Customer Data), 20, 21, 22, 23.5 to 23.7, 25.2 to 25.4, 26 and any accrued payment obligation survive termination or expiry.

24. Export Controls, Sanctions, Anti-Corruption and Government Users

24.1 Customer must comply with all applicable export control and sanctions laws, including those of the United States.

24.2 Customer represents that neither Customer, nor any Authorized User, nor any party controlling Customer, is (a) located in, organized under the laws of, or ordinarily resident in a jurisdiction subject to comprehensive sanctions, or (b) identified on any restricted or denied party list.

24.3 Customer must not export, re-export or make the Service available in breach of those laws, or use the Service in connection with nuclear, chemical or biological weapons, missile technology, or unlawful military end use.

24.4 Government users. The Service is commercial computer software developed at private expense. Use by or on behalf of a government entity, public safety agency or regulated entity is subject to a separate commercial arrangement, including any government or public-safety addendum executed by both parties, and those customers are offered terms by quotation. Absent an executed addendum or Order Form, no rights beyond those in these Terms are granted, and no provision of these Terms is waived by reason of the customer's status as a government entity. Virtik does not represent that it holds FedRAMP authorization, CJIS certification, StateRAMP authorization or any other government or public-safety certification, and a government or regulated customer is responsible for determining whether the Service meets its requirements.

24.5 Anti-corruption. Each party will comply with applicable anti-bribery and anti-corruption laws in connection with the Agreement and will not offer or accept any improper payment or advantage in connection with it.

25. Modifications to these Terms

25.1 Virtik may modify these Terms, the Commercial Terms, the Acceptable Use Policy and the AI Use and Human Oversight Terms. Virtik will post the modified document with a new version number and effective date, and will keep prior versions and make them available on request to legal@virtik.ai and, where Virtik publishes a version-history page, on that page. Sections 25.2 to 25.4 apply to each of those documents. The DPA, the Security Addendum, the Support Policy and the Data Retention and Deletion Schedule (LEG-022) change as each of them states, the Subprocessor List (LEG-009) changes as Section 8 of the DPA states, and Section 25.2 applies to a modification of any of them that materially and adversely affects Customer's rights, except where that document's own rule for its modification is stricter in Customer's favor.

25.2 Material changes. Where a modification materially and adversely affects Customer's rights, Virtik will give notice at least 30 days before it takes effect, by email to an Administrator or through the Service. Where the new version is designated as requiring re-acceptance, Customer's affirmative acceptance is required as Section 2.6 states. Continued use after the effective date of a modification that does not require re-acceptance constitutes acceptance of it. Where a modification materially and adversely affects Customer's rights and applies to an Annual Subscription Term or Enterprise Installment Subscription Term that has already begun and been paid for or committed to, it applies from the start of the next renewal term, unless the modification is required by law or is necessary to address a security or abuse risk, and Customer may cancel renewal under Section 16.5 before it takes effect.

25.3 Modifications do not apply retroactively to a dispute that arose before the modification took effect.

25.4 Where an Order Form incorporates a specific version of these Terms, that version continues to govern that Order Form for its stated term.

25.5 Service changes. Virtik may modify the Service, including by adding, changing or removing features, provided that no modification materially reduces the core functionality of a Plan during a paid Subscription Term that has already been purchased. Where Virtik must withdraw a material feature during a paid term for legal, security or third-party reasons, it will give reasonable notice and, where it cannot provide a substantially equivalent feature, will refund the prepaid Fees attributable to the withdrawn feature for the remainder of the term. That refund is a remedy under Section 20.7.

26. General

26.1 Notices. Virtik may give notice through the Service, by email to an Administrator, or by posting to Virtik's website. Customer must give notice to legal@virtik.ai and, where these Terms require written notice, also to Virtik USA, Inc., Attention: Legal, 113 N San Vicente Blvd, Beverly Hills, CA 90211, United States. A notice given by email is effective on the next Business day after it is sent. Legal process may be served on Virtik at the legal address and legal@virtik.ai stated in this Section. These Terms name no registered agent for service of process, and nothing in this Section limits a method of service that applicable law permits.

26.2 Assignment. Customer may not assign these Terms without Virtik's prior written consent, except to a successor in a merger or sale of substantially all assets that is not a competitor of Virtik and that assumes the Agreement in writing. Virtik may assign to an affiliate or successor.

26.3 Force majeure. Neither party is liable for failure to perform, other than a payment obligation, caused by an event beyond its reasonable control, including natural disaster, war, terrorism, civil unrest, labor action, epidemic, governmental action, carrier or utility failure, failure of a public telecommunications network, or a cyberattack that reasonable security measures would not have prevented, but not a failure of a Virtik Supplier except to the extent that the Virtik Supplier was itself prevented by an event that would qualify under this Section if it had occurred to Virtik.

26.4 Independent parties. The parties are independent contractors. Nothing creates a partnership, joint venture, agency, fiduciary or employment relationship.

26.5 No third-party beneficiaries. The Agreement confers no rights on any third party, except that Virtik's affiliates and personnel may enforce Sections 21 and 22.1, and Virtik Suppliers may enforce Section 21, and except that a data subject may enforce the Standard Contractual Clauses and the UK Addendum as they provide.

26.6 Severability. If a provision is held unenforceable, it will be modified to the minimum extent necessary to be enforceable, and the remainder continues in effect.

26.7 No waiver. A failure to enforce a provision is not a waiver of it.

26.8 Entire agreement; no reliance. The Agreement is the entire agreement of the parties on its subject matter and supersedes all prior proposals, quotations, demonstrations, marketing materials and understandings. Customer acknowledges that in entering into the Agreement it has not relied on, and Virtik makes no representation or warranty other than those expressly stated in the Agreement, including any statement about the accuracy, detection rate, response time, availability or performance of the Service or any AI Feature. Nothing in this Section excludes liability for fraud that is not capable of exclusion under applicable law. Terms in a purchase order or other Customer document are not part of the Agreement, unless an Order Form expressly accepts them.

26.9 Governing law and venue. The Agreement, and any dispute, claim or controversy arising out of or relating to it or to the Service, are governed by the laws of the State of Delaware, United States of America, without regard to its conflict-of-laws principles, except as the closing sentences of this Section provide for the Standard Contractual Clauses and the UK Addendum. Subject to Section 26.10, the state and federal courts located in the State of Delaware that have subject-matter jurisdiction have exclusive jurisdiction and venue over any such dispute, and each party irrevocably consents to the personal jurisdiction of those courts. The United Nations Convention on Contracts for the International Sale of Goods does not apply. By way of exception to the exclusive forum, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information. Mandatory provisions of applicable law that cannot be excluded by agreement continue to apply to a Customer to which they apply. The Standard Contractual Clauses and the UK Addendum (each as defined in the DPA), where they apply under the DPA, are governed by the law and subject to the courts that they specify: under Clause 17 (Option 1) and Clause 18 of the Standard Contractual Clauses, as Section 16.7 of the DPA states, the law of Ireland and the courts of Ireland, and, for the UK Addendum, the law and courts that it specifies. Nothing in this Section 26.9 or in Section 26.10 overrides them or limits a data subject's rights under them. The law and forum of the SCCs apply only to the SCCs and the UK Addendum; the laws of the State of Delaware and the exclusive Delaware forum under this Section continue to govern the rest of the DPA, the Agreement and every other dispute.

26.10 Dispute resolution. The parties will first attempt to resolve any dispute through good-faith discussions between authorized representatives for 30 days after written notice of the dispute. If the dispute is not resolved within that period, either party may bring it in the courts identified in Section 26.9. This Agreement contains no arbitration agreement and no class action waiver.

26.11 Order of precedence. This Section states the order of precedence for the whole Agreement. Section 1.4 of the Master Services Agreement, Section 19.1 of the DPA and Section 2 of the Order Form restate the order for their own subjects and are to be read consistently with this Section; where they differ, this Section governs an Agreement formed on these Terms, and Section 1.4 of the Master Services Agreement governs a Master Services Agreement customer. Where terms conflict, the following order applies, highest first, subject to the rules for Personal Data that follow the list:

1. an Order Form executed by both parties, as to the particulars it states and the provisions it expressly identifies;
2. a Master Services Agreement, or a negotiated enterprise, government, public safety or security-provider agreement or addendum, executed by both parties;
3. the DPA, as to the processing of Personal Data;
4. the Security Addendum, as to security measures, the Data Retention and Deletion Schedule (LEG-022), as to retention and deletion, and the Subprocessor List (LEG-009), as to the identity of subprocessors;
5. an executed Service Level Agreement, as to availability and service credits;
6. the AI Use and Human Oversight Terms, as to AI Features;
7. the Commercial Terms, as to license scope, Plans, entitlements, prices and commercial mechanics;
8. the Acceptable Use Policy and, as to SMS, the SMS Terms and Consent Notice (LEG-008);
9. these Terms;
10. the Documentation and, only where an Order Form incorporates it, the Support Policy.

As to the processing of Personal Data and its transfer: (i) the Standard Contractual Clauses and the UK Addendum (each as defined in the DPA), where they apply under the DPA, prevail over every other document as to the transfers they cover, and the law and forum clause in Section 26.9 does not apply to them (Section 26.9 states the law and courts that do); (ii) the DPA prevails over every document in the list, including items 1 and 2, except that an Order Form or a Master Services Agreement varies a provision of the DPA only if it expressly identifies that provision and the variation does not reduce a protection that applicable data protection law requires; and (iii) an Order Form governs only the commercial particulars it states and the provisions it expressly identifies. As to any matter other than those stated in this list, these Terms prevail over the Commercial Terms. A lower-ranked document continues to apply to the extent it does not conflict with a higher-ranked one. A conflict between two documents does not invalidate either of them.

26.12 Language. These Terms are drafted in English. Translations are provided for convenience. In the event of a conflict, the English version controls, except where applicable law requires otherwise.

26.13 Service territory. Virtik offers self-service subscriptions to Organizations in the United States market and the Europe market where the Service offers online purchase for that market, as the Commercial Terms describe, and may make the Service available elsewhere by Order Form. Virtik may decline to provide the Service in a jurisdiction where it is unable to do so lawfully.

26.14 Insurance. Virtik makes no representation in these Terms about its insurance.

26.15 Master Services Agreement customers. Where Customer and Virtik have executed a Master Services Agreement, each reference in the Commercial Terms and in any other document of the Agreement to "the Terms" is a reference to these Terms as incorporated into the Master Services Agreement or an Order Form, and the Sections of these Terms that this Section lists apply as if set out in full in the Master Services Agreement, unless the Master Services Agreement or an Order Form expressly provides otherwise. This Section is the only list of the Sections of these Terms that apply to a Master Services Agreement. Those Sections are Sections 1, 4.4, 5.3, 6.3, 7, 8, 10.7, 13, 14, 15.1 to 15.3, 16, 17, 19, 20.7, 20.8, 21 (as Sections 9.7 and 9.8 of the Master Services Agreement provide), 22.4 to 22.6, 23.5, 24 and 25.5. Section 25 (other than Section 25.5) does not apply to a Master Services Agreement, which is amended only as it provides, except that the Subprocessor List (LEG-009) applies in the version that Section 8 of the DPA makes current, as Section 13.9 of the Master Services Agreement states. Sections 22.1 and 22.2 do not apply, and Sections 10.1 and 10.2 of the Master Services Agreement state the indemnities. Section 26.11 states the order of precedence for an Agreement formed on these Terms, and Section 1.4 of the Master Services Agreement states it for a Master Services Agreement. Section 23.2 does not apply to a Master Services Agreement, whose Section 5.2 states termination for cause; Sections 16.6(f), 16.18 and 16.19, which this Section preserves as part of Section 16, apply to a termination by Customer under Section 5.2 of the Master Services Agreement.

27. Contact Information

Legal notices: legal@virtik.ai.

Postal address: Virtik USA, Inc., Attention: Legal, 113 N San Vicente Blvd, Beverly Hills, CA 90211, United States.

Support requests: support@virtik.ai.

Security reports: security@virtik.ai.

28. Effective Date and Document Version

28.1 These Terms take effect for a Customer on the date the Customer accepts them, in the version that was current and published on that date. A version of these Terms is effective only once it has been approved, published and given an effective date in Virtik's publication record; this draft is not effective.

28.2 The version identifier of this document is stated in the version history below. Acceptance records bind to the exact version and content hash that Customer was shown.

Version history

END OF DOCUMENT