Core Principles

This Master Services Agreement ("MSA" or "Agreement") and any associated Service Order and/or Statement of Work (together, the "Agreement") govern the provision of the Services by LEDGID Ltd. ("LEDGID") and the use of the Services by the Customer. The terms of this Agreement shall apply to the exclusion of any Customer terms and conditions. LEDGID may update or change this MSA, including, but not limited to, the fees and charges associated with the use of the Services. LEDGID will notify the Customer in writing of any such changes and any such amendments to this MSA will become effective and binding on the fifth business day after posting or notification, unless otherwise stated in the relevant notice. The Customer is encouraged to review this MSA periodically.

1.1 The following definitions and rules of interpretation apply in this Agreement: "Acceptance Date" means the date when implementation is accepted and the system goes live. "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a Party. "Annual Price" means the total price payable to LEDGID on an annual basis, including Subscription Fees, net of tax, as set out in the Service Order. "Authorised User" means an end-user authorised by the Customer to use the Services under this Agreement. "Confidential Information" means proprietary information, including technical data, trade secrets, business information, and any data disclosed by a Party as disclosing party to the other Party as receiving party, whether in writing, orally, electronically, or by inspection. "Content" means text, graphics, software, applications, data, and multimedia content delivered by LEDGID. "Customer" means the customer and any subsidiaries, affiliates, employees, or related entities listed in the Service Order. "Customer Data" means data input by the Customer or Authorised Users and owned or controlled by the Customer. "Data Protection Laws" means GDPR (EU 2016/679) and applicable national implementing laws, regulations, and secondary legislation. "Deliverables" means tangible goods or services provided upon completion of the Services. "Documentation" means all documents provided to the Customer by LEDGID. "Fault" means failure of the Software to operate materially in accordance with Documentation, SOW, or Service Order. "Fixed Term" means the initial term set out in the Service Order. "Help Desk Support" means support to identify and resolve technical issues relating to the Software. "IP Rights" means patents, copyrights, trade marks, domain names, trade secrets, know-how, and all other intellectual property rights, whether registered or unregistered. "Licence" means the non-exclusive, non-transferable licence granted to Customer to use the Services for the Term. "Mandatory Policies" means LEDGID policies notified to the Customer from time to time. "Marketplace Services" means any products, services, subscriptions, benefits, offers, applications or other commercial offerings made available by a Vendor through or in connection with the Platform. "Operator" means an employer, crewing company, ship manager, vessel owner, recruitment organisation, training organisation or other entity utilising the Services for workforce, compliance, operational or commercial purposes. "Party" or "Parties" means LEDGID and/or Customer. "Platform" means the LEDGID platform, applications, software, systems, workflows, interfaces and associated digital infrastructure through which the Services are made available. "Renewal Term" means the period after completion of the Fixed Term as set out in the Service Order. "Service Order" means the document describing the scope of Services provided to the Customer. "Services" means all services provided or made available by LEDGID, including Software, Content, Documentation, Platform access, support and any related services. "Service Levels" means the service response levels specified in Schedule 1 or the relevant Service Order. "Software" means LEDGID proprietary software, including source code, object code, and related Documentation. "Special Instructions" means specific terms agreed and inserted into a Service Order, varying the MSA for the Fixed Term. "Statement of Work" or "SOW" means the detailed specification for Services in a particular engagement. "Subscription Fees" means the total price for subscription-based Services. "Subscription Start Date" means the date of the Service Order or Customer signature, whichever is earlier. "Support Period" means the term of the Service Order or SOW. "Support and Maintenance Services" means the services specified in Schedule 1 or the relevant Service Order. "Support Request" means a request by Customer for support in relation to Software. "Term" means the Fixed Term or Renewal Term. "Termination Date" means the expiry or termination date of the Agreement. "Trust Indicator" means any trust level, verification status, verification outcome, risk indicator, trust score or similar informational output generated by the Services based upon Verification Events or other information available to the Platform. "Unacceptable Use" means misuse or prohibited use of Services as defined in Clause 4.6. "User" means an individual whose identity, access, records or activities are managed, verified, exchanged or otherwise supported through the Platform, whether acting as an Authorised User or as an individual participant in the LEDGID ecosystem. "User Data" means data generated by use of the Services, excluding Customer Data. "User Identity" means the digital identity profile created, controlled and maintained by a User through the Platform. "User Subscriptions" means subscriptions purchased to allow Authorised Users to access Services. "Vendor" means any third-party provider of Marketplace Services made available through the Platform. "Verification Event" means an auditable electronic record generated by the Platform evidencing that a verification activity has been performed, including, where applicable, the source, methodology, date, outcome and associated metadata relating to such verification activity. 1.2 References to days are to calendar days unless expressly stated otherwise. 1.3 References to business days exclude Saturdays, Sundays and public holidays in the jurisdiction applicable to the relevant Service Order, unless otherwise agreed. 1.4 References to writing include electronic communications. 1.5 The Schedules, Service Orders and Statements of Work form part of this Agreement. 1.6 Headings are for convenience only and shall not affect interpretation. 1.7 Words in the singular include the plural and words in the plural include the singular. 1.8 A reference to a person includes an individual, company, corporation, partnership, governmental body or other legal entity. 1.9 An obligation not to do something includes an obligation not to permit or allow that thing to be done. 1.10 References to legislation include any amendment, extension, re-enactment or replacement of that legislation. 1.11 In the event of conflict between this MSA and a Service Order, the Service Order shall prevail only to the extent of the conflict and only for the Services expressly covered by that Service Order.

2.1 LEDGID owns or is licensed to all IP Rights in the Services, Content and Documentation, business names and domain names associated with the Services, and database rights in relation to messages, files, data, software and Platform records. 2.2 Subject to Customer compliance with this Agreement, LEDGID grants the Customer access to the Software and Services as set out in the Service Order. 2.3 All IP Rights in the Services, Content, Software, Documentation, Platform and associated technology remain the property of LEDGID or its licensors. The Customer acquires no ownership rights other than the Licence expressly granted under this Agreement. 2.4 The Customer shall not use, duplicate, copy, modify, distribute, resell, sublicense, lease, rent, share or otherwise make available the Services except as expressly permitted by this Agreement or the applicable Service Order. 2.5 Subject to Customer compliance with this Agreement, the Customer may request export of Customer Data or User Data and LEDGID shall provide such data in a reasonable format, subject to applicable law, Platform functionality and any retention obligations applicable to LEDGID.

3.1 Subscription Fees for the Services are as set out in the Service Order and are payable in advance for each fixed subscription period unless otherwise agreed in writing. 3.2 Unless stated otherwise in the Service Order, all amounts exclude VAT and applicable taxes. 3.3 For invoiced Customers, payment shall be due net thirty (30) days from the invoice date unless otherwise stated in the Service Order. 3.4 For self-service subscriptions, payment shall be due immediately upon sign-up or activation of the relevant subscription. 3.5 Late payments shall accrue interest at four percent (4%) above the European Central Bank main refinancing rate, unless a different rate is set out in Clause 10.7 or the applicable Service Order. 3.6 Upon cancellation or termination for any reason, fees are non-refundable and no pro-rata refunds shall be due, except as expressly stated in this Agreement or the Service Order. 3.7 LEDGID grants the Customer a revocable, non-transferable, non-sublicensable, limited Licence to use the Services for the Term in accordance with this Agreement and the applicable Service Order. 3.8 All Deliverables remain LEDGID property unless ownership is expressly transferred in writing. 3.9 The number of User Subscriptions is set out in the Service Order. Additional subscriptions shall increase the Annual Price accordingly. 3.10 The Customer shall ensure that there is no unauthorised use of User Subscriptions. 3.11 The Customer shall not reverse engineer, decompile, disassemble, attempt to derive source code, introduce malware or otherwise misuse the Services. 3.12 LEDGID may suspend Services for maintenance, updates, upgrades, security, operational integrity or Platform protection purposes.

3A.1 LEDGID may make the Services available under a Service Order, Statement of Work, pilot arrangement or other written approval on a proof of concept, pilot, beta, trial, evaluation or closed invite-only basis for selected Authorised Users, invitees, Operators, Customers, partners or other approved participants. 3A.2 Unless expressly stated otherwise in the applicable Service Order, proof of concept access shall be provided solely for evaluation, testing, feedback, familiarisation, product validation and service-improvement purposes, may be provided free of charge, shall not constitute a production deployment, and may exclude identity screening, trusted LEDGID ID issuance, data sharing, Operator interaction, Vendor interaction, marketplace functionality, verified eligibility workflows, Verification Events, Trust Indicators and other full Platform functionality. 3A.3 No Authorised User, invitee or participant shall be treated as holding a verified LEDGID identity, verified trust status, verified eligibility outcome or production-level account unless and until the applicable identity verification and trusted identity issuance workflow has been completed and activated by LEDGID. 3A.4 The Customer shall ensure that any Authorised Users or invitees participating in a proof of concept understand the limited, evaluation-only nature of such access and do not rely on evaluation access as proof of verified identity, certification, eligibility, approval, clearance or trust status. 3A.5 LEDGID may modify, suspend, withdraw or end proof of concept, pilot, beta, trial or invite-only access where reasonably required for security, legal compliance, product development, operational integrity, commercial launch preparation or protection of the Platform.

4.1 The Customer shall cooperate with LEDGID requests, provide timely access to required data or resources, keep login credentials secure, notify LEDGID of unauthorised access and use the Services lawfully and only in accordance with this Agreement. 4.2 The Services are for Authorised Users only and the Customer remains liable for the acts and omissions of Authorised Users as if they were acts and omissions of the Customer. 4.3 Services may only be used as specified in the Service Order. 4.4 LEDGID is not responsible for external connectivity, telecommunications, internet access, local infrastructure, Customer systems or other external factors outside LEDGID's reasonable control. 4.5 LEDGID does not warrant compatibility with Customer hardware, software, networks, devices or systems unless expressly agreed in writing. 4.6 Unacceptable Use includes breach of the Licence or this Agreement, posting unlawful, offensive, defamatory, infringing or harmful content, granting unauthorised third-party access, developing competing services during the Term and for twelve (12) months thereafter, and any use that threatens the integrity, security or availability of the Services. 4.7 LEDGID may use anonymised, pseudonymised or aggregated Customer Data, User Data and Verification Event information for analytics, benchmarking, trends, reporting, service improvement, operational optimisation and product development, provided that no individual User can reasonably be identified from such information. 4.8 Penetration testing, vulnerability scanning, load testing, security testing or similar testing by or on behalf of the Customer requires LEDGID's prior written consent. 4.9 LEDGID operates as a neutral technology platform and trust infrastructure designed to facilitate the management, verification, exchange and utilisation of information between Users, Operators, Vendors and other authorised participants. 4.10 Trust within the Platform is derived from Verification Events, information supplied by Users and third parties, and the responsible conduct of participants using the Platform. 4.11 Nothing within the Services shall be construed as creating any certification authority, accreditation authority, regulatory authority, employment agency or recruitment agency relationship between LEDGID and any User, Operator, Vendor or third party. 4.12 The Customer shall ensure that Authorised Users maintain the confidentiality and security of all login credentials, authentication methods and access mechanisms associated with the Services. 4.13 Neither the Customer nor any Authorised User shall share access credentials or knowingly permit unauthorised access to the Services. 4.14 Neither the Customer nor any Authorised User shall impersonate another person, organisation or identity when using the Services. 4.15 Neither the Customer nor any Authorised User shall upload, store, exchange, submit, transmit or otherwise utilise information which is fraudulent, forged, materially misleading, unlawfully altered or knowingly inaccurate. 4.16 Neither the Customer nor any Authorised User shall knowingly provide false statements, inaccurate declarations or misleading representations relating to qualifications, certifications, experience, employment history, medical information, training records, competency records or identity information. 4.17 The Customer shall use reasonable endeavours to ensure that all information submitted through the Services is maintained accurately and in good faith. 4.18 The Services are intended to facilitate trust, verification, compliance management, information exchange and commercial interaction. 4.19 LEDGID does not guarantee employment, recruitment, vessel assignment, promotion, commercial opportunity, certification validity, regulatory approval, income generation, business success or any other outcome arising from the use of the Services. 4.20 Any employment, commercial, regulatory or operational outcome arising from information exchanged through the Platform remains dependent upon factors outside LEDGID's reasonable control. 4.21 Trust Indicators are provided for informational purposes only. 4.22 Trust Indicators shall not constitute certification, legal validation, regulatory approval, accreditation, competency assessment, fitness for purpose or suitability for any particular role, engagement or activity. 4.23 Verification Events evidence that a verification activity has occurred but do not independently validate the underlying information to which such Verification Event relates. 4.24 LEDGID may facilitate access to Marketplace Services and Vendor offerings through the Platform. 4.25 LEDGID acts solely as a technology, orchestration and access layer in relation to Marketplace Services unless expressly agreed otherwise in writing. 4.26 Each Vendor shall remain independently responsible for the delivery, performance, compliance, warranties, support obligations and contractual obligations associated with its Marketplace Services. 4.27 LEDGID shall not be responsible for the quality, legality, availability, performance, suitability or fitness for purpose of Marketplace Services provided by a Vendor.

5.1 LEDGID may issue product-specific terms without affecting this MSA unless expressly stated otherwise. 5.2 LEDGID may modify, add, or remove Content. Where such modification materially decreases the functionality purchased by the Customer, the Parties shall discuss in good faith an appropriate fee adjustment. 5.3 Third-party components are subject to their respective licences and the Customer shall comply with any applicable third-party licence terms notified to it. 6.1 Either Party may request changes to the Services, Service Order or Statement of Work in writing. 6.2 Changes shall take effect only upon mutual written agreement by the Parties. 7.1 Subject to the subscription level, LEDGID shall provide support in accordance with Schedule 1 or the applicable Service Order. 7.2 Additional services may be invoiced separately. 7.3 Support may be provided by phone, email, electronic medium or other support channel made available by LEDGID. 7.4 Support excludes defects or issues caused by unauthorised use, Customer systems, third-party systems, misuse, external connectivity or other factors outside LEDGID's reasonable control. 7.5 API support is limited to installation and configuration unless development support is separately agreed. 7.6 Only the current and two immediately preceding Software versions shall be supported unless otherwise agreed in writing.

8.1 This Agreement commences on the Subscription Start Date and continues for the Fixed Term and any Renewal Term unless terminated in accordance with this Agreement. 9.1 Customer may terminate this Agreement at the end of the Fixed Term or any Renewal Term by giving no less than ninety (90) days' written notice prior to the expiry of the relevant Fixed Term or Renewal Term. 9.2 Either Party may terminate this Agreement immediately by written notice if the other Party is in material breach of the Agreement and, if such breach is remediable, the breaching Party fails to remedy the breach within thirty (30) days of written notice from the non-breaching Party. 9.3 Access to the Services will be deactivated on the Termination Date. Upon termination, deactivated Services will have a non-chargeable thirty (30) day return period starting on the Termination Date. Services not returned by the end of this period shall be considered non-returned and may be charged to the Customer where applicable. 9.4 Upon termination or expiry of the Agreement, all outstanding charges and surcharges in conjunction with the Services provided become immediately payable by the Customer. 9.5 All provisions in this MSA regarding payment, indemnification, warranty, liability, confidentiality, and protection of proprietary rights shall survive termination of the Agreement. 9.6 To the extent Services are based on a per-Site basis, as indicated in the Service Order or SOW, the Customer may only terminate the Service Order for a specific Site under Clause 9.7. For the avoidance of doubt, no refund is due for prepaid fees except as expressly stated in Clause 9.7. 9.7 If a Site ceases to be managed by the Customer, other than due to insolvency, the Customer may, on ninety (90) days' prior written notice, terminate the Service Order for that Site and receive a pro-rata refund for the remainder of the Term, less reasonable administration costs, subject to evidence of loss of control. 9.8 LEDGID reserves the right to suspend or terminate Services immediately in the event of non-payment, Unacceptable Use, non-compliance with Clause 18, or any use violating this MSA. 9.9 LEDGID may terminate the Agreement if the Customer takes steps toward insolvency, bankruptcy, administration, liquidation, being wound up or similar proceedings. 9.10 LEDGID may terminate the Agreement if the Customer suspends or ceases, or threatens to suspend or cease, carrying on business. 9.11 Upon suspension or termination, Customer's access to online, offline, or on-site Services will cease immediately. Any Licence terminates and Customer must stop using any Content, Documentation or LEDGID IP. 9.12 During the Term or upon termination, LEDGID may request return, destruction, or a combination thereof of all Confidential Information in Customer's possession or control, including copies or summaries. Customer must comply and, if applicable, provide proof of destruction within fourteen (14) days. If law requires retention, Customer shall inform LEDGID, return or destroy such information as soon as reasonably practicable, and provide proof within fourteen (14) days after such return or destruction. 9.13 Termination under this Clause shall be without prejudice to rights or obligations accrued prior to termination. 9.14 Any provision intended to continue in force after termination shall remain in full effect. 9.15 Without prejudice to any other rights or remedies available to LEDGID, LEDGID may immediately suspend, restrict or terminate access to the Services where the Customer or any Authorised User shares access credentials, impersonates another person, knowingly uploads fraudulent records, knowingly submits false information, attempts to manipulate Trust Indicators or Verification Events, or otherwise acts in a manner which materially undermines the integrity, trustworthiness or security of the Platform.

10.1 For non-subscription Services, including professional services and services subject to User Acceptance Testing, Customer shall pay LEDGID according to the following schedule unless otherwise agreed in writing. 10.1.1 Thirty-three percent (33%) shall be payable on contract award. 10.1.2 Thirty-three percent (33%) shall be payable on completion of User Acceptance Testing. 10.1.3 Thirty-four percent (34%) shall be payable on go-live or within thirty (30) days following contract award, whichever is sooner. 10.2 For subscription-only Services not subject to User Acceptance Testing, one hundred percent (100%) of the Annual Price is payable on the Subscription Start Date. 10.3 Subject to Clauses 10.1, 10.2 and 10.6, Customer shall pay invoices within thirty (30) days of receipt of a properly issued invoice. Standard payment currency is USD. All prices exclude taxes, VAT, customs duties and shipping costs unless otherwise specified. 10.4 Applicable taxes shall be itemised separately on invoices. If Customer pays inapplicable taxes, LEDGID will cooperate to obtain repayment or adjustment under law. 10.5 If any invoice is disputed, Customer must pay the undisputed portion by the due date and notify LEDGID in writing of the dispute within thirty (30) days of the invoice date. 10.6 Subscription Fees are based on maintaining minimum users or units. Annual Price is payable on the Subscription Start Date and each twelve (12) month period thereafter. Changes mid-year may be billed pro-rata. 10.7 Late payments accrue interest of two percent (2%) above the European Central Bank main refinancing rate per month, accruing daily from the due date until payment. LEDGID may suspend Services for overdue invoices. 10.8 Upon default, LEDGID may invoice all outstanding fees up to the end of the Term and such invoices shall fall due immediately. 10.9 Customer shall reimburse LEDGID for pre-approved expenses incurred in performing Services. 10.10 LEDGID may increase Subscription Fees at the end of the Fixed Term and each Renewal Term by a maximum of two percent (2%) plus Eurozone CPI, provided the increase is not less than zero percent (0%). 10.11 Any credit owed to Customer will be issued by credit note, redeemable against future invoices. 10.12 LEDGID will maintain records to substantiate charges, including pre-approved expenses. Customer may review records once per contract year with thirty (30) days' notice. 10.13 If an audit shows underpayment, Customer shall pay the shortfall within thirty (30) days of LEDGID invoice. 10.14 If an audit shows overpayment, LEDGID shall issue a credit note promptly.

11.1 LEDGID personnel performing Services may be required, upon reasonable notice by Customer and at Customer's cost, as identified in the Service Order or SOW or otherwise approved in advance, to travel to Customer's place of business as reasonably necessary. LEDGID, as an independent contractor, shall retain full responsibility for supervision, direction and control of its personnel regarding the method and manner of performing Services. 11.2 All materials, including equipment and development tools required for performing Services, shall be supplied as agreed in the Service Order and/or SOW. 11.3 Where a Service Order or SOW requires implementation or acceptance testing, LEDGID will notify Customer when Services are ready for production use and Customer shall have thirty (30) days from receipt to test compliance with the SOW. 11.4 Upon completion of testing, Customer shall notify LEDGID of acceptance or rejection. If rejected, Customer shall provide a written list of noncompliance. LEDGID will determine, in its reasonable discretion, whether rejection is valid and, if valid, shall promptly make corrections at no additional cost. 11.5 If revised Services still fail to comply materially with the SOW, this procedure shall repeat until compliance is achieved or LEDGID may elect to terminate the Service Order or SOW by written notice, with no further liability except as stated in Clause 11.6. 11.6 If LEDGID terminates under Clause 11.5, any prepaid fees for unprovided Services shall be refunded, excluding milestone payments.

12.1 Services are provided "as is". LEDGID makes no express or implied warranties, including merchantability, satisfactory quality, fitness for a particular purpose or non-infringement. Training materials may contain errors and are not a substitute for Customer's own risk assessments. 12.2 LEDGID makes no representations and assumes no liability for third-party hardware, which is covered only by manufacturer or licensor warranties, if available. 12.3 The warranties set out in this Agreement replace all other warranties, express or implied, to the maximum extent permitted by law. 13.1 Nothing in this Agreement limits liability that cannot legally be limited, including liability for death or personal injury caused by gross negligence and liability for fraud. 13.2 LEDGID shall not be liable for indirect, special, incidental or consequential losses. 13.3 LEDGID shall not be liable for loss of revenue, profit or anticipated profit. 13.4 LEDGID shall not be liable for loss of business, goodwill or reputation. 13.5 LEDGID shall not be liable for business interruption. 13.6 LEDGID shall not be liable for loss, corruption, alteration or unauthorised access to data except to the extent directly attributable to LEDGID and not otherwise excluded or limited under this Agreement. 13.7 LEDGID shall not be liable for any other similar losses. 13.8 LEDGID's aggregate liability shall not exceed the Annual Price. 13.9 The limitations in this Clause 13 shall not apply to fees due under the Agreement or Customer's defence or indemnity obligations.

14.1 Each Party shall indemnify the other against direct liabilities, costs, damages or losses, including legal costs, arising from third-party claims for death or personal injury. 14.2 Customer shall indemnify LEDGID against claims arising from unauthorised use of Services or infringement of third-party rights by Customer content. 14.3 LEDGID shall indemnify Customer against claims arising from LEDGID gross negligence, wilful misconduct or infringement of third-party IP, except where caused by Customer's unauthorised use or modifications. 14.4 LEDGID may, at its expense, procure rights, replace, or modify infringing Software. If impossible, Customer shall return the relevant item and LEDGID's sole liability shall be a refund. 14.5 Customer shall notify LEDGID of potential claims, make no admission without LEDGID's consent, and provide reasonable assistance. 14.6 Indemnity obligations survive termination. 15.1 Neither Party is liable for delays caused by events beyond reasonable control, including natural disasters, epidemics, acts of government, war, terrorism or third-party delays. If such events continue for ninety (90) days, affected Services or the Agreement may be terminated by written notice. 15.2 No refund of Annual Price or Subscription Fees is required for terminated or suspended Services under this Clause. 16.1 Each Party shall not disclose Confidential Information during or after the Term except as permitted under Clause 16.2. 16.2 Disclosure is permitted to personnel, contractors or advisers needing the information and where required by law or governmental authority. 16.3 Confidential Information shall only be used to perform obligations under the Agreement. 16.4 Confidential Information excludes information already known, publicly available, independently developed, received from a third party without obligation, or required by law to be disclosed with prior notice where possible. 16.5 Breach of confidentiality may cause irreparable harm and equitable relief shall be available.

17.1 For the purposes of this Clause, Controller, Processor, Data Subject and Processing have the meanings given under applicable Data Protection Laws. 17.2 Customer Personal Data means Personal Data processed by LEDGID on Customer's behalf. 17.3 Both Parties shall comply with Data Protection Laws. 17.3.1 Privacy Notice — The Parties acknowledge that LEDGID maintains a standalone Privacy Notice for individuals whose personal data may be processed through or in connection with the Services, including Users, Authorised Users, Customer personnel, Operator personnel, Vendor representatives and other Data Subjects. The Privacy Notice explains how LEDGID processes personal data where LEDGID acts as Controller, including in relation to User Identity, Digital Profiles, Verification Events, Platform security, fraud prevention, legal compliance, marketplace interactions, analytics and individual rights. Nothing in the Privacy Notice limits the Customer's obligations as Controller or LEDGID's obligations as Processor under the applicable DPA. 17.4 Customer shall not upload special category data or children's data without written agreement and an executed data processing agreement. 17.5 LEDGID acts as Processor and shall only process Customer Personal Data in accordance with documented instructions. 17.6 LEDGID shall maintain Processing records, not appoint subprocessors without consent, not transfer data outside the EEA without consent and appropriate safeguards, notify Customer of breaches within seventy-two (72) hours, assist Customer with GDPR obligations, Data Subject Requests and regulator correspondence, implement security measures, treat Customer Personal Data as confidential, return or delete data upon termination unless legally required to retain it, train personnel, provide compliance information, allow audits with Customer reimbursement, and not act in a manner that causes Customer to breach Data Protection Laws. 17.7 Nothing prevents either Party from complying with its own obligations under Data Protection Laws. 17.8 For on-premises Software, LEDGID will not access Customer data without consent. 17.9 Customer retains ownership of Customer Data and LEDGID may use anonymised statistics in accordance with this Agreement. 17.10 Data retention shall be governed by LEDGID's published policy, the applicable Service Order and applicable law. 17.11 The Parties acknowledge that each User retains ownership and control of their User Identity and associated personal records maintained through the Platform. 17.12 Nothing in this Agreement shall transfer ownership of a User Identity, Personal Data, credentials, Verification Events or associated records to an Operator, Vendor or other third party. 17.13 Access rights granted through the Platform shall constitute permission to access information only and shall not create any ownership interest in such information. 17.14 Subject to applicable law, Personal Data and records shall only be exchanged through the Platform where initiated, authorised or otherwise permitted by the relevant User. 17.15 The receiving party must accept such information through the applicable Platform workflow before access is granted. 17.16 LEDGID shall not be responsible for any subsequent use of information by a recipient acting outside the Platform. 17.17 LEDGID may generate, store and maintain Verification Events as auditable records of verification activity performed through the Platform. 17.18 Verification Events may be retained for audit, compliance, fraud prevention, security and operational purposes. 17.19 Verification Events shall not independently validate underlying certifications, qualifications, medical records, identity records or other information. 17.20 LEDGID may utilise anonymised, aggregated, statistical or otherwise non-identifiable information derived from the Services for analytics, benchmarking, reporting, service improvement, operational optimisation, research and product development. 17.21 LEDGID shall not intentionally utilise such information in a manner which reasonably permits identification of an individual Data Subject. 17.22 LEDGID may utilise blockchain, distributed ledger, tokenisation, digital attestation or similar technologies in connection with the Services. 17.23 Such technologies may be utilised to improve auditability, traceability, ownership control, record integrity and tamper-evident record keeping. 17.24 The use of such technologies shall not constitute independent validation of underlying information.

18.1 Each Party warrants that it is not a Sanctioned Entity and that the Agreement does not constitute a Sanctioned Transaction. 18.2 Breach of this Clause allows immediate termination or suspension without further liability. 18.3 The breaching Party shall indemnify the other for all resulting claims, losses and costs. 19.1 Customer shall comply with Mandatory Policies. 19.2 Breach of Mandatory Policies constitutes a material breach under Clause 9.2. 20.1 LEDGID warrants that it has committed no prior offence under applicable bribery legislation. 20.2 LEDGID will not, and shall ensure its personnel and contractors do not, commit bribery offences. 20.3 LEDGID has adequate procedures to prevent bribery. 20.4 Breach of this Clause shall indemnify Customer against resulting losses, fines or legal costs. 21.1 Dates are guidance only and may be varied by mutual agreement. 21.2 LEDGID shall use reasonable endeavours to meet supply dates. 21.3 If Customer delays or suspends performance for thirty (30) or more days, LEDGID is entitled to payment for Services already performed and reasonable additional costs within thirty (30) days of invoice. 22.1 Invalidity of any provision does not affect the rest of the Agreement. 22.2 Customer may not assign or subcontract without written consent. 22.3 Customer shall not solicit LEDGID employees during the Term and for one (1) year after termination. 22.4 LEDGID may assign or subcontract at its discretion. 22.5 No third-party beneficiaries are created, except Service Providers may enforce provisions expressly intended to benefit them. 22.6 Notices shall be sent to the addresses stated in the Service Order or otherwise notified in writing. 22.7 This Agreement supersedes prior statements, understandings or representations. 22.8 Waivers must be in writing and failure to enforce is not a waiver. 22.9 No partnership, joint venture, fiduciary relationship or agency is created by this Agreement. 22.10 Each Party represents that it has authority to enter into this Agreement and that no restrictions prevent performance. 22.11 LEDGID may update the MSA from time to time in accordance with the update provisions of this Agreement. 22.12 Renewal or payment of the Annual Price constitutes acceptance of the updated MSA, updated Special Instructions and updated fees, including CPI adjustments under Clause 10.10.

23.1 This Agreement shall be governed by and construed in accordance with the laws of Cyprus, without regard to conflict-of-law rules. 23.2 The Parties shall attempt in good faith to resolve any dispute arising out of or in connection with this Agreement through negotiation before commencing formal proceedings. 23.3 Subject to any mandatory rights or remedies that cannot be excluded under applicable law, any dispute arising out of or in connection with this Agreement shall be referred to and finally resolved by arbitration under the LCIA Rules. 23.4 The seat of arbitration shall be Nicosia, Cyprus. 23.5 The language of arbitration shall be English. 23.6 The tribunal shall consist of one arbitrator unless the Parties agree, or the LCIA Court determines, that three arbitrators are appropriate. 23.7 Nothing in this Clause shall prevent either Party from seeking urgent injunctive, equitable, interim or regulatory relief where required to protect intellectual property, Confidential Information, Personal Data, security, Platform integrity, Verification Events, Trust Assets or compliance with applicable law. SIGNATURES