Wiiisdom General Terms
and Conditions

Last modified: October 2026

Wiiisdom and Customer shall herein be referred to each as a “Party” and collectively as the “Parties”. In consideration of the mutual promises and covenants contained in the Agreement, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

1. Definitions

1.1 Affiliates means any corporation, partnership or other entity now existing or hereafter organized that directly or indirectly controls, is controlled by or under common control with a Party. For purposes of this definition “control” means the direct possession of a majority of the outstanding voting securities of an entity.

1.2 Authorized Reseller means any third-party reseller, distributor or channel partner that has been authorized by Wiiisdom to resell the Services to Customer.

1.3 Confidential Information has the meaning given to it in Section 4.1.

1.4 Customer means the person or entity that enters into a Quote, or similar ordering document with Wiiisdom.

1.5 Customer Data means all Data made available by the Customer or its Users to Wiiisdom or otherwise provided by Customer or its Users in connection with the provision of the Services.

1.6 Customer Systems means servers, systems, platforms, networks, applications, databases, mobile devices or other endpoints that are owned, operated or managed by, or on behalf, of the Customer, excluding the SaaS infrastructure operated by Wiiisdom under a Cloud Subscription.

1.7 Data means text, information, images, documents, materials, photos, audio, video, and all other forms of data or communication.

1.8 Documentation means the documentation for the Subscription Service generally supplied by Wiiisdom to assist its customers in the use of the Subscription Service, including user and system administrator guides and manuals and other written materials.

1.9 Wiiisdom Data means all Data made available by Wiiisdom to Customer in connection with the Customer’s use or performance of the Services.

1.10 Losses has the meaning given to it in Section 9.1.

1.11 Quote means each quotation, order form or similar ordering document signed or otherwise accepted by Customer, which identifies the specific Services ordered by Customer, sets forth the prices for such Services.

1.12 Professional Services means consulting or training services (excluding technical support) and any deliverables, as applicable, provided to Customer by Wiiisdom as described under Section 2.6. below.

1.13 Services means the Subscription Service provided by Wiiisdom pursuant to Section 2.1 hereof, the technical support pursuant to Section 2.5, and/or Professional Services as defined above.

1.14 Subscription Service means Wiiisdom’s proprietary subscription-based software solutions known as Wiiisdom Cloud Platform or 360Suite and any other Wiiisdom software product identified in the Quote and further described on the applicable Quote including all related technical support. Subscription Services are provided by Wiiisdom, as described in the Quote, either on a SAAS basis (meaning the software is hosted or a cloud-based product, including any related software provided by Wiiisdom to access or use the product from the Customer Systems) or an On-Premises basis (meaning the software is installed and run on the Customer Systems).

1.15 Users mean individuals who are authorized by the Customer to use the Services subject to the terms of section 2.2 below, and, with respect to the Subscription Service, who have been supplied passwords by the Customer (or by Wiiisdom at the Customer’s request). Users consist of any employee of the Customer or its Affiliates and any independent contractor of the Customer or its Affiliates.

2. Services

2.1 Services. Wiiisdom shall provide the Customer with the specific Services specified on a Quote. In the event of a conflict between the terms set forth in a Quote and this Agreement, the terms set forth in this Agreement will control, unless a Quote makes specific reference to the section of this Agreement that is to be amended in the Quote. The Customer agrees that purchases hereunder are neither contingent on the delivery of any future functionality or features nor dependent on any oral or written comments made by Wiiisdom regarding future functionality or features.

2.2 License Grant. Subject to the terms and conditions of this Agreement, and in consideration for the payment of fees set forth on the applicable Quote, Wiiisdom hereby grants to the Customer, solely during the term of the applicable Quote, a non-exclusive, non-transferable (except as set forth in Section 10.2) license to access and use the Subscription Service solely for the Customer’s internal business purposes. This license is restricted to use by Customer and its Users and does not include the right to use the Subscription Service on behalf of any third party. The Customer is responsible for procuring and maintaining the environment on which the Customer will install and use or from which it will access the Subscription Service. Subject to the terms of Section 8.3, the Customer agrees: (a) that only authorized Users are permitted to use the Subscription Service; (b) that it is responsible for authorized Users’ actions or failures to act in connection with activities contemplated under this Agreement and (c) to otherwise take all commercially reasonable steps to protect the Subscription Service and the Documentation from unauthorized use and/or access.

2.3 Licensed Volume. The Customer acknowledges that access to and use of the Subscription Service is licensed subject to the applicable licensing metrics set forth in the applicable Quote, which may include the number of Users and on the applicable license type (Enterprise or Professional) as set forth on the applicable Quote and/or the size of the Customer’s underlying BI platform license pool (the “Volume Limitations”). In the event that the Subscription Service is used in excess of the Volume Limitations, the Customer shall promptly notify Wiiisdom or its Authorized Reseller, as applicable, and additional fees shall apply in accordance with the provisions of Section 3.1. For the avoidance of doubt, where licenses are granted on an authorized User basis, each license is assigned to a uniquely identified individual User. A license may be reassigned to another User over time, provided that such reassignment is not made so frequently as to enable the sharing of a single license between multiple Users. The total number of Users who can use the Subscription Service shall not exceed the number of licenses purchased, unless otherwise agreed in a modified Quote.

2.4 Affiliates. Subject to the terms of the Quote, the Customer may make the Subscription Service available to its Affiliates provided that all licensing restrictions are complied with in each instance by each such Affiliate and that the Customer shall be liable for any breach of the terms and conditions of this Agreement by any of its Affiliates. Any license restrictions set forth on a Quote shall be deemed to apply to both the Customer and its Affiliates. By way of example, if a Quote limits use of the Subscription Service to twenty (20) Users, then the use by the Customer and its Affiliates, when aggregated together, shall not exceed a total of twenty (20) Users.

2.5 Technical Support. As part of the Subscription Service, or a standalone basis as described in the Quote, Wiiisdom shall provide technical support services to Customer in accordance with the additional terms on Appendix A attached hereto. For On-premise Subscription Services, Customer shall be solely responsible for keeping the Customer Systems in an operating state that makes them able to be upgraded and, where applicable, for installing updates, patches and new versions and for backing up Subscription Services and any related data, including Customer Data.

2.6 Professional Services. Customer may purchase Professional Services as described in applicable Quote and/or Statement of Work in accordance with the Wiiisdom Professional Services Terms attached as Appendix B.

2.7 Open-Source Software. A list of open-source software made available under the Subscription Service may be provided by Wiiisdom upon written request. Open-source software is licensed to Customer under its own license terms and those terms apply to the use of the Open-Source Software. In the event of a conflict, the open-source software license terms supersede these Terms and Conditions solely with respect to that open-source software.

2.8 Beta Services. Certain functionalities of the Subscription Service may be provided under a beta form (“Beta Subscription”). Under such Beta Subscription, Customer may only operate the functionalities designated as “Beta” in the Documentation for internal testing and evaluation purposes only and not for business purposes. Customer understands that the Beta functionalities provided under a Beta Subscription have been limited in some way through restricted use. With respect to such Beta Subscription, the Beta functionalities are provided “AS IS” and “WITH ALL FAULTS”, without any support, maintenance or warranty from or liability for Wiiisdom. Customer’s use of the Beta or Preview functionalities is at Customer’s sole risk. It shall use caution and not rely in any way on the correct operation or performance of the Beta functionalities. Wiiisdom may delete or modify a Beta or Preview functionality or terminate a Beta License at any time for convenience without notice to Customer. If Customer provides feedback to Wiiisdom, Customer agrees that Wiiisdom may use such feedback and incorporate the feedback into its products without restriction, compensation or other obligation to Customer.

2.9 Evaluation Subscription. The Subscription Service may be provided to Customer on a proof-of-concept (“PoC”), proof-of-value (“PoV”), trial or other evaluation basis (an “Evaluation Subscription”). Under an Evaluation Subscription, Customer may only use the Subscription Service for internal testing and evaluation purposes and not for production or other business purposes. The Evaluation Subscription shall be provided for the limited period and scope agreed between the parties and shall automatically terminate upon expiry of such period. Unless otherwise agreed in writing, the Subscription Service provided under an Evaluation Subscription is provided “AS IS” and “AS AVAILABLE”, without any support, maintenance, service level commitment or warranty from Wiiisdom. Customer’s use of the Evaluation Subscription is at its sole risk. Wiiisdom may suspend or terminate an Evaluation Subscription at any time for convenience upon notice to Customer.

2.10 Artificial Intelligence Features. Certain features of the Subscription Services may use artificial intelligence technologies, including to generate responses or other content based on Customer inputs. Customer acknowledges that AI-generated outputs may be inaccurate, incomplete or inappropriate and shall remain responsible for reviewing and validating such outputs before relying on or using them. Customer shall not submit any data or content through AI features that it is not authorized to use or disclose. Wiiisdom does not use Customer Data submitted through AI features to train third-party artificial intelligence models, unless expressly agreed otherwise with Customer.

7. Term

7.1 Term. This Agreement will continue in effect until otherwise terminated in accordance with Section 7.3 below. The term for the Service shall be set forth on the Quote. The Agreement shall then automatically renew for successive one (1) year periods at the same metrics and/or quantities of the expiring term, unless otherwise stated in a modified Quote or where either Party sends notice of non-renewal or of downgrade at least 60 (sixty) days prior to the end of the current Term. Wiiisdom reserves the right to change the rates, applicable charges and usage policies and to introduce new charges, for such renewal upon providing the Customer with written notice thereof (which notice may be provided by e-mail) at least 90 (ninety) days prior to the then current renewal date of the Quote. Wiiisdom reserves the right to modify these general terms and conditions, including its Appendices, by posting new general terms and conditions online. Any such new general terms and conditions shall apply to any new Quote entered into after their effective date and, for existing subscriptions, as from the next renewal thereof.

7.2 Suspension. Wiiisdom may suspend or terminate access to Services if (i) Customer has failed to pay fees, or (ii) Customer has disrupted or interfered with the security, integrity or availability of the Subscription Services.

7.3 Termination. Notwithstanding the foregoing, either Party may terminate this Agreement (i) immediately in the event of a material breach of this Agreement by the other Party that is not cured within thirty (30) days of written notice from the other Party, or (ii) immediately if the other Party ceases doing business or is the subject of a voluntary or involuntary bankruptcy, insolvency or similar proceeding, subject to mandatory applicable law. All rights and obligations of the Parties which by their nature are reasonably intended to survive such termination or expiration will survive termination or expiration of this Agreement.

7.4 Effect of Termination. Upon any termination or expiration of this Agreement, Wiiisdom shall no longer provide the applicable Services to the Customer and the Customer shall promptly cease and cause its Users to promptly cease using the Services. Customer shall pay Wiiisdom for all fees that had accrued prior to the termination date and any unpaid fees under the Quote will immediately become due and payable upon termination. Except as expressly provided herein, termination of this Agreement by either party will be a nonexclusive remedy for breach and will be without prejudice to any other right or remedy of such party. Upon termination of this Agreement, each party shall promptly return or destroy all Confidential Information of the other party in its possession.

8. Ownership; Use of data; Customer Obligations

8.1 Services. The Customer acknowledges and agrees that as between Wiiisdom and the Customer, all right, title and interest in and to the Services (excluding any Customer Data) and including all modifications and configurations, all Wiiisdom Data, all Professional Services deliverables and all of Wiiisdom’s proprietary technology, including, without limitation, all software, products, processes, algorithms, user interfaces, know-how, techniques, designs and other tangible or intangible technical material or information made available to the Customer by Wiiisdom in providing the Services and all derivatives thereof are and shall remain Wiiisdom’s or its licensors’. The Wiiisdom name, all Wiiisdom logos, and the product names associated with the Services are trademarks of Wiiisdom or third parties, and no right or license is granted to use them. The Customer shall not remove any Wiiisdom’s trademark or logo from the Services. During the term of this Agreement, Wiiisdom grants to the Customer a limited, worldwide, non-exclusive, non-transferable (except as set forth in Section 10.2), royalty-free right to use the Wiiisdom Data solely in connection with the Customer’s permitted use of the Services.

8.2 Customer Data. The Customer retains ownership of all right, title and interest in and to all Customer Data. During the term of this Agreement, the Customer hereby grants to Wiiisdom a limited, worldwide, non-exclusive, non-transferable (except as set forth in Section 10.2), royalty-free right to use, display, transmit, and distribute the Customer Data solely as necessary to provide the Services to the Customer. The Customer is solely responsible for all Customer Data, in particular the accuracy, integrity, quality or legality of collection or process of such Customer Data. Neither the Customer nor its Users shall use the Subscription Service to: (a) send, upload or otherwise transmit any Customer Data that is unlawful, threatening, abusive, harassing, tortious, defamatory, vulgar, obscene, libelous, invasive of another’s privacy, hateful, or racially, ethnically or otherwise objectionable; (b) upload or otherwise transmit, display or distribute any Customer Data that infringes any trademark, trade secret, copyright or other proprietary or intellectual property rights of any person; (c) upload or otherwise transmit any material that contains software viruses or any other computer code, files or programs designed to interrupt, destroy or limit the functionality of any computer software or hardware or telecommunications equipment; (d) interfere with or disrupt the integrity, the performance or the data in the Subscription Service or networks connected to the Subscription Service; or (e) violate any applicable law or regulation.

8.3 Customer Obligations. The Customer shall be solely responsible for the security of the environment on which it will use or from which it will access the Services, and, as applicable, for data backups, system, network, and security infrastructure provisioning, configuration, troubleshooting and meeting the minimum system requirements specified in the Documentation. The Customer is responsible for all activities conducted under its User logins and for its Users’ compliance with this Agreement. Unauthorized use, the attempt to gain unauthorized access to or circumvent any technical limitations, resale or commercial exploitation of the Services in any way is expressly prohibited. Without Wiiisdom’s express prior written consent in each instance, the Customer shall not (and shall not allow any third party to): reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code form or structure of the Services or access the Services in order to build a competitive product or service or copy any ideas, features, functions or graphics of the Services. An exception is made to the prohibition to reverse engineering to the extent permitted by mandatory applicable law and where such action is required to obtain the information necessary to achieve the interoperability of the Services with any software for a use meeting the terms of its Documentation and its purpose. Such action may only be undertaken by Customer if such information is not readily available and if Wiiisdom has received a written request to provide the information and has substantially failed to provide it within a reasonable period of time. Customer shall observe a strict obligation of confidentiality with respect to such information. Except as expressly permitted in this Agreement, the Customer shall not copy (except for back-up purposes), license, sell, transfer, make available, audit, benchmark, lease, time-share, distribute, or assign this license, the Services to any third-party. The Customer shall be liable for any breach of this Agreement by any of its Users. In addition to Wiiisdom’s other remedies hereunder, Wiiisdom reserves the right upon notice to the Customer to terminate any User’s right to access the Services if such User has violated any of the restrictions contained in this Agreement.

Wiiisdom may, upon ten (10) days’ prior written notice, and no more than once per year, except in case of reasonable suspicion of breach, audit Customer’s use of the Subscription Service to verify compliance with license conditions, and in particular the Volume Limitations. If an audit reveals use in excess of the Volume Limitations, Customer shall pay the corresponding additional fees as set forth under Section 3.1 above and, in case of material breach or if the excess exceeds five percent (5%), reimburse the reasonable cost of the audit.

8.4 Usage Data analysis. Wiiisdom may collect, process and use non-personal data generated through Customer’s use of the Services, including configuration metadata, technical logs, telemetry and usage patterns (“Usage Data”), for the purposes of operating, maintaining, supporting and improving the Services, measuring and analyzing their use, and developing new products or services, whether by Wiiisdom, by third parties acting on its behalf, or in collaboration with other parties. Usage Data expressly excludes Customer’s business data, including any data analyzed or processed through WCP. Wiiisdom may aggregate Usage Data with other data and create derived data, statistics, analyses, benchmarks or algorithms for any lawful purpose, including making such aggregated or derived information available to third parties, provided that such information is subject to appropriate anonymization and aggregation measures and does not enable any third party to identify Customer or its Users, identify any specific data transmitted by Customer, or re-identify, reconstruct or otherwise derive such specific data. Where expressly provided in the applicable Quote and where justified by regulatory constraints, Customer may opt out of Wiiisdom’s use of its Usage Data for product development, benchmarking or other secondary purposes, without affecting Wiiisdom’s right to process such data to the extent necessary to provide, secure, maintain and support the Services or comply with applicable law.

9. Indemnification

9.1 Wiiisdom Indemnification. Subject to Section 9.3 below, Wiiisdom will indemnify, defend and hold the Customer and its Affiliates harmless from and against any and all costs, liabilities, losses, and expenses (including, but not limited to, reasonable attorneys’ fees) (collectively, “Losses”) incurred arising out of or in connection with a claim, suit, action, or proceeding brought by any third party against the Customer or any of its Affiliates alleging that the use of the Services as permitted hereunder infringes any patent, copyright or trademark, or constitutes a misappropriation of a trade secret of a third party. Excluded from the above indemnification obligations are claims to the extent arising from (a) use of the Services in violation of this Agreement or applicable law, (b) use of the Services after Wiiisdom notifies the Customer to discontinue use because of an infringement claim, (c) any claim relating to any third party products or services or Customer Data, (d) modifications to the Services made other than by Wiiisdom (where the claim would not have arisen but for such modification), (e) the combination, operation, or use of the Services with software or equipment which was not provided by Wiiisdom, to the extent that the Customer’s liability for such claim would have been avoided in the absence of such combination, operation, or use; or (f) compliance by Wiiisdom with the Customer’s custom requirements or specifications if and to the extent such compliance with the Customer’s custom requirements or specifications resulted in the infringement. If the Services are held to infringe, Wiiisdom will, at its own expense, in its sole discretion use commercially reasonable efforts either (a) to procure a license that will protect the Customer against such claim without cost to the Customer; (b) to replace the Services with non-infringing Services without loss of any material functionality or (c) if (a) and (b) are not commercially feasible, terminate the Agreement and refund to the Customer any prepaid unused fees paid to Wiiisdom for the infringing Services. The rights and remedies granted to the Customer under this Section 9.1 state Wiiisdom’s entire liability, and the Customer’s exclusive remedy, with respect to any claim of infringement of the intellectual property rights of a third party, whether arising under statutory or common law or otherwise.

9.2 Customer Indemnification. Subject to Section 9.3 below, the Customer shall indemnify, defend, and hold Wiiisdom and its Affiliates harmless from and against any and all Losses resulting from a claim, suit, action, or proceeding brought by any third party against Wiiisdom or any of its Affiliates that arises out of or results from a claim alleging that the Customer Data, or any use thereof, infringes the intellectual property rights or proprietary rights of others, personal data protection rights or has caused harm to a third party.

9.3 Indemnification Procedure. The indemnified Party shall (i) promptly notify the indemnifying Party in writing of any claim, suit or proceeding for which indemnity is claimed, provided that failure to so notify will not remove the indemnifying Party’s obligation except to the extent it is prejudiced thereby, and (ii) allow the indemnifying Party to solely control the defense of any claim, suit or proceeding and all negotiations for settlement; provided that the indemnifying Party shall not settle any claim without the indemnified Party’s prior written consent (such consent not to be unreasonably withheld or delayed). The indemnified Party shall also provide the indemnifying Party with reasonable cooperation and assistance in defending such claim (at the indemnifying Party’s cost).

APPRENDIX C

DATA PROCESSING AGREEMENT

This appendix applies to data processing carried out by Wiiisdom on behalf of the Customer for the performance of the Services (the “DPA”). It supplements the Wiiisdom General Terms and Conditions which apply and this appendix supersedes any conflicting terms in connection with such data processing.

For the purposes of such processing, the Customer acts as the Controller and WIIISDOM acts as the Processor (or the “Subcontractor”), within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”).

This DPA will apply to their sub-processing relationship and, where applicable, to any subsequent sub-processing.

As part of their contractual relations, the Parties shall undertake to comply with every applicable regulation on Personal Data processing and, in particular, the GDPR, in order to guarantee the Data Subjects and the Controller the security, availability, confidentiality and protection provided for therein.

1. Definitions

The capitalized words in the DPA shall have the meaning set forth by the GDPR or set forth in the General Terms and Conditions or as specifically defined in this DPA. If a definition is contradictory between applicable law and the meaning set forth in this Agreement, the meaning of applicable law shall prevail.

“Personal Data” means any information relating to an identified or identifiable natural person (Data Subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Data Subject” means the identified or identifiable natural person to whom Personal Data relates.

“Special Categories of Personal Data” means Personal Data falling within Article 9(1) GDPR, namely Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person’s sex life or sexual orientation.

“Exportable Data” means Customer Data, including any input and output data, and any metadata which is directly or indirectly generated by the Customer’s use of the SaaS Subscription Services, excluding any WIIISDOM’s trade secrets or intellectual property assets.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.

For the purposes of this DPA, particularly in the context of software offerings deployed on the Customer’s infrastructure (‘On-Premise’), the term ”Connected Services” means the optional features integrated into the Subscription Service that require data transmission to WIIISDOM’s cloud infrastructure or that of its sub-processors for their execution (including, but not limited to, artificial intelligence-based support agents). The Parties agree that the status of Sub-Processor applies specifically to the processing of Personal Data carried out when using these Connected Services, regardless of the main hosting mode of the Subscription Service.

4. Data availability and Switching rights

4.1 Access and retrieval. Customer may, free of charge, access, export, and delete Exportable Data in a comprehensive, structured, commonly used and machine-readable format.
Following the end of the switching period, Customer shall have thirty (30) calendar days to retrieve its Exportable Data (the “Retrieval Period”).

This section 4 applies solely to Subscription Services provided on a SaaS basis on the Wiiisdom cloud platform and only where the Data Act applies. It does not apply to On-Premise deployments, nor to any private cloud environment operated by or on behalf of the Customer, which fall outside the scope of Chapter VI of the Data Act.

At the end of this Retrieval Period or completion of the switching process as per section 4.2 below, Customer acknowledges that WIIISDOM shall erase all Exportable Data, except for Exportable Data retained temporarily by WIIISDOM under its standard back-up procedures and as required by applicable law.

4.2. Switching. Where eligible under the Data Act or Loi SREN, Customer may exercise its right to switch by giving WIIISDOM at least two (2) months’ notice of its wish to (i) initiate a switch to an alternative data processing editor covering similar service type, (ii) an on-premise infrastructure or (iii) erase Exportable Data.

The switching period will be 30 days, unless WIIISDOM determines that it is technically unfeasible depending on the Customer’s specific configuration, quantity of data, the switching destination, and other circumstances outside of WIIISDOM’s control; in which case, WIIISDOM will provide a fourteen (14) business days written notice from receipt of complete switching request by Customer specifying the appropriate switching period, which shall not exceed seven (7) months. Customer may also postpone the switching period end date, which must remain within the Subscription Services’ term under the Agreement, with one (1) month written notice in accordance with the Data Act or Loi SREN.

WIIISDOM will provide reasonable assistance for switching and will act with due care as set forth in the Agreement and in continuing to provide the Subscription Services and maintain high level of security during switching.

Customer shall be responsible for driving and managing the import and testing of implementation of Exportable Data in its own systems or those of an alternative provider and shall take all reasonable measures to achieve effective switching. Customer shall be liable for any acts or omissions of third parties engaged by Customer in relation to the switching process. In particular, Customer or third parties authorized by it, including any new service provider, undertakes to respect the intellectual property rights and confidentiality of any material provided during the switching process by WIIISDOM, as well as the latter’s trade secrets. Any disclosure of WIIISDOM’s Confidential Information to any third party shall be subject to WIIISDOM’s prior written agreement.

Customer’s rights under this Section shall not extend to any data or materials protected by intellectual property rights or trade secrets, or whose disclosure could compromise the security or integrity of the Services. Customer shall not circumvent any technical or security measures implemented by WIIISDOM to protect such data or the Services.

WIIISDOM may monitor or review the movement of data to verify Customer’s compliance with the present section and the Agreement. Until 12 January 2027, Customer shall bear direct switching costs incurred by WIIISDOM.

Customer shall be responsible for notifying WIIISDOM of the successful completion of the switching process within a period of maximum ninety (90) days of switching period end date, failing which successful completion shall be deemed.

Early Termination Charges. Where Customer terminates SaaS Subscription Service before the end of the applicable initial Subscription Term in accordance with a switching process under this Section, Customer shall pay Wiiisdom an early termination charge equal to (i) sixty percent (60%) of the Subscription fees that would otherwise have become payable until the end of such initial Subscription Term, plus (ii), until 12 January 2027, an amount equal to forty percent (40%) of the Subscription fees applicable during the switching period.

4.3. Required information. WIIISDOM will provide Customer with information regarding available procedures for switching and porting methods, structures and formats as well as restrictions and technical limitations, relevant standards and open interoperability specifications and its offer relating thereto.

4.4. Precedence. To the extent of conflict (i) between this section and the GDPR, the GDPR will prevail, or (ii) between this section and WIIISDOM’s right to terminate the Agreement for breach by Customer, WIIISDOM’s termination right will prevail.

8. General Provisions

All other clauses of the General Terms and Conditions not affected by this DPA remain applicable.

In the event that regulated standard clauses are adopted and are mandatory under applicable law, it is understood that the clauses of this DPA will be replaced by contrary or contradictory standard clauses.

Exhibit 2 – Standard Contractual Clauses

Annex to the COMMISSION IMPLEMENTING DECISION on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, hereinafter also referred as “SCCs”

ANNEX I to the SCCs

1/ If there are transfers of personal data to third countries in the course of the Agreement
Annex to the COMMISSION IMPLEMENTING DECISION on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, hereinafter also referred as “SCCs”
The following modules are to be taken into account, depending on the nature of the transfer in question.

• MODULE ONE: Transfer controller to controller
• MODULE TWO: Transfer controller to processor
• MODULE THREE: Transfer processor to processor
• MODULE FOUR: Transfer processor to controller

The Standard Contractual Clauses are executed with the following options and choices:

• Clause 7 – Optional: the Clause does not apply
• Clause 9 – Module TWO and MODULE THREE: OPTION 2, time period = 5 calendar days
• Clause 11 – ALL MODULES: Paragraph (a): The OPTION does not apply
• Clause 13 – ALL MODULES: The competent supervisory authority is the French one (CNIL)
• Clause 17 – Modules ONE, TWO, THREE: OPTION 1: Member State in the State of France.
• Clause 17 – Module FOUR: Member State is the State of France.
• Clause 18 – Module ONE, TWO, THREE – Paragraph (b): Member State is the State of France.
• Clause 18 – Module FOUR: Country is France.

2/ In case the sub processing is performed by Processor for a controller based in the UE

Annex to the Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council

• Clause 1: Option 1
• Clause 5 optional: the clause is executed
• Clause 7.7.a: Option 2, time period = 5 calendar days.
• Clause 8.c.4: Option 1
• Clause 9.1.c: Option 1
• Clause 9.2.c: Option 1

A – DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred
Categories of data subjects are specified in Exhibit 1 of the DPA.

Categories of personal data transferred
The personal data is described in Exhibit 1 of the DPA.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures
The data exporter might include sensitive personal data described Exhibit 1 of the DPA.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Personal Data is transferred on a continuous basis in accordance with Controller’s instructions and usage of the SaaS Services offered by Data Importer and used by Data Exporter.

Nature of the processing
The nature of the processing is described in Exhibit 1 of the DPA.

Purpose(s) of the data transfer and further processing
To provide the SaaS Services offered by Data Importer and used by Data Exporter and specified in the Agreement.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
By default: during the time the data exporter uses the services provided by the data importer.
Some other retention period(s) may be specified on a case-by-case basis.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
The subject matter, nature and duration of the processing are described in Exhibit 1. The duration of the processing by Data Importer’s sub-processors is the same as the duration of the processing by Data Importer.

The parties are those deemed by reference to the Quote.

B – COMPETENT SUPERVISORY AUTHORITY

MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
Identify the competent supervisory authority/ies in accordance with Clause 13
As specified in Exhibit 2 of this DPA

ANNEX II to the SCCs
TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

The measures listed below are applicable to on-premise deployments and/or SaaS applications. Where there is a difference between the two types of application, we identify the relevant case.

Description of the technical and organizational measures implemented by the data importer(s) and / or the data processor (including any relevant certifications if any) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons

The technical and organizational measures as well as the scope and the extent of the assistance required to respond to data subjects’ requests, are described in the DPA. Some more details are provided hereunder.

Certifications

Wiiisdom Cloud Platform is SOC2 Type II certified.

Unless otherwise stated, Wiiisdom does not guarantee to maintain its certifications beyond their initial validity period.

On premise deployments

On premise deployments are under the control of the Customer. Only support services provided by the Processor may process personal data on the behalf of the Customer

SaaS application

The SaaS application is deployed in single tenant mode. Meaning that each customer has its own dedicated infrastructure when it comes to computing. All resources for a tenant are isolated in a dedicated account and an isolated network. This means there can be no communication between two deployments of the application. These properties ensure that different environments cannot communicate with each other.

Each customer has his own storage service in his dedicated account. In other words, there is no pooling of storage services between different customers. The storage of data is done in 2 different ways:

• Relational Database storage
• Object (File) storage

As mentioned above, the relational database and object storage are specific to each tenant. Customer Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher). Encryption algorithms, key sizes and key management are defined in Wiiisdom’s Cryptography Policy, available to Customer upon request under confidentiality.

In production, only a limited number of Wiiisdom employees can access a tenant’s deployment.

For transfers to (sub-) processors, also describe the specific technical and organizational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter.

The technical and organizational measures that the data importer / Processor will impose on sub-processors are described in the DPA. Some more details are provided hereunder.

The protection of all the processing activities entrusted to sub-processors are assessed prior to the recruiting of said sub-processors. Regulatory obligations are assessed and verified, as are the relevant certifications of each sub-processor, data processing locations, audit rights granted to the Processor (and therefore to the Customer), etc.

For Saas applications and Connected Services

Customer Data processed through Wiiisdom Cloud Platform is hosted on Microsoft Azure, which is ISO 27001 and SOC 2 certified:

• https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-iso-27001
• https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-soc-2

To supervise the application, we use the Grafana Cloud service, which is ISO 27001 and SOC 2 certified (https://grafana.com/legal/security-compliance/).

In order to provide some of the Connected support Services, we use principally HubSpot, which is ISO 27001 and SOC-2 certified:

• https://trust.hubspot.com/

Measures of pseudonymization and encryption of personal data
All data in transit is encrypted, using modern ciphers. TLS 1.2+ is enforced with all transfers
All data at rest are encrypted, using modern ciphers (typically AES-256)
Personal data is pseudonymized as much as possible; for instance, every process made on data related to a natural person is actually referring to an internal identifier and not some data that can directly be used to identify the data subject.

To guarantee the security of data in transit, we rely on certificates provided by well-known certification authorities. All communications are carried out via HTTPS with the TLS 1.2+ algorithm.

For Saas applications

Customer Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher). Encryption algorithms, key sizes and key management are defined in Wiiisdom’s Cryptography Policy, available to Customer upon request under confidentiality.

When creating a tenant’s resources in our various cloud providers, we make sure to use a unique id to identify them. This property allows us to use an internal identifier so as not to have, for example, a direct link between the database and a client.

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services

• Customer Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher). Encryption algorithms, key sizes and key management are defined in Wiiisdom’s Cryptography Policy, available to Customer upon request under confidentiality.
• All access to personal data is nominative and traced
• All remote access intended for maintenance or configuration of systems allowing access to personal data is encrypted (notably SSH and VPN)
• All accounts allowing access to personal data are associated with access authorizations given on a need-to-know basis.
• Authorizations are revoked as soon as the corresponding need to know is no longer recognized.
• Accounts and authorizations are reviewed regularly (at least once a year)
• Internal penetration tests are carried out at least twice a year and external penetration tests at least once a year. Reports are drawn up including, where appropriate, corrective actions and recommendations. A follow-up of the actions to be carried out is implemented.
• Product code is subject to code reviews.
• In production, only a limited number of Wiiisdom employees can access the Customer’s deployment.

For Saas applications

All Wiiisdom’s processes are run on high-availability nodes including real-time replication and data integrity verifications.

The application is deployed in single tenant mode. Meaning that each customer has its own dedicated infrastructure when it comes to computing. All resources for a tenant are isolated in a dedicated account and an isolated network. This means there can be no communication between two deployments of the application. These properties ensure that different environments cannot communicate with each other.

Each customer has his own storage service in his dedicated account. In other words, there is no pooling of storage services between different customers. The storage of data is done in 2 different ways:

• Relational Database storage
• Object (File) storage

As mentioned above, the relational database and object storage are specific to each tenant. Customer Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher). Encryption algorithms, key sizes and key management are defined in Wiiisdom’s Cryptography Policy, available to Customer upon request under confidentiality.

To guarantee high availability, the application is architected in a distributed way. The application is based on microservices, enabling us to guarantee availability and integrity using stateless principles. If one of the application’s services fails, it is immediately replaced by a new instance. These services are restarted automatically to ensure availability and resilience.

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

• All storage under the Processor’s control is “high availability”.
• Availability probes are implemented in order to determine and alert in the event of unavailability of a component necessary for data processing.
• Backups are made regularly
• Procedures for restoring from backups have been developed and are regularly tested.
• Wiiisdom has elaborated a business continuity and disaster recovery plan that is tested regularly.

For Saas applications
All data is hosted on multi-redundant storage with high availability capabilities. Databases are backed up regularly. Disaster Recovery and Business Continuity Plans have been elaborated and are regularly tested and revised

The data is hosted on managed services that allow us to guarantee its replication on different availability zones to ensure high availability and redundancy. Databases and storage accounts can be restored to any point in time within the last seven (7) days, and database backups are also stored in a second Azure region. Backup restoration and disaster recovery tests are carried out at least twice a year.

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processing

• Procedures for restoring from backups have been developed and are regularly tested.
• Code analyzes are carried out
• Security analysis is performed regularly, including vulnerability and penetrability tests. Their findings are reviewed and corrective actions are scheduled if need be.
• Business continuity and disaster recovery plans are tested and reviewed regularly

As part of our development process, we carry out code reviews to ensure an appropriate level of security. During these reviews, various tests are performed, such as Static Application Security Testing (SAST). This type of test reveals vulnerabilities directly on our code base. We also carry out Dynamic Application Security Testing (DAST) to consolidate new developments. Finally, during these code reviews, several developers re-read their collaborator’s code to limit risk.

Our applications use various third-party dependencies. To guarantee the absence of vulnerabilities in these third-party dependencies, we publish them in a tool that enables us to analyze the presence of vulnerabilities in these dependencies on a daily basis. For instance, the various containers representing each of our services are also scanned daily for vulnerabilities.

Finally, we use a last tool to automate the updating of our application components to speed up version upgrades.

Wiiisdom has elaborated a business continuity and disaster recovery plan that is tested regularly.

Measures for user identification and authorization

• All access to personal data is nominative and traced
• Administrative and IT access given to Wiiisdom’s personnel is based on the need-to-know criteria.
• All remote access intended for maintenance or configuration of systems allowing access to personal data is encrypted (notably ssh and VPN)
• All accounts allowing access to personal data come with authorizations given on a need-to-know basis.
• Generic or default accounts are inhibited
• Authorizations are reviewed regularly
• Accounts are created (respectively cancelled) as soon as they are needed (respectively not needed anymore)
• Strong password policy is enforced for users and Wiiisdom’s personnel who have access to Wiiisdom’s Services infrastructure.
• Some Wiiisdom services may support SSO using SAML v2 and OKTA so that its customers can rely on their own authentication services to access Wiiisdom services.

Measures for the protection of data during transmission
All data in transit is encrypted, using modern ciphers. TLS 1.2+ is enforced with all HTTP based transfers. All other transfers are using modern encryption when needed (IMAPS, SMTPS, FTPS, etc.)

To guarantee the security of data in transit, we rely on certificates provided by well-known certification authorities. All communications are carried out via HTTPS with the TLS 1.2+ algorithm.

Measures for the protection of data during storage

• Customer Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher). Encryption algorithms, key sizes and key management are defined in Wiiisdom’s Cryptography Policy, available to Customer upon request under confidentiality.
• All data at rest are encrypted, using modern ciphers (typically AES-256)
• The data of different customers is subject to logical, virtual or physical segregation.
• Logical segregation is generally based on mechanisms for associating data with the identifier of the customer for which they are processed, segregation at the database level or even the storage system.
• Virtual segregation is based on client-specific elements (virtual machines, databases, language model instances, etc.)
• Physical segregation is based on physical elements specific to each client
• All data is encrypted at rest with an AES-256-like encryption algorithm
• Access to files containing data, including backup files, is protected and reserved for accounts assigned to people or components with a need to know.

For Saas applications
Customer Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher). Encryption algorithms, key sizes and key management are defined in Wiiisdom’s Cryptography Policy, available to Customer upon request under confidentiality.

Measures for ensuring physical security of locations at which personal data are processed
The data is processed within secure Data Centers operated by major players in the sector providing full guarantees in this area and certified according to one or more of the industry standard standards ISO 27001:2013, SOC 2 Type II, ISO 9001, etc.

Measures for ensuring events logging
All personal data processes are logged, all the actions of the users are logged. All logs are centralized and stored in secured storage. Access to logs is secured and monitored

For Saas applications
All access to our resources is tracked and logged by our cloud providers. Access to these logs is limited to a certain number of collaborators.

Measures for ensuring system configuration, including default configuration
All default credentials and accesses are disabled by default. In case a shared access is needed, the related credentials are changed so that they don’t use the default values

The application’s various secrets are specific to each environment. For each environment, we initially create a set of secrets that we supply at deployment time. There are no default secrets in the application.

Measures for internal IT and IT security governance and management
A Compliance Officer or some personnel with a similar role is in charge of everything related to personal data protection, including the reviewing of agreements with customers and contractors regarding everything that relates to personal data protection.
The technical team and the CTO in particular are professionals skilled in data security and protection.
Upper management is involved in data protection and the necessary resources and means are made available
The processes and measures in place that are aimed at data protection are documented and the documentation is regularly reviewed and updated.

Measures for ensuring data minimization
The categories and details of personal data that are processed are reviewed by the CTO, the Compliance Officer and the relevant personnel to ensure they are actually needed.

For Saas applications
The application does not process any personal data of its users but email, first name and last name.
Measures for ensuring limited personal data retention
Personal Data retention is limited to the minimum required to perform the provided services under the Agreement and this DPA.

Measures for ensuring accountability
The processes and measures in place that are aimed at data protection are documented and the documentation is regularly reviewed and updated.

Measures for allowing data portability and ensuring erasure
All data can be exported in standard format (SQL, CSV, etc.)
Data extraction procedures, based on a particular user or on the users of a particular customer, have been written and are regularly tested and updated if need be
Data deletion procedures, based on a particular user or on the users of a particular customer, have been written and are regularly tested and updated if need be.

The data for a tenant can be exported from the relational database and the storage of our objects.

In order to ensure the complete deletion of a tenant’s data, we delete the account used to guarantee the complete deletion of this data.

Measures for assisting the Controller
Provision of standard information that can be made available to data subjects concerned by the processing implemented by the Processor on behalf of the Data Controller
Provision of vulnerability and penetrability analysis reports
Implementation of contact and notification procedures, particularly in the event of a request to exercise the rights of data subjects or a data breach.
The Processor has designated a team of professionals in charge of providing assistance to the Controller, especially regarding the fulfilment of its obligations and in particular regarding audits, questionnaires, impact assessments, Data Subject rights, etc.

In particular, we use Vanta, a platform that automates compliance, streamline security reviews and manage risk and prove security in real time.

Additional measures and details
When it comes to offering technical support services, Processor will not process any personal data on the behalf of Controller, with the exception of the following data which may be processed by Processor:

• first name, surname, e-mail address and telephone number of Controller’s employees who use the software (for instance internal IT employees and external IT consultants), as well as purchasers and legal contacts
• where applicable, personal data processed by Controller and accessed by Processor as part of the services provided to Controller (in particular in the case of technical support requests requiring access to such data, and in the absence of the possibility of anonymizing said data, which will otherwise be anonymized, generally at the express request of Processor),
• any data provided by the Data Controller in connection with the use of support services, including AI agents. The AI agent implemented by HubSpot on behalf of the Processor responds only on the basis of the Processor’s public documents and resources and does not access any data of the Data Controller otherwise processed by the Processor.
• as well as, more generally, any data to which it is strictly necessary to access in order to render the services provided to Controller. In particular, this information will be processed by our subcontractor providing services for the supply of support systems “Zoho” (data processed in Quincy and Dallas USA) and “Microsoft 365” for storage and drive computing capacities (data processed in Europe and/or the USA depending on the Customer choice or location). We have carried out the necessary preliminary studies and, where necessary, established the appropriate contractual relationships to ensure that all such processing complies with the applicable regulations.

APPENDIX D
JURISDICTION-SPECIFIC TERMS

The Customer’s shipping or physical address (“Customer Location”) shall determine (i) the Wiiisdom entity entering into this Agreement, (ii) the address to which notices under this Agreement shall be sent, (iii) the governing law applicable to this Agreement and (iv) the courts having exclusive jurisdiction over any dispute arising out of or in connection with this Agreement, as set forth below.

If the Customer Location does not fall within any of the specific jurisdictions identified above, the Customer shall contract with Wiiisdom France SAS and French law and the competent courts of Lille, France shall apply.