S.G. Systems Software End User Licence Agreement (EULA)

1.1 Application. This EULA applies to every licence of the Software granted for an Order that references or links it, regardless of the Seller. The Software is licensed, not sold.

1.2 Licensor. S.G. Systems, LLC owns the Software and is the licensor of it. Where Customer purchases through a Seller other than Licensor, the licence in §3.1 is granted by Licensor directly to Customer, and the Seller does not become the licensor of the Software, conditional on the Seller's Order with Customer remaining in effect.

1.3 Seller. The "Seller" is the entity from which Customer purchases the subscription, licence or Services, as named in the Order. For a direct sale the Seller is S.G. Systems, LLC or, where the Order so states, SG Traceability Systems Ltd. For a channel sale the Seller is the authorised reseller, distributor or channel partner named in the Order. A Seller other than Licensor is not Licensor's agent and has no authority to make commitments on Licensor's behalf.

1.4 Commercial Matters. Pricing, fees, deposits, payment terms, billing, taxes, subscription term and renewal, implementation and professional services, warranties, indemnities and other commercial arrangements between Customer and the Seller are governed by the applicable Order, any Statement of Work and the Seller's Commercial Terms, not by this EULA. Core support and service levels are provided by S.G. Systems, LLC directly to Customer under the SLA; a Seller may agree separate reseller-specific services, which are its own obligations and do not vary the SLA.

1.5 Acceptance. Customer accepts this EULA by accepting an Order, checkout or invoice that references or links it, in the manner provided in the Seller's Commercial Terms (for direct sales, Commercial Terms §1.1). No separate signature of this EULA is required. Use of the Software without an accepted Order is not authorised, except trial and evaluation use, which is governed solely by the Trial and Evaluation Terms.

1.6 No Expansion of Licence Rights by Commercial Documents. No Order, quote, purchase order, Statement of Work, reseller agreement, reseller commercial terms or other commercial document modifies, expands or waives the licence rights, intellectual property rights or use restrictions in this EULA unless S.G. Systems, LLC expressly agrees in a writing signed by it that identifies the provision changed. Terms on a Customer purchase order that conflict with this EULA have no effect. An Order may set the commercial fields that this EULA refers to (for example product, tier, Seat quantity, deployment and term), but only within the products and deployment options Licensor makes available for the product concerned.

1.7 Existing Agreements. Where Customer's current Order accepted the Master Services Agreement Version 1.24 (v5ultimate.com/legal/msa) or an earlier agreement, that agreement continues to govern that Order until it ends or is renewed on documents referencing this EULA. Nothing in this EULA retroactively removes rights accrued under an existing agreement or alters perpetual rights under an existing agreement absent an agreed conversion.

2.1 "Software" means the SG Systems software product identified in the applicable Order, being V5 Ultimate or V5 Classic as applicable, including updates and Documentation provided for that product.

2.2 "V5 Ultimate" means Licensor's V5 Ultimate product, currently Version 5.10, and subsequent releases Licensor makes generally available for it, supplied as Cloud, Private Cloud or On-Premises as stated in the Order.

2.3 "V5 Classic" means Licensor's V5 Traceability product Version 5.9, supplied only where expressly ordered and only as an On-Premises deployment.

2.4 "Order" means a quote, order form, accepted checkout, invoice, renewal or other commercial record accepted by Customer that identifies the Software, tier, Seats, deployment and term purchased from a Seller.

2.5 "Commercial Terms" means the commercial terms between Customer and the Seller referenced in the Order. For direct sales these are the V5 Commercial Terms for Software and Services.

2.6 "Cloud", "Private Cloud", "On-Premises" and "Provider Hosted Services" have the meanings in Commercial Terms §2.3 to Commercial Terms §2.6. Cloud and Private Cloud are always operated by Licensor (or its affiliate); a deployment on infrastructure or a cloud tenancy that Customer (or its contractor) operates is On-Premises.

2.7 "Customer Data" means all data uploaded to or generated in the Software by or on behalf of Customer, including regulated records, audit trail entries and electronic signature records, excluding Usage Data.

2.8 "Usage Data" means event-level data and metadata generated by use of the Software or Provider Hosted Services, such as login timestamps, account identifiers, device or browser type, session duration, feature interactions, performance metrics and application/error logs, excluding the business content of regulated records except where incidentally captured in error logs.

2.9 "Aggregated / De-identified Data" means data that does not identify, and cannot reasonably be used to identify, any natural person or Customer.

2.10 "User" means an individual authorised by Customer to access the Software.

2.11 "Seat" means a licence permitting one concurrently active User session. Customer may authorise more named Users than Seats, provided simultaneously active Users never exceed the licensed Seat count.

2.12 "Documentation" means Licensor's then-current user guides, admin guides, release notes and training materials for the product ordered.

2.13 "Confidential Information" means non-public information disclosed by a party that is designated confidential or that a reasonable person would understand to be confidential, including business, technical, security and product information and Customer Data.

2.14 "AI Features" means functionality of the Software that uses machine-learning or generative models to produce suggestions, drafts, summaries or other output, where enabled for Customer.

2.15 "DPA" means the Data Processing Addendum incorporated where required by law or where personal data in Customer Data is processed, as referenced in the Order or Commercial Terms.

2.16 "Product Terms" means the product- and deployment-specific terms identified in the Order, including any addendum expressly incorporated by it. For direct sales these are the product and deployment provisions of the Commercial Terms (including, for V5 Ultimate, its Cloud, Private Cloud, validation and release provisions, and for V5 Classic, its On-Premises provisions).

3.1 Licence Grant. Licensor grants Customer a non-exclusive, non-transferable, revocable licence to use the Software ordered during the licence or subscription term stated in the Order, solely for Customer's internal business operations, in the tier and Seat quantity stated in the Order. A licence to one product does not include the other. Nothing in this EULA gives a V5 Classic customer a right to V5 Ultimate, or a V5 Ultimate customer a right to V5 Classic; any migration, upgrade or conversion between products is a separate commercial matter requiring a new or amended Order. For Provider Hosted Services (V5 Ultimate only) the licence is a right to access and use the hosted Software; for On-Premises it includes the right to install and operate the Software on infrastructure Customer (or its contractor) operates.

3.2 Configurable Software Position. The Software is supplied as highly configurable standard software. Where relevant, Licensor may describe it using legacy GAMP 4-style terminology for configurable standard software; the actual risk assessment and validation scope depend on Customer's intended use, configuration, integrations and procedures.

3.3 Authorised Users and Seats. Each Seat permits one concurrently active User session. Customer shall not use shared credentials, overlapping sessions, automation or other workarounds to circumvent Seat limits. Licensor may enforce Seat counts by session controls, authentication controls, audit logs and other reasonable technical measures. Customer is responsible for the acts and omissions of its Users.

3.4 Sites and Deployment. Customer may use the Software only in the deployment, and at any sites, entities or environments, stated in the Order. Any restriction on sites or affiliates stated in the Order applies to this licence.

3.5 Historical Licences. Grandfathered named-user or device licensing continues only as stated in the Order and the Commercial Terms. Nothing in this EULA preserves or recreates any perpetual licence, and nothing retroactively alters perpetual rights under an existing agreement absent an agreed conversion.

3.6 Licence Audit. Licensor (directly or through the Seller) may audit usage and deployment records on reasonable notice to verify Seat counts and entitlements; for On-Premises, no more than once per calendar year on thirty (30) days' notice, during business hours.

3.7 Product and Deployment Terms. The product and deployment actually licensed are those identified in the Order, and deployment-specific service, hosting and validation terms are set by the Order and the Product Terms, and support and service levels by the SLA, not by this EULA. V5 Ultimate may be supplied as Cloud, Private Cloud or On-Premises as stated in the Order. V5 Classic is supplied only as On-Premises. Provisions of this EULA that refer to Provider Hosted Services, Cloud or Private Cloud apply only to V5 Ultimate deployed in that way and do not apply to V5 Classic.

4.1 Restrictions. Customer shall not (and shall not permit any third party to): (a) reverse engineer, decompile or attempt to derive source code except as permitted by non-waivable law; (b) bypass licence limits or security controls; (c) use the Software unlawfully; (d) provide the Software as a service bureau or for third-party benefit without Licensor's written consent; or (e) use the Software to build a competing product.

4.2 Resellers. Only Licensor may grant licences to the Software. A Seller may resell subscriptions and licences only as authorised by Licensor and cannot grant rights beyond this EULA.

5.1 Human Review. Where AI Features are enabled for Customer: (a) output is probabilistic assistance and may be incomplete or inaccurate; (b) an authorised User must review output before relying on it and before any regulated or consequential action; (c) AI output alone is not an electronic signature, approval, batch or lot release, or validation evidence, and existing permissions, signatures and change controls continue to apply; (d) Licensor does not use Customer Data to train AI models; and (e) any third-party processing of Customer Data for AI Features is documented in the DPA and sub-processor list.

5.2 Availability. AI Features are available only where the Order, tier or Documentation for the product ordered includes them; no AI Features are represented for V5 Classic.

6.1 Customer Data Ownership. Customer retains all right, title and interest in Customer Data. Customer grants Licensor (and, to the extent it performs Services, the Seller) a limited licence to process Customer Data solely to provide the Software and Services, including support, troubleshooting, security monitoring, compliance with the Customer's agreements and licence administration. Licensor does not use Customer Data to train AI models.

6.2 Electronic Records and Audit Trails. The Software is designed to support data integrity controls, including audit trails, version control, role-based access and encryption for Provider Hosted Services; system access and key actions are logged and time-stamped. During the licence term, Customer Data remains available within the deployment. Customer remains responsible for meeting regulatory retention obligations, including exporting and archiving records as required by its quality system.

6.3 Data Export. Commercially reasonable efforts will be made to support export of Customer Data using the Software's standard supported export methods during the licence term and, for Provider Hosted Services, the retrieval window in §13.3. Standard exports preserve the association of records with their audit trail and electronic signature information to the extent the supported export format provides it; custom export formats require separate written agreement.

6.4 Personal Data. Personal data in Customer Data is processed in accordance with the DPA. For Provider Hosted Services, Licensor processes it as Customer's processor (or sub-processor where Customer is itself a processor), whoever the Seller is; a Seller that processes Customer Data in its own systems does so under its own agreement with Customer. The current sub-processor list is at v5ultimate.com/legal/sub-processors.

7.1 Collection and Purposes. Licensor processes Usage Data to operate, secure, support and improve the Software and Provider Hosted Services, troubleshoot, enforce licensing, and create Aggregated / De-identified Data that does not identify Customer or individuals.

7.2 Roles. For personal data in Customer Data, Licensor acts as a processor under the DPA. For Usage Data processed for the purposes above, Licensor may act as an independent controller or business as applicable.

7.3 Controls. Essential telemetry (security, service delivery, licence enforcement) is always active. Non-essential analytics may be disabled by written notice; this may reduce proactive insights but does not affect service delivery or licence enforcement.

7.4 Retention. Raw Usage Data is retained for no longer than thirteen (13) months unless required for security, audit or legal hold. Aggregated / De-identified outputs may be retained indefinitely.

7.5 On-Premises Deployments. Telemetry may require outbound connectivity; if blocked, certain analytics features may be unavailable, but licence enforcement mechanisms described in the Documentation continue to apply.

8.1 Shared Responsibility. Compliance in a regulated environment is a shared responsibility. The Software provides features designed to support data integrity and auditability. Assessment Documentation and validation assistance are provided as described in the Commercial Terms and purchased in the Order. Customer remains responsible for its intended-use validation, release and approval decisions, SOPs, training, access governance, and performing and approving validation activities (including IQ / OQ / PQ and UAT as applicable) in its environment.

8.2 Private Cloud and Validation (V5 Ultimate). A V5 Ultimate Private Cloud is intended for regulated environments in which Customer validates the system. Its isolated application instance and database, and the release deferral window in Commercial Terms §8.5, are designed to support Customer's controlled validation workflow. Isolation does not by itself validate the implementation: Customer's quality function remains responsible for intended-use validation, testing, approval, release and change control, supported by the assessment documentation under Commercial Terms §7.1 and any validation assistance purchased.

8.3 Validation and Qualification. Customer is responsible for performing and approving qualification and validation of the Software for its intended use and applicable requirements, and for maintaining validation documentation and release approvals.

8.4 Regulatory Cooperation. Customer maintains internal data integrity and system security policies and notifies Licensor (directly or through the Seller) promptly if the Software is involved in a regulatory audit or data integrity concern requiring Licensor's cooperation.

8.5 User Training. Customer ensures Users are trained in accordance with regulatory requirements and Customer SOPs, including on the review of AI Feature output where enabled.

9.1 Access Controls. The Software provides role-based access controls to support ALCOA+ principles. Customer remains responsible for role design, account provisioning and deprovisioning, credential protection and SOP enforcement.

9.2 Provider Hosted Services. Licensor operates Provider Hosted Services whoever the Seller is, and is responsible to Customer for their security and for the related Security Incident notices on the terms and deadlines in Commercial Terms §9.2. The Seller is responsible for its own services, systems and handling of Customer Data. Security, incident notification, backup and disaster recovery commitments for Provider Hosted Services (V5 Ultimate Cloud and Private Cloud only) are set out in Commercial Terms §9 and the service levels in Section 11 of the Commercial Terms, or in the equivalent provisions of the Seller's Commercial Terms.

9.3 On-Premises. For On-Premises deployments (including all V5 Classic deployments), Customer is responsible for infrastructure security, backups and disaster recovery; Licensor has no access to Customer Data except as Customer authorises (for example logs provided during a support case).

10.1 Integrations. ERP integration, ERP gap analysis and custom API integration are provided only if expressly purchased and described in the Order. Standard connectors extend Customer's existing systems; which system owns each record is agreed when the integration is configured. The availability of a standard connector, integration or API does not by itself warrant that every workflow Customer proposes can be achieved using standard interfaces alone; Licensor's integration deliverables are only those expressly specified in the Order or Statement of Work, and an express written commitment in those documents prevails to its extent. Responsibility for Customer-managed integrations, acceptance and related payment matters is governed by the Seller's commercial terms (for direct sales, Commercial Terms §4.5.1 to Commercial Terms §4.5.6).

10.2 Customer Systems. Customer is responsible for third-party systems, identity providers, networks and data sources it connects to the Software, and for its agreements with their providers. Where Customer or a third party appointed by Customer designs, builds or manages an integration, Customer is responsible for that integration and for required changes to its ERP or other third-party systems. Licensor remains responsible, within its obligations under this EULA and the SLA, for defects in the supported V5 APIs and connectors that the integration uses.

10.3 Sub-processors. Provider Hosted Services (V5 Ultimate only) use sub-processors under written agreements that protect Customer Data, as listed at v5ultimate.com/legal/sub-processors; notice and objection rights are as stated in the Commercial Terms and the DPA.

11.1 Protection. Each of Licensor and Customer protects the other's Confidential Information with at least reasonable care and uses it only to perform or exercise rights under this EULA and the Customer's agreements for the Software.

11.2 Compelled Disclosure. If legally compelled to disclose, the receiving party gives prompt notice (where permitted) and cooperates to seek confidential treatment.

11.3 Term. Confidentiality obligations survive for five (5) years after termination; Customer Data and trade secrets remain protected for as long as they qualify as Confidential Information under applicable law.

12.1 Licensor IP. Licensor retains all right, title and interest in the Software, Provider Hosted Services, Documentation and related intellectual property. No rights are granted except as expressly stated in this EULA.

12.2 Customer IP. Customer retains all right, title and interest in Customer Data and Customer-provided materials.

12.3 Feedback. Licensor may use feedback without restriction, provided it does not publicly identify Customer as the source without consent.

13.1 Term. The licence lasts for the licence or subscription term in the Order and ends when that Order ends or is terminated under the Commercial Terms.

13.2 Suspension and Termination. Use rights may be suspended or disabled, including by automated controls, where the Commercial Terms permit suspension (for example for non-payment). Licensor may terminate the licence for a material breach of this EULA not cured within thirty (30) days of written notice.

13.3 Effect of Termination or Suspension. (a) Suspension or termination affects use rights only and does not transfer or extinguish Customer's ownership of Customer Data. (b) For Provider Hosted Services (V5 Ultimate only), Customer Data is retrievable on request for ninety (90) days after termination, provided all undisputed amounts are paid. Customer should export and archive records it needs before service deletion. After that window Customer Data is deleted from active systems, subject to the DPA, any legal hold and the documented backup rotation; indefinite storage is not guaranteed. (c) For On-Premises, Customer ceases use of the licensed Software at the end of the term and removes or disables it as reasonably required; Customer is not required to destroy its regulated records and remains responsible for retaining them in accordance with its quality system and applicable law.

13.4 Survival. Provisions intended to survive (including confidentiality, data rights, intellectual property, limitation of liability and dispute resolution) survive.

14.1 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS EULA OR IN THE COMMERCIAL TERMS WITH THE SELLER, THE SOFTWARE (INCLUDING AI FEATURE OUTPUT) IS PROVIDED "AS IS" AND LICENSOR DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT, TO THE EXTENT PERMITTED BY LAW. Warranties, indemnities and remedies offered by a Seller are given by that Seller.

14.2 Total Liability. Licensor's total liability under this EULA shall not exceed the total fees paid by Customer under the applicable Order in the twelve (12) months preceding the claim. Where Licensor (or its affiliate) is also the Seller, this limit and the limit in the Commercial Terms are a single aggregate limit, not cumulative.

14.3 Exclusions. Neither party is liable for indirect, incidental, consequential, special or punitive damages (including lost profits), except to the extent arising from gross negligence, wilful misconduct or breach of confidentiality obligations.

14.4 Mandatory Law. Nothing in this EULA limits or excludes liability that cannot be limited or excluded under applicable law, including liability for fraud or for death or personal injury caused by negligence.

14.5 Intellectual Property Claims. Whoever the Seller is, Licensor will defend Customer against a third-party claim that the Software, as provided by Licensor, infringes intellectual property, and indemnify Customer, on the scope, conditions, mitigation and exclusions in Commercial Terms §16.1 to Commercial Terms §16.3, applied with Licensor in place of Provider and subject to §14.2 to §14.4. Where Licensor (or its affiliate) is also the Seller, this Section and Commercial Terms Section 16 are one obligation, not two. Licensor has no obligation for a Seller's additions, services, configurations or representations.

14.6 Seller Liability Terms. A Seller's own terms may state the Seller's liability to Customer. They do not change Licensor's liability under this EULA, which remains as stated in this Section 14 unless Licensor expressly agrees otherwise in writing.

15.1 Export Controls and Sanctions. Customer shall comply with export control and sanctions laws applicable to its access to and use of the Software, and shall not access, use or permit access to the Software in violation of them.

15.2 Governing Law and Disputes. This EULA is governed by the laws of the State of Texas, without regard to conflict of laws principles; disputes shall be resolved through mediation, followed by arbitration if necessary, in Dallas, Texas. The UN Convention on Contracts for the International Sale of Goods does not apply. Either party may seek injunctive relief for unauthorised use of its intellectual property or breach of confidentiality. Nothing in this clause removes rights Customer has under mandatory law of its place of residence.

15.3 Order of Precedence. This EULA controls licence scope, intellectual property and use restrictions, and prevails over any conflicting Order, purchase order, Statement of Work or Commercial Terms on those matters, subject to §1.6. The DPA controls for conflicts concerning the processing of personal data. On commercial matters the Commercial Terms and Order control, and on deployment-specific service matters the Order and Product Terms control.

15.4 Assignment. Customer may not assign this EULA without Licensor's prior written consent, except to an affiliate or in a merger, acquisition or sale of substantially all assets where the assignee agrees in writing to be bound and the related Order is assigned with it. Licensor may assign this EULA on the same basis.

15.5 Severability; Waiver. If any provision is unenforceable, the rest remains in effect. Failure to enforce is not a waiver.

15.6 Notices. Notices to Licensor must be in writing to S.G. Systems, LLC at 6944 Meadowbriar Lane, Dallas, TX 75230, USA, with a copy to info@sgsystemsglobal.com. Notices to Customer may be sent to the designated contact in the Order. Formal notices of breach, termination or suspension sent by email are effective only if acknowledged by the receiving party.

15.7 Updates. Licensor may update this EULA prospectively. An updated version applies to an Order only when that Order or its renewal references it after written notice under the Commercial Terms; updates do not retroactively remove accrued rights. The version identifier and change history are maintained for document control.