End User Terms of Service

FOR CUSTOMERS OF DECISIVE GROUP’S SERVICES

THESE GENERAL TERMS OF SERVICE (“GENERAL TERMS”) ARE INCORPORATED BY REFERENCE INTO EACH ORDER (COLLECTIVELY “THE AGREEMENT”) FOR ONE OR MORE OFFERINGS SUBMITTED TO DECISIVE GROUP INC. (“DECISIVE”) AND THE PURCHASER IDENTIFIED ON THE ORDER (“CUSTOMER”). ALL CAPITALIZED TERMS SHALL HAVE THE MEANINGS SET FORTH IN THESE GENERAL TERMS OR IN THE ORDER.

IF CUSTOMER DISAGREES WITH ANY OF THE TERMS OF THE AGREEMENT, THE CUSTOMER MUST NOT USE THE OFFERINGS PROVIDED IN CONNECTION WITH THE AGREEMENT.

1. Scope and Construction of Agreement

These General Terms govern purchase of, access to, and use of any one or more of the following Decisive’s products and services (each, an “Offering”): (a) one or more executable software modules and associated deployment tools in machine-readable form (“Software”); (b) managed, cyber or cloud services hosted by Decisive or its hosting providers (“Cloud Services”); (c) consulting, training and other professional services (“Professional Services”); and/or (d) hardware, equipment and supplies (“Hardware”). Each Offering is further subject to any Offering-specific terms and conditions set out in the applicable Order provided with the Offering. If Customer’s use of the Offering includes the right to access and use third party products and/or services, the Customer acknowledges and accept the terms and conditions of all applicable third-party end user agreements applicable to such products and/or services which are incorporated herein by reference.

An “Order” for one or more Offering(s) means an order for a purchase of an Offering accepted by Decisive which may take the form of: (i) Decisive issued quote or order form signed by the Customer; (ii) a Customer-issued purchase order (excluding any terms and conditions thereon) that refers to a valid Decisive quote for one or more Offering(s); or (iii) a statement of work duly signed by each party. An Order is deemed accepted by Decisive where Decisive issues an Order acknowledgment, starts to deliver, or provides access to the Offering (whole or in part), whichever comes first.

Each Order together with these General Terms constitute the “Agreement” between Customer and Decisive. These General Terms may be revised by time to time at Decisive’s sole discretion. Customer’s continued use of an Offering will constitute acceptance to any revisions to these General Terms.

2. Customer Obligations

Customer is responsible for the use of the Offering by any individual, organization or legal entity (each a “User”) who directly or indirectly receives access to, or the ability to use, the Offering or any component thereof through the Customer. Any act or omission of a User with respect to an Offering is deemed to be the act or omission of Customer.

If access to the Offering requires the use of Access Credentials, Decisive will: (i) assign unique Access Credentials to each User; and (ii) provide Customer with the ability to reset User passwords. Customer requests to re-assign and/or revoke a User’s Access Credentials must be actioned in accordance with Decisive’s then-current support policy. “Access Credentials” means the valid user identification and/or password and/or other identifier(s) which may be provided by Decisive to permit Users to access and use the Services. In no event will Decisive be liable for any unauthorized use or misuse of Customer Access Credentials.

Customer will not: (a) host, time-share, rent, lease, sell, license, sublicense, assign, distribute or otherwise transfer or allow third parties to exploit any component of any Offering, except as provided in the Agreement; (b) copy, modify, translate, reverse engineer, de-compile or disassemble, or create derivative works from any Offering except to the extent that law explicitly prohibits this restriction notwithstanding a contractual restriction to the contrary; (c) attempt to find, circumvent, bypass, exploit, defeat, or disable any limitations, restrictions, security vulnerabilities, security mechanisms, filtering capabilities, or entitlement mechanisms that are present or embedded in any Offering or any component thereof; (d) provide any passwords or other log-in information provided by Decisive as part of any Offering to any third party; (e) share non-public features or content of any Offering with any third party; (f) access any Offering in order to build or benchmark against a competitive product or service, or to build a product or service using similar ideas, features, or functions of any Offering; (g) use any Offering to transmit or store content or communications (commercial or otherwise) that is infringing, illegal, harmful, unwanted, inappropriate, objectionable, confirmed to be criminal misinformation or that otherwise poses a threat to the public or viruses, malware, worms, time bombs, Trojan horses and other harmful or malicious codes, files, scripts, agents or programs; (h) attempt to gain unauthorized access to any Offering, or to gain access by any means, including automated means (e.g. bots) other than those set out in the Documentation; (i) use any Offering bundled with or provided for use with another Offering independently of the applicable bundle or Offering with which it is intended to be used; or (j) use any Offering other than in compliance with all applicable laws and regulations.

3. Access and Use of Cloud Services

Subject to the terms of the Agreement, Decisive shall make the Cloud Service available to Customer and grants to Customer a limited, non-sublicensable, non-exclusive, non-transferable right to allow its Users to access and use the Cloud Service solely for Customer’s internal business purposes. Customer acknowledges and agrees that (i) Decisive may reclassify and/or modify the Cloud Service in its reasonable discretion, provided that such reclassification and/or modification does not cause the functionality of the Service to materially decrease; and (ii) its purchase of the Cloud Service is neither contingent upon the delivery of any future functionality or features nor dependent upon any oral or written public comments made by Decisive with respect to future functionality or features.

The Customer further agrees it will not: (a) violate, or facilitate the violation of, the rights of any third party, including, without limitation, the intellectual property or privacy rights of any third party; (b) negatively affect Decisive or its systems or networks; (c) negatively affect a third party’s use and enjoyment of the Cloud Service or any other Offerings provided by Decisive; or (d) violate Decisive’s Acceptable Use Policy, which can be found at www.decisivegroup.com/legal/acceptable-use-policy.

Decisive leverages the Network Time Protocol (“NTP”) for centralized clock synchronization. It is recommended that NTP be leveraged for all customer managed workloads in the cloud environment. Additional information can be found at www.ntp.org.

Use of the Cloud Services pursuant to any Agreement are further subject to the supplementary terms set forth in Annex A.

4. Customer Data and Security

“Customer Data” means all information and electronic data (i) generated during Customer’s use of the Offering (other than the Decisive Data); and/or (ii) submitted by or on behalf of Customer to the Offering. For clarity, Customer Data includes output(s) arising out of the Offering to the extent that such output(s) contains or is derived from Customer Data. Customer Data is Confidential Information as defined herein.

Decisive shall: (i) maintain appropriate administrative, physical, and technical safeguards to protect the security and integrity of the Offering and the Customer Data; (ii) protect the confidentiality of the Customer Data; and (iii) access and use the Customer Data solely to perform its obligations in accordance with the terms of the Agreement, and as otherwise expressly permitted in the Agreement (“Security Program”). Such Security Program will comply with the Decisive security protocols which are further described in Decisive’s most recently completed Service Organization Control 2 (SOC 2) audit reports or other similar independent third party annual audit report (“Audit Report”). Upon Customer’s request, Decisive shall provide Customer with a summary of Decisive’s then-current Audit Report, which shall be subject to the Confidentiality obligations set forth in the Agreement. In no event during the Term shall Decisive materially diminish the protections provided by the controls set forth in Decisive’s then-current Audit Report.

Customer acknowledges that it has a role in ensuring the confidentiality, integrity, and availability of Decisive’s Offerings and Customer’s Data and systems. To the extent applicable to the Offering and within Customer’s control, Customer shall: (i) maintain a security program designed to ensure its systems and data are protected in accordance with its legal obligations and industry recognized standards; (ii) configure the Offering sufficient for its purposes and standards; (iii) use the current version of the Offering and promptly update Customer’s systems and network with the latest security patches; (iv) take reasonable steps to prevent unauthorized access to the Offering, including without limitation, securing, protecting, and maintaining the confidentiality of its access credentials to the Offering; (v) ensure that it has performed appropriate review of the Offering to confirm it satisfies Customer’s security requirements; (vi) without undue delay, notify Decisive of any known or suspected unauthorized access to the Offering, and (vii) maintain adequate backups of Customer’s Data.

Both during and following the then-current Offering Term (as defined below), Decisive may maintain back-up copies of Customer Data at a secure site for disaster recovery purposes, provided such back-up copies are destroyed in accordance with Decisive’s then-applicable timelines and policies for data destruction. Upon termination of the applicable Offering or as otherwise set forth in the Order, Customer acknowledges and agrees that: (i) it will no longer be able to access or use the Service and/or the Customer Data; and (ii) it has fifteen (15) days following such termination to request a copy of all or part of the Customer Data. Upon expiry of such fifteen (15) day period, Decisive shall have no obligation to maintain or provide any Customer Data and shall thereafter, unless legally prohibited, delete all Customer Data by deleting Customer’s unique instance of the Offering; provided, however, that Decisive will not be required to remove copies of the Customer Data from its backup media and servers until such time as the backup copies are scheduled to be deleted in the normal course of business. If Customer requests a copy of all or part of the Customer Data in accordance with (ii) above, Customer acknowledges that such request may require an Order and the payment of additional Fees.

5. Privacy and Confidentiality

Decisive’s Privacy Policy located at www.decisivegroup.com/legal/privacy-policy describes how Decisive collects, uses and shares personal information.

Each party (“Recipient”) may, during the course of its provision and use of an Offering, receive, have access to, and acquire knowledge from discussions with the other party (“Discloser”) which may not be accessible or known to the general public, such as technical and business information concerning hardware, software, designs, specifications, techniques, processes, procedures, research, development, projects, products or services, business plans or opportunities, business strategies, finances, costs, vendors, penetration test results and other security information; defect and support information and metrics; and first and third party audit reports and attestations (“Confidential Information”). Confidential Information shall not include, and shall cease to include, as applicable, information or materials that: (a) were generally known to the public as of the date of disclosure; (b) become generally known to the public after disclosure other than as a result of the act or omission of the Recipient; (c) were rightfully known to the Recipient prior to its receipt thereof from the Discloser; (d) are or were disclosed by the Discloser generally without restriction on disclosure; (e) the Recipient lawfully received from a third party without that third party’s breach of agreement or obligation of trust; or (f) are independently developed by the Recipient as shown by documents and other competent evidence in the Recipient’s possession. The Recipient shall not: (i) use any Confidential Information of the Discloser for any purpose outside the scope of the Agreement, except with the Discloser’s prior written permission; or (ii) disclose or make the Discloser’s Confidential Information available to any party, except those of its employees, contractors, and agents that are bound by disclosure and use provisions substantially similar to those set forth in the Agreement and have a “need to know” in order to carry out the purpose of the Agreement. Each party agrees to protect the confidentiality of the Confidential Information of the other party in the same manner that it protects the confidentiality of its own proprietary and confidential information of like kind, but in no event shall either party exercise less than reasonable care in protecting such Confidential Information. If the Recipient is compelled by law to disclose Confidential Information of the Discloser, it shall provide the Discloser with prior notice of such compelled disclosure (to the extent legally permitted) and reasonable assistance, at the other party’s cost, if the other party wishes to contest the disclosure.

6. Fees and Invoicing

Customer shall pay Decisive the fees set forth in the applicable Order (“Fees”) in accordance with the payment frequency specified therein. Except as otherwise provided in the applicable Order, Fees for the Offering will be: (i) in Canadian dollars; (ii) due within thirty (30) days of the date of Decisive’s invoice; and (iii) are non-cancelable and non-refundable including Fees payable in respect of the unexpired portion of an Order’s Term. If Customer fails to pay any amounts due pursuant to the Agreement by the due date, in addition to any other rights or remedies it may have pursuant to the Agreement or by matter of law: (i) Decisive reserves the right to suspend the Offering upon thirty (30) days written notice, until such amounts are paid in full; and (ii) Decisive will have the right to charge interest at a rate equal to the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law until Customer pays all amounts due, in addition to any legal or collection agency fees incurred by Decisive in connection with its recovery of such amounts provided that Decisive will not exercise its right to charge interest and recover such legal/collection agency fees if the applicable charges are under reasonable and good faith dispute (with notice of such dispute provided to Decisive within thirty (30) days of Customer’s receipt of the applicable invoice) and Customer is cooperating diligently to resolve the issue. Decisive reserves the right to require that Customer pay any non-recurring or one-time Fees prior to delivery of the applicable Offering.

Unless otherwise specified in the applicable Order, upon invoice from Decisive, Customer will reimburse Decisive for all pre-approved, reasonable expenses incurred by Decisive while providing the Offering. Decisive will include reasonably detailed documentation of all such expenses with each related invoice. For clarity, Decisive agrees that no travel or out-of-pocket expenses shall be incurred other than in accordance with the applicable Order.

All Fees are exclusive of applicable local, state, federal or foreign taxes, levies, duties or similar governmental assessments of any nature, including value-added, use or withholding taxes (collectively, “Taxes”). Customer is responsible for paying all Taxes that arise from or as a result of its purchase of the Offering (excluding taxes based on Decisive’s net income or property) unless Customer provides Decisive with a valid tax exemption certificate authorized by the appropriate taxing authority.

7. Shipment, Title and Risk of Loss

Unless otherwise specified an Order, legal title and risk of loss of or damage to the Hardware pass from Decisive to Customer when delivered to the Customer’s shipping address. Software is licensed to Customer and not sold. The Customer is responsible for inspecting the Hardware at the time of delivery and must identify any visible damage on the delivery receipt that the delivery carrier requires the Customer to sign. Decisive is not responsible for any visible shipping damages not noted on the delivery receipt.

8. Term and Termination

The Agreement shall be in effect commencing on the date the Order is accepted and shall terminate upon completion of the Order, unless terminated sooner in accordance with the Agreement (“Term”).

The obligations with respect to each Offering will commence on the date that the Order for the Offering is accepted by Decisive, unless otherwise specified in the Order, and will remain effective for the period specified in the Order, unless terminated earlier in accordance with the Agreement (“Offering Term”). Unless otherwise specified in an Order, the Offering Term for Cloud Services shall automatically renew for consecutive twelve (12) month periods unless either party provides at least sixty (60) days notice prior to the end of the then-current Offering Term of its intention not to renew the Offering Term.

Either party may terminate the Agreement for cause by giving notice to the other party for: (a) unremedied material breach by the other party of any term or condition of the Agreement after fifteen (15) days written notice of same; (b) the other party’s failure to function as a going concern or operate in the ordinary course; (c) assignment by the other party for the benefit of creditors; or (d) voluntary or involuntary bankruptcy filing by or against the other party; or (d) with respect to a particular Offering, as otherwise provided in the applicable Order.

Decisive may, in its sole discretion, terminate, suspend, modify or discontinue the Offering at any time and without notice for any actual, suspected or anticipated use of the Services that may negatively affect Decisive, its systems or networks, or any third party; however, if circumstances permit, Decisive will use commercially reasonable efforts to provide Customer with notice and an opportunity to remedy such violation or threat prior to such suspension. Decisive shall not be liable for any suspension, termination, modification or discontinuance of one or more Offerings in accordance with these General Terms.

Upon termination of the Agreement for any reason, all rights granted to Customer including all Orders will immediately terminate and Customer will cease using the Offering and Decisive Confidential Information. Except as otherwise provided in the Agreement, termination for any reason shall not relieve Customer of the obligation to pay all future amounts due under all Orders. The respective rights and obligations of the parties to the Agreement shall survive the termination, expiration or cancellation of the Agreement, regardless of the reasons for such termination, expiration or cancellation, if they should by law or by their nature ordinarily be deemed to survive.

9. Ownership

As between Decisive and Customer, Customer owns the Customer Data. Customer grants to Decisive, its Affiliates and applicable contractors a worldwide, limited-term license to generate meta-data based on the Customer Data and host, copy and transmit such meta-data and/or the Customer Data, as reasonably necessary for Decisive to provide the Offering in accordance with the Agreement. Subject to the limited licenses granted in the Agreement, Decisive acquires no right, title or interest from Customer or Customer’s licensors pursuant to the Agreement in or to any Customer Data. Customer agrees to be solely responsible for the accuracy, quality and legality of Customer Data and the means by which Customer acquired Customer Data.

Except for the rights expressly granted pursuant to the Agreement, Decisive and its licensors retain all right, title, and interest in and to the Offering, including all related intellectual property rights inherent therein. If Customer purchases Professional Services, Decisive grants to Customer a worldwide, non-exclusive, non-transferable, non-sublicensable right to use the Professional Services solely for Customer’s use in conjunction with the Offering. No rights are granted to Customer hereunder other than as expressly set forth in the Agreement.

Decisive shall have a royalty-free, worldwide, transferable, sublicenseable, irrevocable, perpetual license to use or incorporate into the Offering any suggestions, ideas, enhancement requests, feedback, recommendations or other information provided by Customer or its Users relating to the features, functionality or operation of the Offering (“Feedback”). Decisive shall have no obligation to use Feedback, and Customer shall have no obligation to provide Feedback.

Decisive and its licensors own the statistical usage data derived from the operation of the Offering, including data regarding web applications utilized in connection with the Offering, configurations, log data, and the performance results for the Service (“Usage Data”). Nothing in the Agreement shall be construed as prohibiting Decisive and its licensors from utilizing the Usage Data to optimize and improve the Offering, monitor Customer’s use of the Offering for billing purposes or otherwise operate Decisive’s business; provided that if Decisive provides Usage Data to third parties, such Usage Data shall be de-identified and presented in the aggregate so that it will not disclose the identity of Customer or any User(s) to any third party.

10. Warranty and Disclaimer

Decisive makes no warranties with respect to the Hardware or Software associated to Hardware other than as set forth in the applicable Order or as may be set forth in the documentation delivered by Decisive with the Hardware (“Warranty Documentation”), which warranties are subject to the limitations set forth in this paragraph. The remedy for breach of the aforesaid warranty is limited to the repair or replacement of the defective item at no charge to Customer or the refund of the purchase price of the item, at Decisive’s sole option, and is conditioned upon (i) Customer’s payment of the price or fee specified in an applicable Order (except for purchases via authorized resellers); (ii) the proper use, maintenance, management and supervision of the item; (iii) the exclusive use of Hardware or consumable materials supplied by Decisive for the item; (iv) a suitable operating environment for the item; and (v) the absence of any intentional or negligent act or other cause external to the item affecting its operability or performance. This warranty will be null and void if maintenance is performed on a Hardware by any party other than Decisive or a qualified party approved by Decisive or if any addition to, removal from or modification of the Hardware is made without Decisive’s approval. If Decisive is requested to provide maintenance service for the Hardware that is not covered by the stated warranty, Customer will be responsible for the cost of all such service at Decisive’s then-current time and materials rates.

SUBJECT TO THE FOREGOING, EACH OFFERING IS PROVIDED “AS IS”, AND DECISIVE, ITS LICENSORS AND SUPPLIERS DISCLAIM ANY AND ALL REPRESENTATIONS, CONDITIONS OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF NON-INFRINGEMENT, TITLE, MERCHANTABILITY OR FITNESS FOR A PURPOSE, SATISFACTORY QUALITY, OR ANY REPRESENTATIONS, CONDITIONS OR WARRANTIES IMPLIED BY STATUTE, COURSE OF DEALING, COURSE OF PERFORMANCE, OR USAGE OR TRADE. DECISIVE MAKES NO REPRESENTATIONS, CONDITIONS OR WARRANTIES REGARDING ANY THIRD PARTY PRODUCT OR SERVICE, INCLUDING ANY THIRD PARTY VENDOR PRODUCT AS DEFINED HEREIN, WITH WHICH ANY OFFERING MAY INTEROPERATE. DECISIVE MAKES NO REPRESENTATIONS, CONDITIONS OR WARRANTIES THAT ANY SOFTWARE OR CLOUD SERVICE WILL PERFORM WITHOUT INTERRUPTION OR ERROR.

11. Limitation of Liability

IN NO EVENT WILL EITHER PARTY’S (OR DECISIVE’S THIRD PARTY LICENSORS) BE RESPONSIBLE OR LIABLE WITH RESPECT TO ANY SUBJECT MATTER OF THE AGREEMENT OR TERMS AND CONDITIONS RELATED THERETO UNDER ANY CONTRACT, NEGLIGENCE, STRICT LIABILITY OR OTHER THEORY: (A) FOR ERROR OR INTERRUPTION OF USE, LOSS OR INACCURACY OR CORRUPTION OF DATA; (B) FOR COST OF PROCUREMENT OF SUBSTITUTE GOODS, SERVICES, RIGHTS, OR TECHNOLOGY; (C) FOR ANY LOST PROFITS OR REVENUES; OR (D) FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, WHETHER OR NOT A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

IN NO EVENT WILL THE AGGREGATE LIABILITY OF EACH PARTY TOGETHER WITH ALL OF ITS AFFILIATES ARISING OUT OF OR RELATED TO THE AGREEMENT EXCEED THE TOTAL AMOUNT PAID BY CUSTOMER AND ITS AFFILIATES HEREUNDER FOR THE SERVICE GIVING RISE TO THE LIABILITY IN THE SIX (6) MONTH PERIOD PRECEDING THE DATE ON WHICH THE LIABILITY AROSE. THE FOREGOING LIMITATION SHALL APPLY WHETHER AN ACTION IS IN CONTRACT OR TORT AND REGARDLESS OF THE THEORY OF LIABILITY BUT WILL NOT LIMIT CUSTOMER’S PAYMENT OBLIGATIONS UNDER THE ‘FEES’ SECTION ABOVE.

12. Third-Party Products, Services and Beneficiaries

Certain third-party hardware, software and services may be resold, distributed, provided or otherwise made available by Decisive (“Third Party Vendor Products”). Third Party Vendor Products are subject to the applicable third party’s agreement that accompanies such Third Party Vendor Product or that is otherwise made available by such third party. Any Third Party Vendor Product included with or embedded in the Offering may be used only with the applicable Offering, unless otherwise permitted in the applicable agreement accompanying such Third Party Vendor Product.

Customer is notified that there are third-party beneficiaries to the Agreement. To the extent that the Agreement contains provisions that relate to (i) use of certain components of an Offering in which such third parties have an interest, (ii) products and services provided by third party subcontractors, suppliers and licensors of Decisive, or (iii) Third Party Vendor Products provided by third party vendors; such provisions are made expressly for the benefit of such third-party beneficiaries and are enforceable by such third-party beneficiaries in addition to being enforceable by Decisive. Except as expressly stated in this Section (Third Party Beneficiaries) or elsewhere in the Agreement or otherwise agreed in writing by the parties, the Agreement is made solely for the benefit of the parties hereto and their respective successors and permitted assigns, and no other person or entity will have or acquire any right or benefit under the Agreement.

13. Publicity

Decisive may, upon Customer’s prior written consent, use Customer’s name to identify Customer as a Decisive customer of an Offering, including on Decisive’s website and social media channels. Decisive agrees that any such use shall be subject to Decisive complying with any written guidelines that Customer may deliver to Decisive regarding the use of its name.

14. Anti-Corruption

Each party represents and warrants that, during the term of the Agreement, it and its affiliates, employees, directors, shareholders, agents and representatives will not directly or indirectly make any offer, payment, promise to pay, or authorize payment, or offer a gift, promise to give, or authorize the giving of anything of value for the purpose of influencing an act or decision of an official of any government (including a decision not to act) or inducing such a person to use his influence to affect any government act or decision in connection with the other party’s business in violation of the Canadian Corruption of Foreign Public Officials Act (CFPOA), the Foreign Corrupt Practices Act of the United States (“U.S.”) and any other applicable anti-corruption laws.

15. Trade Control

Certain parts of the Offerings may be subject to trade control laws, including but not limited to any sanctions or trade controls of Canada, the European Union, the United Kingdom, and United Nations; the Export Administration Regulations administered by the U.S. Department of Commerce’s Bureau of Industry and Security; U.S. sanctions regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Control; or on the U.S. Department of Commerce Entities List; and any import or export licenses required pursuant to any of the foregoing. Accordingly, Customer shall not export or re-export the Offerings, directly or indirectly, separately or as part of a system, without first obtaining proper authority to do so from the appropriate governmental agencies or entities, as may be required by law. Customer represents and warrants that: (a) no relevant agency has suspended, revoked or denied Company’s export and/or import privileges; (b) Customer is not located in or under the control of a national or resident of, a jurisdiction where this transaction is prohibited; (c) Customer shall not, in any manner whatsoever, remove, convey, export, import or transmit the Offering from or to Company’s jurisdiction in violation of the applicable laws and regulations; and (d) Customer will not use any Offering for any purposes prohibited by applicable laws, rules or regulations on trade controls, including related to nuclear, chemical, or biological weapons proliferation, arms trading, or in furtherance of terrorist financing. Customer agrees to cooperate with Decisive by providing end-user statements or other items requested by Decisive to establish compliance with trade control laws and regulations. In the event any of the above representations and warranties are incorrect or the Customer engages in any conduct that is contrary to sanctions or trade controls or other applicable laws, regulations, or rules, any Agreements, Orders, performance of services, or other contractual obligations of Decisive may be immediately terminated at Decisive’s sole discretion.

The Customer further agrees that it will not export, directly or indirectly, any technical information acquired from the other Party under the Agreement or any products using such technical information to a location or in a manner that at the time of export requires an export license or other governmental approval, without first obtaining the written consent to do so from the appropriate agency or other governmental entity in accordance with applicable law, including, but not limited to, the Canadian Controlled Goods Program, U.S. International Traffic and Arms Regulations or other similar legislation.

16. Relationship of the Parties

The Parties shall be independent contractors under the Agreement, and nothing in the Agreement shall constitute either Party as the employer, employee, agent, or representative of the other Party, or both Parties as joint venturers or partners for any purpose. Nothing in the Agreement shall prevent Decisive or its Affiliates from providing to a third party the same or similar products, services or deliverables as those provided to the Customer pursuant to the Agreement.

17. Force Majeure

Neither Party will be responsible for delays or failure of performance to the extent resulting from causes that are beyond the reasonable control of such Party, which such Party is unable to prevent by the exercise of reasonable diligence. The existence of such causes of such delay or failure will extend the period for performance to the extent necessary to enable complete performance in the exercise of reasonable diligence after the causes of delay or failure have been removed.

18. Governing Law

The Agreement and any disputes arising out of or related hereto shall be governed by and construed in accordance with the laws of the Province of Ontario, without giving effect to its conflicts of laws rules. With respect to all disputes arising out of or related to the Agreement, the Parties consent to exclusive jurisdiction and venue in the provincial courts located in Ottawa, Ontario, Canada.

19. Severability

If any provision of the Agreement is determined by a court to be invalid, illegal, or unenforceable, such determination shall not impair or affect the validity, legality, or enforceability of the remaining provisions of the relevant agreement, and each provision, or portion thereto, is hereby declared to be separate, severable, and distinct and the parties to the Agreement shall use their best efforts to agree upon a substitute provision that comports as closely as possible with the intent and effect of the stricken provision, failing which the court shall construe the relevant agreement to as closely as possible achieve the intention of the parties to the Agreement had the stricken provision remained.

20. No Waiver

No failure to exercise, no delay in exercising, and no statement or representation other than by any authorized representative in an explicit written waiver, of any right, remedy, or power will operate as a waiver thereof, nor will single or partial exercise of any right, remedy, or power under the Agreement preclude any other or further exercise thereof or the exercise of any other right, remedy, or power provided in the Agreement, in law, or in equity. The waiver of the time for performance of any act or condition under the Agreement does not constitute a waiver of the act or condition itself.

21. Assignment

Customer may not assign any of its rights or obligations under the Agreement without Decisive’s prior written consent. Any assignment of such rights or obligations in violation of the Agreement shall be null and void. Any valid assignment of Customer’s rights and obligations under the Agreement shall not relieve Customer of any obligations or liabilities which arise prior to or on the date of such assignment.

22. Notices

In any case where any notice or other communication is required or permitted to be given, such notice or communication will be in writing and: (a) personally delivered, in which case it is deemed given and received upon receipt; or (b) sent by international air courier service with confirmation of delivery to: (i) in the case of Customer, the address stipulated in the Order; or (ii) in the case of Decisive, 118 Iber Road, Unit 105, Ottawa, Ontario, Canada K2S 1E9.

23. Entire Agreement

The Agreement and items expressly incorporated into any part of the Agreement form the entire agreement of the parties. All terms and conditions on any purchase orders, supplier registration forms, supplier code of conduct, or similar document issued by Customer shall not amend the terms of the Agreement and will be of no force or effect notwithstanding any term or statement to the contrary made in such document. A provision in an Order executed by both parties will prevail over any conflicting provision elsewhere in the Agreement. Neither party has entered into the Agreement in reliance upon any representation, warranty, condition or undertaking of the other party that is not set out or referred to in the Agreement. The Agreement may not be modified except by formal agreement in writing executed by both parties.

ANNEX A

SUPPLEMENTARY TERMS APPLICABLE TO CLOUD SERVICES

Log-in credentials and private keys generated by Decisive are for Customer’s internal use only and Customer will not sell, transfer or sublicense them to any other entity or person, with the exception of authorized agents or subcontractors performing work on Customer’s behalf. In no event will Decisive be liable for any unauthorized use or misuse of the Customer’s username(s) or password(s).
Decisive’s design of the Services assumes that certain controls will be implemented by Customer. In certain situations, the application of specific controls is necessary to achieve Decisive’s control objectives. Decisive may make control recommendations to Customer, as well as provide the means to implement these controls. Decisive may also provide Customer with best practice guidance regarding control elements for which Decisive is not responsible. To compliment the Decisive controls, Customer is required to undertake the following additional controls and activities:
Customer should implement sound and consistent internal controls regarding general IT system access and system usage appropriateness for all internal user organization components associated with the Services, including the correction and deletion or erasure of Customer Data.
Customer should practice removal of user accounts for any users who have been terminated, if such users were previously involved in any material functions or activities associated with the Services.
Services transactions should be appropriately authorized, secure, timely and complete.
Customer Data should be protected by appropriate methods to ensure confidentiality, privacy, integrity, availability and non-repudiation.
Customer should implement controls requiring additional approval procedures for critical transactions relating to the Services.
Customer should report to Decisive in a timely manner any material changes to Customer’s overall control environment that may adversely affect the Services.
Customer is responsible for notifying Decisive in a timely manner of any changes to personnel directly involved with the Services, including without limitation, financial, technical or ancillary administrative functions directly associated with the Services.
Customer is responsible for adhering to the terms and conditions stated within Customer’s contracts with Decisive.
Customer is responsible for developing, and if necessary, implementing a business continuity and disaster recovery plan that will aid in the continuation of the Services.
Customer will immediately suspend access to Customer Data if Customer become aware of any internal or external violation by any user of the Services.
Customer is responsible for establishing appropriate document control classifications and labelling Customer Data to meet Customer’s specific needs.
The above list of user organization control considerations, including those which include certain specified control objectives, do not represent a comprehensive set of all the controls that should be performed by Customer. Other controls may be required by Customer’s organization.
Data sovereignty is of utmost importance to Decisive. As of the last revised date of this Agreement, Decisive has cloud operations running in data centers in Ottawa, ON and Calgary, AB, Canada.
Decisive will provide Customer with processes to register Customer’s cloud environments using a Virtual Vault Request Form. Decisive will work with Customer when the time comes to deregister Customer’s environments.
Decisive will provide Customer with procedures to help Customer manage secret authentication information in a manner that is consistent with Customer’s overall authentication requirements.
Decisive’s modular cloud architecture facilitates flexible configuration and complete customization of public, private, and hybrid cloud environments. This architecture is built on five functional layers, each of which is optimized for enterprise cloud applications: Virtual storage, Virtual networking, Compute, Virtualization (virtual data center), and Security (virtual firewall). Decisive provides a secure cloud infrastructure environment that functions like a private cloud and reduces the risk of security breaches. Customer is responsible for properly configuring and using the Services and taking appropriate action to secure, protect, and backup and archive both Customer’s accounts and Customer Data in a manner that will provide appropriate security and protection; however, Decisive can enhance Customer’s security posture by providing subscription-based services for firewalls, encryption, backup and security incident management upon request. In relation to these additional services, note the following:
Decisive encrypts Customer Data in transit. At Customer’s request, Decisive will discuss and work with Customer to implement additional cryptographic controls to help Customer achieve Customer’s information security objectives regarding confidentiality, integrity, non-repudiation and authentication for Customer Data at rest.
Decisive’s Backup Service for Customer Data offers unlimited flexibility and scalability to manage increasing volumes of data. It allows Customer to choose only the features and functions that Customer need to create a secure cloud backup environment. Decisive will work with Customer to establish the scope and schedule of Customer’s backups, to establish retention periods and required restoration efforts, and testing backup scenarios.
Decisive’s Security Incident and Event Management Service (SIEMaaS) provides protection against malware and includes regularly scheduled vulnerability management, security testing and auditing including the collection, maintenance and protection of evidence logs and audit trails. Decisive will provide Customer with information on how these processes are managed upon request.
Decisive provides identity and access management for the Decisive Portal; upon termination of this Agreement, all information contained in the Decisive Portal is protected.
Decisive maintains certifications for information security standards and guidelines, including but not limited to: SOC 2 Type II controls relevant to Security, Availability and Confidentiality; and, ISO 27001:2013 Information Technology – Security Techniques – Information Security Management Systems – Requirements controls relevant to Confidentiality, Availability and Integrity. To maintain these standards, Decisive has documented processes, policies and procedures, which support the required information security criteria and protect Customer Data. Self-assessments, as well as independent third-party annual and semi-annual reviews of Decisive’s information security posture are conducted; these assessments are available upon request. Decisive also uses the services of subcontractors who also maintain such certifications (i.e.: Tier 3 Data Center providers).
Decisive cannot protect all Customer Data from loss, destruction, falsification, unauthorized access and unauthorized release, Decisive cannot and does not have access to Customer Data in the Decisive cloud. Decisive protects the infrastructure and ensures that infrastructure can accept Customer workloads.
In the unlikely event of an information security breach inside the tenant area, Customer will be contacted directly in accordance with Decisive’s Service Level Agreement (SLA). Decisive’s Incident Response Team has the necessary responsibility, authority and competence to manage an incident and maintain information security. Together with Customer’s Incident Response Team, Decisive will work to identify and resolve all information security issues. If Customer’s Services include Decisive’s Firewall as a Service (FWaaS) and/or Security Incident and Event Management as a Service (SIEMaaS), Decisive will also advise Customer of information security breaches which occur outside the tenant area.
Decisive will provide Customer with access controls that allow Customer to restrict access to Customer’s cloud services, Customer’s cloud services functions and the Customer Data that Customer maintains using the Services.
Customer is responsible for all activities that occur under Customer’s account, regardless of whether the activities are authorized by Customer or Customer’s agents or undertaken on Customer’s behalf. Decisive and its affiliates are not responsible for unauthorized access to Customer’s account.
Customer acknowledge and agree that Decisive does not exercise any control over the Customer Data that Customer uploads to Decisive’s systems or networks or otherwise transmit to Decisive or its systems or networks via Customer’s use of the Services, and that Customer is solely responsible for all Customer Data. Furthermore, Customer acknowledges and agrees that Decisive will have no liability or responsibility for any Customer Data.

These General Terms of Service were last updated: May 8, 2024 and supercede and wholly replaced the End-User Terms of Service (Direct) and End-User Terms of Service (Reseller Program) previously made available on the Decisive website and incorporated into any Order by reference.