Master Services Agreement

This Master Services Agreement (this “Agreement”) is entered into as of [insert date] (the “Effective Date”) by and between VeriFast Inc, a Canadian corporation with an office located at 258 Front Street, Belleville, Ontario, K8N 2Z2 Canada (“VERIFAST”) and [INSERT CLIENT NAME] a [INCORPORATION JURSIDICTION] corporation with an office located at [ADDRESS] (“CLIENT”).

CLIENT and VeriFast agree as follows:

1. SERVICES

Services; Affiliates. VeriFast shall perform for CLIENT the services (including the provision of any Deliverables (defined below), collectively, the “Services”) described in this Agreement and in any mutually executed statements of work issued under this Agreement (each, an “SOW”). CLIENT’s right to receive, access, and use the Services and the Deliverables extends to CLIENT’s Affiliates, and all references herein and in each SOW to CLIENT shall be deemed to include CLIENT and its Affiliates, unless otherwise required by the context. “Affiliate” means any entity that directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with a party to this Agreement. For purposes of the definition of Affiliate, “control” means: (a) direct or indirect ownership of (or option to convert into) greater than 50% of the equity interest of the entity or (b) in control of more than 50% of the operating assets used in the business of an entity.

1. Statements of Work. Each SOW shall be substantially in the form of the sample SOW attached hereto as Exhibit A-1, or such other form as mutually agreed by the parties. Each SOW shall be deemed to incorporate all terms and conditions of this Agreement, and all SOWs shall be incorporated into and form a part of this Agreement. In the event of a conflict or inconsistency between the terms of this Agreement and the terms of an SOW, the terms of this Agreement shall control (unless such SOW expressly states that its terms prevail with respect to specific provisions in this Agreement).

2. Change Requests. Any material change(s) to an SOW regarding the nature or scope of the Services (including any such changes to any Deliverables) must be agreed to in a writing signed by authorized representatives of CLIENT and VeriFast (each, a “Change Request”). Each Change Request must specify any changes with respect to fees for the covered Services. Any fees associated with the implementation of any Change Request shall be reasonable and consistent with charges for other Services performed under the applicable SOW. CLIENT will have no obligation to pay fees for Services not covered by a mutually executed SOW or Change Request.

3. Delivery. VeriFast shall provide each Deliverable to CLIENT via such format, manner, and media as set forth in the applicable SOW or as otherwise agreed by the parties.

4. Milestones. VeriFast shall commit and use sufficient resources to meet each of the activities, goals, and timelines set forth in an SOW (collectively, “Milestones”). VeriFast shall notify CLIENT as soon as reasonably practicable of any anticipated or actual delay in, or failure to meet, a Milestone. VeriFast shall use good faith efforts to mitigate any adverse consequences of such failure or delay.

5. Reporting. VeriFast shall provide to CLIENT such reports regarding the progress of the Services (including any particular Milestones) as required under the applicable SOW or as otherwise reasonably requested by CLIENT from time to time.

6. VeriFast Background Check Policies. At all times in the course of providing Services, VeriFast will (and will require all employees, contractors, and agents to) comply with the VeriFast Background Checks Policy (attached hereto as Exhibit B).

2. FEES AND INVOICING; TAXES

   1. Fees and Expenses. As compensation for VeriFast’s provision of the Services, CLIENT will pay VeriFast the fees as specified in each SOW. The pricing for the Services is specified in the SOW, including terms for any prices increases, renewals or extensions.

   2. Payment. All undisputed payments due to VeriFast for any Services will be paid by CLIENT within 30 days after CLIENT’s receipt of an invoice from VeriFast which complies with the requirements of this Agreement.
      
      

3. Invoices. VeriFast must submit all invoices for Services within the timeframe specified in the applicable SOW or, if not so specified, within sixty (60) days after the date the Services were performed (including, with respect to any Deliverables, sixty (60) days after the date such Deliverables were delivered to CLIENT). CLIENT will have no liability whatsoever as to any fees, expenses, or other charges not invoiced within such sixty (60) day period or the timeframe specified in the applicable SOW. All taxes which are properly chargeable to CLIENT shall be stated separately in VeriFast’s invoices. All such invoices will describe the nature of the Services performed in sufficient detail as CLIENT may reasonably require, and each invoice for expenses that are reimbursable under an SOW must include true and correct copies of receipts and invoices therefor. With respect to any invoice, VeriFast shall provide CLIENT all such documentation and additional information as reasonably requested by CLIENT. Unless a different address has been specified in a particular SOW, VeriFast shall submit invoices to the email(s) specified in the SOW in a PDF format. Each PDF should contain a single invoice with all supporting documentation, and containing no embedded files. VeriFast shall only submit any past due invoices, including any correspondence associated with such past due invoices to the stated email in the SOW.

4. Taxes. VeriFast is responsible for declaring all amounts received from CLIENT to the Internal Revenue Service and any other applicable taxing authority, and VeriFast is solely responsible for all federal, state, and local taxes due and payable on all amounts VeriFast receives from CLIENT.

3. TERM AND TERMINATION

1. Term. The term of this Agreement begins on the Effective Date and continues for one (1) year thereafter (the “Initial Term”), subject to earlier termination as permitted herein. The Initial Term may be renewed for successive terms thereafter of such lengths as agreed to by the parties in a signed writing (each, a “Renewal Term”). The Initial Term and any Renewal Terms are collectively referred to as the “Term.” In the event the Term would expire while the parties are in the course of negotiating in good faith the renewal of the Term, the Term shall continue on a month-to-month basis until the parties have mutually agreed on written terms of the Renewal Term. Except as CLIENT may otherwise notify VeriFast, if any SOW is outstanding as of the effective date of the termination of this Agreement, the terms of this Agreement will continue in effect with respect to such SOW until such SOW is terminated in accordance with the terms of this Agreement or such SOW.

2. Termination by CLIENT. CLIENT may terminate this Agreement at any time and for any or no reason by providing VeriFast with at least 30 days’ prior written notice. CLIENT may terminate any SOW at any time and for any or no reason by providing VeriFast with at least thirty (30) days’ prior written notice.

3. Termination by Either Party. Either CLIENT or VeriFast may terminate this Agreement in its entirety or any individual SOW if the other party breaches a warranty or material term of this Agreement, including such SOW, or otherwise fails to comply with a material obligation under this Agreement, including such SOW, and fails to correct the same within 10 business days after written notice from the non-breaching party.

4. Consequences of Termination; Survival.

   1. Within thirty (30) days after termination of this Agreement in its entirety, CLIENT shall pay in full any undisputed amounts owed to VeriFast as of the effective date of such termination.

   2. The terms of this Agreement which by their nature are to survive this Agreement will survive its termination, including Sections 4 (Confidential Information), 5 (Data Privacy and Security), 6 (Proprietary Rights; Ownership of Intellectual Property), 7 (Representations and Warranties), 8 (Indemnification), 13 (Records Audit Rights), 17 (Miscellaneous) and Exhibit C.

5. Transition Services. After termination of any SOW for any reason (except by reason of CLIENT’s failure to pay undisputed fees or CLIENT’s other uncured material breach), upon CLIENT’s request and for the period of time reasonably requested by CLIENT in order for CLIENT to wind down its use of the services and make a transition to alternate service providers (the “Transition Period”), VeriFast will (a) continue to provide and perform those Services under such SOW that are requested by CLIENT and (b) reasonably cooperate with CLIENT and its service providers in the transfer of any Services or CLIENT data to CLIENT or its other service providers. During any such Transition Period, the parties will continue to comply with their respective obligations under this Agreement and any SOW, including CLIENT’s payment obligations.
   
   

4. CONFIDENTIAL INFORMATION. The parties shall treat CLIENT’s Confidential Information as defined and pursuant to terms in Exhibit C, attached hereto and incorporated herein.

5. DATA PRIVACY AND SECURITY

   1. Data Privacy. VeriFast shall comply with the data privacy terms and requirements as set forth in Exhibit C, attached hereto and incorporated herein.

6. PROPRIETARY RIGHTS; OWNERSHIP OF INTELLECTUAL PROPERTY

   1. VeriFast Property.  As between VeriFast and CLIENT, means all services, inventions, discoveries, improvements, developments, concepts, trade secrets, original works of authorship, derivative works of authorship, products, drawings, ideas, know-how, show-how, designs, schematics, specifications, proofs of concept, prototypes, systems, algorithms, computer programs (including source code, object code, routines, and macros), databases, software, hardware, processes, procedures, methodologies, techniques, documentation, and other work products, together with all documentation and notes relating to the foregoing, whether or not patentable or registrable under copyright, patent, trademark, or similar laws, which VeriFast, alone or jointly, creates, conceives, develops, reduces to practice, or causes another to create, conceive, develop, or reduce to practice, in connection with the Services (collectively, “VeriFast Property”) shall be the sole ownership of VeriFast. This Agreement does not constitute a sale and does not convey to CLIENT any rights of ownership in or related to the VeriFast Property or the intellectual property rights owned by VeriFast. Except for the limited license granted herein, all right, title and interest in the VeriFast Property, in all languages, formats and media throughout the world, whether now known or later devised, including all copyright and other intellectual property rights, are and will continue to be the sole, exclusive, and absolute property of VeriFast, with all rights reserved.

   2. CLIENT Property. As between VeriFast and CLIENT, all (a) Deliverables (excluding any VeriFast Proprietary Materials or Third Party Materials that CLIENT has agreed may be incorporated therein in accordance with Section 6.3), (b) Confidential Information, (c) information, data, and materials provided or otherwise made available to VeriFast (or its contractors or agents) under this Agreement, (d) information and data uploaded, downloaded, transmitted, processed, stored, or generated by or utilizing any Deliverables or Services, (collectively, “CLIENT Property”), shall be the sole and exclusive property of CLIENT. VeriFast further agrees that to the extent permissible under applicable laws, each and every Deliverable shall be a “work made for hire” as defined under 17 U.S.C. §§ 101 et seq., as amended or superseded, and, as such, will be the sole and exclusive property of CLIENT. Except as expressly permitted under this Agreement or otherwise expressly authorized by CLIENT in writing, CLIENT shall have no right to modify, translate, enhance, improve, combine with other materials, create derivative works, or other products based on, sell, license, distribute, make available, or otherwise use, exploit, or disseminate, in any manner, media, or territory, any Deliverable or other CLIENT Property.

   3. Acceptance Testing. If applicable, testing criteria and procedures required for acceptance of individual Deliverables listed in the applicable SOW will be jointly agreed by CLIENT and VeriFast and will be specified in the applicable SOW. If the SOW does not state any acceptance criteria or procedures, then CLIENT shall evaluate such Deliverables based on CLIENT’s reasonable satisfaction and notify VeriFast whether CLIENT accepts or rejects each such Deliverable. If CLIENT rejects a Deliverable, then VeriFast shall, at VeriFast’s sole expense, remedy the issues identified by CLIENT with such Deliverable and re-deliver the Deliverable to CLIENT. This cycle shall continue until the earlier of CLIENT’s acceptance of the Deliverable and the termination of the applicable SOW.

   4. Data.

      1. For the purposes of this Agreement:

1. “Input Data” means any data provided by the End User to VeriFast for the purposes of verifying his/her ability to pay.

2. “Output Data” means all data or information that is created or produced by, viewed through, or results from use of the VeriFast services including but not limited to the platform.  

2. Input Data.  The parties acknowledge and agree that: (i) ownership of the Input Data remains with the potential or actual tenant or borrower (the “End Users”); and (ii) the Client represents and warrants that it has obtain the proper consent from the End Users for the use of the Input Data. 

3. Output Data. 

1. VeriFast shall be the sole owner of the Output Data.  VeriFast shall have the right to use and exploit the Output Data for its own commercial purposes including the provision of its services to its clients. 

2. The Client shall have the right to use the Output Data for its internal business purposes only, and shall not sub-license, resell, transfer or other use or exploit the Output Data in any commercial way.  VeriFast grants the Client a revocable, non-exclusive, non-transferable and non-sublicensable license to use the Output Data for its internal business purposes. 

3. VeriFast shall not be responsible for any errors or inaccuracies with the Output Data to the extent that such errors and./or inaccuracies are due to underlying errors or inaccuracies with the Input Data.

7. REPRESENTATIONS AND WARRANTIES

   1. General. VeriFast represents and warrants the following: (a) it has the requisite corporate power and authority to execute and perform this Agreement and to grant to CLIENT any rights granted by VeriFast herein; (b) this Agreement, when duly and validly executed and delivered by VeriFast, will constitute the legal, valid, and binding obligation of VeriFast, enforceable against VeriFast in accordance with its terms; (c) VeriFast’s execution and performance of its obligations hereunder will not violate any agreement or other obligation by which it is bound; (d) VeriFast has and shall maintain in effect at VeriFast’s sole expense all licenses, certifications, credentials, permissions, authorizations, consents, registrations, and permits necessary to carry out its obligations under this Agreement; (e) VeriFast shall perform the Services hereunder and operate its business in compliance with all applicable federal, state, and local laws, regulations, and ordinances governing VeriFast; and (f) VeriFast has not been, nor is VeriFast currently, a defendant in any litigation, mediation, arbitration, or other legal proceeding, or proceeding conducted by any governmental authority, relating to the nature or quality of services or deliverables VeriFast has provided to others that are similar to any Services VeriFast is providing to CLIENT hereunder.

   2. Services. VeriFast represents and warrants that VeriFast shall perform all Services (a) in a timely, professional, and workmanlike manner, (b) using personnel having the skill, experience, training, and qualifications necessary to perform those tasks assigned to them, and (c) in conformity with the specifications set forth in the applicable SOW and the prevailing applicable commercial standards. VeriFast further represents and warrants that the Services shall perform in accordance with or otherwise conform to any and all performance capabilities, characteristics, specifications, functions, quality standards, and other descriptions and standards therefor as set forth in the applicable SOW or otherwise agreed in writing by CLIENT and VeriFast. If CLIENT notifies VeriFast of a breach of the foregoing warranty within 12 months after the completion of the performance of such Services, VeriFast shall promptly, as CLIENT may direct in CLIENT’s discretion, (i) re-perform or otherwise correct such nonconforming Services at no additional charge to CLIENT, (ii) reduce the charges related to the nonconforming Services by an amount that shall equitably reflect the reduced value of such Services;

   3. Deliverables. VeriFast represents and warrants that, for a period of twelve (12) months following the later of CLIENT’s acceptance (if applicable) and successful implementation and use in a production environment of any Deliverable, such Deliverable will (a) be free of any defects in workmanship and materials and (b) perform in accordance with or otherwise conform to any and all performance capabilities, characteristics, specifications, functions, quality standards, and other descriptions and standards therefor as set forth in the applicable SOW or otherwise agreed in writing by CLIENT and VeriFast. If CLIENT notifies VeriFast of a breach of such warranty, VeriFast shall promptly, as CLIENT may direct in CLIENT’s discretion, (i) remedy such nonconformance at no additional charge to CLIENT, (ii) reduce the charges related to the nonconforming Deliverable by an amount that shall equitably reflect the reduced value of such Deliverable; or (iii) terminate the applicable SOW. Acceptance under this provision shall not affect any warranty obligation of VeriFast under this Agreement. No invoice shall be issued with respect to a Deliverable until it has been accepted by CLIENT in accordance with this Section.

   4. Notification; Warranties Cumulative. VeriFast shall immediately notify CLIENT if VeriFast becomes aware that any of the representations or warranties set forth in this Section 7 are no longer true or have been breached. All such warranties are cumulative of and in addition to any other warranties provided by applicable law or equity.

8. MUTUAL INDEMNIFICATION

Each party (an “Indemnifying Party”) shall indemnify and hold harmless the other party, its Affiliates, and its and their respective partners, principals, officers, directors, employees, subcontractors, contractors, and agents (each, an “Indemnified Party”) from and against any and all liabilities, losses, expenses (including legal fees and expenses), fines, penalties, taxes, deductions, costs, charges, interest, premiums, or damages (collectively, “Liabilities”) arising out of or relating to any (a) personal injury, bodily injury (including death), or property damage to the extent caused by the Indemnifying Party or any of its employees, contractors, or other agents, (b) gross negligence, fraud or willful misconduct of the Indemnifying Party or any of its employees, contractors, or other agents, (c) breach or default by the Indemnifying Party of any term or provision of this Agreement, (d) violation of any applicable law, rule, or regulation by the Indemnifying Party or any of their employees, contractors, or other agents, (e) as to VeriFast, any claim asserted by a third party against any CLIENT Indemnified Party to the extent such Liabilities arise out of or result from any Services or Deliverables, (f) as to VeriFast, any claim that any Services or Deliverables, or any portion thereof, or any use thereof by or on behalf of CLIENT Indemnified Party, infringe, misappropriate, or otherwise violate any intellectual property right, any right of privacy, or any other proprietary right of any person, or (g) claim asserted by any third party against any Indemnified Party in connection with the Indemnifying Party’s calculation and payment (or non-payment), on behalf of its employees or contractors, of any wages, salaries, compensation, taxes, withholdings, or other statutory or contractual obligations of any kind, including Workers’ Compensation Insurance, The Affordable Care Act, The Federal Insurance Contribution Act, The Social Security Act, The Federal Unemployment Tax Act, income tax withholding (federal, state, and local), and any and all federal, state, or local taxes or contributions. In connection with any assertion of Liabilities by any third party against an Indemnified Party, the Indemnifying Party shall assume and maintain control of the defense of such claim. The Indemnifying Party shall not, without the Indemnified Party’s prior written consent, agree to any judgment or enter into any settlement or other compromise that adversely affects the interests of the Indemnified Party. In no event shall either party’s obligations hereunder be limited by (or to the extent of) any limits of or proceeds under any insurance policy covering either party and/or any contractors or agents thereof.

9. NON-ASSIGNABILITY; SUBCONTRACTING

VeriFast shall not assign, transfer, or subcontract any portion of its rights or duties hereunder without CLIENT’s prior written consent and approval, which CLIENT may grant or withhold in CLIENT’s sole discretion, and any attempt to do so shall be null and void and of no effect. VeriFast shall have the right to use subcontractors in the performance of its provided (a) the applicable subcontractor agreement complies with all applicable terms, conditions, and provisions of this Agreement. VeriFast shall be and shall remain jointly and severally liable for any and all of its obligations in this Agreement, including any SOW hereunder, to the extent that it subcontracts any portion thereof. As used in this Agreement, the term “contractors” includes any such subcontractors of VeriFast. VeriFast shall be responsible for all payments due to such subcontractor in respect of its performance of any Services, and VeriFast shall pay all such amounts promptly when due. No subcontractor shall be deemed a third-party beneficiary for any purposes under this Agreement. If VeriFast or its owners intend to sell all or substantially all of VeriFast’s assets, merge with another entity, or sell securities in a single or series of related transactions constituting a controlling interest in VeriFast (collectively, a “Change of Control”), VeriFast shall provide CLIENT with at least ninety (90) days’ notice prior to the consummation of such transaction. In addition to any other termination rights provided by this Agreement (specifically including Section 3.2), CLIENT may, upon written notice to VeriFast, terminate this Agreement and all SOWs if such Change of Control is to a competitor of CLIENT.

10. DIVESTED ENTITY RIGHTS

This Agreement, and the rights hereunder, shall be extended to each Divested Entity (defined below) to permit each such Divested Entity to continue to use and access the Services, and receive the benefits and rights under this Agreement, for a transition period not to exceed 12 months (the “Divestment Period”) in the same manner as if such Divested Entity was an Affiliate of CLIENT. VeriFast shall not be entitled to any additional fee for such Divested Entity use. With respect to the fees payable hereunder, the total usage of CLIENT, Affiliates, and any Divested Entity shall apply towards any applicable volume- based fees or minimum requirements. “Divested Entity” means any Affiliate or any business, division, department, or group of assets of CLIENT or any Affiliate which (a) was, immediately prior to a particular date (the “Divestment Date”) properly entitled to use the Services, (b) would not, on or after the Divestment Date, be entitled (other than by virtue of this Section 11) to use the Services, and (c) as of the Divestment Date, is either acquired by a legal entity or, in the case of any business, division, department, or group of assets, is constituted as a separate legal entity, or, in the case of an Affiliate, ceases to be an Affiliate for any other reason.

11. RECORDS AUDIT RIGHTS

VeriFast will maintain complete auditable records of all financial and non-financial transactions relating to this Agreement for a period of at least 3 years after the effective date of termination of this Agreement. Upon receiving a written request from CLIENT, VeriFast will provide CLIENT, its internal and external auditors, inspectors, and regulators, access to (a) sites where either VeriFast or any of its contractors are providing Services, (b) VeriFast’s personnel, and (c) data and records relating to the Services. Such access will be provided by VeriFast at reasonable times during regular business hours. CLIENT will provide VeriFast with at least ten (10) business days’ notice of an audit of such records. VeriFast will make the information reasonably required to conduct the audit available on a timely basis and assist CLIENT and its internal or external auditors as reasonably necessary. VeriFast will not be responsible for CLIENT’s expenses incurred for an audit unless the audit discloses an over-billing in excess of five percent (5%) during the period covered by the audit, in which case VeriFast will pay for the entire cost of the audit. For purposes of clarity, nothing in the foregoing sentence limits or affects VeriFast’s responsibility to promptly reimburse CLIENT for any over-billing that the audit uncovers.

12. RELATIONSHIP OF THE PARTIES

The parties intend VeriFast to serve solely under this Agreement as an independent contractor and not as an employee, agent, partner, or joint venturer of CLIENT. No other relationship is intended to be created between the parties. VeriFast will have no power or authority to bind CLIENT or assume or create any obligation or responsibility on CLIENT’s part or in CLIENT’s name and will not represent to any third party that VeriFast has such power or authority. Under no circumstances shall CLIENT be responsible for the payment of wages, salaries, compensation, taxes, withholdings, or other statutory or contractual obligations of any kind on behalf of or relating to any employees or contractors of VeriFast.

13. NON-EXCLUSIVITY

This Agreement is a nonexclusive arrangement and does not create any exclusivity of any nature between the parties. VeriFast acknowledges that it is not the exclusive supplier of any of the Services to CLIENT. VeriFast further acknowledges and agrees that at any time and in CLIENT’s sole discretion, CLIENT may perform or engage any third party to provide any services or deliverables similar to those provided by VeriFast under this Agreement.

14. PUBLICITY OR ENDORSEMENT

CLIENT may, upon written agreement executed by both parties, and subject to CLIENT’s branding guidelines, grant VeriFast express approval to refer to CLIENT or any Affiliate of CLIENT in any marketing, advertising, or promotional material or in any press release, publication, broadcast, website, or other public communication in any media, including the use of any trademark, service mark, trade dress, domain name, or other proprietary designation of CLIENT or any of CLIENT’s Affiliates, for any service provided by VeriFast.

15. MISCELLANEOUS

    1. Interpretation. For purposes of this Agreement, the following interpretations apply: (a) the words “include,” “includes,” and “including” are deemed to be followed by the words “without limitation”; (b) the word “or” is not exclusive; (c) the words “herein,” “hereof,” “hereby,” “hereto,” and “hereunder” refer to this Agreement as a whole;

(d) all references to days are to calendar days unless business days are specified; (e) “business day” means any day other than a Saturday or Sunday, or other day on which banking institutions located in New York, New York are authorized or obligated by applicable law to close; (f) all references to “dollars” or “$”mean United States Dollars;

(g) the word “person(s)” includes any legal entity(ies) as well as natural person(s); and (h) each party is contractually obligated to perform or refrain from performing each task or activity that it “shall,” “will,” or “must” perform or refrain from performing as set forth in this Agreement. Unless the context otherwise requires, the following shall apply: (i) references herein (A) to Sections and Exhibits mean the sections of, and the exhibits attached to, this Agreement; (B) to an agreement, instrument, or other document means such agreement, instrument, or other document as amended, supplemented, or modified from time to time to the extent permitted by the provisions thereof and by this Agreement; and (C) to a statute means such statute as amended from time to time and includes any successor legislation thereto and any regulations promulgated thereunder; and (ii) words in the singular or plural form include the plural and singular form, respectively. The exhibits referred to herein shall be construed with and as an integral part of this Agreement to the same extent as if they were set forth verbatim herein. Titles to headings of Sections are inserted for convenience of reference only and shall not be deemed a part of or to affect the meaning or interpretation of this Agreement. This Agreement shall be construed without regard to any presumption or rule requiring construction or interpretation against the party drafting an instrument or causing any instrument to be drafted. Words and expressions that are used in this Agreement, but not defined in this Agreement, have the meanings by which they are customarily understood through prevailing industry practice.

2. Governing Law; Venue and Jurisdiction. This Agreement and the rights and obligations of the parties hereunder are governed by, and shall be construed, interpreted, and enforced in accordance with, the laws of the State of Georgia, without reference to or application of its conflict of law rules. All actions in any way arising out of or relating to this Agreement shall be exclusively litigated in courts within such state, and the parties hereby irrevocably consent and submit to the venue and jurisdiction of any local, state, or federal court located therein.

3. Entire Agreement. This Agreement (including all SOWs) and any exhibits, schedules, addenda, supplements, or documents attached hereto or incorporated herein by reference together constitute the parties’ entire understanding with respect to the subject matter hereof and supersede all prior and contemporaneous representations, promises, understandings, communications, or agreements between the parties regarding such subject matter. No other representations, promises, understandings, communications, or agreements between the parties with respect to such subject matter, whether oral or written, shall be of any force or effect.

4. Language.  The official text of this Agreement shall be in the English language as used in the United States, and any interpretation or construction of this Agreement shall be based on the English language text. If and insofar as there is a discrepancy between the English language of this Agreement and a translated version of thereof, the English language shall prevail. The parties have expressly required that this Agreement and all documents and notices relating hereto be drafted in English. Les parties aux présentes ont expressément exigé que la présente convention et tous les documents et avis qui y sont afférents soient rédigés en anglais.

5. Amendments; Waivers. No supplement, modification, amendment, or change to this Agreement shall be valid and binding unless in writing and signed by authorized representatives of both parties (it being understood that no shrink- wrap agreements or “click-through” agreements, agreements, terms, or conditions posted to VeriFast’s website, terms or conditions set forth on order forms, invoices, purchase orders, or similar documents supplied by VeriFast or any contractors or agents thereof, or similarly unsigned electronic or written documents shall modify this Agreement or bind CLIENT, regardless of whether those terms are presented to CLIENT prior to or after this Agreement is executed). A waiver of rights under this Agreement will not be effective unless it is in writing and signed by an authorized representative of the party that is waiving its rights. No waiver of any breach, term, condition, or performance of this Agreement by either party, in any one or more instance, shall constitute a further waiver of the same or of any other breach, term, condition, or performance. Failure, delay, or forbearance by either party to insist upon strict performance of any provision of this Agreement, or to exercise any rights or remedies hereunder, shall not be construed as a waiver.

6. Severability. If any provision of this Agreement is held by the reviewing court to be overbroad, invalid, or otherwise unenforceable under the applicable law and circumstances, the parties agree to a reduction of the scope of such provision and the remainder of such provision shall remain in full force and effect. The invalidity or unenforceability, in whole or in part, of any provision of this Agreement shall not affect the validity or enforceability of any other provision. If any portion of this Agreement is held invalid or unenforceable with respect to particular circumstances, such portion nevertheless shall remain in full force and effect in all other circumstances.

7. Successors and Assigns; Third-Party Beneficiaries. This Agreement is binding upon and inures solely to the benefit of the parties and their respective successors and permitted assigns. Except as otherwise expressly set forth in this Agreement (including with respect to CLIENT Affiliates and CLIENT Indemnified Parties), it is not the intention of this Agreement or of the parties to this Agreement to confer a third-party beneficiary right of action upon any third party or entity whatsoever, and nothing in this Agreement, express or implied, confers, or shall be construed to confer, on any third party any legal or equitable right, benefit, or remedy of any nature whatsoever under or by reason of this Agreement.

8. Notices.  Each party shall deliver all notices, consents, claims, demands, and waivers under this Agreement (each, a “Notice”) in writing and addressed to the other party at its mailing or email address set forth below (or to such other address that the receiving party may designate in writing). Notices shall be deemed given as follows: if by hand delivery, upon receipt; if by nationally recognized overnight courier (with all fees prepaid), upon receipt; if by email of a PDF document, upon receipt of confirmation of transmission; or if mailed (sent by registered or certified mail, return receipt requested, and postage prepaid), three (3) days after deposit in the U.S. mail. Notices sent to Verifast shall be sent to Avery Smart, email: avery.smart@verifast.com. Notices sent to CLIENT shall be sent to CLIENT, Attention: [Insert Name], [Insert Address], email: [Insert Email], with a copy to [Insert Name/Email].

9. Counterparts; Execution. This Agreement (and each SOW) may be executed in one or more counterparts, each of which when so executed shall constitute an original and all of which together shall constitute one and the same agreement. An executed copy of this Agreement (and each SOW) shall be effective whether delivered as an original, by pdf, or other electronic format.

EXHIBIT A-1

FORM of STATEMENT OF WORK NO. [ ] (SPECIMEN ONLY – DO NOT EXECUTE)

This Statement of Work No. [ ] (this “SOW”) is entered into as of [Month day, year], (the “SOW Effective Date”) and is issued pursuant to, and is incorporated into and forms a part of, that certain VeriFast Services Agreement entered into as of [Month day, year], (the “Agreement”) by and between CLIENT Management Company (“CLIENT”) and Verifast, Inc. (“VeriFast”). Any capitalized term not otherwise defined herein shall have the meaning specified in the Agreement.

In the event of a conflict or inconsistency between the terms of this SOW and the terms of the Agreement, the terms of the Agreement shall control unless this SOW expressly states otherwise with respect to a specific provision of the Agreement.

The term of this SOW begins on [Month day, year], and ends on [Month day, year].

1. Services and Deliverables

[Insert a detailed description of the Services, including a detailed description of any Deliverables to be provided (including any specifications for such Deliverables)]

The Services also include such services that are a necessary or customary pre-requisite or sub-part of the services expressly set forth above. Unless expressly identified as to be performed by CLIENT, all tasks and activities set forth in this SOW will be performed by VeriFast, even if written in the passive voice.

2. Schedule

[Specify the time schedule for performing the Services, including any applicable Milestones, dates for delivering any Deliverables, and desired timing for periodic reports on progress of the same]

3. Acceptance

[Insert a detailed description of the process by which the Services or Deliverables will be accepted, including any relevant acceptance criteria]

4. Fees and Expenses

[Specify the terms of payment and any approved expenses]

The pricing for the Services is fixed during the term of this SOW, including all renewals or extensions thereof.

Billing

VeriFast setup fees are billed at the time of the SOW Effective Date. VeriFast Services are billed in advance on a monthly basis. Your billing cycle renews automatically until canceled and the billing cycle length may be changed at any time. CLIENT may add properties at any time upon notice to Verifast, and fees for such additions shall be prorated for the applicable month of such addition. CLIENT may remove properties upon thirty (30) days prior notice to Verifast.

Cancellation Policy

The term of this SOW is 12-months; however CLIENT may terminate this SOW at any time upon ninety (90) days notice, without penalty, and no fees shall be payable by CLIENT after such 90 day period. If cancellation is requested, the parties shall comply with the transition services provisions of Section 3.5 of the Agreement.

Taxes

Our fees do not include any purchase-specific taxes, such as sales or use taxes. If we’re required by law to collect or pay these taxes, we will add them to your service billing pursuant to Section 2.5 of the Agreement unless you provide us with a valid tax exemption certificate issued by the appropriate taxing authority.

Past Due Charges

If any undisputed invoiced amount is not received by the due date, those charges may accrue late interest fees at the rate of 1.5% of the outstanding balance per month or, if lower, the highest rate permitted under applicable law. Access to accounts with outstanding undisputed balances more than 90 days past due may be closed and all account data permanently deleted.

EXHIBIT B 

BACKGROUND CHECKS POLICY

This Background Checks Policy (this “Policy”) is attached to and made a part of that certain VeriFast Services Agreement (the “Agreement”) by and between CLIENT (“CLIENT”) and Verifast, Inc. (“VeriFast”). Any capitalized term not otherwise defined herein shall have the meaning specified in the Agreement.

VeriFast will pay for and conduct background checks, to the extent permitted by applicable law, on each individual it intends to assign to perform work under this Agreement (or who will otherwise have access to CLIENT’s Confidential Information), which background checks must (a) be conducted no earlier than 1 year prior to the date such individual is to commence performing work and (b) include, at a minimum, items with respect to such individual relating to the following for the prior 7 years: (i) Social Security trace; (ii) education verification;

3. employment verification; (iv) professional license verification (if applicable); (v) multi-jurisdictional index search; (vi) county and federal criminal misdemeanor and felony conviction report; (vii) state criminal check (if applicable); and (viii) financial administrative action report (FDIC, FRB, NCUA, OCC, OTS, FINRA, & SEC).

To the extent allowable by law, VeriFast will not permit any individual whose background check contains adverse results in the aforementioned categories to perform work under this Agreement.

VeriFast will provide copies of such background checks to CLIENT upon request

EXHIBIT C

PRIVACY AND DATA SECURITY APPENDIX

1. Definitions

“Applicable Law” means all laws and regulations in Canada and the United States applicable to the Processing of Personal Information under this Agreement. 

“CLIENT Systems” shall mean any CLIENT file computing system, database, server, website, application or networked environment or domain, including, without limitation, all development, quality assurance, staging and production environments owned or operated by or for CLIENT.

“Confidential Information” means any information relating to, disclosed, accessed, received or collected (in each case, by or on behalf, of a party) in the performance of this Agreement that is or should be reasonably understood to be confidential to a party, including, without limitation, the terms of this Agreement, financial, business and technical plans and strategies, pricing information, customer lists, Personal Information and Personal Financial Information (each as defined below), creative content, inventions and new products, services and technologies. Each party hereto acknowledges that (a) in the performance of its obligations hereunder, such party shall receive Confidential Information concerning the other party, and (b) unauthorized disclosure of any Confidential Information would irreparably damage the other party. For the avoidance of doubt, CLIENT Confidential Information also includes, without limitation, (i) any and all information accessed through or provided by any CLIENT System; (ii) any password issued to VeriFast for access to any CLIENT System; (iii) any information disclosed, accessed, received or collected through a third party acting on behalf of the CLIENT, for example, if VeriFast receives CLIENT information directly from another CLIENT service provider or other mechanism that provides (or provides access to) CLIENT Confidential Information outside of CLIENT itself, including, without limitation, through the provision of software as a service, platform as a service or an application programming interface; (iv) User Information; and (v) any Personal Information or Personal Financial Information that is provided by or pertains to CLIENT, any CLIENT representative, any customer of CLIENT or any other person associated with CLIENT.

“Data Security Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Client Confidential Information or Personal Information transmitted, stored, or otherwise Processed by VeriFast or its Agents.

“days” means calendar days unless otherwise specified.

“De-identified Data” means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such individual and (b) qualifies as “de-identified data” or a similar term under Applicable Law.

“Personal Information” shall mean any information, other than Personal Financial Information: (a) that identifies or can be used to identify, contact or precisely locate the person to whom such information pertains; (b) from which identification or contact information of an individual person can be derived; or (c) as otherwise may be defined by Applicable Law. Personal Information includes, without limitation: name, address, phone number, fax number and email address. Additionally, to the extent any other information (such as location, personal profile, unique identifier, biometric information, or IP address; however, expressly excluding any Personal Financial Information) is associated or combined with Personal Information or a unique device identifier, then such information also will be considered Personal Information for purposes of this Agreement.

“Process” or “Processing” means the collection, recording, organization, structuring, adaptation or alteration, retrieval, consultation, access, disclosure, transfer, storage, deletion, combination, destruction, disposal, or other use of information.

“Personal Financial Information” shall mean any and all financial account information, payment information or any other CLIENT or customer information defined as financial information under Applicable Law. For the avoidance of doubt, Personal Financial Information includes, without limitation, “cardholder data” and “sensitive authentication data” (as each such term is used in the PCI DSS), checking account information, bank account information, social security number and credit card security codes, or other government-issued identifier.

“Sanitization” (or to “Sanitize”) means a process that removes information from media or that renders such information irretrievable.

“Secure Destruction” means a process that destroys media on which information is located (“Destroyed”) and thereby makes recovery of such information impossible, consistent with NIST 800-88, as revised.

“User Information” shall mean all information pertaining to users of the CLIENT Systems, including, without limitation, any user Personal Information and Personal Financial Information and all user data that is generated, collected, stored, processed or used in connection with or derived from VeriFast’s performance of the Services, including without limitation, from cookies or other tracking technology placed in connection with the Services, whether or not such information has been de- identified, anonymized and/or aggregated.

2. Obligations; Non-Disclosure. Each party agrees that, except as expressly permitted in this Agreement, such party will not at any time during or after the term of this Agreement disclose any of the other party’s Confidential Information to any person. The non-disclosure obligations of each party specified in this Agreement shall not apply, and such party shall have no further obligations, with respect to any Confidential Information to the extent that such Confidential Information: (a) is generally known to the public at the time of disclosure or becomes generally known through no wrongful act on the part of the relevant party; (b) is in such party’s possession at the time of disclosure otherwise than as a result of that party’s breach of any legal obligation; (c) becomes known to such party through disclosure by sources other than the other party having the legal right to disclose such Confidential Information; or (d) is required to be disclosed by such party to comply with Applicable Law, provided that (i) such party provides prior written notice of such disclosure to the other party and takes reasonable and lawful actions to avoid and/or minimize the extent of such disclosure and (ii) such disclosure shall not include any information that could identify a particular person or device. Additionally, each party hereto shall have the right to disclose any and all Confidential Information to its respective business, legal, and financial advisors in the normal course of such party’s business, provided that (i) such advisors are subject to written non-disclosure requirements at least as restrictive as those that apply to the Parties pursuant hereto and (ii) such disclosure shall not include any information that could identify a particular person or device.

3. Limited Collection, Use and Access.

   1. VeriFast represents and warrants that, unless expressly permitted under this Agreement, it will not collect (including, without limitation, caching or storing), access, use, disclose, process or retain CLIENT Confidential Information for any purpose other than that which is necessary to perform the Services as otherwise permitted by Applicable Law. 

   2. For the avoidance of doubt, VeriFast specifically acknowledges and agrees that in providing the Services to CLIENT, VeriFast shall not share, sell, disclose, transfer, provide, or exchange CLIENT Confidential Information collected or received hereunder to any third party for any purpose other than as necessary to perform the Services (and not, for example, and without limitation, to otherwise (re-)identify, market to, or contact a user or permit a third party to do the same). VeriFast agrees that it shall act solely as a “VeriFast” under the CPRA with respect to any Personal Information in CLIENT Confidential Information, and VeriFast shall not take any action that would result in VeriFast not acting as a VeriFast under the CPRA with respect to that Personal Information.

4. Data Security.

   1. General. VeriFast agrees that its collection, use, storage and disposal of CLIENT Confidential Information shall at all times comply with Applicable Law. VeriFast shall, and shall contractually require and cause any Agents (as defined below), to implement and maintain security procedures and practices for Confidential Information that ensure a level of security appropriate to the risk and comply with Applicable Law and industry standards that will ensure its security and confidentiality, protect against any anticipated or actual threats or hazards to its security or integrity, and prevent unauthorized access, acquisition, destruction, use, modification and/or disclosure, including without limitation, establishing, implementing and maintaining an information security program (“Information Security Program”) as further set forth below. VeriFast and its Agents shall each ensure that its security infrastructures are consistent with industry standards for virus protection, firewalls and intrusion prevention technologies to help prevent VeriFast’s network, systems, servers and applications from unauthorized access as more fully described in this Exhibit C. VeriFast will restrict and track access to CLIENT Confidential Information and CLIENT Systems at all times to only those employees and Agents whose access is essential to performing the Services, and such employees and Agents will be required (including during the term of their employment or retention and thereafter) to protect CLIENT Confidential Information in accordance with the requirements of this Agreement. 

   2. Information Security Program. VeriFast’s Information Security Program shall at a minimum, require VeriFast to maintain and implement: (i) an organizational structure and appropriate security controls to identify and protect CLIENT Confidential Information in accordance with this Agreement; (ii) employee and Agent controls, such as communication of all applicable security policies, background checks (as permitted by Applicable Law), security awareness training, disciplinary processes; (iii) controls to ensure the physical safety and security of VeriFast’s facilities, including, without limitation, records of such access, available for review by CLIENT;
      (iv) controls to ensure VeriFast’s security posture is maintained over time, such as patch management, backups, and incident management; (v) controls to protect access to VeriFast’s systems, the CLIENT Systems and CLIENT Confidential Information, and ensure appropriate levels of access are restricted to authorized employees and Agents, and that authentication mechanisms are appropriately protected, such as key management and access rights auditing; and (vi) controls to ensure its software is securely developed in accordance with this Agreement, such as design reviews, secure separation of development and production environments, code reviews, and quality assurance testing.

   3. Monitoring and Security Flaw Resolution.

      1. VeriFast shall proactively ensure the security of its applications and environment. VeriFast shall ensure that the Services and its networks, servers and applications are continuously monitored for potential Security Flaws. VeriFast shall respond and resolve (at VeriFast’s expense) any detected Security Flaw within eight (8) hours of discovery.

   4. Access Control. VeriFast must utilize reasonable controls to prevent unauthorized access to CLIENT Confidential Information.

5. Disposal. As soon as possible after any of CLIENT Confidential Information (or a portion thereof) is no longer needed by VeriFast to fulfill its obligations under this Agreement, upon request of CLIENT, and in any event upon termination or expiration of this Agreement for any reason, VeriFast shall, and shall cause its Agents, to immediately Securely Destroy and certify such Secure Destruction (and produce a written certification upon request by CLIENT) of any or all of CLIENT Confidential Information and all records of CLIENT Confidential Information, (including, without limitation, all electronic copies such as on hard drives, backup tapes, portable devices, optical, magnetic, or other storage media, as well as all hard copies) or, if requested by CLIENT, return CLIENT Confidential Information to CLIENT through a secure method designated by CLIENT. VeriFast shall ensure that CLIENT Confidential Information is Destroyed. Non-functional electronic storage media (e.g., a failed drive) not capable of Sanitization, must be Destroyed. VeriFast shall track disposition of the media (e.g., Destroyed by VeriFast, Sanitized by VeriFast, conveyed to a CLIENT-authorized third party for Destruction, etc.) and store a Certificate of Sanitization (COS) and/or Certificate of Destruction (COD) upon completion of the Sanitization or Destruction and provide such COS or COD to CLIENT upon request.

6. Communications. VeriFast must implement network security controls for networks that will Process CLIENT Confidential Information, or otherwise be used in the performance of Services.

7. Business Continuity and Disaster Recovery.

   1. VeriFast must have a disaster recovery (“DR”) program and maintain a documented organizational business continuity plan (“BCP”). The program and plans must be designed to ensure that VeriFast can continue to function through operational interruption and continue to provide Services.

   2. VeriFast must ensure that the scope of the BCP covers all locations, personnel, and information systems that are used to perform Services.

   3. The DR plan and BCP must be minimally tested on an annual basis. VeriFast must document the results and, upon request, VeriFast will provide documentation for CLIENT’s review to confirm that such tests are being performed.

   4. VeriFast must promptly notify CLIENT in the event the DR plan and/or BCP is executed and report the potential impact on VeriFast’s capability to perform Services.

8. Access to CLIENT Systems and Facilities. The parties acknowledge that employees and/or Agents of VeriFast may be given access to CLIENT Systems and/or CLIENT’s facilities as determined by CLIENT in connection with the provision of the Services. VeriFast agrees that each proposed employee and Agent of VeriFast with that access shall have a business need to access CLIENT Systems and/or CLIENT’s facilities. 

9. Security Audit Rights. At the request of CLIENT and at CLIENT’s cost, VeriFast shall provide CLIENT, or an independent third-party auditor selected by CLIENT, access to, and the right to conduct a security audit of, all records, security policies and procedures, and other practices relating to the use, processing, storage and disclosure of CLIENT Confidential Information. The audit results and VeriFast’s plan for addressing or resolving issues identified by the audit shall be shared with CLIENT within ten (10) days of VeriFast’s receipt of the audit results. In addition, subject to VeriFast’s advance approval as to scope and timing, CLIENT also reserves the right to conduct, at its own cost, not more than twice per calendar year, technical security integrity reviews, and penetration tests and monthly Internet security scans to ensure VeriFast remains compliant with this Agreement and Applicable Laws (collectively, “Application Security Assessments”). CLIENT will provide seven (7) days’ notice prior to penetration testing or the commencement of monthly scanning activities. VeriFast shall correct any Security Flaw discovered by CLIENT within eight (8) hours. Further, VeriFast and any Agent that accesses, stores or collects CLIENT Confidential Information shall conduct, at its own cost, an Application Security Assessment annually using an independent third-party tester. CLIENT acknowledges that all information relating to VeriFast’s records, policies, procedures and systems shall constitute VeriFast’s Confidential Information subject to the Confidentiality provisions of this Agreement.

10. Agents. Client acknowledges and agrees that VeriFast may engage contractors, subcontractors, third-party service providers, or agents (collectively, “Agents”) to access and process Client Confidential Information for the purposes of providing the Services.  VeriFast shall, by way of contract or other legal act under Applicable Law ensure that every Agent is subject to obligations regarding the processing of Client Confidential Information that are no less protective than those to which VeriFast is subject under this Agreement.  VeriFast shall remain liable and responsible for the performance or non-performance of its Agents.

11. Data Processing. VeriFast will receive Personal Information from or on behalf of CLIENT. The Personal Information is disclosed by CLIENT only for limited and specified purposes set forth in the Agreement. With respect to Personal Information provided by CLIENT, or otherwise Processed by VeriFast on CLIENT’s behalf, VeriFast shall, and shall ensure any person engaging in Processing Personal Information on its behalf, shall: 

    1. Process Personal Information only to deliver services as instructed and permitted by CLIENT, in compliance with Applicable Law, collect that Personal Information approved by CLIENT, not sell or share (as those terms are defined in the CPRA) and not Process Personal Information for any other purpose, including for a commercial purpose other than the business purposes set forth in the Agreement and the direct business relationship between the CLIENT and VeriFast, unless CLIENT has provided its prior written agreement or otherwise required by Applicable Law;

    2. Not combine any Personal Information that VeriFast Processes under this Agreement with any Personal Information that VeriFast Processes on behalf of any third party or from its own interaction with the data subject except as instructed in writing by CLIENT or otherwise expressly permitted by Applicable Laws;

    3. Not disclose or transfer Personal Information to, or allow access by, any third party (including Agents) unless such third party has entered into an agreement that is no less protective than that to which VeriFast is subject under this Agreement;

    4. Where appropriate, kept up to date, and ensure that any Personal Information which is inaccurate or incomplete is erased or rectified in accordance with CLIENT’s instructions;

    5. Notify CLIENT , unless specifically prohibited by Applicable Law, if VeriFast receives: (i) any requests from an individual with respect to Personal Information Processed, including but not limited to opt-out requests, requests for access and/or rectification, blocking, and all similar requests, and shall not respond to any such requests unless expressly authorized to do so by CLIENT; (ii) any complaint relating to the Processing of Personal Information, including allegations that the Processing infringes on an individual’s rights under Applicable Law; or (iii) any order, demand, warrant, or any other document purporting to compel the production of Personal Information under Applicable Law. VeriFast shall cooperate with CLIENT with respect to any action taken relating to such request, complaint, or order or other document;

    6. Take appropriate technical and organizational measures for the fulfillment of data subject requests under Applicable Law;

    7. Provide employees and personnel who will be provided access or will otherwise Process Personal Information with appropriate training regarding information security and the protection of Personal Information and ensure such employees and personnel have committed to maintaining Personal Information confidentially;

    8. Provide to CLIENT, its authorized representatives, and such independent inspection body as CLIENT may appoint, on reasonable notice: (i) access to VeriFast’s information, processing premises, and records; (ii) reasonable assistance and cooperation of VeriFast’s relevant staff; and (iii) reasonable facilities at VeriFast’s premises for the purpose of auditing VeriFast’s compliance with its obligations under this Agreement and Applicable Laws; and

    9. Take any other steps reasonably requested by CLIENT to assist CLIENT in complying with any notification, registration, data protection impact assessment or other obligations applicable to CLIENT under Applicable Law or in responding to any investigation by any law enforcement body or regulator if and to the extent such regulation relates to Confidential Information handled by VeriFast on CLIENT’s behalf.

12. De-identified Data. VeriFast may de-identify CLIENT’s Personal Information. In the event VeriFast de- identifies CLIENT’s Personal Information, VeriFast shall: (a) ensure, through the implementation of reasonable measures, that De-identified Data cannot reasonably be used to infer information about, or otherwise be linked to, a particular natural, human person or a household; and (b) publicly commit to continue to maintain and use De-identified Data in a de-identified form and not to attempt to re-identify the De-identified Data, except that VeriFast may attempt to re-identify the information solely or the purpose of determining whether its de-identification processes satisfy the requirements of Applicable Law.

13. International Transfer of Data. VeriFast may transfer CLIENT Confidential Information to, or allow access to CLIENT Confidential Information by, its employees or Agents in any location outside the United States . VeriFast shall comply with all Applicable Laws when transferring the Client Confidential information outside of the United States or other foreign countries.   

14. Assistance with Regulator Interactions. Upon notice to VeriFast, VeriFast shall assist and support CLIENT in the event of an investigation by any regulator, including a data protection regulator, or similar authority, if and to the extent that such investigation relates to Confidential Information handled by VeriFast on behalf of CLIENT. Such assistance shall be at CLIENT sole expense, except where such investigation was required due to VeriFast’s acts or omissions, in which case such assistance shall be at VeriFast’s sole expense. VeriFast shall take any other steps reasonably requested by CLIENT to assist CLIENT in complying with any notification, registration or other obligations applicable to CLIENT or its Affiliates under Applicable Law with respect to Personal Information or Personal Financial Information. In the event that this Agreement, or any actions to be taken or contemplated to be taken in performance of this Agreement, do not or would not satisfy either party’s obligations under such laws, the Parties shall negotiate in good faith an appropriate amendment to this Agreement.

15. Breach Notification. VeriFast shall comply with Applicable Law with respect to Data Security Breach procedures, including, without limitation, notice requirements. 

16. Security Manager. On the effective date of this Agreement, VeriFast shall designate an individual as the primary security manager under the Agreement. The security manager shall be responsible for managing and coordinating the performance of VeriFast’s privacy and data security obligations under this Agreement.