Master Services Agreement (Includes SLA)

1.1 Acceptance; Effective Date. Customer accepts this MSA for a new purchase or renewal by any of: (a) signing or otherwise accepting an Order that references or links this MSA; (b) electronically accepting a checkout that incorporates it; or (c) paying a new order or renewal invoice that clearly states that payment constitutes acceptance and prominently links this MSA, made available before payment. No separate signature of this MSA is required. The MSA published at the link identified in that transaction or in the renewal notice under §18.11 governs that purchase or renewed term; a revision published after that notice and not itself notified before payment does not apply to it. Unless the Order states otherwise, the date Provider receives Customer's initial payment is the "Effective Date" of that Order. Ordinary payment of an instalment or invoice already due under an existing committed term is not acceptance of changed terms (§18.11).

1.1.1 Initial Payment Composition. Unless otherwise stated in the Order, Customer's initial payment includes (a) any one-time Onboarding Fees due at signing and (b) the subscription payment due at signing, being either the first instalment (where instalment billing is elected) or the full annual fee (where annual billing is elected).

1.1.2 Document Version. This MSA is Provider document Version V1.24, revision date September 28, 2026. An Order, checkout or invoice need not state a version number: referencing the current MSA URL with a conspicuous acceptance notice is sufficient. Provider retains the published version, its publication date and archived snapshots, together with the relevant order, notice and payment records, as evidence of the terms accepted.

1.2 Software Activation. For Provider Hosted Services, access will be provisioned within 72 hours of receipt of the initial subscription payment and required account set-up information, unless the Order states a different provisioning plan (for example for a Private Cloud instance). For On-Premises deployments, Provider will make the Software and licence information available within 72 hours of receipt of the initial subscription payment, subject to Customer providing required environment and access prerequisites.

1.3 Agreement Scope; Product and Deployment Election. This MSA governs the Software and all related Services and Presales Services purchased by Customer. Each Order identifies: the product and version (V5 Ultimate or V5 Classic); tier; number of concurrent Seats; deployment (Cloud, Private Cloud or On-Premises); the subscription term; Services; fees; the contracting Provider entity; and, where relevant, the applicable Assessment Documentation reference. Cloud and Private Cloud are always operated by Provider; a deployment on infrastructure or a cloud tenancy that Customer (or its contractor) operates is On-Premises. V5 Classic is supplied only where the Order expressly names it, and only On-Premises. Where an Order does not identify the product or the deployment, Provider will not assume either; the Parties will confirm the election in writing before provisioning.

1.3.1 Commercial Records. A Provider-issued quote, accepted checkout, accepted billing-portal change, invoice, renewal, statement of work or other written commercial record accepted or paid by Customer may serve as the Order for the specific items purchased or changed, provided it references or links this MSA in accordance with §1.1. The billing provider and merchant of record, if any, are identified on the applicable checkout or Order.

1.4 Order of Precedence. (a) An Order controls only its commercial fields (for example fees, quantities, tier, Seat minimums, term, billing, deployment election, entity and dates). (b) Any other deviation from this MSA in an Order is effective only if it expressly identifies the clause varied and is agreed by both Parties. (c) The DPA controls only for conflicts concerning the processing of personal data. (d) A signed Supplier Quality Agreement ("SQA") controls only for the quality matters it covers. (e) An expressly signed amendment prevails within its stated scope. (f) This MSA controls all other matters. The Privacy Notice is an informational processing disclosure and does not vary this MSA. The Trial and Evaluation Terms do not apply to paid scope and do not fill gaps in this MSA.

2.1 "Software" means the product ordered, being V5 Ultimate and/or V5 Classic, including updates and Documentation provided by Provider under this MSA for that product.

2.1.1 "V5 Ultimate" means Provider's V5 Ultimate product, currently Version 5.10, and subsequent releases Provider makes generally available for it under Section 8.

2.1.2 "V5 Classic" means Provider's V5 Traceability product Version 5.9 (the product governed by MSA Version 1.23), supplied under this MSA only where expressly ordered and only as an On-Premises deployment on Customer-operated infrastructure; Provider does not host V5 Classic. V5 Ultimate and V5 Classic are separate products: no feature parity, cross-product licence, automatic migration or entitlement to a different major product generation is implied; any move between them is governed by §4.8.

2.2 "Provider" means the contracting entity named in the Order: S.G. Systems, LLC, a Texas limited liability company with its principal office at 6944 Meadowbriar Lane, Dallas, TX 75230, USA; or, for Customers contracting in the EU, EEA, United Kingdom or Switzerland where the Order so states, SG Traceability Systems Ltd (Ireland, CRO 732738). Only the named entity is a party to that Order; the entities are not jointly liable.

2.3 "Cloud" means a shared, multi-tenant hosted deployment of V5 Ultimate operated by Provider using third-party infrastructure.

2.4 "Private Cloud" means a Provider-hosted deployment of V5 Ultimate operated by Provider on the same hosting platform and environment, and by the same operator, as V5 Ultimate Cloud, but with a separate, isolated application instance and a separate database dedicated to Customer. Customer does not operate, secure, patch or back up the hosting infrastructure for a Private Cloud; Provider's hosted obligations, including Section 9 and §11.4, apply. The region and any other characteristics stated in the Order apply; no other characteristics are implied. A deployment on infrastructure or a cloud account that Customer controls is not Private Cloud (see §2.5).

2.5 "On-Premises" means installation and operation of the Software on infrastructure that Customer (or its contractor) operates, including a cloud account, subscription or tenancy that Customer controls ("Customer-managed cloud"). A Customer-managed cloud deployment is On-Premises for all purposes of this MSA and is not Private Cloud.

2.6 "Provider Hosted Services" means V5 Ultimate Cloud and V5 Ultimate Private Cloud. V5 Classic is never a Provider Hosted Service. Infrastructure operated by or for Customer, including a Customer-managed cloud, is not Provider Hosted Services.

2.7 "Services" means Provider Hosted Services (if ordered), onboarding and implementation (if purchased), support, maintenance, training assistance, validation assistance, installation services and related professional services provided by Provider.

2.7.1 "Presales Services" means limited-scope paid or complimentary services before go-live or expansion, including ERP Gap Analysis, Proof of Concept, discovery and similar evaluation work described in the applicable commercial record.

2.8 "Order" means an Order Form, signed proposal, quote, renewal, invoice, accepted checkout, accepted billing-portal change or other record provided by Provider and accepted by Customer that contains the elements in §1.3 (references in V1.23 to "Order Form / Signed Proposal" mean an Order).

2.9 "Onboarding / Implementation Services" means paid professional services for set-up, configuration, project management, custom API integration, training, UAT facilitation (if included), validation support (if included) and related rollout activities, as described in the Order.

2.9.1 "Self-Service Onboarding" means any guided set-up materials, in-product onboarding or documentation Provider makes available with a subscription at no separate charge. Self-Service Onboarding is not paid assisted implementation.

2.10 "Onboarding Fees" means one-time fees for Onboarding / Implementation Services, billed as stated in the Order.

2.11 "ERP Gap Analysis" means a structured analysis of Customer's ERP data model, workflows and integration requirements to identify gaps, mappings and integration approach, purchasable as a Presales Service or within an implementation.

2.12 "Custom API Integration" means Customer-specific API integration work, including custom mappings, transforms or connectors beyond standard configuration, when purchased.

2.13 "Critical Issue" means a severe Software malfunction that prevents Customer performing essential business operations reliant on the Software.

2.14 "Security Incident" means any unauthorised access, use, disclosure, alteration or destruction of Customer Data, or a confirmed compromise of the confidentiality, integrity or availability of Provider Hosted Services.

2.15 "Sandbox Environment" means a separate, isolated test environment provided by Provider where included in the Order (or, for On-Premises, an environment designated by Customer) for testing releases before production use.

2.16 "Customer Data" means all data uploaded to or generated in the Software by or on behalf of Customer, including regulated records, audit trail entries and electronic signature records, excluding Usage Data.

2.17 "Service Level Agreement (SLA)" means the deployment-specific commitments in Section 11.

2.18 "Renewal Term" means each additional period commenced under §5.2.

2.19 "Invoice" means Provider's written request for payment under Section 5 and/or Section 6.

2.20 "Device" means a dedicated human-machine interface (such as a PC or tablet) used to access the Software, identified by a unique network interface. A Device does not include passive peripherals such as scales, scanners or printers unless expressly listed as licensed on a historical Order.

2.21 "Legacy User Licence" means a historical named-user quantity on a prior Order, recognised only as part of Grandfathered Subscription Terms.

2.22 "Legacy Device Licence" means a historical device-based quantity on a prior Order, recognised only as part of Grandfathered Subscription Terms.

2.23 "Usage Data" means event-level data and metadata generated by use of the Software or Provider Hosted Services, such as login timestamps, account identifiers, device or browser type, session duration, feature interactions, performance metrics and application/error logs, excluding the business content of regulated records except where incidentally captured in error logs.

2.24 "Aggregated / De-identified Data" means data that does not identify, and cannot reasonably be used to identify, any natural person or Customer.

2.25 "User" means an individual authorised by Customer to access the Software.

2.26 "Seat" means a licence permitting one concurrently active User session. Customer may authorise more named Users than Seats, provided simultaneously active Users never exceed the licensed Seat count. Provider may use session controls, authentication controls, audit logs and other reasonable technical measures to enforce Seat limits.

2.27 "Grandfathered Subscription Terms" means pricing, quantities, commercial treatment and renewal rights that Provider has agreed to continue honouring for a specific Customer although they originated under an older model. They form part of a current subscription and are not a perpetual licence grant. They do not preserve the retired Silver, Gold, Platinum or Diamond support-tier structure; support is governed by Section 11, including §11.12.

2.28 "Converted Legacy Customer" means a Customer whose older perpetual, support, named-user or device-based arrangement has been converted to a subscription but may continue under Grandfathered Subscription Terms.

2.29 "Timely Payment" means Provider's receipt in full of all undisputed invoiced amounts on or before the due date, without extension, carry-forward or partial payment unless Provider agrees in writing.

2.30 "Documentation" means Provider's then-current user guides, admin guides, release notes and training materials for the product ordered.

2.31 "Confidential Information" means non-public information disclosed by a Party that is designated confidential or that a reasonable person would understand to be confidential, including business, technical, pricing, security and product information and Customer Data.

2.32 "DPA" means Provider's Data Processing Addendum, incorporated where required by law or where Provider processes personal data in Customer Data, and available on request.

2.33 "Assessment Documentation" means the independent assessment report(s) and supporting materials described in §7.1, each limited to the software version and scope it identifies.

2.34 "IQ / OQ / PQ" means installation, operational and performance qualification activities performed within Customer's validation programme in Customer's environment.

2.35 "UAT" means pre-go-live testing to confirm configured workflows meet Customer's intended use and acceptance criteria.

2.36 "POC" means a paid, limited-scope Services engagement to confirm fit. Unless the Order states otherwise, POCs commonly exclude integrations, multi-site rollout, mass data migration and validation services.

2.37 "Billing Portal" means any third-party billing or customer portal Provider enables for payment, payment-method management, Seat changes, billing-frequency changes, renewals and similar self-service actions.

2.38 "Account Manager" means Provider personnel authorised to quote, scope, approve or coordinate additional Services, expansions and development requests.

2.39 "Configurable Software Classification" means Provider's classification of V5 as highly configurable standard software. For validation planning Provider may describe it using legacy GAMP 4-style terminology for configurable standard software; Customer remains responsible for validating its configured intended use.

2.40 "Separate Branch Development" means development, paid or complimentary, performed in a controlled source branch distinct from the main production branch until reviewed, tested, approved and merged under Provider's change control.

2.41 "AI Features" means any feature of the Software, where enabled for Customer, that generates suggestions, drafts, summaries, classifications or other output using machine-learning or large language models.

3.1 Paid Assisted Implementation. Onboarding / Implementation Services are professional services purchased by Customer and billed as Onboarding Fees as stated in the Order. Where an Order does not include them, Provider has no obligation to provide assisted implementation beyond Self-Service Onboarding and §3.5. Nothing in this MSA requires every Customer to purchase implementation.

3.1.1 Presales Services. ERP Gap Analysis, POCs and similar evaluation work may be purchased before a production subscription, before a broader implementation or as part of an expansion. Unless otherwise stated, Presales Services are limited in scope and billed separately from subscription fees.

3.2 Typical Onboarding Components. Depending on what Customer purchases, Onboarding / Implementation Services may include: project management (kickoff, timeline, weekly status cadence); a POC (scope and exclusions defined in the Order); ERP Gap Analysis; Custom API Integration; configuration and rollout support (roles, permissions, templates, workflows aligned to the tier ordered); role-based training; and UAT and validation support (UAT facilitation, IQ / OQ template protocols and reasonable assistance under §7.4) where included in the Order.

3.3 Scope, Deliverables, and Timeline. Scope, deliverables and estimated timeline are defined in the Order or a written addendum executed by both Parties. Timelines depend on Customer providing timely access to personnel, systems, data and environments (including ERP sandbox access where applicable).

3.4 Start Condition. Provider is not obligated to schedule or begin Onboarding / Implementation Services until it has received the Onboarding Fees (if any) and the initial subscription payment under §1.1.1, unless the Order states otherwise.

3.5 Post-Setup Training & Assistance Included with Subscription (Reasonable Use). During an active subscription Provider will provide reasonable remote assistance for training questions, operational guidance and minor configuration support at no additional charge. Major expansions (new sites, new integrations, significant workflow redesign, on-site training or net-new development) require a separate written agreement and may require additional fees.

3.6 Enterprise Onboarding & Validation Package (If Purchased). Where Customer purchases the Enterprise tier and the Order includes Onboarding / Implementation Services, Provider's standard Enterprise onboarding scope includes (a) facilitated UAT support (planning, facilitation, issue triage and retest coordination) and (b) an IQ / OQ template package with reasonable remote assistance for Customer's execution. Customer remains responsible for final execution, review, approval and maintenance of validation deliverables within its quality system. Provider-executed qualification protocols are provided only where expressly listed in the Order.

4.1 Licence Grant. Provider grants Customer a non-exclusive, non-transferable, revocable licence to use the Software ordered during the applicable subscription term, solely for Customer's internal business operations, in the tier (for example Express, Professional or Enterprise) and Seat quantity stated in the Order. A licence to one product does not include the other.

4.1.1 Configurable Software Position. Provider supplies V5 as highly configurable standard software. Where relevant, Provider may describe it using legacy GAMP 4-style terminology for configurable standard software; the actual risk assessment and validation scope depend on Customer's intended use, configuration, integrations and procedures.

4.2 Provider Hosted Services. Where the Order specifies V5 Ultimate Cloud or V5 Ultimate Private Cloud, Provider will provide hosting, infrastructure security, backups, maintenance, updates under Section 8 and the applicable SLA in Section 11. A Private Cloud uses the same Provider-operated hosting environment as Cloud, with its own isolated application instance and database (§2.4); release timing for a Private Cloud production instance follows §8.5.

4.3 On-Premises and Customer-Managed Deployments. Where the Order specifies On-Premises (including a Customer-managed cloud), Customer operates the infrastructure (including security, backups, disaster recovery, identity provider, monitoring and third-party licences) and is responsible for its regulatory compliance. Provider provides software support under §11.2. Uptime, backup and recovery commitments for Provider Hosted Services do not apply. There is no default deployment: the Order must state it (§1.3). Delivery format and supported configurations are described in the Documentation for the product ordered; V5 Classic is always deployed On-Premises under this Section, with support under §11.5.

4.4 Licensing Structure; Current Seat Model; Grandfathered Subscription Terms. (a) Current Standard Model. Seats measured by concurrent Users. Unless the Order or renewal states otherwise, new subscriptions, re-quotes and replacement arrangements are issued on a Seat basis. (b) Seat Licensing. Each Seat permits one concurrently active User session. Customer shall not use shared credentials, overlapping sessions, automation or other workarounds to circumvent Seat limits; Provider may enforce Seat counts by reasonable technical measures. (c) Minimum Threshold. Unless an accepted Order or checkout states a different tier or Seat minimum, Customer must purchase at least three (3) Seats. (d) Historical Models. Named-user and device licensing are no longer standard for new Customers, but Converted Legacy Customers may continue under Grandfathered Subscription Terms. (e) Grandfathered Terms Honoured While Paid On Time. Provider may continue to honour Grandfathered Subscription Terms, including legacy or similar pricing subject to annual increases, while Customer remains current on undisputed payments and otherwise compliant. Grandfathered pricing and licensing do not preserve a retired support tier; the support transition is governed by §11.12. (f) Expansion While Current. While current, a Converted Legacy Customer may expand within its grandfathered pricing and licensing framework, documented in a written commercial record; support for any expansion is provided under Section 11. (g) Forfeiture Upon Non-Payment. On failure of Timely Payment of any undisputed amount, Customer loses its Grandfathered Subscription Terms, and any continued service, reinstatement, renewal or expansion may be re-quoted under Provider's then-current pricing, terms and model. (h) No Perpetual Rights. Grandfathered Subscription Terms do not preserve or recreate any perpetual licence; this Agreement does not retroactively alter perpetual rights under an existing agreement absent an agreed conversion. (i) Audit. Provider may audit usage and deployment records on reasonable notice to verify Seat counts and grandfathered entitlements; for On-Premises, no more than once per calendar year on thirty (30) days' notice, during business hours.

4.5 ERP Integration. ERP integration, ERP Gap Analysis and Custom API Integration are provided only if expressly purchased and described in the Order. Standard connectors extend Customer's existing ERP; which system owns each record is agreed when the integration is configured.

4.6 Use Restrictions. Customer shall not (and shall not permit any third party to): (a) reverse engineer, decompile or attempt to derive source code except as permitted by non-waivable law; (b) bypass licence limits or security controls; (c) use the Software unlawfully; (d) provide the Software as a service bureau or for third-party benefit without Provider's written consent; or (e) use the Software to build a competing product.

4.7 AI Features. Where AI Features are enabled for Customer: (a) output is probabilistic assistance and may be incomplete or inaccurate; (b) an authorised User must review output before relying on it and before any regulated or consequential action; (c) AI output alone is not an electronic signature, approval, batch or lot release, or validation evidence, and existing permissions, signatures and change controls continue to apply; (d) Provider does not use Customer Data to train AI models; and (e) any third-party processing of Customer Data for AI Features is documented in the DPA and sub-processor list. AI Features are available only where the Order, tier or Documentation for the product ordered includes them; no AI Features are represented for V5 Classic.

4.8 V5 Classic to V5 Ultimate Transition. V5 Classic (Version 5.9) and V5 Ultimate (Version 5.10) are separate software products and service offerings. No V5 Classic licence, subscription, maintenance or support arrangement (including Grandfathered Subscription Terms or the support transition under §11.12) entitles Customer to V5 Ultimate, a free upgrade, or an automatic transfer of licences, pricing or Customer Data. Any move to V5 Ultimate requires a separate Order or other written commercial agreement accepted by both Parties, including the applicable licence or subscription fees. Provider may, at its discretion, quote additional fees for professional services connected with a move, such as assessment, implementation, configuration, integration, training, validation assistance and data extraction, conversion or migration. Those fees apply only if their scope and amount are agreed in writing before the work begins; no such fee is imposed retrospectively, and any waiver or discount applies only if expressly documented. Migration availability and scope depend on technical feasibility and the agreed requirements; no automatic or like-for-like transfer of functionality or data is promised. Customer retains ownership of its Customer Data and its standard export rights under §12.5 and §5.4, which are not subject to these transition fees.

5.1 MSA Term. This MSA begins on the first Effective Date and continues until all Orders under it have ended or it is terminated.

5.2 Subscription Term. Unless an accepted Order specifies a different term, each Order, renewal or recurring arrangement establishes a 365-day subscription term (the "Initial Term"). Unless Customer gives written notice of non-renewal at least thirty (30) days before the end of the then-current term, each term renews automatically for successive one-year Renewal Terms at the fees then in effect, subject to §5.5, the renewal notice and acceptance provisions in §18.11, and any loss of Grandfathered Subscription Terms. Monthly instalment billing of an annual term is a payment schedule and does not permit monthly cancellation.

5.3 Termination for Cause. Either Party may terminate an Order for a material breach not cured within thirty (30) days of written notice.

5.4 Effect of Termination or Suspension. (a) On termination, expiry or suspension for non-payment, Customer's right to use the Software may be disabled, including by automated controls. Suspension or termination affects use rights only and does not transfer or extinguish Customer's ownership of Customer Data. (b) For Provider Hosted Services (V5 Ultimate only), Customer Data is retrievable on request for ninety (90) days after termination, provided all undisputed amounts are paid. Customer should export and archive records it needs before service deletion. After that window Provider will delete Customer Data from active systems, subject to the DPA, any legal hold and its documented backup rotation; Provider does not guarantee indefinite storage. (c) For On-Premises, Customer ceases use of the licensed Software at the end of the term and removes or disables it as reasonably required; Customer is not required to destroy its regulated records and remains responsible for retaining them in accordance with its quality system and applicable law. (d) Past-due undisputed amounts may also result in suspension or termination under §6.7.

5.5 Renewal and Grandfathered Pricing Treatment. (a) Invoice Timing. No later than sixty (60) days before the end of a term, Provider may invoice the next term based on the governing commercial record. (b) Cancellation Window. Customer may cancel or adjust the upcoming term by written notice at least thirty (30) days before it starts; later notices apply to the following term. Cancellation does not entitle Customer to a refund or credit for the current term. (c) Term Start Payment. Subscription payment is due thirty (30) days before the first day of each term (or as stated on the Invoice); Provider may suspend services automatically if payment is not received by the due date. (d) Grandfathered Pricing While Current. As in §4.4(e)–(f). (e) Loss of Grandfathered Treatment. As in §4.4(g). (f) Price Changes. For Customers not under Grandfathered Subscription Terms, Provider may adjust fees at renewal with at least sixty (60) days' written notice before the next term; Customer may decline by non-renewal notice under (b). Any change to this MSA proposed for the renewed term is notified under §18.11.

5.6 Survival. Provisions intended to survive (including payment obligations, confidentiality, data rights, IP, limitation of liability, indemnification and dispute resolution) survive.

6.1 Fees. Customer shall pay the fees in the applicable Order, renewal and/or Invoice, including Onboarding Fees (if any), subscription fees, recurring service fees and approved expansions.

6.1.1 Additional Services Pricing. Services outside the included subscription or onboarding scope (custom development, change requests, additional validation support, data work, integrations, reports, training or other professional services) may be quoted, typically through the Account Manager, and billed at the rates or fixed fees in the applicable commercial record. Provider may perform minor items at no charge in its discretion but is not obligated to.

6.2 Onboarding Fees. Onboarding Fees are billed upfront and due as stated in the Order. Unless otherwise stated in writing, Onboarding Fees are non-refundable once paid, including if Customer cancels, delays or abandons the project.

6.3 Subscription Payment Options. Unless an accepted Order states different billing: (a) Annual: 100% of the term's fees due at signing and before term start. (b) Monthly instalments: twelve equal monthly instalments of the annual term, the first due at signing and each subsequent on the same calendar day monthly; a 10% convenience fee applies unless the Order states otherwise. (c) Methods: ACH is preferred; card payments may incur a processing fee. Provider may use a Billing Portal and payment processor identified at checkout for invoicing, payment, renewals and subscription administration. (d) Billing Portal Changes: where enabled, accepted portal transactions (Seat increases, billing-frequency changes, renewals, payment-method updates) become part of the applicable commercial record from their effective date, within the commercial fields described in §1.4.

6.4 Activation and Scheduling Contingent on Payment. Provider may withhold activation, onboarding scheduling, Services or expansion until required payments are received.

6.5 Upgrades and Expansions. Fees for upgrades or added Seats are prorated over the remaining term unless the commercial document states otherwise. For Converted Legacy Customers who remain current, added licensing may remain under Grandfathered Subscription Terms; once those are lost, further changes are quoted under the then-current model.

6.6 Downgrades. Downgrades take effect at the next renewal, with written notice at least thirty (30) days prior under §5.5(b).

6.7 Late Payment; Automatic Shutoff; Loss of Grandfathered Terms. If an undisputed amount is not received by its due date, Provider may restrict, suspend or disable access until payment is received. If unpaid more than thirty (30) days after the due date, Provider may suspend Provider Hosted Services and pause non-critical support. If unpaid more than forty-five (45) days after the due date, Provider may terminate the affected Services for cause, but only by written notice under §5.3 and only if the amount remains unpaid at the end of that thirty (30) day cure period; an overdue invoice alone is not notice of breach. §5.4 then applies. Failure of Timely Payment also results in loss of Grandfathered Subscription Terms. Customer is responsible for reasonable costs of collection to the extent permitted by law.

6.8 Taxes. Fees exclude taxes. Customer is responsible for applicable sales, use, VAT, GST or similar taxes (excluding taxes on Provider's net income) unless it provides a valid exemption certificate.

6.9 No Refunds; Cancellation; Abandoned Projects. Except as expressly stated in this MSA (for example §16.2 and §11.6), the Order, or non-waivable law, all fees are non-refundable. This does not remove any refund guarantee expressly offered to Customer at the time of purchase, any refund terms of a merchant of record that applied to that purchase, or rights under non-waivable law. Cancellation, early termination, non-use or abandonment of Services (including POCs and implementations) does not entitle Customer to a refund, credit or pro-ration.

7.1 Independent Assessment (Assessment Access). V5 Classic Version 5.9 and V5 Ultimate Version 5.10 have each been independently assessed by Dr. Bob McDowall. Each assessment is limited to the software version, scope, evidence, findings and qualifications identified in the applicable report. Assessment documentation is available on request under confidentiality for customer evaluation and audit support. An independent assessment is not regulatory approval or certification and does not validate a customer's configured implementation or guarantee customer compliance. No assessment is represented for later patches or releases, a particular deployment or installation (including any individual Private Cloud instance) or AI Features unless the applicable report states so. Customer may use the V5 Ultimate 5.10 assessment documentation as supporting evidence in its own validation of that version; it does not validate or certify Customer's instance, configuration or any later version.

7.2 Shared Responsibility. Compliance in a regulated environment is a shared responsibility. Provider supports Customer's programme by delivering features designed to support data integrity and auditability, by providing Assessment Documentation and by providing validation assistance as described in this MSA and purchased in the Order. Customer remains responsible for its intended-use validation, release and approval decisions, SOPs, training, access governance, and performing and approving validation activities (including IQ / OQ / PQ and UAT as applicable) in its environment.

7.2.1 Private Cloud and Validation. A Private Cloud is intended for regulated environments in which Customer validates the system. Its isolated application instance and database, and the release deferral window in §8.5, are designed to support Customer's controlled validation workflow. Isolation does not by itself validate the implementation: Customer's quality function remains responsible for intended-use validation, testing, approval, release and change control, supported by the assessment documentation under §7.1 and any validation assistance purchased.

7.3 Data Integrity and Retention. The Software is designed to support data integrity controls, including audit trails, version control, role-based access and encryption for Provider Hosted Services. During an active subscription, Customer Data remains available within the deployment. Customer remains responsible for meeting regulatory retention obligations, including exporting and archiving records as required by its quality system; post-termination retrieval is governed by §5.4.

7.4 IQ / OQ and UAT Assistance. Provider will provide reasonable remote assistance during Customer's validation activities, including templates where included in scope, answers about Software behaviour, configuration and controls, and issue triage and retest coordination where included in the purchased onboarding scope. Provider supports validation planning by providing release notes and compliance-impact considerations for updates. Provider-executed qualification, executed protocols or requalification are provided only as expressly purchased; none is automatic. Extensive custom documentation, on-site activity or audit participation beyond reasonable remote assistance may require additional fees and written agreement.

7.5 Audit and Inspection Readiness. Provider will reasonably cooperate with Customer's regulatory audits relating to the Software's controls and, for Provider Hosted Services, relevant security and access records, subject to confidentiality and reasonable scheduling.

7.6 Security and Access Controls. The Software provides role-based access controls to support ALCOA+ principles; system access and key actions are logged and time-stamped. Provider protects Customer Data in Provider Hosted Services through reasonable administrative, technical and physical safeguards. Customer remains responsible for role design, account provisioning and deprovisioning, and SOP enforcement.

8.1 Controlled Software Updates. Updates, patches and enhancements are managed under a change control approach appropriate for regulated environments. Change handling follows the deployment: (a) Cloud: Provider applies releases on its release schedule and gives advance notice of material changes, with release notes and impact information; changes that materially reduce functionality are notified at least sixty (60) days in advance. (b) Private Cloud: releases to the production instance are coordinated with Customer under §8.5. (c) On-Premises: Customer decides when to apply releases in its environment. V5 Classic, being On-Premises, follows (c). Emergency patches are governed by §8.4.

8.1.1 Separate Branch Development. Customer-specific developments, paid or complimentary, may be performed on separate controlled branches, with branch history, testing, review, approval and merge activity maintained under Provider's change control.

8.2 Customer Review for Critical Updates. Updates that materially affect electronic records, security or regulatory-relevant controls will be communicated in advance. For Cloud, Provider will coordinate timing to give Customer a reasonable window to assess validation impact; for Private Cloud, §8.5 applies; for On-Premises, Customer controls deployment timing.

8.3 Versioning and Documentation. Each release includes release notes describing changes and potential validation considerations. Customers may request a compliance impact summary where changes affect audit trails, electronic signatures, access controls or retention behaviour.

8.3.1 Main Product Integration. Provider may maintain multiple branches and fold approved branch changes into the main product, documented through its controlled release and change processes.

8.3.2 Version Support Limits. Provider supports released versions as stated in the Documentation or Order and, for a Private Cloud production instance, the prior supported release during the window in §8.5. This MSA does not promise indefinite version pinning, rollback to any historical build, a fixed support period not stated in the Order, free entitlement to future major product generations, or automatic migration from V5 Classic to V5 Ultimate. Any move or migration between products is a separately agreed project under §4.8.

8.4 Emergency Patches. Provider may deploy emergency patches to Provider Hosted Services to address active threats or critical vulnerabilities, and will provide notice and documentation as soon as reasonably practicable. For On-Premises, Provider will make such patches available with recommended deployment guidance.

8.5 Private Cloud Release Deferral and Validation Window. (a) Deferral. For a Private Cloud production instance, Customer may defer a routine, non-security feature release and remain on the prior supported version for up to one hundred eighty (180) calendar days, counted from the date of Provider's written release notice. That notice will include release notes and impact information under §8.3. (b) Scheduling. The Parties will coordinate proposed installation windows. During the window Provider will not apply that feature release to the production instance without Customer's agreement, other than as permitted in (d). Provider will give at least thirty (30) days' written notice before the window ends. (c) Extension. If Customer has, within the window, supplied a documented validation plan with milestones and needs more time, the Parties will discuss in good faith and may record a reasonable extension in writing before the window ends, stating any support or security limits that apply during it. No extension arises without that written record. (d) Earlier change. Provider may require earlier mitigation or upgrade, with prompt notice and coordination where practicable, to address a critical security vulnerability or active threat, a legal or regulatory requirement, a material incompatibility, or end of life of an underlying platform component; urgent security patches may be applied sooner under §8.4. (e) Support during the window. Provider provides reasonable software support and the service levels in §11.4 for the supported prior release, subject to the exclusions in Section 11. (f) Limits. This Section does not provide indefinite version pinning, continued operation of a build with an unremediated vulnerability, feature parity between releases, or custom forks. An Order may set a shorter window only by expressly varying this Section under §1.4(b). This Section applies to V5 Ultimate Private Cloud only; On-Premises timing is governed by §8.1(c).

9.1 Security Standards. Provider maintains reasonable security measures for Provider Hosted Services, including access controls, monitoring and encryption. Provider's security overview at v5ultimate.com/security is informational.

9.2 Incident Response. For a Security Incident involving Provider Hosted Services, Provider will: (a) notify Customer without undue delay and in any event within seventy-two (72) hours of becoming aware of it (the period runs from awareness, not from later confirmation); (b) provide a detailed incident report within three (3) business days, with supplemental reports as facts become available; and (c) cooperate with Customer to mitigate impact and support required regulatory reporting. Any shorter period required by applicable law or the DPA for a personal data breach applies.

9.3 Business Continuity and Disaster Recovery. Provider Hosted Services include automated backups at the intervals, and recovery objectives, stated for that deployment in Section 11. Provider maintains a disaster recovery plan and performs periodic recovery testing.

9.4 On-Premises Responsibility. For On-Premises, Customer is responsible for infrastructure security, backups and disaster recovery; Provider has no access to Customer Data except as Customer authorises (for example logs provided during a support case). Provider's obligations in this Section apply to Provider Hosted Services.

10.1 Validation and Qualification. Customer is responsible for performing and approving qualification and validation of the Software for its intended use and applicable requirements, and for maintaining validation documentation and release approvals. Provider supports this with Assessment Documentation (§7.1), assistance under §7.4 and, where purchased, the scope in §3.6.

10.2 Regulatory Reporting. Customer maintains internal data integrity and system security policies and notifies Provider promptly if the Software is involved in a regulatory audit or data integrity concern requiring Provider's cooperation.

10.3 User Training. Customer ensures Users are trained in accordance with regulatory requirements and Customer SOPs, including on the review of AI Feature output where enabled.

10.4 Account Management. Customer ensures accounts are assigned appropriately, removed or updated promptly, and that shared credentials are prohibited, and manages simultaneously active Users within the licensed Seat count.

11.1 Purpose and Scope. This Section sets out service levels by product and deployment. Only the Part matching the Order applies; no commitment in one Part applies to another product or deployment. All uptime, backup, recovery, maintenance and credit commitments apply exclusively to V5 Ultimate Provider Hosted Services. For V5 Classic, which is On-Premises only, and for V5 Ultimate On-Premises, Provider provides software support for Customer-operated infrastructure only (§11.2, §11.5).

11.2 Ongoing Operational Support (On-Premises). For On-Premises, Provider provides remote software support, operational guidance and troubleshooting for defects reproducible in a supported configuration; Customer is responsible for infrastructure and system maintenance. No uptime is warranted. Target initial response times for V5 Classic (Version 5.9) and V5 Ultimate (Version 5.10) On-Premises: Severity 1 (production down) 2 business hours; Severity 2 (major impairment) 1 business day; Severity 3 (minor) 2 business days; Severity 4 (question/request) 3 business days. These are initial response targets, not resolution guarantees. On-site support requires a separate statement of work.

11.3 V5 Ultimate Cloud. (a) Uptime: 99.9% Monthly Uptime Percentage, calculated as (total minutes in the month − unavailable minutes) ÷ total minutes × 100, excluding scheduled maintenance and §11.10 exclusions. (b) Backup and recovery: encrypted backups every twenty-four (24) hours, retained thirty (30) days; RPO 24 hours; RTO 8 hours for Severity 1 incidents. (c) Target initial response: Severity 1 – 1 business hour; Severity 2 – 4 business hours; Severity 3 – 1 business day; Severity 4 – 2 business days. (d) Maintenance: announced at least seventy-two (72) hours in advance, performed in low-traffic windows, capped at four (4) hours per month.

11.4 V5 Ultimate Private Cloud (Provider-hosted). (a) Uptime: 99.9% Monthly Uptime Percentage calculated as in §11.3, also excluding Customer-scheduled upgrade windows. (b) Backup and recovery: encrypted backups every twelve (12) hours, retained thirty (30) days (longer retention only if stated in the Order); RPO 12 hours; RTO 4 hours for Severity 1 incidents. (c) Target initial response: as in §11.3(c). (d) Maintenance: announced at least seventy-two (72) hours in advance, in a window agreed with Customer, capped at four (4) hours per month. (e) Prior release: these service levels continue for the supported prior release during a deferral window under §8.5. A Customer-managed cloud is On-Premises and is supported under §11.2.

11.4.1 Business Hours (All Section 11 Software Support). 09:00–18:00 in Customer's local time zone on weekdays, excluding Provider's published holidays, unless the Order states otherwise.

11.5 V5 Classic On-Premises Support. V5 Classic is supplied On-Premises only and is not offered as Cloud, Private Cloud or any other Provider Hosted Service. Support for V5 Classic is software support for Customer-operated infrastructure under §11.2, with the transition from legacy support tiers governed by §11.12 and any support commitment expressly retained under §1.4; Sections 11.3, 11.4 and 11.6 do not apply to V5 Classic.

11.6 V5 Ultimate Service Credits. If Monthly Uptime for V5 Ultimate Cloud or Private Cloud falls below 99.9% in a calendar month, Customer may receive a credit against the next invoice for that deployment of: 10% of one month's fees for that deployment where uptime is below 99.9%; 25% where below 99.0%; or 50% where below 95.0%. Only the highest applicable tier applies. Service credits are Customer's sole and exclusive remedy for failure to meet the uptime commitment.

11.7 Credit Request Process. Customer must request credits in writing within thirty (30) days after the end of the month in which the event occurred. Approved credits apply to future invoices and are not refundable.

11.8 SLA Reporting. Provider will make reasonable SLA performance information available on request, including uptime and material incident summaries.

11.9 SLA Applicability. Uptime, backup, RPO and RTO commitments apply only to the Provider Hosted Services named in the applicable Part. They do not apply to On-Premises or customer-operated infrastructure, trials, sandboxes unless stated in the Order, or Presales Services.

11.10 Exclusions. SLA commitments do not apply to downtime or issues caused by Customer's actions, configuration or environment, third-party identity-provider or network failures beyond Provider's control, scheduled maintenance, Customer-scheduled upgrade windows, suspension under §6.7, or Force Majeure events.

11.11 SLA Review and Adjustment. SLA metrics may be adjusted only by mutual written agreement of the Parties, including following any annual review; neither Party may adjust them unilaterally.

11.12 Retirement of Legacy Support Tiers. From the date this MSA applies to Customer under §1.1 and §18.11, the former Silver, Gold, Platinum and Diamond support tiers are retired and replaced by the severity-based support framework in this Section 11. Existing Customers on those tiers move to the applicable current framework without a support-tier conversion fee. Severity, initial response targets, support hours and any remedies are determined by this Section 11 and the product and deployment ordered, not by the former tier name. This transition does not by itself change agreed subscription fees, Seat entitlements or Grandfathered Subscription Terms for pricing, and confers no upgrade to, or migration into, V5 Ultimate (§4.8). For V5 Classic and V5 Ultimate On-Premises, only the on-premises software-support provisions apply; hosted uptime, backup, recovery and service-credit commitments apply only to V5 Ultimate Provider Hosted Services. A specifically negotiated written support commitment continues only to the extent expressly retained under §1.4; a legacy tier name alone creates no additional entitlement after transition. Where an existing signed contract requires signed amendments, it continues on its terms until a valid transition under §18.11(e).

12.1 Confidentiality. Each Party protects the other's Confidential Information with at least reasonable care and uses it only to perform or exercise rights under this MSA.

12.2 Compelled Disclosure. If legally compelled to disclose, the receiving Party gives prompt notice (where permitted) and cooperates to seek confidential treatment.

12.3 Customer Data Ownership. Customer retains all right, title and interest in Customer Data. Customer grants Provider a limited licence to process Customer Data solely to provide the Software and Services, including support, troubleshooting, security monitoring, compliance with this MSA and licence administration. Provider does not use Customer Data to train AI models.

12.4 DPA; Sub-processors. Provider processes personal data in Customer Data in accordance with the DPA and may use sub-processors under written agreements that protect Customer Data. The current list is at v5ultimate.com/legal/sub-processors. Provider will notify designated Customer contacts at least thirty (30) days before adding a new sub-processor, and Customer may object on reasonable grounds within that period. The DPA may provide greater rights. The Privacy Notice describes Provider's processing for information only.

12.5 Data Export. Provider will make commercially reasonable efforts to support export of Customer Data using the Software's standard supported export methods during the subscription and the retrieval window in §5.4. Standard exports preserve the association of records with their audit trail and electronic signature information to the extent the supported export format provides it; custom export formats require separate written agreement. Standard exports are not charged as migration services under §4.8.

12.6 Term. Confidentiality obligations survive for five (5) years after termination; Customer Data and trade secrets remain protected for as long as they qualify as Confidential Information under applicable law.

13.1 Provider IP. Provider retains all right, title and interest in the Software, Provider Hosted Services, Documentation and related intellectual property. No rights are granted except as expressly stated.

13.2 Customer IP. Customer retains all right, title and interest in Customer Data and Customer-provided materials.

13.3 Feedback. Provider may use feedback without restriction, provided it does not publicly identify Customer as the source without consent.

14.1 Collection & Purposes. Provider processes Usage Data to operate, secure, support and improve the Software and Provider Hosted Services, troubleshoot, enforce licensing, and create Aggregated / De-identified Data that does not identify Customer or individuals.

14.2 Roles. For personal data in Customer Data, Provider acts as Customer's processor under the DPA. For Usage Data processed for the purposes above, Provider may act as an independent controller or business as applicable.

14.3 Controls. Essential telemetry (security, service delivery, licence enforcement) is always active. Non-essential analytics may be disabled by written notice; this may reduce proactive insights but does not affect service delivery or licence enforcement.

14.4 Retention. Raw Usage Data is retained for no longer than thirteen (13) months unless required for security, audit or legal hold. Aggregated / De-identified outputs may be retained indefinitely.

14.5 On-Premises Deployments. Telemetry may require outbound connectivity; if blocked, certain analytics features may be unavailable, but licence enforcement mechanisms described in the Documentation continue to apply.

15.1 Mutual Authority. Each Party represents it has the legal power and authority to enter into this Agreement.

15.2 Services Warranty. Provider will perform Services in a professional and workmanlike manner consistent with generally accepted industry standards.

15.3 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS MSA, THE SOFTWARE AND SERVICES (INCLUDING AI FEATURE OUTPUT) ARE PROVIDED "AS IS" AND PROVIDER DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT, TO THE EXTENT PERMITTED BY LAW.

16.1 Provider IP Indemnity. Provider will defend Customer against any third-party claim alleging that the Software, as provided by Provider, infringes a U.S. patent, copyright or trademark (or, where the Provider is SG Traceability Systems Ltd, such rights under the laws of Ireland, the EU or the UK), and will indemnify Customer for settlements and finally awarded damages (including reasonable attorneys' fees), provided Customer (a) promptly notifies Provider, (b) allows Provider to control the defence and settlement, and (c) reasonably cooperates.

16.2 Mitigation. If infringement is alleged, Provider may (a) modify the Software to be non-infringing, (b) replace it with a non-infringing equivalent, or (c) terminate the affected subscription and refund prepaid unused subscription fees for the remainder of the term.

16.3 Exclusions. Provider has no obligation for claims arising from Customer Data, Customer modifications, combinations with third-party products not provided by Provider, or use outside the scope of this MSA.

16.4 Customer Indemnity. Customer will defend Provider against third-party claims arising from Customer Data or Customer's misuse of the Software in violation of this MSA, and indemnify Provider for settlements and finally awarded damages (including reasonable attorneys' fees), subject to the same notice, control and cooperation principles.

17.1 Total Liability. Provider's total liability under this Agreement shall not exceed the total fees paid by Customer under the applicable Order in the twelve (12) months preceding the claim.

17.2 Exclusions. Neither Party is liable for indirect, incidental, consequential, special or punitive damages (including lost profits), except to the extent arising from gross negligence, wilful misconduct or breach of confidentiality obligations.

17.3 Mandatory Law. Nothing in this Agreement limits or excludes liability that cannot be limited or excluded under applicable law, including liability for fraud or for death or personal injury caused by negligence.

18.1 Governing Law. Where the Provider is S.G. Systems, LLC, this Agreement is governed by the laws of the State of Texas, without regard to conflict of laws principles. Where the Provider is SG Traceability Systems Ltd, this Agreement is governed by the laws of Ireland. The UN Convention on Contracts for the International Sale of Goods does not apply.

18.2 Dispute Resolution. Where the Provider is S.G. Systems, LLC, disputes shall be resolved through mediation, followed by arbitration if necessary, in Dallas, Texas. Where the Provider is SG Traceability Systems Ltd, the courts of Dublin, Ireland have exclusive jurisdiction. Either Party may seek injunctive relief for unauthorised use of its intellectual property or breach of confidentiality.

18.3 Entire Agreement. This MSA, with the Orders, DPA, any signed SQA and incorporated addenda expressly agreed under §1.4, constitutes the entire agreement and supersedes prior agreements or understandings on its subject matter for the Orders it governs. The legacy On-Premises Licence Addendum (June 6, 2026) is not incorporated into this version; it applies only to an existing accepted contract that expressly incorporated that version. Any deviation for a V1.24 Order must be expressly agreed under §1.4.

18.4 Independent Contractors. The Parties are independent contractors; nothing creates a partnership, joint venture or agency.

18.5 Assignment. Neither Party may assign this Agreement without the other's prior written consent, except to an affiliate or in a merger, acquisition or sale of substantially all assets where the assignee agrees in writing to be bound.

18.6 Force Majeure. Neither Party is liable for failure or delay caused by events beyond its reasonable control, including natural disasters, labour disputes, war, terrorism, government action or widespread internet outages.

18.7 Severability; Waiver. If any provision is unenforceable, the rest remains in effect. Failure to enforce is not a waiver.

18.8 Notices. Notices must be in writing to the addresses in the applicable Order, or to S.G. Systems, LLC at 6944 Meadowbriar Lane, Dallas, TX 75230, USA, or to SG Traceability Systems Ltd at its registered office stated in the Order, with a copy to info@sgsystemsglobal.com. Formal notices of breach, termination, suspension or indemnity claims sent by email are effective only if acknowledged by the receiving Party. Update, price and renewal notices under §5.5 and §18.11 may be sent by email to Customer's designated contact without acknowledgement; Provider retains evidence of dispatch and delivery, and a message that is returned undelivered is not notice until re-sent to a valid address. Customer must keep its designated contact current.

18.9 Amendments. Amendments must be in writing and signed by both Parties, except (a) accepted Billing Portal transactions within §6.3(d), and (b) acceptance of this MSA, or of an updated version, by signed or electronic Order, checkout or payment as provided in §1.1 and §18.11. Separately negotiated amendments remain subject to their own amendment terms and to §1.4.

18.10 Billing Portal and Self-Service Changes. Where Provider enables a Billing Portal, Customer actions taken through it (payment, renewal, Seat changes, billing-frequency changes and other accepted commercial changes) are deemed authorised by Customer and form part of the applicable commercial record for the affected subscription.

18.11 Updates and Acceptance by Payment. (a) Prospective updates. Provider may update the published MSA prospectively; the version identifier and change log are maintained for document control. (b) Notice. Before payment, Provider will give Customer's designated contact written notice of any material change, with an accessible link and the effective date. For annual renewals, that notice is given at least sixty (60) days before the renewal date and before the non-renewal deadline in §5.2. (c) Acceptance by renewal payment. Payment of the renewal invoice following that notice accepts the notified MSA for the renewed term, without separate signature. A later materially changed revision requires fresh notice; payment never accepts terms that were not notified. (d) Existing terms. Ordinary payment of an instalment or invoice already due under an existing committed term, or an automated debit alone, does not establish assent to changed terms. A mid-term change applies only if separately offered with clear notice and affirmatively accepted, which may include payment expressly offered as acceptance of that change. (e) Protected terms. Updates do not retroactively remove accrued rights, and do not override separately negotiated amendments, a DPA or an SQA, which keep their precedence under §1.4. Where an existing signed contract requires amendments to be signed, it continues on its terms until a valid transition under that contract, such as acceptance at renewal in accordance with its terms; publication on the website does not by itself amend it.