Preamble

The company B4Purpose, develops and markets software, hereinafter referred to as “B4Purpose Tool" and services that enable the Client to implement and govern their compliance process with the General Data Protection Regulation (GDPR) and Law No. 78-17 of January 6, 1978.

B4Purpose Tool is marketed through the website b4purpose.fr. It features a user-friendly interface, suitable for associations, sole proprietorships, and any organization with fewer than 250 employees processing personal data subject to GDPR.

The list and description of services offered by B4Purpose can be found on the aforementioned website.

After becoming familiar with the features of B4Purpose Tool and/or the Services and ensuring its suitability for their needs, the Client has chosen to purchased to B4Purpose and avail Services under the conditions described in these General Service Conditions (hereinafter referred to as the "GSC"), the Subscription Offer, and the associated order form (hereinafter together referred to as the "Contract").

To frame reciprocal transactions and establish a framework of trust between B4Purpose and the Client, any signature of the order form, including the clause "I acknowledge having read and accept the attached General Service Conditions," implies the Client's unconditional adherence to these General Service Conditions.

These GSC are established in accordance with Article L. 441-1 of the French Commercial Code and prevail over any opposing purchasing conditions.

B4Purpose reserves the right to update the GSC. It is the user's responsibility to regularly review them. Continuing to use the Platform after receiving notification from B4Purpose is presumed to indicate the Client's unconditional acceptance of the new GSC.

I- Scope and Duration of the Contract

a. Scope of the Contract

The following GSC detail the rights and obligations of B4Purpose and the Client regarding the following services: General awareness of GDPR: This involves training teams on the issues of personal data protection and the risks associated with the Client's activities, aiming to enhance the trust of its employees and partners. This can be done through various means (in-person, video, documentation, etc.).

Purchase to B4Purpose Tool: It provides access to the B4Purpose Tool software and all modules included therein. It is recommended to use a generic company email address, not an email address containing the name and/or first name of a company member. Support: Optional service to assist the data protection officer (DPO) or designated representative in managing the compliance process.

II- The "B4Purpose Tool"

Platform Payment by the Client automatically grants access to the platform. Depending on the permitted subscription type, one or more users can access the platform. For multi-user, the first profile created is automatically considered an administrator with corresponding rights. The administrator can then authorize other users to access the Platform and configure their profiles (hereinafter referred to as "Users"). It is recommended to assign the role of administrator to the DPO or data protection representative. The features of the Platform are described in the associated order form, with B4Purpose retaining the exclusive right to add, delete, or modify these features at any time, as long as it does not substantially hinder the purpose of the Platform. Some of these enhancements may be optional for the Client and subject to additional charges or an increase in the subscription amount. The Client can separately order (i) the delivery or design of training materials for their teams; (ii) organizational or technical support services.

III- Right of Use

B4Purpose grants the Client a personal, non-transferable, non-exclusive right to use the B4Purpose Tool software for the Client's business purposes and for the duration of the Contract. The right of use is granted for the existing version of B4Purpose Tool at the date of subscription and for updates provided during its duration. This right of use is strictly limited to (i) Users and (ii) legal entities listed as beneficiaries in the order form or any other document. As a result, the Client and Users are prohibited from (i) any temporary or permanent reproduction of B4Purpose Tool, its screens, their sequence, the drafting and presentation of questionnaires that are not directly dictated by the text of the GDPR, with the exception of standard clauses and provisions offered for download; (ii) any dissemination, distribution, rental, commercialization, sublicensing, transfer, direct or indirect provision of the Platform for the benefit of a third party or the public, free of charge or for a fee; (iii) any modification, adaptation, or evolution of B4Purpose Tool; (iv) any unauthorized translation or adaptation not expressly authorized by B4Purpose; (v) any use of B4Purpose Tool for the development, production, or marketing of a derived software or a software whose purpose, function, or expression is substantially or formally similar to B4Purpose Tool, or for any other act that infringes on the rights of B4Purpose; (vi) any insertion of screens or intermediary devices that modify the authorized number of Users. However, for Clients acting on behalf of their own clients, especially as outsourced DPOs, they acquire the right to provide B4Purpose Tool to their clients for the purpose of their outsourced compliance missions.

IV- Contractual Obligations of B4Purpose

To ensure the proper execution of Services, the Parties commit to close, active, and regular collaboration under the Contract. They agree to share information and inform each other of any events or difficulties that may affect the process. B4Purpose undertakes, within the conditions and limits of the Contract, to perform the Services entrusted to it by the Client. Specifically, B4Purpose commits to:

• complete any deliverables specified in the Specific Conditions (hereinafter referred to as "Deliverables");
• provide advice to the Client, who is solely responsible for decisions made;
• define the organization of the Services, task sequencing and scheduling, allocation of resources for task completion, and choice of working methods;
• provide assistance to the client as part of the software subscription. To this end, a user guide detailing all software functionalities has been made available to the client.

V- Contractual Obligations of the Client

To enable B4Purpose to perform the Services according to the terms of the Contract, the Client undertakes to carry out the tasks and fulfill the obligations incumbent upon it under the Contract, including:

• Clearly and comprehensively express its needs, constraints, objectives, and business stakes for each Service assigned to B4Purpose;
• Provide B4Purpose with the information, documentation, means, and/or elements necessary to perform the Services;
• Mobilize the necessary resources for Service execution within deadlines compatible with the Service schedule;
• Ensure the cooperation of any third parties involved (external DPO, for example) in the project related to the Services;
• Perform the required validations within contractual deadlines;
• Use the software appropriately;
• Respect the software's usage scope.

VIII- Late Payment or Default

In case of late or partial payment at the due date, B4Purpose reserves the right to restrict or block access to the software interface and to suspend the provision of services to the client until full payment of the amounts due is received. No legal interest rate is provided in case of late payment for the services listed in these General Service Conditions.

IX- Termination

In the event of a breach by either Party of any obligations under the Contract, including (i) B4Purpose's persistent failure to provide a characteristic service for a consecutive period of at least forty-five (45) calendar days; (ii) the non-payment of any price or fee by the Client for a consecutive period of at least thirty (30) calendar days; or (iii) the Client's non-compliance with the conditions and limitations of use of the Platform, not remedied within a period of seven (7) calendar days from the notice of the breach, the other Party may terminate the Contract automatically, without prejudice to any damages that may be claimed under the "Liability" article. As an exception, B4Purpose reserves the right to immediately and automatically terminate the Contract without prior notice or compensation in the event that the Client or a User compromises the integrity of the Platform, B4Purpose's intellectual property rights, or the brand image of B4Purpose and B4Purpose Tool. In case of termination of the Contract due to the Client's breach, all amounts paid remain acquired by B4Purpose, which will invoice all remaining amounts due until the end of the Contract (or for the ongoing year if termination occurs after its initial renewal). In case of termination of the Contract due exclusively to B4Purpose's breach, B4Purpose will issue a credit note for any invoice corresponding to the remaining contractual period as of the effective termination date and retain the royalties received and/or due for the elapsed contractual period until the effective termination.

X- Ownership of B4Purpose Tool: Platform & Contents

B4Purpose retains exclusive ownership of pre-existing means, tools, inventions, connectors, methods, and know-how developed in the course of the subscription, whether or not they are subject to specific protection (copyright, patent, trademark, license, etc.), as well as any software edited or acquired by B4Purpose that is used within the scope of the subscription. B4Purpose Tool and its content (excluding Client Data) remain entirely and exclusively the property of B4Purpose (including its settings, features, screens, questionnaires, data dictionaries, legal content, and visual structure of pages and exports). B4Purpose Tool holds the sole rights to its trademarks and logos. These GCS do not transfer any intellectual property rights over B4Purpose Tool or its contents to the Client beyond the granted right of use. The Client undertakes to maintain intact any intellectual property notice appearing on the Platform and generally refrains from any act that could directly or indirectly harm the rights and image of B4Purpose and B4Purpose Tool. The Client takes all necessary measures to train, inform, and prevent Users from infringing the rights of B4Purpose and B4Purpose Tool.

XI- Client's Ownership: Client Data

All "Client Data" (files, content, contracts, mapping, logos, trademarks, register, personal data, or generally any documents of the Client inserted or incorporated into B4Purpose Tool) are deemed to belong to the Client and remain its property. The Client declares to hold the intellectual property rights associated with Client Data or to have obtained the necessary authorizations for their use and exploitation. As such, the Client grants B4Purpose the right to use this Client Data solely for the purposes of hosting and corrective and evolutionary maintenance of the Platform. The Client guarantees and indemnifies B4Purpose against any claims by third parties related to Client Data. The exclusive rights to documents generated through the B4Purpose Tool platform belong to the Client.

XII- Confidentiality

In the context of performing the above-mentioned services, B4Purpose and its clients will communicate and share technical, commercial, and confidential information and documents that are the property of each party. In this context, each Party undertakes to (i) keep all information received from the other Party confidential, (ii) not disclose the other Party's confidential information to any third party other than employees or agents who need to know; and (iii) use the other Party's confidential information only for the purpose of exercising its rights and fulfilling its obligations under the Contract. It is specified that the source codes of B4Purpose Tool, questionnaires, dictionaries, and Client Data constitute confidential information. Notwithstanding the foregoing, neither Party shall have any obligation with respect to information that (i) has become public knowledge independently of any fault on the part of the receiving Party; (ii) is developed independently by the receiving Party; (iii) was known to the receiving Party before the other Party disclosed it; (iv) is lawfully received from a third party not subject to a confidentiality obligation; or (v) must be disclosed under the law or a court order. The Parties' obligations with respect to confidential information shall remain in force for the duration of the Contract and after its termination, for as long as the relevant information remains confidential to the disclosing Party and, in any case, for a period of five (5) years after the end of the Contract.

XIII- Personal Data

The Parties undertake to comply with their respective obligations under the Regulation. In the context of the execution of the Contract, the Client acts as the data controller for personal data and B4Purpose acts as the data processor on behalf of the Client. As such, B4Purpose only processes personal data imported into B4Purpose Tool, including User data, of identified individuals in the platform ("Personal Data"), based on documented, general, or specific instructions from the Client, and for the sole purposes of hosting and corrective and evolutionary maintenance of the Platform. By exception, B4Purpose may be legally required to process Personal Data under applicable regulations. In such cases, B4Purpose will inform the Client of this obligation before processing, unless such information is prohibited by applicable law. As needed, Personal Data is stored and processed by B4Purpose (i) only during the subscription period, (ii) on secure servers located exclusively in France, (iii) for the aforementioned purposes only, and (iv) does not involve any transfer outside the French territory. Individuals whose Personal Data is imported into the Platform have rights of access, rectification, opposition, erasure, limitation, and portability, and can exercise these rights directly with the Client. It is the Client's responsibility to inform these individuals of the aforementioned purposes and that Personal Data is transmitted to B4Purpose as part of the subscription. Subcontracting B4Purpose engages EVERDATA for hosting the B4Purpose Tool platform. B4Purpose also engages Digital Unicorn for the development and continuous improvement of the B4Purpose Tool platform. In the event of the Client ordering additional services, B4Purpose may engage subcontractors who may access Personal Data ("Subcontractors"). B4Purpose undertakes to ensure compliance with the Regulation by these Subcontractors. In the event of adding or replacing a Subcontractor, B4Purpose will inform the Client by updating these General Service Conditions. Data Security B4Purpose implements appropriate technical and organizational measures to protect Personal Data and Client Data during the subscription period. At the end of the subscription period, at the Client's choice, B4Purpose either deletes or returns the Personal Data and Client Data. B4Purpose undertakes to destroy any existing copies of Personal Data and Client Data (subject to legal retention obligations). 3. Data Breach B4Purpose undertakes to inform the Client within 48 hours (working days) of any breach of the security of Personal Data and any violation of Personal Data processed as part of the subscription, and to collaborate with the Client in implementing remediation measures. B4Purpose undertakes to collaborate with the Client in conducting impact assessments, handling requests from data subjects, and in case of prior consultation with the CNIL (French Data Protection Authority) by a Client.

XIV- Limitation of Liability

The effectiveness of the Platform in terms of compliance with Regulation depends solely on the diligence of the Client and the Users' compliance with actions to achieve and maintain compliance. The Client is solely responsible for actions to be implemented (contractualization, security, governance, privacy by design, impact assessment, etc.) within its company, on its information system, with its partners, subcontractors, and employees. B4Purpose does not substitute for the Client in practices or decisions to be taken as part of its compliance. B4Purpose's liability cannot be engaged, directly or indirectly, in case of non-compliance by the Client with the Regulation, except for B4Purpose's fault as a data processor. B4Purpose declares and warrants that its Platform conforms to its description in the BDC. In the context of using B4Purpose Tool, B4Purpose's liability cannot be engaged in case of (i) unavailability, slowdown of access, or operation of the Platform due to internet limitations; (ii) contamination by viruses of Client Data and/or software due to causes unrelated to B4Purpose; (iii) introduction or attempted fraudulent or malicious access by third parties to the Client's Information System; (iv) possible diversion of passwords, confidential codes of the Client, and more generally, any sensitive information for the Client. B4Purpose holds an insurance policy covering the consequences of civil and professional liability that may be incumbent upon it under these conditions.

XV- Major Forces

B4Purpose's liability cannot be invoked if the non-performance or delay in the performance of any of its obligations described in these general terms and conditions results from a force majeure event. Force majeure includes any external, unpredictable, and irresistible event as defined in Article 1195 of the French Civil Code.

XVI- Applicable Law and Competent Court

Any dispute relating to the interpretation and execution of these terms and conditions is subject to French law. In the event of a dispute arising from these GCS, the parties must first attempt to resolve it amicably, including by using the services of a mediator. In the absence of an agreement, the dispute will be brought before the Commercial Court of Versailles. Last updated on April 4, 2022.