Terms of Use

1. PREAMBLE

Aliston is a French limited liability company (société à responsabilité limitée) with share capital of €7,500, registered with the Trade and Companies Register of Versailles under number 511 850 471, whose registered office is located at 7 rue Christophe Plantin, 78540 Vernouillet, France ("Aliston").

Cirrus Shield is the software published by Aliston and provided in SaaS (Software as a Service) mode.

These terms of use (the "Terms") apply to Customers from their effective date and supersede any prior version.

The Software and Services are intended exclusively for professionals acting within the scope of their commercial, industrial, craft, professional or non-profit activity. The Customer represents that it is contracting in that capacity and acknowledges that the consumer-protection provisions of the French Consumer Code do not apply to it.

The Customer, having reviewed the capabilities, purpose, features, standard nature and operating mode of the SaaS service identified in the quote, and having had the opportunity to request a detailed presentation of the Cirrus Shield Software from Aliston, has decided to make use of it. The Customer acknowledges having received all the information and advice needed to assess Aliston's proposal and having satisfied itself that the Software is suited to its needs.

It is the Customer's responsibility to ensure:

• That the Software is suited to its own needs, in particular based on the information provided in the Documentation made available to it;
• That it has the skills required to access the Services and use the Software;
• That it has sufficient bandwidth and network access, in accordance with the prerequisites communicated by Aliston.

It is the Customer's responsibility to check, in accordance with the standards of its profession, the results obtained using the Software.

Any access to the Services and/or use of the Software presupposes knowledge of the Terms and entails their unconditional acceptance.

2. DEFINITIONS

"Administrator": means the person appointed by the Customer from among its Users, responsible for managing rights and access to the Software and holding administration privileges.

"Bug": means a malfunction of the Software, reproducible by Aliston, preventing its use in accordance with the Documentation.

"Customer": means the professional legal entity or natural person that has entered into an Agreement with Aliston to access the Services and use the Software.

"Agreement": means, in descending order of priority in the event of contradiction: the purchase order and quote (and their appendices), the DPA, and these Terms.

"Intended Purpose": means the purpose for which the Software was designed.

"Documentation": means the description of the Software's features and instructions for use, provided in electronic form in French or English. Any other documentation, including sales or training materials, is excluded from the Agreement.

"Customer Data": means all data, files, settings and content, including personal data, imported, entered or generated by the Customer and its Users in the Software.

"DPA": means the personal data processing agreement entered into between the Parties within the meaning of Article 28 of the GDPR, appended to the Terms and forming an integral part of the Agreement.

"AI Features": means the Software's features based on artificial intelligence systems, including models provided by third parties.

"Software": means the standard version of Cirrus Shield distributed by Aliston at the time the quote is signed, excluding customizations or specific developments, together with its subsequent updates.

"Operating Platform": means all hardware, software packages, operating systems, databases and environments on which the Software is operated.

"GDPR": means Regulation (EU) 2016/679 of 27 April 2016 on the protection of personal data.

"Services": means the services provided by Aliston under the Agreement.

"Third-Party Services": means services, applications, connectors or APIs provided by third parties and connected to the Software at the Customer's initiative.

"User": means a natural person authorized by the Customer to access the Software.

3. PURPOSE

The Terms are intended to define the conditions of access to the Services, the corrective maintenance of the Software during the subscription period, and the email support reserved for the Administrator trained by Aliston's teams.

4. EFFECTIVE DATE – TERM – RENEWAL

The Agreement is entered into for a term of one (1) year from the date indicated on the purchase order or, failing that, the date of the first invoice, unless otherwise provided in the Agreement. It is automatically renewed for successive twelve (12) month periods, unless either Party gives notice by registered letter with acknowledgment of receipt or by email to contact@cirrus-shield.com, acknowledged by Aliston by email or registered letter with acknowledgment of receipt, at least two (2) months before the end of the then-current period.

The provisions of this article are without prejudice to the Customer's rights under Article 17 (Reversibility and Change of Provider).

5. CONDITIONS OF ACCESS TO THE SOFTWARE

Access to the Software is provided exclusively via the Internet, at the Internet address communicated to the Customer. The Customer is solely responsible for its Internet connection and all related costs.

The number of authorized Users corresponds to the number of subscriptions defined in the purchase order. Each User has personal, strictly confidential login credentials (login and password). The Customer undertakes to ensure that its Users maintain this confidentiality. Any connection made using a User's credentials is deemed, absent proof to the contrary, to have been made by the Customer. Aliston may impose password strength requirements and the implementation of multi-factor authentication.

Access management is carried out through the Administrator: creating Users and associated login credentials (within the limit of the number of Users defined in the Agreement), deleting or modifying login credentials, and managing security rules and access rights for each User.

The Customer undertakes, both on its own behalf and on behalf of the Users it has designated, to immediately inform Aliston of any use of login credentials it deems fraudulent. Aliston shall not be liable for any loss or damage resulting from access to the Software by a User or by a third party using login credentials in the Customer's custody.

6. OPERATION AND USE

Aliston undertakes to use all reasonable means at its disposal to ensure the permanence, continuity and quality of the Services. In the event of a network incident, Aliston undertakes to use all reasonable means at its disposal to restore access to the Services as soon as possible.

For technical reasons, Aliston reserves the right, subject to four (4) calendar days' notice, to temporarily interrupt all or part of the Services. Scheduled interruptions shall, as far as possible, take place outside business hours (9:00 a.m. to 6:00 p.m. Paris time, business days) and may not exceed six (6) consecutive hours during business hours and days. In the event of an emergency justified by a security imperative, Aliston may act without notice, provided it informs the Customer as soon as possible.

As a general rule, routine operation and maintenance tasks (backup, software updates) do not require interruption of the Services. Aliston's equipment is designed for 24/7 operation.

Aliston reserves the right to change the Software's features at any time, without materially degrading the essential features subscribed to. Aliston ensures the protection of the Operating Platform, processing, transmissions and backups, under the conditions set out in Article 20 (Security).

The storage capacity allocated to the Customer is defined in the quote or, failing that, under the pricing conditions then in effect. Beyond this, additional charges will be invoiced based on the rates then in effect.

7. USAGE RIGHTS

Aliston grants the Customer, for the term of the Agreement, a personal, non-exclusive, non-assignable and non-transferable right to use the Software, in accordance with its Intended Purpose, for its own needs only, within the limit of the agreed number of Users, and in accordance with the Documentation.

The Customer undertakes to request an additional quote from Aliston if it needs to create users beyond the maximum number set out in the Agreement. In the event of a confirmed excess of the maximum number of Users set out in the Agreement, the Customer shall immediately become liable to Aliston for an additional fee at the rate then in effect.

Any use not expressly authorized by Aliston under the Agreement is unlawful, pursuant to Article L.122-6 of the French Intellectual Property Code. In particular, the Customer is prohibited from:

• Using the Software or the Documentation in any way for the purpose of designing, producing, distributing or marketing a similar, equivalent or substitute software package;
• Making the Software or the Documentation available, directly or indirectly, to a third party, in particular by lease, assignment or loan, even free of charge, or entrusting it to any service provider as part of outsourcing, except with Aliston's prior written consent;
• Decompiling, disassembling or reverse-engineering the Software, except in the limited cases provided for in Article L.122-6-1 of the French Intellectual Property Code;
• Attempting to access the Operating Platform without authorization, testing its vulnerability, or carrying out penetration testing without Aliston's prior written consent;
• Carrying out a bulk or automated extraction or reuse of the content or structure of the Software's databases (Articles L.342-1 et seq. of the French Intellectual Property Code), in particular through scraping techniques;
• Using the Software, the Documentation or the data derived from them to develop, train or improve a competing artificial intelligence product, service or model;
• Publishing or communicating to third parties any performance measurements or benchmarks of the Software without Aliston's prior written consent;
• Using the Software for any processing not authorized by Aliston or contrary to applicable regulations.

8. INTELLECTUAL PROPERTY

Aliston represents that it holds all the intellectual property rights necessary to enter into the Agreement. The right of use granted under the Agreement does not entail any transfer of intellectual property to the Customer. Accordingly, the Customer shall refrain from any act that could directly or indirectly infringe Aliston's rights in the Software, which is protected in particular by the French Intellectual Property Code.

Customer Data is and remains the exclusive property of the Customer. The Customer grants Aliston, for the term of the Agreement, a non-exclusive, worldwide license to host, reproduce, process, back up and display Customer Data, solely for the purpose of performing the Agreement.

Aliston is authorized to compile and use aggregated and anonymized usage data, which does not allow the identification of the Customer, any User or any data subject, for statistical, security and Software-improvement purposes.

9. INFRINGEMENT WARRANTY

In the event of a claim alleging that the Software infringes an intellectual property right in France or the European Union, Aliston may, at its option and expense, either replace or modify all or part of the Software, or obtain a license for the Customer allowing it to use the Software, provided that the Customer:

• Has performed all of its obligations under the Agreement, and is in particular current on its fees;
• Has notified Aliston, within eight days, by registered letter with acknowledgment of receipt, of the infringement action or the claim preceding such action;
• Allows Aliston to defend its own interests and those of the Customer, and to that end, cooperates in good faith with Aliston by providing all information and assistance necessary to conduct such defense.

If none of these measures is reasonably feasible, Aliston may terminate the Agreement and shall compensate the Customer by refunding the fees paid over the twelve (12) months preceding notice of termination.

The provisions of this article set out the full extent of Aliston's obligations with respect to infringement of patent or copyright resulting from use of the Software.

10. ASSISTANCE – MAINTENANCE – TECHNICAL SUPPORT

During the term of the Agreement, the Customer benefits from the delivery and installation of corrective and technological updates to the Operating Platform.

Aliston will further provide the Customer with email support and maintenance services related to the Software. Within the scope of the Agreement, Aliston makes available to the Customer a team of support consultants to provide technical and functional assistance for the Software.

Except on public holidays and Aliston's exceptional closure days, and barring force majeure as defined herein, the support team's hours of operation are 9:00 a.m. to 6:00 p.m. (Paris time), Monday to Friday. Aliston reserves the right to change these hours and will notify the Customer of the new time slots by any means it deems appropriate.

The Services include: unlimited access to email support for the Administrator trained by Aliston's teams, provided exclusively to assist with use of the Software or to handle Bugs; and updates to the Software under the conditions of this article.

The need to carry out an update is decided unilaterally by Aliston in light of legal and/or technological developments. Updates are implemented directly by Aliston on the Software and may, as applicable, include: correction of Bugs, and enhancement of existing functions.

The following are excluded from the services provided by Aliston under the Agreement:

• Use of the Software not in accordance with the Documentation, the instructions for use or its Intended Purpose, or abnormal use for any reason whatsoever (in particular negligence, handling error, accident, etc.);
• Any work or supplies not explicitly mentioned in the Agreement, including telephone training of the Customer's personnel;
• Compatibility issues between the Software and any other hardware, network or software environment of the Customer, or any failure thereof;
• The provision of a telecommunications network enabling access to the Software;
• More generally, the consequences of the Customer's failure to comply with its obligations under the Agreement or any other agreement entered into with Aliston.

11. ADDITIONAL SERVICES

The Agreement does not cover additional services recommended by Aliston or requested by the Customer to meet its specific needs. Consulting, training and consulting services, data migration or recovery services, and telephone support for the Administrator or Users, are subject to a separate agreement or quote.

12. COOPERATION

The Customer undertakes, in particular, to:

• Refer to the Documentation before each request for intervention;
• Provide Aliston with any information requested by Aliston to understand and resolve Bugs encountered;
• Designate, from among its personnel, a competent point of contact responsible for handling Bugs, who shall be available throughout Aliston's intervention;
• Facilitate access by Aliston's personnel to all its premises where necessary and provide Aliston's personnel with free access to its premises and an appropriate point of contact;
• Install and administer its own equipment, applications and networks not supplied by Aliston.

13. FEES

The initial fee for the right to the Services payable by the Customer will be determined in the quote based on the number of Users designated by the Customer and the options agreed by mutual consent under the Agreement.

Aliston may revise the amount of the annual fee at each renewal, up to the higher of the following two values: (i) the annual change in the Syntec index, or (ii) seven percent (7%). Any revision is notified to the Customer by email at least sixty (60) days before the renewal date. If the revision exceeds the annual change in the Syntec index, the Customer may refuse the revision by giving notice of non-renewal of the Agreement at the renewal date, within thirty (30) days of notice of the revision, notwithstanding the notice period set out in Article 4. Failing that, the revised fee shall apply from the renewal date.

14. PAYMENT TERMS

Invoices are issued annually, in advance, payable within 30 days by direct debit.

Notwithstanding Article 1342-10 of the French Civil Code, the Parties expressly agree that, where several invoices are due and the Customer makes a partial payment, Aliston shall be free to allocate such payment as it sees fit, notwithstanding any indication to the contrary given by the Customer.

In the absence of payment of invoices by their due date, unpaid amounts shall, without prior formal notice, give rise to the invoicing of late-payment interest calculated per day of delay on the basis of the interest rate applied by the European Central Bank to its most recent refinancing operation, increased by 10 percentage points, in accordance with Article L.441-10 of the French Commercial Code. This interest accrues from the day following the payment due date until the date of payment in full. In addition, in the event of late payment by the Customer, a flat-rate compensation for collection costs of forty euros (€40) shall automatically be due. Additional compensation may be claimed by Aliston, upon substantiation, where the collection costs actually incurred exceed the above flat-rate compensation.

The fee for the right of use, together with all other amounts due under these terms, are stated exclusive of VAT, customs duties, withholding taxes and all applicable taxes, which shall be borne by the Customer. Where a withholding tax, customs duty or import tax applies, the Customer shall pay such taxes to the competent tax authorities and shall spontaneously provide Aliston with proof of payment.

Furthermore, without prejudice to its right to claim damages through any legal means, or to its right to terminate the Agreement, in the event of non-payment thirty (30) days beyond the agreed payment term, despite formal notice having gone unheeded, Aliston reserves the right to suspend its obligations under these terms, including access to the Software, until full payment of the principal amount, penalties, service-reinstatement fees and interest. Service-reinstatement fees will be invoiced to the Customer based on the rate in effect at the time of reinstatement; for guidance, such fees currently amount to a flat rate of four hundred euros excluding tax (€400 excl. tax) as of the date hereof. This suspension does not change the amount of the monthly fee, which remains due for the entire current period; the Services will resume as soon as the cause of suspension has been remedied, without extending the current period.

No set-off may occur without Aliston's prior written consent.

15. SUSPENSION OF SERVICES

In addition to the case of non-payment referred to in Article 14, Aliston may suspend all or part of access to the Services, after prior notice to the Customer except in an emergency, in the event of: (i) a proven risk to the security, integrity or availability of the Operating Platform or the data of other customers; (ii) use of the Software in violation of the Terms or applicable regulations; (iii) an injunction from a judicial or administrative authority. Suspension does not constitute termination, does not give rise to any compensation, and does not exempt the Customer from paying the fee during the suspension period.

16. TERMINATION

16.1 Termination by the Customer

The Services may not be terminated during a subscription period, unless expressly stated for all or part of the Services in the quote. Where the Customer wishes to terminate Services that may be terminated, payments already made will not be refunded and amounts due for the current period remain payable. These provisions are without prejudice to the Customer's rights under Article 17.

16.2 Termination for Breach

In the event either Party fails to perform a material obligation under the Agreement, and such failure is not remedied within thirty (30) calendar days of the first presentation of a registered letter with acknowledgment of receipt notifying the breach in question and the risk of termination, the other Party may terminate the Agreement by registered letter with acknowledgment of receipt, without prejudice to any damages it may be entitled to claim under the Agreement.

Termination takes effect on the date the notice is first presented, and results in the immediate suspension of all of the Customer's access to the Services, subject to Article 17. Termination or expiry of the Agreement, for whatever reason, does not give rise to a refund of amounts collected by Aliston. By way of exception, where termination is pronounced for breach by Aliston under this article, Aliston shall reimburse the Customer the pro rata portion of the fee corresponding to the prepaid subscription period that has not yet elapsed as of the effective date of termination.

17. REVERSIBILITY – CHANGE OF PROVIDER – FATE OF DATA

This article applies in accordance with Regulation (EU) 2023/2854 of 13 December 2023 (the "Data Act"), applicable since 12 September 2025.

17.1 Ongoing Export

The Software allows the Customer to export its Customer Data at any time, free of charge, in a structured, commonly used, machine-readable format.

17.2 Change of Provider

The Customer may notify Aliston at any time of its wish to change data-processing service provider, migrate to on-premises infrastructure, or repatriate its Customer Data. The applicable notice period may not exceed two (2) months. Upon expiry of the notice period, a thirty (30) calendar-day transitional period begins, during which Aliston cooperates in good faith with the Customer and, where applicable, the receiving provider, and maintains continuity of the Services. If migration is technically unfeasible within this timeframe, Aliston shall notify the Customer within fourteen (14) business days of the request, indicating an alternative transitional period, which may not exceed seven (7) months.

Aliston provides reasonable assistance with the transfer of exportable Customer Data. Any fees charged for this purpose shall not exceed the costs incurred by Aliston that are directly related to the change; from 12 January 2027, no change fees will be charged, in accordance with Article 29 of the Data Act. Services beyond Aliston's legal obligations (data recovery, transformation or enrichment, project support, specific developments) remain chargeable on a quoted basis.

A change of provider or repatriation of data during a subscription period does not exempt the Customer from payment of amounts due for the current period.

17.3 Data Recovery and Deletion

From termination of the Agreement, whatever the cause, Customer Data remains recoverable by the Customer for a minimum period of thirty (30) calendar days. The Customer may request Aliston's assistance with recovery, under the conditions set out in Article 17.2.

At the end of this recovery period, or upon the Customer's prior written request, Aliston shall delete Customer Data from its active systems within thirty (30) days. Backup copies are destroyed at the end of their normal rotation cycle, not exceeding six (6) months. A certificate of deletion is provided upon request. Data whose retention is required of Aliston by a legal obligation is excepted.

18. SOURCE CODE ESCROW

In the event Aliston permanently ceases business without the Software being taken over, the Customer may request access to the source code of the programs owned by Aliston, under an escrow agreement entered into with a specialized organization, the costs of establishing and maintaining which shall be borne by the requesting Customer.

19. PROTECTION OF PERSONAL DATA

Each Party undertakes to comply with applicable regulations on the protection of personal data, in particular the GDPR and French Law No. 78-17 of 6 January 1978, as amended.

19.1 Processing of Customer Data — Aliston as Processor

With respect to personal data contained in Customer Data, the Customer acts as data controller and Aliston as processor within the meaning of Article 28 of the GDPR. This processing is governed by the DPA appended to the Terms, which sets out, in particular, the subject matter, duration, nature and purposes of the processing, the categories of data and data subjects, the Customer's documented instructions, security measures, the regime for sub-processing, Aliston's assistance, notification of data breaches without undue delay after discovery, the fate of the data, and audit arrangements.

Customer Data is hosted in France, in the data centers of OVH SAS (OVHcloud). Any transfer of personal data outside the European Union or the European Economic Area is governed in accordance with Chapter V of the GDPR.

It is the Customer's responsibility, as data controller, to ensure the lawfulness of the processing it carries out by means of the Software, to ensure that data subjects are informed and can exercise their rights, and to entrust Aliston only with data collected lawfully.

19.2 Contractual Relationship Management Data — Aliston as Controller

With respect to data relating to the Customer's contacts (identity, professional contact details, billing and login data), Aliston acts as data controller, for the purposes of managing the contractual relationship, billing, support and security. Data subjects have the rights set out in Articles 15 to 22 of the GDPR, which they may exercise at contact@cirrus-shield.com, and may lodge a complaint with the CNIL (French data protection authority). Aliston's privacy policy, available at www.cirrus-shield.fr, provides further detail on this processing.

19.3 Health Data — Exclusion

Aliston is not certified as a "Health Data Host" (HDS) within the meaning of Article L.1111-8 of the French Public Health Code. The Software is accordingly not intended for the hosting of personal health data collected in connection with prevention, diagnosis, care or medico-social follow-up activities.

The Customer shall not import, enter or have such data processed in the Software, except with Aliston's prior written consent formalized in special terms. Any breach of this provision is the sole responsibility of the Customer and authorizes Aliston to implement Article 15 (Suspension of Services).

20. SECURITY

Aliston implements appropriate technical and organizational measures within the meaning of Article 32 of the GDPR, including in particular: access control and traceability, encryption of data flows, daily data backups, regular testing of restoration procedures, protection against malware, and up-to-date security components. These commitments constitute an obligation of means.

The Customer remains responsible for the security of its own information systems, management of access rights by the Administrator, the strength of its Users' passwords, and the security of the Third-Party Services it connects to the Software.

21. ARTIFICIAL INTELLIGENCE FEATURES

Certain features of the Software may rely on artificial intelligence systems, including models provided by third parties. Aliston identifies these AI Features in the Documentation, in accordance with the transparency obligations of Regulation (EU) 2024/1689 (the "Artificial Intelligence Act").

Content generated by the AI Features is provided as assistance and suggestions only, with no guarantee of accuracy, completeness or fitness for a particular purpose. The Customer verifies such content at its own responsibility before any use and maintains appropriate human oversight. The Customer shall not use the AI Features for practices prohibited by the Artificial Intelligence Act, or to make, without significant human intervention, decisions producing legal or similarly significant effects on natural persons.

Customer Data is not used to train general-purpose artificial intelligence models, except with the Customer's prior written consent.

22. LIABILITY

22.1 Customer Liability

The Customer and Users undertake to comply with applicable regulations, in particular regarding intellectual property, the protection of personal data and privacy. The Parties acknowledge that only the Customer has control over the content passing through the Operating Platform.

The Customer warrants that it holds all authorizations for the use and/or distribution, within the relevant territory, of the information and data of any kind hosted via Cirrus Shield, and is solely responsible for the consequences of making such data available to the public. The Customer shall not include in the data hosted via Cirrus Shield any unlawful content, such as defamatory, hateful or discriminatory statements, or personal data processed in violation of applicable regulations.

In the event of a breach of French Law No. 2004-575 of 21 June 2004, as amended (LCEN), and Regulation (EU) 2022/2065 (the "DSA"), established by a judicial authority within the meaning of those laws, or in the event of an injunction issued by a competent authority to remove unlawful content, Aliston may take any measures necessary to remove such content or prevent access to it, without the Customer's prior consent, subject only to informing the Customer thereof, before or after the fact. Where it appears to Aliston that data hosted on the Customer's behalf is manifestly unlawful, Aliston may take any useful measure to remove or block access to it, and shall inform the Customer accordingly. In the event of an amicable claim or formal notice from a third party addressed to Aliston alleging that content is unlawful or causes it harm, Aliston will inform the Customer without delay.

The suspension or interruption of access to content for the above reasons shall not entitle the Customer to any compensation from Aliston. Furthermore, the Customer shall remain liable to Aliston for the full agreed price throughout the period of suspension or interruption. In all cases, the Customer indemnifies Aliston against the financial and other consequences of any claim, action, or, a fortiori, any judgment to which Aliston may be exposed as a result of unlawful data it has had hosted via Cirrus Shield under the Agreement.

22.2 Aliston's Liability

Aliston is subject to an obligation of means under these terms.

Aliston's liability may only be engaged in the event of proven fault and only for direct damages. Aliston shall in no event be liable for indirect damages, which the Parties expressly agree to include: loss of business, commercial losses, loss of customers, loss of orders, loss of revenue or profit, loss of opportunity, business disruption of any kind, harm to reputation, damages resulting from the use or inability to use Third-Party Services, and any action brought against the Customer by a third party, except in the cases referred to in Article 9.

If Aliston's liability is established by a final decision of a competent court, the total compensation that may be claimed, for all causes and all damages combined, shall be expressly limited to the amount of fees actually collected by Aliston for the Services during the six (6) months preceding the event giving rise to the damage.

The limitations and exclusions in this article do not apply in the event of fraud or gross negligence by Aliston, bodily injury, or in cases where the law prohibits limiting liability. They survive termination or rescission of the Agreement, even where established by a court. The Parties acknowledge that this article establishes an allocation of risk between them and that the price of the Services reflects that allocation.

Aliston shall not be liable for the erroneous application, or absence of application, of usage advice provided as part of support, nor for the application of advice not originating from Aliston, nor for the acts of third parties or Third-Party Services.

23. INTERNET DISCLOSURE

The Customer acknowledges that it is familiar with the Internet, its characteristics and its limitations, and in particular acknowledges:

• That data transmissions over the Internet enjoy only relative technical reliability;
• That certain specific networks may be subject to access restrictions that will prevent access to the Software;
• That data circulating over the Internet is not fully protected against possible interception, and that the Customer communicates passwords, confidential codes and generally any sensitive information at its own risk;
• That the content made available via the Software may be subject to unauthorized third-party intrusion and may consequently be compromised, despite Aliston's provision of password-protected access.

24. TECHNICAL PROTECTION MEASURES

The Customer is informed of, and expressly accepts, that the Software includes technical devices that, upon an Internet connection, transmit to Aliston technical identification information (in particular the IP address and connection logs). This information may be used by Aliston for security purposes, to combat fraud and infringement, and to detect any unlawful or non-compliant use of the Software. Trackers placed via Aliston's website are governed by its cookie policy, in accordance with Article 82 of Law No. 78-17, as amended.

25. FORCE MAJEURE

The Parties' liability shall be excluded if the failure to perform all or part of their obligations results from an event of force majeure within the meaning of Article 1218 of the French Civil Code.

Events of force majeure suspend performance of the Agreement; the Parties shall meet to determine how to proceed with their relationship. If the force majeure event lasts more than one (1) month, the Agreement may be terminated automatically by either Party, without indemnity, unless otherwise agreed.

The following are expressly considered events of force majeure or fortuitous events, in addition to those customarily recognized by French case law: blockage, disruption or congestion of telecommunications networks; failure of hosting, energy or telecommunications providers; large-scale cyberattacks (including denial-of-service attacks and ransomware) affecting Aliston or its hosting providers despite reasonable security measures; blockage of transportation or supply means for any reason whatsoever; severe weather, epidemics and pandemics, earthquakes, fires, storms, floods and water damage; governmental or legal restrictions, and legal or regulatory changes to forms of commercialization.

26. INTERNATIONAL SANCTIONS – EXPORT CONTROLS

Each Party represents that it complies with applicable regulations regarding economic sanctions, embargoes and export controls, in particular those of the European Union and the United Nations. The Customer warrants that neither it, nor its beneficial owners, appear on any list of sanctioned persons or entities, and shall not use the Software from, or for the benefit of, any country, territory, person or entity subject to such measures. In the event of a violation, Aliston may suspend or terminate the Agreement automatically, without indemnity or refund.

27. ELECTRONIC INVOICING

The Customer agrees to receive invoices from Aliston in electronic form, including, within the scope of the French electronic invoicing reform (Article 289 bis of the French General Tax Code), via an approved platform. The Customer shall provide Aliston with the information necessary to address its electronic invoices and shall promptly inform it of any changes.

28. EVIDENCE AGREEMENT

The logs, connection records, timestamps and technical records kept by Aliston under reasonable security conditions shall be deemed valid evidence between the Parties, absent proof to the contrary, in particular regarding access, usage volumes and operations carried out within the Software. The Parties acknowledge the validity and evidential force of electronic writings and signatures under the conditions set out in Articles 1366 and 1367 of the French Civil Code.

29. MISCELLANEOUS

29.1 Changes to the Terms

Aliston reserves the right to modify the Terms. Any modification shall be notified to the Administrator at least thirty (30) days before it takes effect. Continued use of the Services after that date constitutes acceptance. If a material modification increases the Customer's obligations, the Customer may refuse the modification by terminating the Agreement as of the date the modification takes effect, by written notice given before that date, without indemnity on either side. In that case, Aliston shall reimburse the Customer the pro rata portion of the fee corresponding to the prepaid subscription period not yet elapsed as of the effective date of termination; amounts already due remain payable to Aliston.

29.2 Confidentiality

Customer Data is and remains the property of the Customer. Aliston undertakes to keep such data confidential, to make no copies of it other than as required for technical or backup purposes, and to make no use of it other than as provided for in the performance of the Agreement and in Article 8. Reciprocally, the Customer undertakes to maintain full confidentiality regarding Aliston's documents, pricing information, data and deliverables of which it becomes aware in connection with the Agreement. These obligations survive for five (5) years after the end of the Agreement.

29.3 Waiver

The fact that a Party does not enforce any breach by the other Party of any obligation referred to in the Agreement shall not be construed as a waiver of that obligation for the future.

29.4 Limitation Period

In accordance with Article 2254 of the French Civil Code, any action by the Customer against Aliston relating to the performance of the Agreement is time-barred twelve (12) months after the event giving rise to it.

29.5 Assignment – Subcontracting

The Agreement is entered into on a personal basis (intuitu personae). The Customer's rights under the Agreement may not be assigned, sublicensed, sold or otherwise transferred by the Customer without Aliston's prior written consent. Aliston may freely assign or transfer the Agreement in connection with a merger, a transfer of business, a transfer of the relevant line of business, or any restructuring transaction, subject to informing the Customer. Aliston may use subcontractors to perform the Services, for which it remains responsible; the subcontracting of personal data processing is governed by the DPA.

29.6 Entire Agreement

The Agreement sets out the entire obligations of the Parties. Article headings shall be disregarded in the event of any difficulty in interpretation between a heading and a clause. No general or specific terms contained in documents sent or provided by the Customer (including its own general purchasing conditions) may become part of the Agreement or otherwise affect or modify its scope. Unless otherwise stated, the Agreement may only be amended by an addendum signed by authorized representatives of both Parties, without prejudice to Article 29.1.

29.7 Severability

If one or more provisions of the Agreement are held invalid or declared as such pursuant to a law, a regulation, or a final decision of a competent court, the other provisions shall remain in full force and effect, and the Parties shall agree on an economically equivalent and valid replacement provision.

29.8 Commercial Reference

Aliston may refer to the Customer's name and logo as a commercial reference to promote the Software, unless the Customer objects in writing at any time.

29.9 Trademarks

Cirrus Shield is a registered trademark owned by Aliston. Without Aliston's express authorization, the Customer and Users shall not use or disseminate it in any way whatsoever.

29.10 Notices

Unless otherwise provided in the Terms, notices shall be validly given by registered letter with acknowledgment of receipt to the address stated in the Agreement, or by email with express acknowledgment of receipt from the recipient. Any time period shall run from the first presentation of the letter or the acknowledgment of receipt of the email.

29.11 Non-Solicitation of Personnel

The Customer shall not hire or engage, directly or indirectly, any Aliston staff member who worked on the Agreement, during the term of the Agreement and for two (2) years from its expiry. In the event of breach, the Customer shall be liable for a flat-rate indemnity equal to twelve (12) months of the relevant staff member's most recent gross salary, without prejudice to any additional damages.

29.12 Language

The Terms are drafted in French. In the event of a translation, only the French version shall prevail.

29.13 Governing Law and Jurisdiction

The Agreement is governed by French law. In the event of a dispute, and after an attempt at amicable settlement within thirty (30) days, exclusive jurisdiction is granted to the Versailles Commercial Court — referred to as the Versailles Economic Activities Court during the pilot period provided for by Law No. 2023-1059 of 20 November 2023 — notwithstanding multiple defendants or third-party proceedings, including for expedited or emergency proceedings and payment order proceedings and any related proceedings.

DATA PROCESSING AGREEMENT (DPA)

This data processing agreement (the "DPA") is entered into pursuant to Article 28 of the GDPR between the Customer, acting as data controller, and Aliston, acting as processor. It is appended to the Terms, forms an integral part of the Agreement, and applies to any processing of personal data contained in Customer Data carried out by Aliston on behalf of the Customer under the Services. Capitalized terms have the meaning given to them in the Terms or, failing that, in the GDPR.

A.1 Description of the Processing

Subject matter: hosting, storage, backup, provision, display and processing of Customer Data strictly necessary for the provision of the Software and Services.

Duration: the term of the Agreement, plus the data recovery and deletion period provided for in Article 17.3 of the Terms.

Nature and purposes: technical operations of collection, recording, storage, consultation, communication to the Customer only, backup, restoration and erasure, solely for the purposes of performing the Agreement, support and security.

Categories of data: determined solely by the Customer at its own responsibility; typically identification, contact, professional and business-relationship data relating to its prospects, customers, members, partners and Users.

Categories of data subjects: determined solely by the Customer; typically its prospects, customers, contacts, members, suppliers and Users.

Excluded data: in accordance with Article 19.3 of the Terms, health data is excluded from the Service. The Customer shall only entrust data falling within Articles 9 and 10 of the GDPR (other than health data, which remains excluded) if it has an appropriate legal basis, for which it is solely responsible.

A.2 Customer Instructions

Aliston processes Customer Data solely on the Customer's documented instructions, including with respect to transfers outside the European Union. The Agreement, the Documentation, and use of the Software's features by the Customer and its Users constitute the Customer's documented instructions. Any additional instruction shall be sent in writing to contact@cirrus-shield.com; if it exceeds the scope of the Services, it may give rise to a quote. Aliston shall inform the Customer if, in its view, an instruction constitutes a breach of the GDPR or other applicable data protection law.

A.3 Personnel Confidentiality

Aliston ensures that persons authorized to process Customer Data are bound by a confidentiality undertaking or are subject to an appropriate statutory obligation of confidentiality, and that they process such data only on a need-to-know basis.

A.4 Security

Aliston implements the technical and organizational measures set out in Article 20 of the Terms, in accordance with Article 32 of the GDPR, taking into account the state of the art, implementation costs and risks. The Customer remains responsible for assessing the adequacy of these measures relative to the risks specific to its processing, for managing its Users' access rights, and for configuring the security of its own environment.

A.5 Sub-Processing

The Customer grants general authorization for Aliston to use sub-processors to perform the Services. The list of sub-processors as of the DPA's effective date is as follows:

• OVH SAS (OVHcloud) — hosting of Customer Data — data centers located in France.
• Where applicable: Mistral AI SAS — AI Features — processing in France.

Aliston shall inform the Customer, by email to the Administrator, of any plan to add or replace a sub-processor at least thirty (30) days before it takes effect. The Customer may raise a written, reasoned objection based on legitimate data-protection grounds within that period. In the event of an objection and absent a reasonable solution, either Party may terminate the Agreement with respect to the affected part of the Services, without indemnity, with the Customer benefiting from a pro rata refund of the prepaid, unused period. Aliston imposes on its sub-processors, by contract, data protection obligations equivalent to those set out in this DPA, and remains fully liable to the Customer for their performance.

A.6 Assistance to the Customer

Given the nature of the processing, Aliston assists the Customer, through appropriate technical and organizational measures and to the extent possible, in responding to requests to exercise data subjects' rights (Articles 15 to 22 of the GDPR). If a data subject contacts Aliston directly, Aliston shall forward the request to the Customer within a maximum of five (5) business days, without responding to it on the merits. The Software allows the Customer to access, rectify, export and delete data by its own means; any assistance beyond these standard features may be invoiced on a quoted basis.

Aliston also helps the Customer, within the limits of the information available to it, to comply with the obligations set out in Articles 32 to 36 of the GDPR, in particular with respect to carrying out data protection impact assessments and prior consultation with the supervisory authority. Aliston maintains the record of categories of processing activities required under Article 30.2 of the GDPR.

A.7 Data Breach Notification

Aliston shall notify the Customer of any personal data breach affecting Customer Data without undue delay and no later than forty-eight (48) hours after becoming aware of it, by email to the Administrator. The notification shall include, to the extent information is available, the elements set out in Article 33(3) of the GDPR; information may be provided in phases. It is the sole responsibility of the Customer, as data controller, to make any notifications to the supervisory authority and to data subjects, as applicable.

A.8 Location and Transfers

Customer Data is hosted in France, in the data centers of OVH SAS. Aliston shall not transfer Customer Data outside the European Union or the European Economic Area without the Customer's prior instruction or authorization, and, in that case, only in compliance with Chapter V of the GDPR (adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses, supplemented where necessary by additional measures).

A.9 Audit

Aliston makes available to the Customer the information necessary to demonstrate compliance with this DPA, primarily in the form of available documentation, certifications and reports. If such information proves insufficient, the Customer may, at its own expense, carry out an audit, including an inspection, at most once every twelve (12) months, subject to thirty (30) days' written notice, during business days and hours, without disrupting the Services or compromising the security or confidentiality of other Aliston customers' data. The audit may be entrusted to an independent third party bound by a confidentiality undertaking and not in competition with Aliston. Time spent by Aliston's teams beyond one (1) person-day may be invoiced at the rate then in effect.

A.10 Fate of the Data

At the end of the Agreement, recovery and deletion of Customer Data shall take place under the conditions set out in Article 17.3 of the Terms: a thirty (30) day recovery period, deletion from active systems within the following thirty (30) days or upon prior written request, destruction of backup copies at the end of their rotation cycle not exceeding six (6) months, a certificate of deletion available on request, subject to statutory retention obligations.

A.11 Customer Obligations

The Customer, as data controller, warrants the lawfulness of the processing carried out by means of the Software, has an appropriate legal basis for each processing operation, ensures that data subjects are informed and can exercise their rights, entrusts Aliston only with data collected and processed lawfully, and complies with the exclusion of health data set out in Article 19.3 of the Terms. The Customer indemnifies Aliston against any claim, action or judgment resulting from non-compliance with these obligations.

A.12 Liability — Duration — Order of Precedence

Each Party's liability under this DPA is governed by Article 22 of the Terms and by Article 82 of the GDPR. The DPA takes effect on the effective date of the Agreement and remains applicable for as long as Aliston processes Customer Data. In the event of a conflict between the DPA and the Terms regarding the processing of personal data, the DPA shall prevail, in accordance with the order of precedence set out in Article 2 of the Terms.