Fundel Business

CUSTOMER AGREEMENT FOR

FUNDEL BUSINESS

Sponsor Marketplace & Business Workspace

Supplier: Fundel AS · org. no. 929 699 580 · Ørvikeien 17, 3970 Langesund · fundel.no · kenneth@fundel.no

Customer: completed automatically from the information the Customer provides at electronic conclusion of the agreement in the portal.

PART A — DIGITAL AGREEMENT SUMMARY

This summary reproduces the main terms the Customer has accepted electronically in the Supplier's onboarding portal, and is an integral part of the Agreement. The order of precedence in the introduction to Part B applies in the event of conflict between the parts of the Agreement.

PARTIES

SELECTED PLAN AND PRICE (EXCL. VAT)

KICKBACK AND TRANSACTION MODEL

AGREEMENT PERIOD AND TERMINATION

Confirmation of acceptance

The Agreement is concluded when a person with authority to bind the Customer checks the checkboxes below in the portal. The complete terms are available via link and may be downloaded before acceptance. The Supplier records the time of acceptance, the accepted version and identifying information about the user who accepts, and sends a confirmation by email with a PDF of the accepted version.

☐ I confirm that I have authority to enter into this Agreement on behalf of the Customer.

☐ I have read and accept the Agreement's complete terms (Part B, Part C and Part D).

PART B — GENERAL TERMS AND CONDITIONS

In the event of conflict between the parts of the Agreement, Part A (Digital Agreement Summary) takes precedence over Part B (General Terms and Conditions), which takes precedence over Part C (Special Terms). In matters concerning the processing of personal data, Part D (the Data Processing Agreement) takes precedence over the other parts of the Agreement. Annexes rank below the part to which they are attached. The confirmation email and summary screen in the onboarding portal shall be read in accordance with Part A and do not amend the Agreement.

1 DEFINITIONS

In the Agreement the following terms have the meaning set out below. The definitions are listed in alphabetical order.

2 CONCLUSION OF AGREEMENT AND CREDIT ASSESSMENT

2.1 Conclusion of Agreement

The Agreement is concluded electronically when a person with authority to bind the Customer accepts the terms in the Supplier's onboarding portal by checking, cf. the Digital Agreement Summary in Part A. The Agreement is deemed concluded at the point in time when the acceptance is recorded in the portal. The Supplier records the time of acceptance, the accepted version of the terms and identifying information about the accepting user, and sends the Customer a confirmation by email with a PDF of the accepted version. The electronic acceptance has the same binding effect between the parties as a physical signature.

2.2 Reservation Regarding Credit Assessment

The Supplier reserves the right to carry out a credit assessment of the Customer before or in connection with the conclusion of the agreement. If the credit assessment gives reasonable grounds to do so, the Supplier may refuse conclusion of the Agreement, require advance payment or other satisfactory security, or set other reasonable payment terms. Acceptance recorded in the portal is not binding on the Supplier until any reservation under this provision has been resolved.

3 INTELLECTUAL PROPERTY RIGHTS

3.1 Supplier's Rights

All intellectual property rights to the Services, including but not limited to source code, design, user interfaces, databases, algorithms and conceptual solutions, belong to the Supplier and/or its licensors. Conclusion of the Agreement does not entail any transfer of intellectual property rights to the Customer.

The Customer is not entitled to reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Supplier's software. It is also not permitted to copy, distribute, sell, license or transfer access to all or part of the Services to third parties.

3.2 Customer's Right of Use

The Supplier grants the Customer a non-exclusive, non-transferable right of use to the Services during the Agreement Period, limited to the Customer's own business purposes in connection with the Fundel Sponsor Marketplace. The right of use is conditional upon the Customer at all times complying with the Agreement's provisions and paying the agreed remuneration.

3.3 Customer Content

The Customer retains all rights to its own content (text, images, logos, etc.) uploaded to the Business Workspace. The Customer grants the Supplier a royalty-free, non-exclusive licence to store, display, distribute and make available this content as part of the operation of the Fundel platform during the Agreement Period. The Customer warrants that uploaded content does not infringe third-party rights.

3.4 Third-Party Claims

If a third party brings a claim against the Customer that the Supplier's platform infringes such party's intellectual property rights for reasons exclusively related to the Supplier's core solution, the Supplier may at its own discretion either secure the Customer's continued right of use, modify the solution so that the infringement ceases, or terminate the Agreement against proportionate repayment of prepaid remuneration.

4 CONFIDENTIALITY

The parties undertake to treat all information about the other party's business, trade secrets, technical solutions, prices, customer lists and other information exchanged in connection with the Agreement as confidential. Such information shall not be made available to third parties without prior written consent from the other party, and shall not be used for purposes other than the fulfilment of the Agreement.

The confidentiality obligation does not apply to information that is generally known, information received from a third party without confidentiality restrictions, or information that must be disclosed pursuant to law or governmental order. The confidentiality obligation applies throughout the Agreement Period and for a further three (3) years after the termination of the Agreement.

5 CUSTOMER'S COOPERATION

The Customer is obliged to cooperate loyally to enable the Supplier to deliver the Services as agreed. This includes, among other things:

• ensuring that the Supplier at all times has correct and up-to-date contact information, including a valid email address for invoices and notifications;

• making necessary content (logo, descriptions, pricing information, contact details, etc.) available within a reasonable time after conclusion of the agreement;

• holding the Supplier harmless from losses and costs arising from the Customer having uploaded content in breach of Norwegian law or third-party rights;

• notifying the Supplier in writing without undue delay of changes in contact information, legal status or other matters of significance for the Agreement.

If the Customer fails to fulfil its cooperation obligation, and this results in a delay in delivery, the Supplier is nevertheless entitled to the agreed remuneration from the originally agreed delivery date.

6 SUBCONTRACTORS

The Supplier is entitled to use subcontractors in the delivery of the Services, including cloud services, payment infrastructure and technical operations services. The Supplier is fully responsible to the Customer for the subcontractors' performance in the same way as for its own performance.

When using subcontractors that process personal data, the Supplier ensures that these are subject to equivalent data protection requirements as those in the Data Processing Agreement (Part D).

7 PRICES AND PAYMENT TERMS

7.1 Prices

Current prices are set out in Part A (Digital Agreement Summary). All prices are stated exclusive of value added tax in Norwegian kroner (NOK).

Any additional services beyond what is set out in Part A must be agreed separately and in writing.

7.2 Price Adjustment

The Supplier may adjust the subscription price once per year in accordance with the change in the Consumer Price Index (CPI), published by Statistics Norway (SSB). The Customer is notified in writing of such CPI adjustment with at least 30 days' notice.

If the Supplier intends to make price changes beyond the CPI adjustment, the Supplier will notify the Customer in writing with at least 60 days' notice. The price change takes effect from the first billing period after the notice expires. If the Customer does not accept the price change, the Customer may terminate the Agreement with effect from the date on which the new price would otherwise have taken effect. The founder price under Part A is locked for the specified period and is not adjusted during the lock period.

7.3 Invoicing and Payment Terms

The ongoing subscription is invoiced in advance per billing period as specified in Part A. On quarterly or annual prepayment, a 15% discount is given on the subscription. The Supplier's share of kickback and lead/booking fees is invoiced monthly in arrears.

Invoices are sent to the Customer's registered invoice email address. The Customer is responsible for keeping the email address up to date. An invoice fee accrues in accordance with the Supplier's rates applicable from time to time.

Invoices fall due for payment 15 days from the invoice date. Payment is deemed completed when the amount is available in the Supplier's bank account.

7.4 Late Payment and Set-Off

In the event of late payment, default interest accrues in accordance with the Late Payment Interest Act (Act of 17 December 1976 no. 100), as well as any reminder fees and debt collection charges. Accrued interest is added to the principal at each year end.

The Customer may not withhold payment or make set-off against the Supplier's claim on the basis of its own counterclaims. The limitation in the preceding sentence does not, however, prevent the Customer from setting off counterclaims that are clear and due, and that have either been acknowledged by the Supplier or established by a final judgment or other enforceable decision.

8 SUPPLIER'S BREACH

8.1 Breach

There is a breach on the part of the Supplier if the Services are not delivered in accordance with the Agreement, and this is not due to circumstances on the Customer's part or force majeure (cf. clause 10).

8.2 Notice and Complaint

If the Supplier foresees that the Services cannot be delivered as agreed, the Customer shall be notified in writing without undue delay. The Customer shall submit complaints in writing and without undue delay after a breach is or should have been discovered. Complaints are sent to kenneth@fundel.no.

8.3 Rectification

The Supplier may demand to rectify the breach within a reasonable time. Rectification shall normally be completed within 60 days of receipt of a written complaint.

8.4 Price Reduction

If the breach is not rectified within 60 days, the Customer may claim a proportionate price reduction for the affected period.

8.5 Damages

The Customer may claim damages for documented, direct financial loss arising from the Supplier's breach. Damages are limited to 25% of the remuneration the Customer has paid excl. VAT in the last twelve (12) months before the claim arose. The Customer may not claim damages for indirect loss, loss of profit, consequential loss or loss arising from loss of data.

The limitation of liability does not apply in cases of gross negligence or wilful misconduct on the part of the Supplier. The limitation of liability in this clause 8.5 and the limitation of liability in clause 32 (DPA) apply cumulatively, such that all claims the Customer brings under the Agreement and the Data Processing Agreement in the same calendar year together may not exceed the higher of the two caps. Data protection claims arising from the Data Processing Agreement are covered by the limitation in clause 32.

8.6 Termination for Cause

The Customer may terminate the Agreement in the event of material breach that is not rectified within 60 days of written complaint. Breach that is of a non-material nature or that is rectified within the deadline does not give grounds for termination.

9 CUSTOMER'S BREACH

If the Customer breaches its obligations under the Agreement, the Supplier may, following prior written notice, suspend the provision of the Services until the breach has been brought to an end.

Grounds for suspension of the Services include:

• payment default that has lasted more than 30 days after due date;

• publication of illegal or unlawful content in the Business Workspace or SMP that has not been removed within a reasonable deadline set by the Supplier;

• breach of the Supplier's or third-party intellectual property rights;

• material breach of the Agreement's other provisions.

Suspension of the Services does not entitle the Customer to a refund of remuneration already paid. The Supplier may charge a reactivation fee of NOK 2,000 exclusive of VAT for reactivation of the Services.

In the event of material breach, the Supplier may terminate the Agreement with immediate effect. Payment default exceeding 30 days is always considered material breach.

The Supplier may claim damages for documented loss resulting from the Customer's breach.

10 FORCE MAJEURE

Neither party is liable for breach caused by circumstances outside the parties' control, which the parties could not reasonably have foreseen, prevented or overcome the consequences of at the time of entering into the Agreement. Such circumstances may include, among others, war, mobilisation, natural disasters, general strike or lockout, fire, water damage, serious cyberattacks against critical infrastructure, or government-imposed trade restrictions.

The affected party shall notify the other party in writing without undue delay. Obligations are suspended for as long as the relevant situation persists. If the force majeure situation lasts for more than 60 consecutive days, both parties may terminate the Agreement with 30 days' notice. The Customer is in such case entitled to proportionate refund of prepaid but unearned remuneration.

11 TERM AND TERMINATION

The term of the Agreement follows from Part A (Digital Agreement Summary). Unless otherwise agreed, the Agreement runs for a minimum period of 12 months from activation of the Business Workspace (the effective date), and is thereafter automatically renewed for new periods of 6 months, unless one of the parties terminates the Agreement in writing no later than 3 months before the expiry of the current period.

Termination during the minimum period results in the remaining subscription payment for the minimum period becoming immediately due, unless the termination is due to the Supplier's material breach.

Separate agreements on additional services must be terminated individually. Termination cannot be validly given by a third party without documented authority.

Termination shall be sent in writing to kenneth@fundel.no (the Supplier) or to the Customer's registered email address for notifications.

The Supplier may terminate the Agreement with 14 days' written notice if the Customer is subject to debt negotiations, is petitioned into bankruptcy or has otherwise ceased its payments.

12 ASSIGNMENT OF THE AGREEMENT

The Supplier may assign its rights and obligations under the Agreement to third parties, including companies within the same group or in connection with a business transfer, without the Customer's prior consent. The Customer shall be notified in writing of the assignment.

The Customer may not assign its rights or obligations under the Agreement without prior written consent from the Supplier. Consent may not be refused without reasonable grounds.

13 GOVERNING LAW AND JURISDICTION

The rights and obligations of the parties under this Agreement are governed in their entirety by Norwegian law. If a dispute arises regarding the Agreement's interpretation or legal effects, the parties shall first seek a solution through negotiations. If negotiations do not lead to a resolution within 30 days after one party has demanded negotiations, the dispute shall be resolved by Oslo District Court as the agreed venue.

PART C — SPECIAL TERMS AND SERVICE DESCRIPTION

14 THE FUNDEL PLATFORM — OVERVIEW

Fundel is a Norwegian SaaS platform operated by Fundel AS at fundel.no. The platform gives sports clubs and associated users access to digital raffle sales (Raffle), digital trail bingo (BingGo) and the Sponsor Marketplace (SMP). Through this Agreement, the Customer is given access to Fundel's B2B component: Business Workspace and Sponsor Marketplace.

The platform is technically built on Elixir/Phoenix LiveView with a PostgreSQL database and is operated on Hetzner infrastructure. The Supplier does not guarantee specific uptime levels (SLA), but strives to keep the Services available with reasonable continuity. The descriptions of the Services in this Part C are indicative and set out the core elements of the Service. The Supplier may change, further develop and deliver individual features to varying extents, as long as the Service's core functionality (Business Workspace and Sponsor Marketplace) is maintained. No individual feature mentioned in the service description shall be regarded as a separate guaranteed deliverable, unless this is expressly stated in Part A.

15 BUSINESS WORKSPACE

15.1 Content and Access

Business Workspace is the Customer's dedicated workspace in the Fundel platform. The Customer is assigned one or more users with access to the Business Workspace. The workspace is logically separated from sports clubs' workspaces in the platform's navigation rail.

15.2 Functionality in Business Workspace

Business Workspace includes the following functionality:

• Business Dashboard — overview of incoming enquiries from sports clubs, suggested clubs based on category and geographic match, active sponsorship agreements, exposure metrics (impressions, profile visits, bookings) and income overview from completed transactions;

• Sponsor profile editor — the Customer can edit its public profile: company name, logo, description, website, city/area, industry/category and contact information;

• Sponsor Services — the Customer can create, edit and deactivate individual offering units of the types product, lead and booking, with associated pricing information and kickback terms;

• Booking management — incoming enquiries from sports clubs are displayed in an enquiry list with the option to accept, reject or complete a booking;

• Notifications — the Customer receives notifications in the platform for new enquiries, status changes and other relevant events.

15.3 Limitations

Business Workspace is intended for one legal entity (the Customer). Sharing access with third parties outside the Customer's organisation is not permitted.

16 SPONSOR MARKETPLACE (SMP)

16.1 Customer's Presence in the SMP

With an activated subscription, the Customer's sponsor profile and Sponsor Services will be visible and searchable for sports clubs' administrators and members in the SMP. Visibility requires that the Customer has a fully completed profile with valid content.

16.2 Categories and Searchability

The SMP distinguishes between two categories of businesses: National partners (businesses offering services throughout Norway) and Local businesses (businesses with a local/regional presence). The Supplier categorises the Customer based on registered information and reserves the right to adjust the categorisation with reasonable justification and prior notice.

Ranking and exposure in the SMP is determined by the Supplier's algorithm, which takes into account, among other things, geographic distance, reviews/ratings and kickback terms. The Supplier gives no guarantee of specific placement or exposure.

16.3 The Booking Process

A sports club wishing to enter into an agreement with the Customer sends a booking request through the SMP. The Customer receives notification and can accept, reject or mark the request as completed. An accepted booking establishes an active sponsorship agreement between the Customer and the relevant sports club, which will appear in both parties' overviews in the platform. The Supplier is not a party to agreements concluded between the Customer and sports clubs through the Sponsor Marketplace, and only provides a technical platform to bring the parties together. The Supplier assumes no responsibility for performance, quality, delay, defects, payment or other breach in the underlying relationship between the Customer and the sports club, and is not liable for disputes between them.

16.4 Customer's Responsibility for Sponsor Services

The Customer is solely responsible for ensuring that Sponsor Services are correctly described, lawfully marketed and in compliance with Norwegian marketing practice. The Customer warrants that the offered price is genuine, and that the Customer has the capacity and willingness to deliver the described service. The Supplier may with reasonable justification remove or pause a Sponsor Service, including if the content is contrary to Norwegian law, good business practice or the platform's guidelines.

17 THE KICKBACK MODEL AND TRANSACTION REMUNERATION

17.1 Kickback to Sports Club

For Sponsor Services of the product type, a kickback is calculated upon a completed transaction. The Customer sets the kickback rate per Sponsor Service, minimum 5% and recommended 10% of transaction value. The sports club receives remuneration equal to 85% of the kickback in accordance with clause 17.4, and the Supplier retains 15% as transaction remuneration. The applicable kickback rate is set out in the Customer's Business Workspace and in Part A.

17.2 Transaction Remuneration and Lead/Booking Fee

The Supplier retains 15% of the kickback as transaction remuneration per completed product transaction facilitated via the SMP. No separate transaction commission is charged beyond this. For leads and bookings, a fixed fee of NOK 75 exclusive of VAT is charged per approved lead or completed booking.

17.3 Invoicing and Automatic Deduction

The Supplier's share of kickback and lead/booking fees is accumulated on an ongoing basis and invoiced to the Customer monthly in arrears, in accordance with the selected plan and payment terms in Part A. Automatic deduction from a registered payment source requires that the Customer gives a separate, voluntary consent to this. The consent is given as a separate, verifiable action in the portal and is not included in the general acceptance of the Agreement's terms. The Customer may at any time withdraw the consent to automatic deduction with effect for future deductions. After withdrawal, invoices are paid by ordinary means of payment in accordance with the invoice's payment deadline.

17.4 Settlement and Payout to the Sports Club

Payment for Sponsor Services is made directly from the end customer to the Customer through the Supplier's payment provider (as at the conclusion of the Agreement, Stripe, an electronic money institution authorised in the EEA). Upon a completed transaction, the kickback is charged as the Supplier's agreed remuneration under clause 17.1, and is deducted by the payment provider before payout of the purchase price to the Customer. The Customer's payment obligation relating to the kickback is finally discharged by such deduction.

The sports club's right to remuneration equal to 85% of the kickback follows from a separate agreement between the Supplier and the sports club, and constitutes the Supplier's independent obligation towards the sports club. Payout to the sports club is made through the payment provider, monthly in arrears, with an accompanying settlement statement. The Supplier does not receive or hold funds belonging to the Customer or the sports club in its own account; all payment transactions are carried out by the payment provider. The Customer is not a party to the settlement between the Supplier and the sports club.

18 CUSTOMER'S PROFILE AND CONTENT

18.1 Content Requirements

All content that the Customer uploads or publishes in the platform, including descriptions, images, logos and prices, shall:

• be accurate, complete and not mislead users or sports clubs;

• not infringe third-party intellectual property rights;

• comply with the Norwegian Marketing Control Act and other relevant legislation;

• not contain illegal, offensive or discriminatory content.

18.2 Customer Warranties

The Customer warrants that information about public approvals, authorisations, certifications or industry affiliation is accurate and up to date. The Customer is obliged to notify the Supplier in writing without undue delay if the information changes.

18.3 Supplier's Right to Remove Content

The Supplier may with reasonable justification remove, hide or refuse publication of the Customer's content if the content is considered to be contrary to Norwegian law, good business practice, the platform's guidelines, or may damage the Supplier's or third parties' interests. The Customer is notified of such action without undue delay.

19 CHANGES TO THE SERVICE

The Supplier is entitled to update, improve and change the Services on an ongoing basis. Minor changes and improvements may be implemented without prior notice.

Material changes that result in a deterioration of the Services' core functionality for the Customer are notified in writing with at least 30 days' notice. In such cases, the Customer may terminate the Agreement with effect from the time of the change, and is entitled to proportionate refund of prepaid remuneration for the remaining agreement period.

The Supplier may discontinue individual components of the Services (e.g. specific integrations) if this is due to the loss of third-party dependencies, without this constituting material breach, provided that the core services (Business Workspace and SMP) remain available.

20 PERSONAL DATA IN THE SERVICE CONTEXT

The Supplier processes personal data about the Customer's contact persons for the administration of the contractual relationship and the delivery of the Services. The Supplier is the data controller for such processing.

To the extent that the Services involve the Supplier processing personal data on behalf of the Customer (as Data Controller), this is governed by the Data Processing Agreement in Part D.

21 TERM AND TERMINATION

The term, renewal and termination of the Agreement are exhaustively regulated in clause 11 (Term and Termination), cf. Part A.

PART D — DATA PROCESSING AGREEMENT (DPA)

This Data Processing Agreement ("DPA") is an integral part of the Agreement between Fundel AS ("the Data Processor") and the Customer ("the Data Controller"). The DPA governs the Data Processor's processing of personal data on behalf of the Data Controller in connection with the delivery of the Services. In the event of conflict between the DPA and other parts of the Agreement on data protection matters, the DPA prevails.

22 BACKGROUND AND PURPOSE

As part of the delivery of the Services, Fundel AS (the Data Processor) will process personal data on behalf of the Customer (the Data Controller). The processing is necessary to deliver the Services as described in Part C. This DPA sets out the parties' obligations pursuant to the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

23 DEFINITIONS

In this DPA, the following terms have these meanings. The definitions are listed in alphabetical order.

• "Data Controller" — the Customer, who determines the purposes and means for the processing of personal data.

• "Data Processor" — Fundel AS, which processes personal data on behalf of the Data Controller.

• "GDPR" — the EU General Data Protection Regulation 2016/679.

• "Personal Data" — any information relating to an identified or identifiable natural person, cf. GDPR Article 4 no. 1.

• "Personal Data Breach" — a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data.

• "Data Protection Legislation" — laws and regulations on the processing of personal data applicable from time to time, including the GDPR and the Norwegian Personal Data Act.

• "Sub-processor" — a third party engaged by the Data Processor to carry out specific processing tasks.

Otherwise, the understanding of terms corresponds to those defined or used in the Data Protection Legislation.

24 SCOPE OF PROCESSING

24.1 Purpose

The Data Processor processes personal data exclusively to deliver the Services as described in Part C, including:

• administration of the Customer's Business Workspace and User Account;

• display of the Customer's contact person and business information in the SMP;

• forwarding of booking enquiries from sports clubs to the Customer;

• sending of notifications and invoice-related communications;

• operation, maintenance and error correction in the Services.

24.2 Categories of Data Subjects and Personal Data

24.3 Duration of Processing

The Data Processor processes personal data for as long as the Agreement runs and the processing is necessary to deliver the Services. Upon termination of the Agreement, the Data Processor shall, at the data controller's (Customer's) choice, either delete or anonymise all personal data, or return them to the Customer, cf. the General Data Protection Regulation Article 28 no. 3 letter g. Unless the Customer requests return, the personal data is deleted or anonymised by default within 90 days after termination. Return takes place upon the Customer's written request, within a reasonable time and in a commonly used format, against reasonable remuneration for the Data Processor's costs. The Data Processor may nevertheless retain personal data for as long and to the extent that storage is required under applicable legislation, including the Bookkeeping Act. Information retained on this basis is processed only for the purpose to which the storage obligation applies, and is deleted when the obligation ceases.

25 DATA CONTROLLER'S OBLIGATIONS

The Data Controller (the Customer) undertakes to:

• ensure that a valid legal basis exists for all processing of personal data instructing the Data Processor, cf. GDPR Art. 6;

• fulfil the rights of data subjects pursuant to GDPR Chapter III;

• notify the relevant supervisory authority and data subjects in the event of a personal data breach on the Data Controller's part, cf. GDPR Art. 33 and 34;

• keep the Data Processor continuously informed of changes in purposes, categories of personal data or data subjects that affect the Data Processor's instructions.

26 DATA PROCESSOR'S OBLIGATIONS

The Data Processor undertakes to:

• only process personal data in accordance with documented instructions from the Data Controller and for the purpose set out in clause 24;

• notify the Data Controller without undue delay if an instruction is, in the Data Processor's assessment, contrary to applicable data protection legislation;

• assist the Data Controller in fulfilling the rights of data subjects pursuant to GDPR Chapter III, to the extent that the Data Processor possesses the necessary information;

• assist with documentation and compliance with the requirements in GDPR Art. 32–36 in light of the nature of the processing;

• ensure confidentiality obligations for all personnel with access to personal data under this DPA.

Assistance as referred to above, which goes beyond what is natural in the Data Processor's ongoing service delivery, is provided against remuneration in accordance with the Data Processor's applicable hourly rates, unless otherwise agreed.

27 SECURITY

The Data Processor shall at all times have implemented appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or deletion. The measures shall be proportionate to the risk associated with the processing.

The Data Processor ensures that only authorised personnel have access to personal data, and that such personnel are subject to a confidentiality obligation.

28 SUB-PROCESSORS

The Data Processor may engage sub-processors to carry out specific tasks under this DPA. Such sub-processors may include, among others, cloud and operations infrastructure (e.g. Hetzner), payment services and communication services. The Data Processor enters into written agreements with sub-processors that impose on them at least equivalent data protection requirements as set out in this DPA.

The Data Controller gives at the time of entering into the Agreement a general consent to the use of sub-processors. The Data Processor notifies the Data Controller in writing of planned changes to sub-processors with at least 30 days' notice. The Data Controller may within this deadline, with reasonable justification, object to the change. If the Data Processor cannot maintain the delivery without the relevant sub-processor, and the Data Controller refuses consent, both parties may terminate the Agreement with 30 days' notice.

29 INTERNATIONAL DATA TRANSFERS

Personal data is processed primarily within the EEA. The Data Processor may transfer personal data to countries outside the EEA if this occurs as a change of sub-processor pursuant to clause 28. If transfer to a third country is necessary, this shall take place in accordance with GDPR Chapter V, including through the use of the EU Standard Contractual Clauses (SCC) or another lawful transfer mechanism.

30 PERSONAL DATA BREACH

The Data Processor notifies the Data Controller in writing without undue delay after the Data Processor becomes aware of a personal data breach. The notification shall contain: a description of the breach, categories and estimated number of affected data subjects, likely consequences, and measures taken or planned.

If all information is not available at the time of the first notification, supplementary information is provided without undue delay.

Responsibility for notifying the Norwegian Data Protection Authority and the data subjects under GDPR Articles 33 and 34 lies with the Data Controller. The Data Processor shall, upon request, assist the Data Controller with such notification, cf. GDPR Article 28(3)(f).

31 AUDIT

The Data Processor makes available to the Data Controller all documentation necessary to demonstrate compliance with the GDPR and this DPA, including any audit reports from independent third parties.

Audit is as a general rule conducted by the Data Processor making available documentation as referred to in the preceding paragraph, including updated procedures, security declarations and audit reports from independent third parties. Physical audit may be conducted by the Data Controller or an independent auditor with a confidentiality obligation if there is a reasonable basis that cannot be clarified through document-based audit, or if this is required under the Data Protection Legislation. Physical audit is notified in writing with at least 30 days' notice, may not be conducted more than once per calendar year, and shall be conducted in a manner that does not disrupt the Data Processor's normal operations. Assistance from the Data Processor in connection with audit is provided against remuneration in accordance with applicable hourly rates, unless the audit reveals material deviations attributable to the Data Processor.

32 LIMITATION OF LIABILITY (DPA)

The Data Processor's liability for breach of this DPA is limited to the Data Controller's direct loss. Indirect loss, including loss of profit and consequential loss, is not covered. Total liability under the DPA in a calendar year is capped at 50% of the remuneration the Data Controller has paid to the Data Processor in the relevant calendar year. The limitation of liability does not apply in cases of gross negligence or wilful misconduct.

PART E — ANNEXES AND TEMPLATES

ANNEX 1 — DATA PROCESSING SCHEDULE

This schedule sets out the framework for the Data Processor's processing of personal data on behalf of the Customer, cf. Part D. At electronic conclusion of the agreement, the schedule's fillable fields are completed automatically from the information the Customer has provided during onboarding in the portal, and are reproduced in the confirmation the Customer receives by email. The fields are thus not completed manually. The automatically completed information constitutes an integral part of this schedule and the Data Processing Agreement.