MASTER TERMS OF USE AGREEMENT

This Master Terms of Use Agreement (“Agreement”) is entered into by and between Jombone Inc., a Delaware corporation with its principal office at 3300 Dallas Pkwy Suite 200, Plano, TX 75093, United States, also operating under Jombone Inc. as a corporation registered in Ontario, Canada (“Jombone”), and the Customer identified in the applicable Order Form or the individual/entity accepting this Agreement (“Customer”).

This Agreement governs Customer’s access to and use of the Jombone Staffing Operations and Intelligence Platform (the “Platform”), including all related services, whether under a free trial, free tier, or paid subscription.

Effective Date: As of the date Customer accepts this Agreement by (1) clicking “I Agree,” (2) executing an Order Form referencing this Agreement, or (3) using the Jombone Platform, including under a free trial or free tier. Where Customer is located in Canada (outside the Province of Quebec), acceptance also constitutes acceptance of Schedule A (Canadian Addendum) appended to this Agreement.

By accepting this Agreement, Customer represents that the individual accepting it has authority to bind the Customer entity and its affiliates. If the individual lacks such authority or does not agree with these terms, they must not accept this Agreement or use the Platform. Direct competitors of Jombone are prohibited from accessing the Platform without Jombone’s prior written consent.

1. Definitions

“Customer Data” means all data, including Personal Data, submitted by or on behalf of Customer to the Platform.

“Order Form” means the executed document specifying the services purchased, term, fees, and other commercial details, incorporated into and forming part of this Agreement.

“Platform” means Jombone’s cloud-based suite of software services, including modules for applicant tracking, client management, invoicing, timesheets, pay/bill rate management, onboarding, learning management, communication, and analytics, accessible via web browsers and mobile applications.

“Personal Data” means data subject to applicable Data Protection Laws, as defined in the Data Processing Addendum (DPA).

“Software” means the Jombone Platform’s software, including web-based applications and mobile applications for iOS and Android, as provided under this Agreement.

“Initial Term” means the subscription term specified in the applicable Order Form, commencing on the Effective Date.

“Renewal Term” means each successive term following the Initial Term, as described in Section 7.1.

“Change of Control” means, with respect to Customer: (i) a merger, consolidation, or reorganization with or into another entity; (ii) a sale, transfer, or disposition of all or substantially all of Customer’s assets; (iii) a sale, transfer, or issuance of equity interests resulting in a change of more than fifty percent (50%) of the voting power or economic interest of Customer; (iv) a change in the composition of Customer’s board of directors or equivalent governing body such that the individuals constituting such body as of the Effective Date cease to constitute a majority; or (v) the dissolution, liquidation, or winding up of Customer’s business.

“Customer Jurisdiction” means the country and, where applicable, province or state in which Customer is organized or primarily conducts business, as identified in the applicable Order Form. For the avoidance of doubt, the Province of Quebec is not a permitted Customer Jurisdiction under this Agreement.

“Applicable Law” means all applicable federal, state, provincial, and local laws and regulations governing the parties’ respective obligations under this Agreement, as determined by Customer Jurisdiction.

2. License and Access Rights

2.1 Grant of License. Subject to Customer’s compliance with this Agreement, Jombone grants Customer a non-exclusive, non-transferable, non-sublicensable, limited license during the Term to access and use the Platform and its Software solely for Customer’s internal business purposes, as specified in the applicable Order Form.

2.2 Scope of License. The license permits Customer to:

• Access the Platform via supported web browsers and mobile applications for iOS and Android.
• Use the Platform’s features as provided in the subscription tier specified in the Order Form.
• Allow authorized users (e.g., employees or contractors) to access the Platform under Customer’s account, provided Customer remains responsible for their compliance with this Agreement.

2.3 Restrictions. Customer shall not:

• Sublicense, sell, lease, rent, or distribute the Software or Platform;
• Reverse-engineer, decompile, disassemble, or attempt to derive the source code of the Software, except as permitted by Applicable Law;
• Modify, adapt, or create derivative works of the Software;
• Use the Software or Platform for illegal purposes or to transmit infringing, libelous, or unlawful material;
• Attempt to gain unauthorized access to the Platform or its systems; or
• Monitor the Platform’s performance for benchmarking or competitive purposes without Jombone’s prior written consent.

Jombone reserves the right to seek injunctive relief for violations of these restrictions.

2.4 Geographic Restriction — Quebec. The Platform is not offered to, and may not be used by, any Customer whose Customer Jurisdiction is the Province of Quebec, Canada. Jombone does not operate in, target, or accept Order Forms from entities organized or primarily doing business in Quebec. Any person or entity in Quebec who accesses the Platform does so in violation of this Agreement and Jombone reserves the right to immediately terminate such access without notice or refund. This restriction does not apply to Canadian Customers outside Quebec that may have individual employees or contractors temporarily located in Quebec.

2.5 Intellectual Property Ownership. Jombone retains all right, title, and interest in the Software, Platform, and all related intellectual property. Customer receives no ownership rights in the Software or Platform, only the limited license described herein.

2.6 User Accounts. Customer must create accounts using valid email addresses and passwords. Accounts are personal and non-transferable. Customer is responsible for maintaining confidentiality of login credentials and all activities under their accounts.

2.7 Sandbox Environment. Jombone may provide a temporary sandbox environment for testing during onboarding. The sandbox will be decommissioned within 30 days of onboarding completion, and all data therein will be securely deleted unless Customer requests transfer in writing within that period.

2.8 Updates and Maintenance. Jombone may update or modify the Software at its discretion to enhance functionality or security, with reasonable notice to Customer. Such updates do not materially reduce the Platform’s core functionality during the Term.

3. Subscription Model and Fees

3.1 Freemium Model. The Platform operates on a freemium model, offering limited features under a free tier and additional features via paid subscriptions, as detailed in the Order Form.

3.2 Fees and Payment. Fees are specified in the Order Form. Unless otherwise stated in the Order Form, invoices are due on receipt. All fees for the subscription term specified in the Order Form are non-cancellable and non-refundable, regardless of actual usage or early termination by Customer. Late payments accrue interest at 1.5% per month or the maximum rate permitted by Applicable Law, whichever is lower. Jombone may suspend access for non-payment after 10 days’ written notice.

For Canadian Customers, fees may be invoiced in Canadian Dollars (CAD) or United States Dollars (USD) as specified in the Order Form. The late payment interest rate of 1.5% per month (18% per annum) is within the permitted range under the Criminal Code of Canada (Section 347) as amended effective January 1, 2025.

3.3 Enterprise Agreements. Enterprise clients may negotiate custom terms via Order Forms, which take precedence over conflicting provisions in this Agreement.

3.4 Non-Cancellable Commitment. All subscription fees for the Initial Term and any Renewal Term are firm, non-cancellable, and non-refundable commitments. Monthly billing is provided as a payment convenience and does not create a month-to-month arrangement or imply the right to cancel prior to the expiration of the then-current term.

3.5 Acceleration. If Customer (a) requests or initiates early termination prior to the end of the then-current term, (b) fails to cure a payment default within 10 days of written notice, (c) ceases operations or undergoes dissolution, or (d) undergoes a Change of Control without providing the notice required by Section 12.8, all remaining fees for the balance of the then-current term shall become immediately due and payable in full.

THE PARTIES ACKNOWLEDGE THAT: (I) JOMBONE’S ACTUAL DAMAGES IN THE EVENT OF EARLY TERMINATION WOULD BE DIFFICULT TO CALCULATE PRECISELY; (II) THE ACCELERATED AMOUNT REPRESENTS A REASONABLE ESTIMATE OF JOMBONE’S ANTICIPATED LOSS; AND (III) THE ACCELERATED AMOUNT IS NOT A PENALTY. CUSTOMER WAIVES ANY RIGHT TO CONTEST THE ACCELERATED AMOUNT AS AN UNENFORCEABLE PENALTY.

3.6 Taxes. All fees are exclusive of applicable taxes. Customer is responsible for all sales, use, value-added, goods and services, harmonized sales tax (HST/GST), and similar taxes imposed by any governmental authority on the transactions contemplated by this Agreement, excluding taxes based on Jombone’s net income. For Canadian Customers, Jombone will add applicable HST or GST to invoices as required by Canadian federal and provincial tax law. Quebec Sales Tax (QST) does not apply as Jombone does not serve Quebec Customers.

4. Data Ownership and Privacy

4.1 Ownership. Customer retains all rights to Customer Data. Jombone may process and store Customer Data solely to provide and improve the Platform, in accordance with the Data Processing Addendum (DPA) and Applicable Law.

4.2 Data Security. Jombone will maintain industry-standard technical and organizational measures to protect Customer Data, as detailed in the DPA. In case of a data breach, Jombone will notify Customer within 72 hours of discovery as required by Applicable Law, including obligations under PIPEDA (Canada, excluding Quebec) and applicable US state breach notification laws.

4.3 Data Retention. Upon termination or Customer’s written request, Jombone will return or securely delete Customer Data within 30 days, unless required to retain it by Applicable Law.

4.4 CASL (Canadian Customers). To the extent Jombone sends Commercial Electronic Messages (CEMs) to Customer’s employees or authorized users in connection with the Platform, Jombone will comply with Canada’s Anti-Spam Legislation (S.C. 2010, c. 23) (“CASL”). Customer represents and warrants that it has obtained all required consents under CASL for any CEM sent via the Platform to Customer’s users. Customer shall ensure any CEMs sent using the Platform’s communication features comply with CASL’s consent, identification, and unsubscribe requirements. Customer indemnifies Jombone from any CRTC enforcement action or third-party CASL claim arising from Customer’s non-compliance.

4.5 Software Installation Consent (Canadian Customers). Customer acknowledges that installation or use of the Platform’s desktop or mobile software components constitutes express consent under Section 8 of CASL for installation of computer programs. Customer shall obtain appropriate consent from its users prior to deploying the Platform to their devices.

5. Third-Party Integrations

5.1 Authorization. The Platform integrates with third-party services (e.g., background checks, e-signatures, messaging, Google Maps) via APIs and webhooks. Customer authorizes Jombone to share Customer Data with these providers as necessary to deliver the integrated features.

5.2 Due Diligence. Jombone conducts due diligence on third-party providers and ensures they are contractually obligated to comply with applicable data protection laws. Jombone will notify Customer of known third-party disruptions within 24 hours.

5.3 Liability Disclaimer. Jombone is not liable for service disruptions caused by third-party providers, provided Jombone has exercised reasonable care in their selection.

5.4 Criminal Background Checks (Canadian Customers). Criminal background check integrations are supported for North American jurisdictions. For Canadian Customers, results are governed by applicable provincial human rights legislation and the Criminal Records Act (R.S.C. 1985, c. C-47). Customer is solely responsible for ensuring its use of criminal background check data complies with Applicable Law.

6. Service Levels

Jombone’s commitments to Platform uptime, incident response, and service credits are governed by the Service Level Agreement (SLA), incorporated herein. The Platform targets 99.5% uptime per calendar quarter, excluding scheduled maintenance (not to exceed 4 hours per month) and third-party disruptions.

7. Term and Termination

7.1 Term. This Agreement begins on the Effective Date and continues for the Initial Term specified in the Order Form. Unless either party provides written notice of non-renewal at least 30 days prior to the expiration of the then-current term, the subscription shall automatically renew for successive terms equal to the Initial Term at Jombone’s then-current pricing.

7.2 Termination for Cause. Either party may terminate this Agreement for a material breach if the breaching party fails to cure within 30 days of written notice. In the event of termination by Jombone for Customer’s material breach, all remaining fees for the balance of the then-current term shall become immediately due and payable in full pursuant to Section 3.5.

7.3 No Termination for Convenience. Customer may not terminate this Agreement for convenience during the Initial Term or any Renewal Term. Any request or notice of early termination by Customer shall constitute a triggering event under Section 3.5. For the avoidance of doubt, a Change of Control does not constitute grounds for termination of this Agreement.

7.4 Effect of Termination. Upon termination, Customer’s access to the Platform ceases, and Jombone will handle Customer Data as specified in the DPA. The following provisions survive expiration or termination: Sections 1, 3, 4, 7.4, 8, 9, 10, 12, 13, 14, 16, and any provision which by its nature is intended to survive. Termination does not relieve Customer of any obligation to pay Fees accrued prior to termination or accelerated Fees due under Section 3.5.

8. Warranty and Disclaimer

The Platform is provided “as is.” Jombone disclaims all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement, to the fullest extent permitted by Applicable Law. Notwithstanding the foregoing, Jombone’s uptime commitments under the SLA are not affected by this disclaimer.

As this Agreement is a B2B commercial agreement entered into by business entities, the parties acknowledge that statutory consumer protection legislation intended for individual consumers does not apply to the commercial relationship governed by this Agreement.

9. Limitation of Liability

9.1 Cap. Jombone’s total liability for all claims under this Agreement shall not exceed the fees paid by Customer under the applicable Order Form in the 12 months preceding the claim.

9.2 Exclusions. Jombone is not liable for indirect, incidental, special, or consequential damages, including loss of data or business interruption. This limitation does not apply to damages arising from Jombone’s gross negligence or willful misconduct.

9.3 Third-Party Services. Jombone is not liable for damages caused by third-party services, provided due diligence was performed, as detailed in the SLA.

9.4 Canadian Carve-Out. The limitation in Section 9.2 does not apply to: (a) damages arising from Jombone’s breach of its obligations under PIPEDA or other Applicable Canadian Data Protection Laws; or (b) claims arising from Jombone’s intentional misconduct, fraud, or violations of applicable Canadian law that cannot be contractually excluded.

10. Confidentiality

Each party agrees to maintain the confidentiality of the other’s confidential information and to use it only as permitted under this Agreement. This obligation survives termination for 3 years, except for trade secrets, which remain protected indefinitely.

11. Feedback, Support, and Publicity

11.1 Feedback. Customer may provide feedback about the Platform. Jombone may use such feedback without restriction or compensation, provided it remains non-confidential unless otherwise agreed in writing.

11.2 Support. Support is provided as outlined in the SLA. For accessibility issues, contact [email protected]. Jombone strives to meet WCAG 2.1 accessibility standards.

11.3 Publicity. Customer grants Jombone the non-exclusive right to reference Customer’s name and logo in marketing materials, customer lists, press releases, and case studies, subject to any reasonable brand guidelines provided to Jombone in writing. Customer may revoke this right at any time upon 30 days’ written notice to [email protected].

12. General Provisions

12.1 Governing Law and Dispute Resolution. The governing law and dispute resolution forum applicable to this Agreement are determined by Customer Jurisdiction as follows:

12.1(C) ATTORNEYS’ FEES. THE PREVAILING PARTY IN ANY ARBITRATION OR COURT PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT SHALL BE ENTITLED TO RECOVER ITS REASONABLE ATTORNEYS’ FEES, COSTS, AND EXPENSES FROM THE NON-PREVAILING PARTY. IF JOMBONE RETAINS AN ATTORNEY OR COLLECTION AGENCY TO COLLECT AMOUNTS DUE FROM CUSTOMER, CUSTOMER SHALL BE LIABLE FOR ALL REASONABLE COSTS OF COLLECTION WHETHER OR NOT ARBITRATION OR SUIT IS FILED.

12.2 Force Majeure. Neither party is liable for delays or failures due to events beyond their reasonable control, including natural disasters, government actions, pandemics, or internet outages, provided the affected party gives prompt written notice and uses commercially reasonable efforts to mitigate the impact.

12.3 Assignment. Jombone may assign this Agreement without Customer’s consent to an affiliate or to a successor entity in connection with a merger, acquisition, or sale of all or substantially all of Jombone’s assets. Customer may not assign this Agreement, in whole or in part, without Jombone’s prior written consent, including in connection with any merger, acquisition, Change of Control, or sale of substantially all of Customer’s assets. Any purported assignment by Customer in violation of this Section shall be null and void. This Agreement shall be binding upon and inure to the benefit of the parties and their respective successors and permitted assigns.

12.4 Notices. Notices must be in writing, sent via email to the designated contact in the Order Form or to [email protected], with confirmation of receipt. Notices are deemed received upon confirmed delivery. For Canadian Customers, dispute notices must also be sent by courier to: Jombone Inc., 2233 Argentia Road, Suite 302A, East Tower, Mississauga, ON L5N 2X7, Canada.

12.5 Entire Agreement. This Agreement, together with the Order Form, DPA, SLA, and any applicable Schedule, constitutes the entire agreement between the parties, superseding all prior agreements. In case of conflict, the Order Form prevails, followed by the applicable Schedule, DPA, SLA, and this Agreement.

12.6 Severability. If any provision is unenforceable, the remaining provisions remain in full force and effect. An unenforceable provision shall be modified to the minimum extent necessary to make it enforceable.

12.7 Modifications. Jombone may update this Agreement with 30 days’ written notice. Continued use of the Platform after the notice period constitutes acceptance of the revised terms. Jombone will maintain a version history of this Agreement and will make prior versions available upon written request.

12.8 Change of Control. Customer shall provide Jombone with written notice within ten (10) business days following consummation of any Change of Control event. This Agreement shall survive and remain binding upon Customer’s successor, acquirer, or surviving entity following any Change of Control. No Change of Control shall relieve Customer or its successor of any obligation to pay Fees accrued prior to, or remaining due through the end of, the then-current Subscription Term. Jombone may, within sixty (60) days of receiving notice of a Change of Control, require the successor entity to provide written assurances of its ability and willingness to perform Customer’s obligations hereunder. Failure to notify Jombone of a Change of Control within the required period shall constitute a triggering event under Section 3.5.

12.9 Electronic Signatures and Counterparts. This Agreement and any Order Form may be executed in counterparts, each of which shall be deemed an original. Execution via electronic signature (including DocuSign or similar platforms) shall constitute valid and binding execution.

• US Customers: Electronic signatures are enforceable under the Electronic Signatures in Global and National Commerce Act (ESIGN Act, 15 U.S.C. §§ 7001–7006) and the Uniform Electronic Transactions Act as adopted by the applicable state.
• Canadian Customers (excluding Quebec): Electronic signatures are enforceable under Ontario’s Electronic Commerce Act, 2000 (S.O. 2000, c. 17) and applicable provincial electronic commerce legislation.

12.10 Waiver of Jury Trial. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY IRREVOCABLY AND UNCONDITIONALLY WAIVES ALL RIGHT TO TRIAL BY JURY IN ANY ACTION ARISING OUT OF OR RELATING TO THIS AGREEMENT. This provision applies to US-based Customer disputes only; it does not apply where prohibited by Applicable Law in Canada.

12.11 Language. This Agreement is drawn up in English. As Jombone does not serve Quebec Customers, the requirements of the Charter of the French Language (RLRQ c. C-11) do not apply to this Agreement. All communications and documentation shall be in English.

13. Customer Representations and Warranties

Customer represents and warrants that:

• Customer is duly organized and validly existing under the laws of its jurisdiction of formation and has full power and authority to enter into this Agreement;
• This Agreement has been duly authorized, executed, and delivered by Customer and constitutes a legal, valid, and binding obligation enforceable against Customer in accordance with its terms;
• The individual accepting this Agreement on behalf of Customer has been duly authorized to bind Customer, and Customer shall be estopped from asserting lack of authority as a defense to enforcement;
• Customer shall use the Platform in compliance with all Applicable Law, including employment and labor laws, data protection and privacy laws (including CASL for Canadian Customers), and anti-corruption statutes;
• All information provided by Customer in connection with any Order Form is accurate and complete in all material respects; and
• For Canadian Customers (excluding Quebec): Customer has complied and shall comply with all applicable Canadian federal and provincial privacy laws, including PIPEDA, applicable provincial PIPA, and CASL, in connection with Customer’s use of the Platform.

14. Indemnification

14.1 Customer Indemnification. Customer shall indemnify, defend, and hold harmless Jombone and its officers, directors, employees, and agents from and against any third-party claims, damages, losses, and expenses (including reasonable attorneys’ fees) arising from: (a) Customer’s breach of this Agreement; (b) Customer’s misuse of the Platform; (c) Customer Data uploaded by Customer; (d) Customer’s violation of Applicable Law; or (e) for Canadian Customers, any CRTC enforcement action or third-party CASL claim arising from Customer’s use of the Platform’s communication features.

14.2 Jombone Indemnification. Jombone shall indemnify, defend, and hold harmless Customer from third-party claims that the Platform, as provided and used in accordance with this Agreement, infringes such third party’s intellectual property rights, provided Customer promptly notifies Jombone of the claim, grants Jombone sole control of the defense, and cooperates in the defense.

15. Acceptance

By clicking “I Agree,” executing an Order Form, or using the Platform, Customer acknowledges that it has read and understood this Agreement in its entirety and agrees to be bound by it, the DPA, the SLA, and any applicable Schedule. Customer acknowledges that the individual accepting this Agreement has actual authority to bind the Customer entity.

16. Region-Specific Provisions

This Section sets out provisions that apply specifically to Customers in certain jurisdictions. In the event of a conflict between this Section and the general terms of this Agreement, this Section prevails for Customers in the applicable jurisdiction.

17. Acceptance

By clicking “I Agree,” executing an Order Form, or using the Platform, Customer acknowledges that it has read and understood this Agreement in its entirety and agrees to be bound by it and all applicable Schedules, and confirms that the individual accepting this Agreement has actual authority to bind the Customer entity.

— End of Jombone Inc. Master Terms of Use Agreement —

SERVICE LEVEL AGREEMENT (SLA)

This SLA is part of the Master Terms of Use Agreement between Jombone Inc. and the Customer identified in the applicable Order Form. It applies to all Customers regardless of jurisdiction unless otherwise specified.

1. Definitions

Platform Uptime: The availability of core Platform features, measured as the percentage of time the Platform is accessible, excluding scheduled maintenance, third-party disruptions, and Customer-caused issues.

Business Hours: 9:00 AM to 6:00 PM in the Customer’s local time zone (Central Standard Time for US Customers; Eastern Standard Time for Ontario Customers; Mountain Standard Time for Alberta Customers; Pacific Standard Time for British Columbia Customers), Monday through Friday, excluding applicable statutory holidays.

Misuse: Customer’s intentional violation of the Agreement.

2. Uptime Commitment

Jombone will use commercially reasonable efforts to ensure the Platform achieves 99.5% uptime per calendar quarter, calculated as:

Uptime % = (Total Minutes in Quarter − Unplanned Downtime) / Total Minutes in Quarter × 100

Scheduled maintenance (not to exceed 4 hours per month) will be communicated with at least 24 hours’ notice. Third-party disruptions are excluded if Jombone has exercised due diligence.

3. Third-Party Dependencies

Jombone disclaims SLA commitments for disruptions caused by third-party providers, provided Jombone has exercised reasonable care in their selection and notifies Customer of known disruptions within 24 hours.

4. Incident Response Times

• Severity 1 — Critical outage / complete unavailability: Initial response within 2 hours (Business Hours)
• Severity 2 — Degraded performance / partial disruption: Initial response within 4 hours
• Severity 3 — Minor issue / general support: Initial response within 1 business day

5. Customer Responsibilities

Customer agrees to: provide prompt notice of incidents via [email protected]; designate a support contact in the Order Form; cooperate with Jombone in resolving service issues; and maintain adequate internet and system environment.

6. Exclusions

This SLA does not apply to: issues caused by Customer’s systems, internet access, or Misuse; beta features, sandbox environments, or non-production systems; or downtime due to force majeure events or regulatory changes.

7. Service Credits

For confirmed uptime failures below 99.5%, Customer may request service credits equal to 5% of the monthly subscription fee for each full 1% below the target, capped at 50% of the monthly fee. Credits must be claimed in writing to [email protected] within 30 days of the affected quarter. Service credits are Customer’s sole and exclusive remedy for SLA failures.

8. Governing Law

This SLA is governed by the same governing law applicable to the Agreement as determined by Customer Jurisdiction under Section 12.1 of the Agreement.

— End of Jombone Inc. Service Level Agreement —

DATA PROCESSING ADDENDUM (DPA)

This Data Processing Addendum (“DPA”) supplements the Master Terms of Use Agreement and governs the processing of Personal Data by Jombone in connection with the Platform. This DPA applies to all Customers; region-specific obligations are set out in Section 6 below.

1. Definitions

“Data Protection Laws” means all applicable laws relating to the processing, privacy, and use of Personal Data, including: (i) for US Customers — CCPA/CPRA (California), TDPSA (Texas), VCDPA (Virginia), and any applicable US federal privacy regulation; (ii) for Canadian Customers (excluding Quebec) — PIPEDA (federal), PIPA (Alberta and BC), and successor legislation; and (iii) any other applicable jurisdiction-specific privacy laws. Quebec Law 25 is not addressed in this Agreement as Jombone does not offer the Platform to Quebec Customers.

“Customer Data” means Personal Data processed by Jombone on behalf of Customer.

“Subprocessors” means third-party service providers engaged by Jombone to support delivery of the services.

2. Processing of Personal Data

2.1 Scope. Jombone will process Customer Data only in accordance with Customer’s documented instructions, including as necessary to provide the services under the Agreement.

2.2 Compliance. Customer shall ensure its instructions comply with applicable Data Protection Laws. Jombone will notify Customer if it believes an instruction violates such laws.

3. Rights of Data Subjects

Jombone shall assist Customer in responding to requests from data subjects exercising their rights under applicable Data Protection Laws (e.g., access, correction, deletion, portability) within 30 days of receiving Customer’s request, or within any shorter period required by Applicable Law.

4. Subprocessors

4.1 Authorization. Customer authorizes Jombone to engage Subprocessors to support the services.

4.2 Notification and Objection. Jombone maintains a current list of Subprocessors at jombone.com/subprocessors (the “Subprocessor Page”), updated prior to engaging any new Subprocessor. Jombone will notify Customer of new Subprocessor engagements at least 14 days in advance via email or update to the Subprocessor Page. Customer may object within 14 days of notification for reasonable data protection concerns. If the parties cannot resolve the objection, Customer may terminate the affected services with 30 days’ written notice.

4.3 Subprocessor Obligations. Jombone shall ensure each Subprocessor is subject to written obligations providing the same level of data protection as this DPA.

5. Data Security and Breach Notification

Jombone shall implement and maintain appropriate technical and organizational security measures to protect Customer Data. Jombone will notify Customer of any data breach within 72 hours of discovery.

• US Customers: Jombone will notify Customer in accordance with applicable US state breach notification laws, including Texas Business and Commerce Code Chapter 521 and California Civil Code Section 1798.82.
• Canadian Customers (excluding Quebec): Jombone will notify Customer and, where required by PIPEDA, the Office of the Privacy Commissioner of Canada (OPC) within the timeframes required by Applicable Law.

5.1 Transfers of Customer Data.

• US Customers: Jombone will process US Customer Data in the United States and Canada. For transfers to other jurisdictions, Jombone will execute Standard Contractual Clauses (SCCs) or other approved transfer mechanisms where required.
• Canadian Customers (excluding Quebec): Jombone will use commercially reasonable efforts to process Canadian Customer Data within Canada or the United States. Jombone will provide Canadian Customers with a description of the protections applicable to transferred data upon written request.

6. Region-Specific Data Processing Obligations

6.1 PIPEDA (Federal Canada). Jombone will process Canadian Customer Data in compliance with PIPEDA’s ten fair information principles: Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use/Disclosure/Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance. Jombone’s Privacy Officer is reachable at [email protected].

6.2 Quebec Exclusion. Quebec Law 25 obligations are not addressed in this Agreement as Jombone does not offer the Platform to Quebec Customers. See Section 2.4 and Section 16B.3 of the Agreement.

6.3 Alberta PIPA / BC PIPA. Jombone will comply with the applicable provincial PIPA for Customers in Alberta and British Columbia in lieu of PIPEDA where required.

6.4 CCPA/CPRA. Jombone acts as a “Service Provider” (as defined under CCPA) with respect to California Customers’ personal information. Jombone will not sell, share, or use California personal information for any purpose other than performing the services under this Agreement.

6.5 US State Privacy Laws. Where Customer is subject to additional US state privacy laws (Virginia CDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, or similar), Jombone will act as a “Processor” as defined under those laws and will comply with applicable processor obligations.

7. Data Retention and Deletion

Upon termination of services or at Customer’s written request, Jombone shall return or securely delete all Customer Data within 30 days, unless required to retain it by Applicable Law.

8. Audits

Jombone will allow Customer (or a designated third-party auditor) to verify compliance with this DPA, subject to reasonable notice, once per year unless triggered by a security incident. Customer bears audit costs unless non-compliance is found.

9. Governing Law

This DPA is governed by the same governing law applicable to the Agreement as determined by Customer Jurisdiction under Section 12.1 of the Agreement.

10. Order of Precedence

In the event of a conflict between this DPA and the Agreement, this DPA prevails with respect to data protection obligations.

— End of Jombone Inc. Data Processing Addendum —

SCHEDULE A: CANADIAN CUSTOMER ADDENDUM

This Schedule A forms part of the Agreement and applies to all Customers whose Customer Jurisdiction is Canada (“Canadian Customers”). In the event of conflict between this Schedule and the body of the Agreement, this Schedule prevails for Canadian Customers.

A1. Governing Law and Dispute Resolution (Canada)

This Agreement is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein. Disputes are resolved by binding arbitration in Toronto, Ontario under ADRIC rules. See Section 12.1(b).

A2. Privacy Laws Summary for Canadian Customers

The following Canadian privacy laws may apply to Customer’s use of the Platform, depending on province of operation:

• Federal: Personal Information Protection and Electronic Documents Act (PIPEDA) — applies to all inter-provincial and commercial activities
• Alberta: Personal Information Protection Act (PIPA Alberta)
• British Columbia: Personal Information Protection Act (PIPA BC)
• All other provinces: PIPEDA applies by default

Customer is solely responsible for determining which privacy laws apply to its own business activities conducted through the Platform.

A3. CASL Summary for Canadian Customers

Canada’s Anti-Spam Legislation (CASL) applies to Commercial Electronic Messages (CEMs) sent from or to electronic addresses in Canada. Key obligations:

• Consent: Express or implied consent required before sending CEMs
• Identification: Every CEM must clearly identify the sender
• Unsubscribe: Every CEM must include a functioning unsubscribe mechanism active for at least 60 days; requests must be honored within 10 business days
• Penalties: Up to CAD $1M per violation for individuals; CAD $10M per violation for corporations

Customer is responsible for CASL compliance for CEMs sent by Customer using the Platform’s communication features. Jombone is responsible for CASL compliance for CEMs sent directly by Jombone to Customer’s personnel.

A4. Currency

Unless the Order Form specifies CAD pricing, all fees are in USD. Where CAD is specified, Section 3.6 of the Agreement applies. Customers wishing to be invoiced in CAD should note this on the Order Form or contact their Jombone account representative.

A5. Jombone’s Canadian Contact

Jombone Inc. (Ontario): 2233 Argentia Road, Suite 302A, East Tower, Mississauga, ON L5N 2X7
Privacy Officer (Canada): [email protected]
General Inquiries (Canada): [email protected]

A6. Language

This Agreement is drawn up in the English language. As Jombone does not serve Quebec Customers, the requirements of the Charter of the French Language (RLRQ, c. C-11) do not apply to this Agreement. All communications and documentation shall be in English.

— End of Schedule A: Canadian Customer Addendum —