Controlup Software as a Service Agreement

This Software as a Service Agreement (“Agreement”) is a binding legal agreement between you (“Customer”) and the applicable ControlUp entity identified in the applicable Order (“ControlUp”). By accessing or using the Software or Services, by executing an Order that references or incorporates this Agreement, or by clicking “I Agree” or a similar acknowledgment, Customer agrees to be bound by this Agreement. If Customer does not agree to these terms, it must not access or use the Software or Services.

Customer (i) irrevocably waives, to the maximum extent permitted by applicable law, any requirement for an original (non-electronic) signature or for the delivery or retention of non-electronic records; and (ii) acknowledges and agrees that any processing of personal data in connection with the Software shall be governed by the applicable data protection terms, including the Data Processing Addendum or Privacy Policy, as applicable, each of which is incorporated herein by reference (https://controlup.com/privacy/dpa ou https://www.controlup.com/controlup-privacy-policy).

All capitalized terms used in this Agreement shall have the meanings set forth in Exhibit A attached hereto.  Other capitalized terms used in this Agreement are defined where they are used and have the meanings so indicated.

For the purposes of this Agreement the term Customer also includes Customer’s affiliates as defined in Exhibit A.

2. SERVICES AND SOFTWARE

1. Services and Software under Orders.   ControlUp will implement, configure, maintain and provide remote access to and use of: (i) the Software described in the applicable Order(s), and (ii) the Customer Data. Such Software will be made accessible through the Facilities, in accordance with the milestones, implementation dates, specifications and requirements set out in the Agreement and in the applicable Order(s).  Services include and/or will allow for:  (A) unlimited storage space on the Facilities for Customer’s and its Affiliates’ use, (B) Customer, its employees, agents, vendors and Affiliates (and their respective employees, agents and vendors) to transmit Customer Data over the Internet, (C) file and data backup, (D) real-time access to and use of the Customer Data, (5) Customer to promptly restrict and/or remove users from having access to the Hosted Services, and (6) all other services required in order for the Hosted Services to comply with the Documentation.  

2. Grant of License and Related Obligations and Restrictions.  

   1. Facilities (infrastructure).   ControlUp hereby grants Customer, its employees, agents, and vendors a limited, personal, non-exclusive, non-transferable, non-sublicensable license during the Term to access and use the Facilities as contemplated hereunder, including in the description of the Services set out in an applicable Order.  

   2. Software.   ControlUp hereby grants Customer, its employees, agents and vendors as well as Customer’s Affiliates, their employees, agents and vendors  a non-transferable (except as set out in Section 19.2) non-exclusive, worldwide, irrevocable (for the applicable Order Term) license to use the Software and Documentation, subject to any geographical limitations, term restrictions, and payment obligations set forth in the applicable Order. This license is contingent upon Customer maintaining an active Order and fulfilling all payment obligations thereunder.

   3. Customer Responsibilities. The Customer shall be solely responsible: i) for selecting qualified users to use the Software, who are familiar with the information, calculations, and reports that serve as input and output of the End Points and Named Users; (ii) for any activities occurring during the use of the Software; (iii) for using the Software for lawful purposes only; and (iv) for obtaining or providing, at the sole expense of the Customer, all telephone, internet service   and/or leased or dedicated access lines, telephone and computer equipment, including  connection equipment and modems and any other hardware or software necessary to enable  the operation of the Software. The Customer declares and warrants that ControlUp shall not be held liable for any network-related problems that can be attributed to the operation of the  Software. The Customer also acknowledges that internet and network configuration changes  might affect the Software’s performance and accessibility. 

   4. Customer Restrictions. The following restrictions shall also apply to the Customer’s use of the Software: (i) Customer shall refrain from accessing the Software in order to (a) create a competitive product or service; (b) create a product using similar ideas, features, functions or graphics of the Software; or (c) copy any ideas, features, functions or graphics of the Software; (ii) Customer shall not be entitled to: (a) license, sublicense, sell, resell, transfer, assign, distribute or commercially exploit or make the Software available to any third party, in any manner whatsoever; or (b) create Internet “links” to the Software or “frame” or “mirror” any content thereof on any other server, wireless or Internet-based device; (iii) During the Customer’s use of the Software, the Customer shall not (a) send spam or otherwise distribute duplicative or unsolicited messages that violates any applicable laws; (b) send or store infringing, obscene (including pornography, violence, terror, etc.), threatening, libelous, or otherwise unlawful or tortuous material, including, but not limited to, material harmful to children or violating privacy rights of a third party; (c) send or store material containing viruses, worms, trojan horses or other harmful computer code, files, scripts, or programs; (d) attempt to gain unauthorized access to the Software or its related systems or networks; (e) violate or cause ControlUp to violate any applicable law in any manner whatsoever; or (f) use the Software for any other purpose than for reasonable internal business purposes.

   5. License Scope and Usage Limits. Customer’s permitted use of the Software and Services is limited to the quantity of licenses, metrics, or capacity purchased and set forth in the applicable Order or this Agreement (e.g., Named Users, Concurrent Sessions, Endpoints, or other authorized usage metrics): (a) When the Order includes ControlUp Scoutbees, usage is limited to up to 20,000 tests per 24-hour maintenance window; (b) Remote Control for Unmanaged Devices is limited to fifty (50) Remote Control sessions to unmanaged devices within any rolling 24-hour period. Any sessions exceeding this limit may be automatically blocked or otherwise handled in accordance with the Monitoring and Excess Use provisions set forth in Section 2.2(f).

   6. Monitoring and Excess Use., ControlUp may audit and monitor the Customer’s use of the Software and Services to verify compliance with the license metrics, quantities, and other usage limitations specified in the applicable Order. If, at any time during the Term, ControlUp notifies Customer of its over deployment exceeding the number of licenses permitted under the applicable Order – including (i) Named Users, (ii) End Points, and/or (iii) Concurrent Licenses (“Excess Use”), then Customer shall within sixty (60) days of such notice, either (A) cease such Excess Use or (B) purchase the additional number of licenses required to address such Excess Use pro-rated to the end date of the then applicable Order Term. 

   7. Pre-Authorized Growth. Any increases in Customer’s usage of the Software or Services that fall within the growth allowances, auto-scaling provisions, or expansion tiers expressly set forth in the applicable Order shall not constitute Excess Use under this Agreement.

   8. Repeated Excess Use. If Customer elects to cease such Excess Use but subsequently incurs Excess Use again during the same Order Term, ControlUp reserves the right to invoice Customer for such Excess Use at the then-current applicable rates, pro-rated through the end of the Order Term, regardless of whether Customer later ceases such Excess Use. Unless otherwise specified in the Order, Customer shall pay all invoices for Excess Use within sixty (60) days of the invoice date.

3. Customer Data.   (a) Ownership. As between the parties, Customer Data is and shall remain the property of Customer. ControlUp shall use Customer Data solely to perform its obligations under this Agreement, except as otherwise permitted under this Agreement.

(b) Availability. Customer Data stored in the Software or Facilities shall be available to Customer through the Software or Facilities on a self-service basis, without the need for a separate request. ControlUp shall additionally make Customer Data available for export in ControlUp’s then-current standard format upon Customer’s request, at no additional charge and no more frequently than once per calendar month.

(c) Export and Deletion. For a period of sixty (60) days following expiration or termination of the applicable Order, ControlUp will make Customer Data available for export in ControlUp’s then-current standard format at no charge. Thereafter, ControlUp shall have no obligation to retain Customer Data and may delete it. Customer Data residing in back-up media will be deleted in accordance with ControlUp’s ordinary back-up rotation cycle. ControlUp may retain Customer Data as required by applicable law, provided it remains subject to the confidentiality and security obligations of this Agreement.

2. Use of Customer Data. ControlUp may, alone or together with its affiliates and service providers, generate and commercially exploit anonymized usage statistics and use Customer Data to enhance the Software or develop additional functionality, including transferring data between single-tenant and multi-tenant environments. Nothing in this Agreement shall prohibit or limit such activities. Except as expressly permitted herein, ControlUp shall not sell, assign, lease, disseminate, or otherwise dispose of Customer Data to any third party, nor shall ControlUp commercially exploit any part of Customer Data. ControlUp shall not possess or assert any property interest in, or any lien or other right against, Customer Data.

3. Back-up.   ControlUp shall perform daily and weekly back-ups of all Customer Data and maintain such back-ups for the duration of the applicable Order Term(s). At no additional cost to Customer, ControlUp shall also maintain a copy of each weekly back-up replicated across multiple availability zones. Any third-party back-up shall be subject to security obligations no less restrictive than those applicable to ControlUp under this Agreement.

4. ControlUp Personnel; Subcontracting.   The Services will be performed by ControlUp Personnel. ControlUp may subcontract the performance of any Services without Customer’s prior consent, provided that each Subcontractor is bound by written obligations no less restrictive than those set forth in this Agreement, including with respect to confidentiality and the protection of Customer Data. ControlUp remains fully liable for the acts and omissions of its Subcontractors as if performed by ControlUp directly. Engagement of Sub-processors requires no prior Customer consent and is governed exclusively by the applicable Data Processing Addendum.

5. Performance through ControlUp Affiliates. ControlUp may perform its obligations under this Agreement, in whole or in part, through its Affiliates. ControlUp remains responsible for the performance of its obligations hereunder.

6. Security and Supervision.    ControlUp Personnel, when on Customer premises, accessing Customer networks, or providing maintenance services, shall comply with all of Customer’s applicable security, supervision, and standard procedures.

3. AFFILIATES

1. Affiliate Use. Customer’s Affiliates may access and use the Services either: (i) by entering into their own Orders or Statements of Work with ControlUp that incorporate this Agreement by reference; or (ii) by being expressly included in Customer’s Order, subject to the following conditions: (A) such use is within the scope of the entitlements set forth in Customer’s applicable Order and does not exceed the total licensed volumes thereunder; (B) Customer expressly identifies each Affiliate it wishes to include under the Order prior to execution of such Order, or obtains ControlUp’s prior written authorization for any Affiliate not identified at the time of Order execution; (C) each Affiliate’s use is subject to and governed by the terms of this Agreement; and (D) Customer remains primarily liable for each Affiliate’s compliance with this Agreement and for all fees arising from Affiliate usage, including any overages.

2. Separate Orders. Where an Affiliate requires entitlements beyond those available under Customer’s existing Order, was not expressly identified in the applicable Order, or wishes to contract with ControlUp independently, such Affiliate must execute a separate Order with ControlUp, which shall incorporate the terms of this Agreement by reference unless the parties agree otherwise in writing.

3. Existing Customers. Where an Affiliate proposed to be included under Customer’s Order is itself an existing ControlUp customer with an active Order in effect, such Affiliate may not be included under Customer’s Order prior to the natural expiration of its own then-current Order term. For the avoidance of doubt, no existing Order between ControlUp and an Affiliate shall be terminated early for the purpose of consolidating such Affiliate under Customer’s Order. Upon expiration of the Affiliate’s existing Order term, the Affiliate may be included under Customer’s Order subject to the conditions set forth in Section 3.1 and subject to ControlUp’s prior written agreement.

4. Commercial Terms. The commercial terms applicable to each entity accessing the Services — whether Customer or any Affiliate — shall be set forth in the applicable Order for that entity and negotiated separately based on each entity’s specific requirements, volumes, and circumstances. The inclusion of an Affiliate under Customer’s Order or the execution of a separate Order by an Affiliate does not entitle such Affiliate to the same pricing, discounts, payment terms, or other commercial conditions as those agreed with Customer. ControlUp makes no representation that the commercial terms extended to Customer will be made available to any Affiliate, and each Affiliate’s commercial terms shall be determined at ControlUp’s sole discretion at the time of contracting.

4. PROFESSIONAL SERVICES

4. Delivery. ControlUp shall provide Professional Services as described in the applicable Order or Statement of Work (“SOW”), and subject to the additional terms, scope, deliverables, and fees set forth therein. Professional Services are separate and distinct from the Services, and neither party’s obligations with respect to the Services are dependent upon the provision or completion of any Professional Services.

5. No Effect on Services. Any delay, deficiency, or failure in the performance of Professional Services shall not constitute a breach of this Agreement with respect to the Services, shall not entitle Customer to terminate, suspend, or reduce its subscription to the Services, and shall not relieve Customer of its obligation to pay Fees for the Services. Customer’s sole remedies with respect to Professional Services are as set forth in the applicable Order or SOW.

6. Intellectual Property. ControlUp retains all right, title, and interest in and to all deliverables, scripts, templates, automation workflows, and other materials developed in connection with Professional Services, excluding any Customer Confidential Information or Customer Data incorporated therein. Customer receives a limited, non-exclusive, non-transferable license to use such deliverables solely for its internal business purposes during the term of this Agreement. Nothing herein restricts ControlUp from developing or providing similar work product to any third party.

5. EVALUATION AND PROOF OF CONCEPT

5. Evaluation Period. Unless otherwise specified in writing by ControlUp, each Evaluation shall be limited to thirty (30) days from the date access is first granted to Customer (“Evaluation Period”). ControlUp reserves the right to terminate an Evaluation at any time upon written notice.

6. As-Is Basis. The Software and Services provided during an Evaluation are provided strictly “AS IS” and “AS AVAILABLE,” with no indemnification, support, service level commitment, or warranty of any kind, express or implied.

7. Liability Cap. Notwithstanding anything to the contrary in this Agreement, ControlUp’s total aggregate liability arising out of or relating to any Evaluation shall not exceed ten thousand United States dollars (USD $10,000). The Limitation of Liability and Data Protection Liability Cap Sections of this Agreement do not apply to Evaluations, and this Section states ControlUp’s entire liability with respect to any Evaluation.

8. Data Access. Customer shall have no right to access data in the Evaluation environment after the Evaluation Period ends.

9. Separate Trial Agreement. This Section applies unless the parties have executed a separate Trial or Proof of Concept Agreement, in which case the terms of that agreement shall govern the Evaluation in its entirety and supersede this Section.

10. Conflict. In the event of any conflict between this Section and any other provision of this Agreement with respect to an Evaluation, this Section shall prevail.

6. SERVICE LEVELS AND SUPPORT SERVICES

6. Service Levels.   ControlUp shall provide the Services in accordance with the Service Levels set out in the applicable Order and as detailed in ControlUp’s Service Level Agreement, available at https://support.controlup.com/docs/service-level-agreement-and-support-definitions (“Service Level Agreement“). Questions regarding the Service Levels or Support Services may be directed to support@controlup.com.

7. Support Services.   ControlUp shall provide the Support Services set out in each applicable Order and as detailed in ControlUp’s Support Definitions, available at https://support.controlup.com/docs/service-level-agreement-and-support-definitions.

 

6. Scope of Support and Exclusions. ControlUp is responsible only for providing support for failures of its products to materially conform to the functional specifications set forth in the applicable product documentation. If the Customer provides ControlUp Support with all necessary components to replicate an issue, ControlUp will attempt to resolve it, provided it is able to reproduce the problem. To facilitate the collection of information and resolution of issues classified as Critical or High priority, the Customer must be available during business hours throughout the issue resolution process. ControlUp will not provide support in cases where the problem arises from the ControlUp product being combined, integrated, or operated with hardware or software not supported or authorized by ControlUp, improper or unauthorized use of the ControlUp product by the Customer in a manner inconsistent with the Agreed Use, or the inability to reproduce the issue on an unmodified version of the ControlUp product running on the applicable supported platform.
7. Exclusions for Third-Party Hosted Services and Sub-processors. ControlUp shall not be responsible for any service interruptions, outages, or performance issues caused by third-party hosting providers, cloud infrastructure providers, or other external services used in connection with the Software or Services (e.g., AWS, Azure, Google Cloud). Any such interruptions shall not constitute a breach of the Service Levels or give rise to liability on the part of ControlUp.
8. Exclusions for Suspension. The Service Levels shall not apply during any period in which Customer’s access to the Software or Services is suspended in accordance with this Agreement or is otherwise unavailable as a result of Customer’s breach.

7. DISASTER RECOVERY AND BUSINESS CONTINUITY PLAN

1. Disaster Recovery Plan. ControlUp shall maintain and apply business continuity and disaster recovery plans to all Services (the “Disaster Recovery Plan”), available at https://trustcenter.controlup.com/. The Disaster Recovery Plan shall: (i) be designed to continue the ControlUp business operations that are critical to the overall operation and functionality of the Services notwithstanding the occurrence of a Crisis; (ii) specify procedures and frequency of testing; and (iii) be maintained consistent with then-current generally accepted industry standards.

2. Contents. The Disaster Recovery Plan shall address: (a) technology infrastructure supporting the plan; (b) procedures to activate the plan, including notification and communication methods and contact lists; (c) disaster recovery strategies, processes, and procedures, including failover to an alternate site; and (d) scheduled and unscheduled plan maintenance. The Disaster Recovery Plan shall provide for redundancy or back-up of business operations designed to restore the Services within the recovery time and recovery point objectives specified therein.

3. Essais. ControlUp shall test the Disaster Recovery Plan at least once in any twelve (12) month period and shall review and update the plan on a regular basis in line with industry developments. Upon Customer’s written request, ControlUp shall provide an executive-level summary of the results of any such test and shall reasonably consider any recommendations made by Customer to remediate deficiencies identified by such test.

4. Prioritization. If a Crisis prevents ControlUp from providing the Services, ControlUp shall allocate its efforts and resources to restoring the Services in accordance with its then-current business continuity prioritization procedures.

5. Confidentiality. The Disaster Recovery Plan, any test results, and any related documentation constitute ControlUp Confidential Information and are provided subject to the Confidentiality Section of this Agreement.

8. INCIDENT MANAGEMENT

          Should a disaster or other event, including an Error, occur with a material adverse impact on the Services, the Facilities or the Software, each Party shall immediately notify the other Party and in any case, within 48 hours after becoming aware of such event. Each Party shall cooperate in good faith with the other Party (i) in the notification process of any incident to the other Party’s competent regulatory authority, where applicable (e.g. in case of data breaches (including personal data and critical data, where applicable), cyberattacks etc); (ii) in the assessment of any such incident, error, disaster and/or breach and its root causes; (iii) in the definition and implementation of any remediation and/or action plan to address the identified deficiencies.

            ControlUp undertakes to and shall ensure to report to Customer any incident impacting the confidentiality, integrity, availability and authenticity of any Customer Data.  Such notification shall be sent to the email address specified in the Data Processing Addendum (DPA) and shall include the known details of the incident, its potential implications, and the actions taken or planned by ControlUp in response. The email must include the known details of the event, the implications and ControlUp’s actions undertaken in response of such event.

9. INFORMATION SECURITY

1. ControlUp shall implement and maintain an information security program that complies with the requirements of SOC2 and/or ISO27001 certifications. The program shall include policies, procedures, and controls to protect customer data, ensure service integrity, and minimize disruptions, with regular audits and updates to maintain compliance with these standards. ControlUp will accurately and completely collect and maintain information regarding the storage location, media, and method of storage of all Confidential Information on an ongoing basis. 

Return, export, and deletion of Customer Data upon termination are governed by Section 2.3.

To the extent Services rendered by the ControlUp are considered "outsourced services" in accordance with any law or regulation on outsourcing applicable to the Customer and/or any Customer Affiliates in connection with this Agreement and the related Services, ControlUp shall comply at all times with the relevant applicable law or regulation, in particular it shall have verifiable internal controls in place to ensure compliance with security regulations and procedures and implement appropriate organizational and technical measures as contractually and specifically agreed for each Service in order to protect all Customer Data from unauthorized processing, and to ensure the accessibility, the confidentiality and safety, the availability, authenticity and the integrity of these Customer Data.

9. Protection. ControlUp must, at all times, take all necessary security and protective measures against, in particular, destruction, loss, access by unauthorized third parties or alteration of or to Customer Data provided or administered by the Customer or its subcontractors to which the ControlUp has access for the purposes of fulfilling its obligations under the Agreement.

10. Data Property. All Customer Confidential Information are and shall remain the Customer’s exclusive property and shall be treated as the Customer’s Confidential Information. Likewise, information generated by the systems, such as application logs, tables, reports, accounts, printed material of any and all types (account statements, etc.), is the Customer’s exclusive property. ControlUp shall acquire no rights over this information or data and only use the Customer’s Confidential Information to the extent necessary for the performance of the Services. Unless written approval from Customer given in advance, Customer’s Confidential Information must not be, notably used by the ControlUp and/or its Representatives other than for strict fulfilment of those obligations stipulated in the Agreement, which implies the Customer Data shall be rigorously physically and/or logically segregated from data of the ControlUp’s other users/customers.

 

10. ARTIFICIAL INTELLIGENCE

1. Access. Access to AI Features is subject to the applicable feature being included in Customer’s active Order, and may be subject to usage limits, consumption-based metrics, or fair use thresholds notified through the platform or documentation. Features identified as preview or beta are provided without support, Service Levels, indemnification, or warranty.

2. Use of Data. ControlUp and its Affiliates may process Customer Data, and may engage authorized third-party service providers to do so, to analyze usage, Inputs, Outputs, functionality, and feedback in order to support, maintain, and improve the Services. All application usage data used for analytics or AI purposes shall be anonymized and aggregated so that it cannot reasonably be used to identify any individual or Customer instance. ControlUp shall not use personal details contained in Inputs for such purposes. Customer represents that it holds all necessary rights in the Customer Data and authorizes such processing.

3. Disclaimer. AI FEATURES AND ANY OUTPUTS ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND. OUTPUTS MAY CONTAIN INACCURACIES, ERRORS, OR OMISSIONS. CUSTOMER IS SOLELY RESPONSIBLE FOR VALIDATING ANY OUTPUT BEFORE RELIANCE AND ASSUMES ALL RISK ARISING FROM SUCH RELIANCE. CONTROLUP SHALL HAVE NO LIABILITY FOR ANY DECISION MADE OR ACTION TAKEN IN RELIANCE ON ANY OUTPUT. AI Features are excluded from all Service Levels, and any downtime or degradation shall not constitute a breach or give rise to any remedy.

4. Acceptable Use. Customer shall not: (a) reverse engineer, extract, or replicate ControlUp’s AI models, algorithms, or training methodologies; (b) use any Output to develop or train a product or service competing with the Software or Services; (c) submit Inputs designed to manipulate, probe, or circumvent the models or their safeguards; or (d) use AI Features in violation of applicable law or with the intent to violate applicable law.

5. Opt-Out. Customer may elect, by written notice, to disable AI Features where such capability is made available. Opting out may degrade or disable features, analytics, and automation.

6. Intellectual Property. (a) ControlUp owns all right, title, and interest in the AI Features, all AI Platform Data, and all improvements to ControlUp’s models or services arising from operation of the AI Features. (b) Customer retains all right, title, and interest in its Customer Data and Inputs. The processing rights in Section 10.2 transfer no ownership to ControlUp. (c) As between the parties, Customer owns all right, title, and interest in Outputs generated in response to Customer’s Inputs, and ControlUp hereby assigns to Customer any right, title, and interest it may have in such Outputs. Customer acknowledges that Outputs are generated probabilistically, that ControlUp may generate identical or substantially similar Outputs for other customers, and that Customer’s ownership confers no exclusivity in and no right to restrict ControlUp’s generation or delivery of any such similar Output. Nothing in this Section transfers any right in the AI Features or AI Platform Data. (d) Outputs may reflect content or structures derived from third-party sources. ControlUp does not warrant that any Output is free from third-party intellectual property claims, and Customer is solely responsible for reviewing Outputs before any use beyond its internal operations. ControlUp’s indemnification obligations do not extend to Outputs. (e) Feedback regarding AI Features may be used by ControlUp without restriction, compensation, or confidentiality obligation.

7. Customer Inputs. Customer warrants that its Inputs do not infringe any third-party intellectual property rights and shall defend and indemnify ControlUp against any claim alleging that they do.

11. CONFIDENTIALITY, PROPRIETARY RIGHTS AND DATA PROTECTION

11. Restrictions.   The receiving party will keep the Confidential Information of the disclosing party confidential.  The receiving party may disclose the Confidential Information of the disclosing party to its Representatives who have a need to know such Confidential Information solely in connection with this Agreement.  The receiving party will cause such Representatives to comply with this Agreement and will assume full responsibility for any breach of this Agreement by any such Representatives. The receiving party will not transfer or disclose any Confidential Information of the disclosing party to any third party without the disclosing party’s prior written permission and without such third party having a corresponding contractual obligation to keep such Confidential Information confidential.  The receiving party will not use any Confidential Information of the disclosing party for any purpose other than in connection with this Agreement. Notwithstanding anything to the contrary, Customer may disclose ControlUp Confidential Information to third parties in connection with such third party’s provision of software or services to Customer.  Such disclosures will be made under an obligation of confidentiality limiting the use of such Confidential Information by such third parties to the provision of software and/or services to Customer.

12. Exclusions.   Confidential Information  will not include information that: (i) is in the public domain at the time of disclosure; (ii) was  in the possession of or demonstrably known by the receiving party prior to its receipt from the disclosing party without restriction on its use or disclosure; (iii) is independently developed by the receiving party without use of, reference to or reliance on the disclosing party’s Confidential Information; or (iv) becomes known by the receiving party from a source other than the disclosing party without breach of this Agreement and is not subject to an obligation of confidentiality.

13. Legal Requirements.   If the receiving party is required to disclose any of the disclosing party’s Confidential Information under a subpoena, court order, statute, law, rule, regulation or other similar requirement (a “Legal Requirement”), the receiving party will, to the extent not precluded by law, provide prompt prior notice of such Legal Requirement to the disclosing party so the disclosing party may seek an appropriate protective order or other appropriate remedy or waive compliance with the provisions of this Agreement. If the disclosing party is not successful in obtaining a protective order or other appropriate remedy and the receiving party is, in the reasonable opinion of its counsel, legally compelled to disclose such Confidential Information, or if the disclosing party waives compliance with the provisions of this Agreement in writing, the receiving party may disclose, without liability hereunder, such Confidential Information in accordance with, but solely to the extent necessary, in the reasonable opinion of its counsel, to comply with the Legal Requirement.  Notwithstanding anything to the contrary, Customer may disclose ControlUp Confidential Information as required to satisfy any request by any governmental or regulatory body. Recipient’s obligations of confidentiality for each item of discloser’s Confidential Information will not expire.

14. Data Protection Contract Requirements.   ControlUp and Customer shall enter into a Data Processing Addendum (“DPA“) available at https://controlup.com/privacy/dpa. 

15. Disposition of Confidential Information on Termination or Expiration.   Upon termination or expiration of this Agreement or upon the disclosing party’s written request and where practicable, the receiving party will return to the disclosing party all copies of Confidential Information already in the receiving party’s possession or within its control.  Alternatively, with the disclosing party’s prior written consent, the receiving party may destroy such Confidential Information using means to protect against unauthorized access to or use of the information, including, where appropriate, burning, shredding, or pulverizing such information, or by taking such other means as to assure that such information may not be recoverable following its disposal. In such case, an officer of the receiving party will certify in writing to the disclosing party that all such Confidential Information has been destroyed.  Notwithstanding the above, the receiving party may retain copies of such Confidential Information as required by applicable law, or, to the extent such copies are electronically stored in accordance with the receiving party's email record retention policies, so long as such Confidential Information is kept confidential as required under this Agreement.

16. Ownership. ControlUp shall own and retain all right, title and interest in and to (a) the Software and Services, including any and all improvements, enhancements or modifications thereto (regardless of the developing party and whether or not the same are a result of any feedback by the Customer), and (b) all intellectual property rights related to any of the foregoing. The Customer shall also refrain from reverse engineering, decompiling, disassembling or attempting in any other manner whatsoever to discover the source code of the Software.

17. Feedback. If Customer provides any suggestions, comments, ideas, or other feedback to ControlUp regarding the Software, Services, or any ControlUp technology or offering (“Feedback”), ControlUp shall own all right, title, and interest in and to such Feedback, and Customer hereby irrevocably assigns to ControlUp all rights in such Feedback. ControlUp may use, disclose, reproduce, license, distribute, and exploit Feedback for any purpose without restriction, compensation, or confidentiality obligation to Customer.

 

12. AUDIT RIGHTS

1. Customer Audit. ControlUp has its and its Subcontractors internal system of control of the Service delivery processes audited on an annual basis according to an internationally accepted reporting standard such as ISAE 3402 or a similar standard by an independent auditing company. Customer will receive such annual reports in due course after preparation for Customer's review. In addition, ControlUp shall deliver to Customer any report and finding made on ControlUp and the Subcontractors, whether produced by their internal or external auditors or by other third parties appointed by ControlUp or the Subcontractors in relation to the Agreement. Customer and its Affiliates where applicable, reserve a right to audit either itself/themselves or through a third-party independent contractor selected by Customer at Customer’s expense, the ControlUp and/or its Subcontractors during standard business hours, subject to reasonable coordination and no more than once per calendar year. The Audit right includes but is not limited to an on-site audit and review of ControlUp’s architecture, systems and procedures used, and records kept, in connection with the Services and the Software, as well as an audit of the performance of the agreed Services.  Customer and its Affiliates, where applicable, reserve the right to request information on this matter for monitoring purpose. During the Term and for twelve (12) months thereafter, ControlUp agrees to maintain, in accordance with generally accepted accounting principles, complete and accurate records so as to permit Customer to monitor compliance with this Agreement, and applicable laws, rules and regulations.  Each audit and review shall be conducted upon Customer’s reasonable request.  Upon notice of any audit findings, ControlUp shall use commercially reasonable efforts to make any necessary changes to ensure compliance with its obligations under the Agreement, and applicable laws, rules and regulations.  Any audits described in this Section shall be conducted during reasonable times and upon reasonable advance notice to ControlUp and shall be of reasonable duration and shall not unreasonably interfere with ControlUp’s day-to-day operations.  Further, Customer shall not conduct an audit more than once per year.  In the event that Customer conducts an audit through a third party independent contractor, such independent contractor shall be required to enter into a non-disclosure agreement containing confidentiality provisions substantially similar to those set out in Section 11 to protect ControlUp Confidential Information. The ControlUp, having obtained external certifications (ISO 27001, ISO 27017, ISO 27018 and ISO 27701, is committed to provide evidence of such certifications on a yearly basis.

2. Regulatory Audit. In addition to the above audit rights in favor of Customer, and/or its affiliates, where applicable, ControlUp will provide to Customer’s and/or Affiliates regulators and other law enforcement agents access at all reasonable times, after providing ControlUp with at least forty-eight (48) hours advance notice (except in the event of audits or investigations by regulators or other law enforcement agents, or investigations of reasonable suspicion of misappropriation, fraud or business irregularities of a potentially criminal nature, or relating to Customer data protection requirements), to ControlUp’s records kept in connection with the Services and the Software for the purpose of performing regulatory audits to enable Customer’s regulators included Customer’S Affiliates regulators or other law enforcement personnel to confirm that ControlUp is meeting all applicable information privacy, security, regulatory and other legal requirements which ControlUp is required to comply with in connection with performance of its obligations under this Agreement. During the Term and for twelve (12) months thereafter, ControlUp agrees to maintain, in accordance with generally accepted accounting principles, complete and accurate records so as to permit Customer’s regulators included Customer’s Affiliates regulators and any other law enforcement agents to confirm that ControlUp is meeting all applicable information privacy, security, regulatory and other legal requirements which ControlUp is required to comply with in connection with performance of its obligations under this Agreement.

13. FEES AND OTHER PAYMENTS

13. Fees.   The Fees for the Services and Software will be specified in the applicable Order. Customer shall provide ControlUp with complete and accurate billing and contact information. This information includes Customer’s legal company/organization name (if applicable), street address, telephone number, fax number (if applicable), e-mail address, and name of an authorized billing contact. In the event of a change of any of this information, Customer agrees to update the information within 30 days of any change.

14. Taxes. Except to the extent that Customer has provided an exemption certificate, direct pay permit or other such appropriate documentation, ControlUp shall add to each invoice and Customer shall pay any sales, use, excise, value-added, gross receipts, services, consumption and other similar transaction taxes (“Transaction Taxes”) however designated that are properly due and payable upon the Software and Services provided under this Agreement, and required by law to be collected from Customer, excluding however taxes based upon ControlUp’s net income and any taxes or amounts in lieu thereof (e.g., Ohio Commercial Activity Tax, and Washington B&O Tax) paid or payable by ControlUp.  Such Transaction Taxes shall only become due and payable by Customer upon the receipt of an invoice from ControlUp in line with local transaction tax rules and regulations.

15. Purchase Orders and Additional Legal Terms. If Customer issues a purchase order, such purchase order shall be for the total fees set forth in the applicable Order. ControlUp hereby rejects any additional or conflicting terms included in any purchase order or other Customer ordering documents, and acceptance of such documents is expressly conditioned on the terms and conditions of this Agreement. 

16. Late Payment Fee.   Any undisputed amounts not paid when due will accrue interest at a rate of one and one-half percent (1.5%) per month, or the maximum rate permitted by law, whichever is lower, from the due date until paid in full. Customer must notify ControlUp in writing of any good-faith dispute regarding an invoice within thirty (30) days of the invoice date, specifying the disputed amount and the basis for the dispute; all amounts not so disputed shall be deemed undisputed and must be paid when due.

17. Suspension.   If any undisputed amount remains unpaid for more than thirty (30) days after its due date, ControlUp may, upon ten (10) days’ prior written notice, suspend Customer’s access to the Software and Services until all outstanding amounts are paid in full. Suspension shall not relieve Customer of its payment obligations, and ControlUp shall have no liability for any consequences of a suspension made in accordance with this Section. If the non-payment is not cured within thirty (30) days following suspension, ControlUp may terminate the relevant Order and this Agreement for material breach. Termination for non-payment shall not release Customer from its obligation to pay all fees accrued or committed through the end of the applicable Order term, including any remaining fees due under a multi-year commitment.

18. Reseller Orders. Where Customer places an Order through an authorized reseller or other third party, the Fees, payment terms, and invoicing arrangements applicable to that Order are solely between Customer and such reseller, and ControlUp shall have no responsibility for billing, collection, or refunds thereunder. If Customer fails to pay any amount due to the reseller in respect of such Order, ControlUp may suspend Customer’s access to the Software and Services in accordance with the Suspension Section above, provided that the reseller has furnished ControlUp with documentation evidencing such non-payment. Suspension under this Section shall not relieve Customer of any obligation to the reseller, and ControlUp shall have no liability to Customer arising from any such suspension. Any dispute regarding amounts payable to a reseller shall be resolved between Customer and the reseller and shall not affect Customer’s obligations under this Agreement.

 

14. TERM

1. Agreement Term.   This Agreement is effective as of the Effective Date and, unless terminated earlier in accordance with this Agreement, will continue until the termination or expiration of any and all Orders (the “Term”). 

15. TERMINATION

15. Termination for Material Breach.   If either party materially breaches this Agreement or any Order, and  such breach is incapable of cure, or   such breach is capable of cure but the breaching party does not cure such breach within thirty (30) days after written notice of material breach, the non-breaching party may terminate the relevant Order and this Agreement upon written notice of immediate effect (“Termination for Cause”). 

16. Effect of Expiration/Termination. In case of Termination for Cause by Customer, Customer shall be entitled to receive, as a sole remedy, a refund equal to the proportional portion of the fees already paid to ControlUp, which may also be set-off against yet unbilled and/or unpaid fees for the remainder of the Order Term. 

17. Upon termination of this Agreement, for any cause whatsoever, the following terms shall apply: (I) any rights granted to Customer under this Agreement, shall terminate automatically; and (ii) Customer shall remove and destroy any copies of the Software installed by it, and/or by anyone on its behalf.

18. Transition Assistance.   Upon expiration or termination other than for Customer’s material breach, and at Customer’s written request, ControlUp will provide transition assistance as Professional Services under a separate Order at ControlUp’s then-current rates. ControlUp shall have no obligation to provide assistance to, or cooperate with, any third party, or to disclose any Confidential Information, methodologies, or technology.

 

16. RENEWAL

1. Auto-Renewal. This Agreement shall remain in effect for the term specified in the applicable Order (the “Initial Term”). Thereafter, certain Orders under this Agreement may be subject to automatic renewal for successive one (1) year periods (each, a “Renewal Term” and together with the Initial Term, the “Term”), in accordance with ControlUp’s then-current auto-renewal policy (the “Auto-Renewal Policy”, available at https://www.controlup.com/auto-renewal-policy/). The Auto-Renewal Policy applies only to customers within its defined scope. If the Auto-Renewal Policy applies to Customer and Customer does not wish to renew, Customer must provide written notice of non-renewal prior to the end of the then-current Term, following the cancellation procedures described in the policy. 

2. Non-Auto-Renewal Orders. Customers that fall outside the scope of the Auto-Renewal Policy must enter into a new Order to continue receiving services under this Agreement.

17. REPRESENTATIONS, WARRANTIES, COVENANTS AND LIMITATION OF LIABILITY

17. Non-Infringement.   ControlUp represents, warrants and covenants that:  (i) it has and will have all rights, titles, licenses, intellectual property, permissions and approvals necessary in connection with its performance under this Agreement and to grant Customer the rights granted hereunder; and (ii) none of the Services or Software nor their use as contemplated under this Agreement, do or will infringe, violate, trespass or in any manner contravene or breach any patent, copyright, trademark, license or other property or proprietary right or constitute the unauthorized use or misappropriation of any trade secret of any third party.

18. Software and Services.   ControlUp represents, warrants and covenants that: (i) the Software and resulting Services will conform to and operate in accordance with the Documentation; (ii) it shall perform the Services in conformance with the levels of service, quality control and other performance standards described in each applicable Order and/or Exhibit to this Agreement; (iii) all Services provided in connection with this Agreement are and will be performed to the best of ControlUp’s ability and in an effective, timely, professional and workmanlike manner in accordance with the highest applicable industry standards and practices; and (iv) ControlUp Personnel performing any Services hereunder will be appropriately trained and have a level of skill commensurate with the requirements of this Agreement, and ControlUp will promptly and cooperatively work with Customer to rectify any reasonable issues that Customer has with any person who is performing Services under this Agreement, including replacement, upon Customer’s reasonable request.

19. Defects; Errors.   ControlUp represents, warrants and covenants that Software and Facilities will properly operate without a material defect or Error. 

20. Compliance with Laws.   ControlUp represents, warrants and covenants that the Services, Software and the use contemplated under the Agreement is and for the duration of the Term, shall continue to be in compliance with all applicable national, federal, state and local laws, rules and regulations, and that ControlUp shall take no action or make any omission that would cause Customer to fail to comply with such laws, rules and regulations.   ControlUp agrees to inform Customer in writing of developments affecting the representations, warranties, and covenants set forth in this Section 17.4 during the Term.  Without limiting the generality of the foregoing:

    1. Anti-Bribery and Anti-Corruption.   In connection with this Agreement, ControlUp represents, warrants and covenants that is and at all times has been in compliance with all applicable anti-bribery and anti-corruption laws, including, but not limited to, the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, the Organisation for Economic Co-operation and Development Convention on Combating Bribery of Foreign Public Officials in International Business Transactions.  Except as previously disclosed to Customer in writing, ControlUp represents, warrants and covenants that: (i) ControlUp has not and will not make, permit or authorize, directly or indirectly, any offer, payment, promise, gift or transfer of money, anything of value, or any financial or other advantage to any person to secure any improper advantage; (ii) ControlUp has not been and is not currently subject to any governmental or regulatory review, audit, inspection or investigation related to applicable anti-bribery laws; and (iii) ControlUp is not aware of any allegations, investigations or inquiries by any governmental authority with regard to a potential violation of applicable anti-bribery law by ControlUp or its Representatives or other persons acting on its behalf.  ControlUp agrees to accurately record in its books and records any and all expenses related to this Agreement.  ControlUp agrees that it will not permit any of its Representatives to pay bribes in connection with ControlUp’s execution of its obligations under this Agreement.  In the event ControlUp obtains credible information indicating that any of its Representatives have paid bribes in connection with ControlUp’s execution of its obligations under this Agreement, ControlUp will promptly notify Customer in writing.  ControlUp agrees to provide Customer with periodic certifications of compliance with applicable anti-bribery and anti-corruption laws.

    2. Anti-Money Laundering.   In connection with this Agreement, ControlUp represents, warrants and covenants that it is and at all times has been in compliance with all laws, rules and regulations relating to the prevention of money laundering and/or terrorist financing applicable to it or its property or in respect of its business or operations, including all applicable financial record-keeping, know-your-customer and reporting requirements of the United States, and equivalent laws, rules and regulations enforced by other jurisdictions, which laws include, without limitation, the Currency and Foreign Transactions Reporting Act of 1970 (commonly known as the Bank Secrecy Act), as amended from time to time, including by the USA PATRIOT Act of 2001.

    3. Sanctions.   In connection with this Agreement, ControlUp represents, warrants and covenants that is and at all times has been in compliance with all applicable laws and regulations relating to economic or financial sanctions or embargos administered or enforced by a competent governmental authority, including without limitation: (i) the United Nations Security Council; (ii) the European Union; (iii) the governmental institutions and agencies of the United States, including the Office of Foreign Assets Control of the United States Department of Treasury ("OFAC"); and (iv) the governmental institutions and agencies of the United Kingdom, including Her Majesty's Treasury ("HMT").  ControlUp represents, warrants, and covenants, that it has implemented, and will periodically review to ensure the adequacy of, compliance measures reasonably designed to achieve compliance with this paragraph, and shall promptly notify Customer upon discovery of any circumstances that may indicate a breach of these obligations.

21. Encryption.   ControlUp will identify in the applicable Order any encryption used in the Services and Software and the Commodity Classification, Export License or License Exceptions, and Import License granted with respect thereto.  ControlUp represents that it has complied with, and will continue to comply with, all applicable laws, rules and regulations of the United States or any foreign country with respect to the export or importation of the Services and Software, any modifications, enhancements or updates thereto, and any technical data derived therefrom.

22. Disclaimer.   EXCEPT AS EXPRESSLY SET OUT IN THIS AGREEMENT, NEITHER PARTY MAKES ANY OTHER WARRANTY, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Customer acknowledges that ControlUp engages reputable providers of hosting services, for generation and hosting services of the Software ("Hosting Services"), and that notwithstanding anything to the contrary in this Agreement or any Order: (i) such services are provided pursuant to the general terms of use of such provider of Hosting Services, (ii) ControlUp cannot and does not make warranties for the Hosting Services, (iii) ControlUp is not obligated to impose the terms under this Agreement on a provider of Hosting Services, and (iv) ControlUp shall have no liability whatsoever in respect of the Hosting Services and its providers.

23. Limitation of Liability.   NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS AGREEMENT OR ANY ORDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW CONTROLUP OR CUSTOMER SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL OR PUNITIVE DAMAGES, EVEN IF IT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.  IN ADDITION, IN NO EVENT SHALL THE TOTAL LIABILITY OF CONTROLUP AND ANYONE ON ITS BEHALF FOR ALL DAMAGES, LOSSES, CLAIMS AND COSTS, WHETHER IN CONTRACT, TORT OR OTHERWISE, EXCEED THE AGGREGATE AMOUNT PAID OR PAYABLE BY CUSTOMER TO CONTROLUP DURING THE PERIOD OF 12 MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE LIABILITY. NOTWITHSTANDING THE ABOVE, NO LIMITATION OR EXCLUSION OF EITHER PARTY’S LIABILITY WILL APPLY WITH RESPECT TO ANY CLAIMS ARISING OUT OF OR RELATING TO CONFIDENTIALITY, PROPRIETARY RIGHTS AND NON-INFRINGEMENT INDEMNIFICATION OBLIGATIONS, OR EITHER PARTY’S WILLFUL MISCONDUCT OR GROSS NEGLIGENCE, OR ANY CLAIMS FOR PERSONAL INJURY OR PROPERTY DAMAGE (INCLUDING WITHOUT LIMITATION ALL COSTS ASSOCIATED WITH THE RECOVERY OR REPLACEMENT OF LOST OR DAMAGED DATA).  For the avoidance of doubt, any fines or penalties assessed on a party under applicable law arising out of the other party’s breach of this Agreement are direct damages.

24. Data Protection Liability Cap. NOTWITHSTANDING ANYTHING ELSE IN THIS AGREEMENT, CONTROLUP’S TOTAL AGGREGATE LIABILITY FOR CLAIMS ARISING OUT OF OR RELATING TO DATA PROTECTION AND PRIVACY OBLIGATIONS SHALL NOT EXCEED FIVE MILLION DOLLARS (USD 5,000,000).
18. INDEMNIFICATION

18. Indemnification by ControlUp.    ControlUp shall defend or settle at its expense any action, claim or proceeding brought against Customer to the extent based upon a claim that ControlUp’s proprietary Software, Services, and technology (excluding any Customer Data, Customer Inputs, third-party integrations, or AI-generated Outputs) infringe any third-party intellectual property right. ControlUp’s obligation to indemnify Customer shall be limited to the following: ControlUp agrees to pay Customer reasonable attorneys’ fees and expenses, incurred in investigation or defense of such claims, and all damages and liabilities finally awarded against Customer or paid in settlements and arising out of such third-party claims. Customer shall give ControlUp prompt notice of any such claim made against it, shall provide (at the ControlUp’s request and expense) such information and assistance in the defense of such claims as reasonably requested by ControlUp, and shall grant ControlUp sole control of the defense of any such claim, suit or proceeding, including appeals, negotiations and any settlement or compromise thereof. If the use of Software and/or the Services or part thereof becomes, or in ControlUp’s opinion may become, subject to any claim of infringement of any duly issued patent or copyright or asserted trade secret right and its use is thereby enjoined, ControlUp’s sole liability shall be, at ControlUp’s option, to either: (i) procure for Customer the right to continue using the Software and/or the Services as per the terms of this Agreement; (ii) replace or modify the applicable Software and/or Services so that they are not infringing and substantially equivalent in function to the enjoined Software and/or Services, so that it is non-infringing; or (iii) if neither of the foregoing alternatives is reasonably practical, ControlUp shall refund a portion of the License Fees paid to ControlUp for such Software and/or Services based on the Software’s then-current depreciated value and terminate this Agreement and refund any unused, prepaid fee covering the remainder of the Agreement Term after the effective date of such termination, without any further liability. Notwithstanding the foregoing, ControlUp shall have no liability for Customer’s willful acts or for any settlement or compromise incurred or made by Customer without ControlUp’s prior written consent. ControlUp shall have no obligation to defend and shall have no liability to the extent an infringement allegation is based upon: (x) use by Customer of the Software in conjunction or in combination with any device other than as authorized by ControlUp, or any use of the Software by Customer that is in violation of this Agreement, (y) use of the Software by Customer in a manner or for an application other than for which it was designed, (z) Customer’s modifications to the Software, (xx) ControlUp’s compliance with Customer’s particular design, instructions or specifications, (yy) Customer’s failure to implement any modifications, including corrections and enhancements, made available to Customer by ControlUp, if such use would have prevented the infringement, (zz) any Customer-provided content, data, or Inputs, including any claim that Customer Data or Customer Inputs infringe any third-party intellectual property right; or (zzz) any Output generated by AI Features, including any claim arising from the accuracy, completeness, or fitness of such Output. Subsections (x) through (zzz) above will be both individually and collectively known as “Other Claims”.

19. Customer Indemnification.   Customer will defend any claim, suit, or proceeding brought against ControlUp and will pay any damages or court costs (excluding consequential and exemplary damages) finally awarded against ControlUp, or agreed to by Customer in settlement or compromise, to the extent such claim, suit, or proceeding is based on: (i) an infringement allegation arising from Other Claims; (ii) Customer’s use of the Software in violation of the terms and conditions herein; and (iii) Customer’s violation of any international, federal, provincial, state, or local, law, rule or regulation including any such law, rule or regulations which are privacy related. ControlUp shall give Customer prompt notice of any such claim made against it, shall provide (at Customer’s request and expense) such information and assistance in the defense of such claims as reasonably requested by Customer, and shall grant Customer sole control of the defense of any such claim, suit or proceeding, including appeals, negotiations and any settlement or compromise thereof.

20. Each party may be represented in any such indemnification proceeding by counsel of its own choosing at its own expense. The indemnifying party shall not agree to any settlement or compromise that admits fault or imposes liability on the part of the indemnified party without its prior written consent.

19. GENERAL

19. Governing Law. This Agreement shall be governed, construed, interpreted and enforced according to the laws applicable to the relevant ControlUp Entity in the Order, as follows:

(i) Order signed with ControlUp, Inc.: The Agreement shall be governed by the laws of the State of New York, without giving effect to its provisions regarding conflict of laws, and only the courts in New York County, New York shall have jurisdiction in any conflict or dispute arising out of this Agreement.

(ii) Order signed with ControlUp Technologies Ltd.: The Agreement shall be governed by the laws of Israel, without giving effect to its provisions regarding conflict of laws, and only the courts in Tel Aviv, Israel shall have jurisdiction in any conflict or dispute arising out of this Agreement.

(iii) Order signed with ControlUp GmbH: The Agreement shall be governed by the laws of Germany, without giving effect to its provisions regarding conflict of laws, and only the courts in Frankfurt, Germany shall have jurisdiction in any conflict or dispute arising out of this Agreement.

(iv) Order signed with ControlUp UK Limited: The Agreement shall be governed by the laws of England and Wales, without giving effect to its provisions regarding conflict of laws, and only the courts in London, United Kingdom shall have jurisdiction in any conflict or dispute arising out of this Agreement.

(v) Order signed with ControlUp Pty Ltd: The Agreement shall be governed by the laws of the State of New South Wales, Australia, without giving effect to its provisions regarding conflict of laws, and only the courts in Sydney, New South Wales, Australia shall have jurisdiction in any conflict or dispute arising out of this Agreement.

(vi) Order signed with ControlUp Canada Inc., a Canadian corporation, having its principal place of business at 26 Wellington St. E., Suite 300, Toronto, Ontario, Canada: The Agreement shall be governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without giving effect to its provisions regarding conflict of laws, and only the courts located in Toronto, Ontario shall have jurisdiction in any conflict or dispute arising out of this Agreement.

19. Assignment.   Neither party will assign its rights or obligations under this Agreement without the prior written consent of the other party and any attempt to do so without such consent will be null and void.   Notwithstanding the above and anything to the contrary otherwise set out in this Agreement, in the event ControlUp undergoes any change of control, such change will constitute an assignment.

20. Notices.   Any notice required or permitted under this Agreement shall be sent by registered mail to the address set forth in the applicable Order, or by email to the designated notice email address, including, for ControlUp, legal@controlup.com. Notices shall be deemed received: seven (7) business days after delivery if sent by registered mail, or two (2) business days after transmission if sent by email.

21. Reseller and Third-Party Access. Customer acknowledges that any reseller or third party through which it obtains access to the Software or Services acts solely as an independent distributor and not as an agent of ControlUp, and has no authority to make representations, warranties, or commitments on behalf of ControlUp, or to alter, amend, or modify this Agreement.

22. No Waiver by Conduct.   No waiver of any of the terms of this Agreement or any Order will be valid unless in writing and designated as such.   Any inaction or delay on the part of either party in enforcing any of its rights under this Agreement will not be construed as a waiver of such right to enforce the same for such occurrence or any other occurrence.

23. Publicity.   Neither party shall issue any press release or public announcement regarding this Agreement or the relationship between the parties without the other party’s prior written consent, such consent not to be unreasonably withheld, conditioned, or delayed.

Notwithstanding the foregoing, Customer grants ControlUp the right to identify Customer as a customer of ControlUp and to use Customer’s name and logo in customer lists, on ControlUp’s website, and in sales and marketing materials, provided such use is consistent with any trademark usage guidelines Customer provides in writing. Customer may withdraw this right at any time upon thirty (30) days’ written notice, in which case ControlUp will cease such use on a going-forward basis, provided that ControlUp shall not be required to recall, destroy, or modify any materials already produced or distributed.

Nothing in this Section restricts either party from: (i) disclosing the existence of this Agreement to its Affiliates, professional advisors, actual or prospective investors, acquirers, or financing sources under obligations of confidentiality; (ii) making any disclosure required by applicable law, regulation, or stock exchange rule; or (iii) continuing to use any materials previously approved by the other party.

19. Severability.   If any of the provisions of this Agreement are for any reason held to be invalid, illegal or unenforceable by a court of competent jurisdiction, the remaining provisions of this Agreement will be unimpaired and will remain in full force and effect, and the invalid, illegal or unenforceable provision will be replaced by a valid, legal and enforceable provision that comes closest to the intent of the parties underlying the invalid, illegal or unenforceable provision.

20. Third Party Beneficiaries.   Unless expressly stated otherwise, this Agreement is for the sole benefit of the parties hereto and their successors and permitted assigns, and nothing herein, express or implied, shall give or be construed to give any person other than the parties any legal or equitable rights hereunder, provided that ControlUp’s Affiliates and Subcontractors shall be entitled to the benefit of, and may enforce, the limitations of liability, disclaimers, and confidentiality provisions set forth in this Agreement.

21. Force Majeure. Neither party shall be liable for any delay or failure to perform its obligations under this Agreement (other than payment obligations) to the extent such delay or failure results from any cause beyond its reasonable control, including acts of God, natural disaster, epidemic or pandemic, war, terrorism, civil unrest, labor dispute, government action, embargo, failure of the internet or public telecommunications networks, cyberattack, or failure of third-party cloud infrastructure or utilities. The affected party shall notify the other party without undue delay and use commercially reasonable efforts to resume performance. If such event continues for more than sixty (60) days, either party may terminate the affected Order upon written notice.

22. Survival.   The following provisions survive expiration or termination of this Agreement or any Order: Definitions; Customer Data (Section 2.3); Confidentiality, Proprietary Rights and Data Protection; Fees and Other Payments with respect to amounts accrued prior to termination; Representations, Warranties, Covenants and Limitation of Liability; Indemnification; and this Section, together with any provision that by its nature is intended to survive.

23. Order of Precedence.   In the event of any conflict, ambiguity, or inconsistency between or among the documents comprising or related to this Agreement, the terms of this Agreement shall prevail. This includes any conflict with any Order, Addendum, Data Processing Addendum, Customer purchase order, vendor portal terms, or other Customer ordering or procurement document, whether or not executed by ControlUp and whether or not incorporated by reference.

An Order may vary the terms of this Agreement solely with respect to the commercial terms applicable to that transaction (including fees, licensed volumes, term length, and Service scope). No Order, Addendum, or Data Processing Addendum shall be construed to expand ControlUp’s obligations, warranties, indemnities, or liability beyond those expressly set forth in this Agreement unless such document expressly identifies the specific Section of this Agreement it is intended to modify and is signed by an authorized representative of ControlUp. Without limiting the foregoing, in no event shall any Addendum, Data Processing Addendum, or other document increase ControlUp’s aggregate liability beyond the limitations set forth in the Limitation of Liability and Data Protection Liability Cap Sections.

Notwithstanding the foregoing, the Data Processing Addendum shall prevail solely with respect to the processing of personal data and solely to the extent required by applicable data protection law. In all other respects, including with respect to liability, indemnification, audit rights, and subcontracting, this Agreement shall prevail.

19. Entire Agreement. This Agreement, including all exhibits and Orders executed hereunder, constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior or contemporaneous agreements, proposals, negotiations, representations, and understandings, whether written or oral, relating to such subject matter, including, without limitation, any prior non-disclosure agreement, proof of concept agreement, evaluation agreement, end user license agreement, or similar arrangement between the parties. Notwithstanding the foregoing: (i) any non-disclosure agreement entered into by the parties shall continue to apply solely with respect to Confidential Information disclosed prior to the Effective Date, unless expressly superseded in writing, and (ii) any accrued payment obligations or liabilities arising under a prior agreement shall survive in accordance with their terms.

20. Modification. ControlUp may update or modify this Agreement at any time by posting a revised version at https://www.controlup.com/saas-agreement/ or by otherwise notifying Customer in writing. Modifications take effect on the date the revised Agreement is posted, unless a later effective date is specified. Customer’s continued access to or use of the Software or Services following notice of a modification constitutes acceptance of the updated Agreement. ControlUp recommends that Customer review this page periodically. Modifications will not apply retroactively to Orders executed prior to the modification date with respect to the commercial terms of those Orders. No other modification to this Agreement is valid unless agreed in a writing signed by an authorized representative of ControlUp.

 

 

EXHIBIT A
 
 DEFINITIONS

 

“Affiliate” means, with respect to either party, any entity that controls, is controlled by, or is under common control with such party. For purposes of the Agreement, “control” means possessing, (i) directly or indirectly, the power to direct or cause the direction of the management, policies or operations of an entity, whether through ownership of voting securities, by contract or otherwise; or (ii) the ownership of, or the power to vote, at least fifty percent (50%) of the voting stock, shares or interests of such entity.   An entity that otherwise qualifies under this definition will be included within the meaning of “Affiliate” even though it qualifies after the execution of the Agreement.

“Agreement” means the Software as a Service Agreement, the Exhibits thereto, and the Orders thereto, and all duly executed amendments to any of the foregoing.

“AI Features” means the artificial intelligence and machine learning functionality made available by ControlUp as part of the Services, including the underlying models, algorithms, and methodologies. 

“AI Platform Data” means aggregated and anonymized data, insights, behavioral patterns, model performance data, and operational learnings derived from the operation of the Services across ControlUp’s customer base, regardless of whether such data originates in whole or in part from Customer’s use of the Services. AI Platform Data does not constitute Customer Data or Customer Confidential Information. 

“Business Day” means Monday through Friday, excluding any holidays recognized by Customer. All time period references in this Agreement to “days” other than Business Days shall be deemed to refer to calendar days.

“Confidential Information” means any and all information relating to or disclosed in the course of this Agreement, which is or should be reasonably understood to be confidential or proprietary to the Discloser, including the Parties and the business of the Parties and their respective Affiliates, Customer data, any documents exchanged between the Parties in connection with the Agreement. A Recipient’s obligation to protect Confidential Information does not apply to any Confidential Information that the Recipient can demonstrate: (i) was publicly available at the time of disclosure to it; (ii) was published or otherwise became publicly available after disclosure to the Recipient, through no fault of its own; (iii) was in the possession of the Recipient at the time of disclosure to it from a third party who had a lawful right to such information and disclosed such information to it, without a breach of duty owed to the Discloser; or (iv) was independently developed by the Recipient without reference to Confidential Information of the Discloser, as proven by dated written records. Collectively Customer Confidential Information and ControlUp Confidential Information.

“ControlUp Confidential Information” means (i) all information relating to the business, operations, technology, or affairs of ControlUp and its Affiliates to which Customer has access, whether in oral, written, graphic, electronic, or machine-readable form, in the course of or in connection with the Agreement; (ii) the Software, Services, Facilities, and Documentation, including their architecture, design, configuration, source code, data models, algorithms, artificial intelligence and machine learning models, and any underlying methodologies, know-how, or technology; (iii) ControlUp’s information security program, policies, audit reports, certifications, penetration test results, vulnerability and threat data, and business continuity and disaster recovery plans; (iv) ControlUp’s nonpublic financial information, pricing, discounts, product roadmaps, and development plans; (v) any information expressly described in an applicable Order as ControlUp Confidential Information; (vi) notes, analyses, and studies prepared by Customer or any of its Representatives during the Term or at any time thereafter incorporating any of the information described in this definition; and (vii) the terms and conditions of the Agreement. ControlUp Confidential Information is protected under this Agreement regardless of whether it is marked or otherwise identified as confidential. 

“ControlUp Entity” means the specific ControlUp group company that enters into the Agreement with Customer, being one of the following:

(i) ControlUp, Inc., a Delaware corporation, having its principal place of business at 3141 Stevens Creek Blvd #41038, San Jose, CA 95117, United States;

(ii) ControlUp Technologies Ltd., an Israeli limited liability company, having its principal place of business at 2 Nim Blvd., Rishon Lezion 7546302, Israel;

(iii) ControlUp GmbH, a German company, having its principal place of business at Mazars Rechtsanwaltsgesellschaft mbH, Theodor-Stern-Kai 1, 60596 Frankfurt am Main, Germany;

(iv) ControlUp UK Limited, a company incorporated in England and Wales, having its principal place of business at 5.2 Central House, 1 Ballards Lane, London N3 1LQ, United Kingdom;

(v) ControlUp Pty Ltd, an Australian proprietary limited company, having its principal place of business at c/o YML Group, Tower 1, Westfield Shopping Plaza, NSW 2022, Australia; or

(vi) ControlUp Canada Inc., a Canadian corporation, having its principal place of business at 26 Wellington St. E., Suite 300, Toronto, Ontario, Canada.

“ControlUp Personnel” means any third party warranting, administering or otherwise involved in the offer, sale, performance, or fulfillment of the Services hereunder, including any of ControlUp’s employees, representatives, agents, contractors, or subcontractors.

“Crisis” means an extraordinary event affecting ControlUp that requires emergency response measures to be taken, including any event that may result in the Services, Software or Facilities becoming unavailable for a significant amount of time.

“Customer Confidential Information” means (i) all information related to the business of Customer and any of its Affiliates, clients and other third parties, to which ControlUp has access, whether in oral, written, graphic or machine-readable form, in the course of or in connection with the Agreement, including without limitation the Customer Data, (ii) any and all information to which ControlUp has access relating to a current or former employee, officer, or director of Customer or any of its Affiliates, (iii) notes, analyses and studies prepared by ControlUp or any of its Representatives, during the Term or at any time thereafter, incorporating any of the information described in this definition, and (iv) the terms and conditions of the Agreement.  

“Customer Data” means all Customer Confidential Information, all personal data and any other information relating to the employees, contractors, clients or customers of Customer (excluding ControlUp) or relating to the businesses of Customer or its Affiliates, including third party information, operations, facilities, products, services and markets, all as to the extent provided to or obtained by ControlUp from Customer, Customer’s employees, contractors or agents pursuant to the Agreement, or derived from any of the above or Customer’s use of the Services.

“Data Processing Addendum” or “DPA” means ControlUp’s Data Processing Addendum, available at https://controlup.com/privacy/dpa, as updated from time to time. 

“Documentation” means the user, operations and training manuals, marketing materials, proposals, and responses to requests for information or proposals, as well as any specifications, concerning the Services and relevant Software licensed under the Agreement.

“End Point” refers to each hardware or virtualized based station monitored by the Software under the terms of this Agreement, including, but not limited to, personal computers, laptops, terminal services, VDI, servers, screens, etc. 

“Error” means any defect or error in the Facilities or in the code of any Software that prevents: (i) the Facilities or Software from operating in accordance with the relevant Documentation; (ii) access to the Customer Data stored on the ControlUp’s Facilities; or (iii) the Services from being provided in accordance with the SLA.

“Evaluation” means the period during which the Software and Services are made available to Customer free of charge for evaluation, trial, proof of concept, or similar purpose.

“Excess Use” means any instance in which Customer’s use of the Software or Services exceeds the license metrics, quantities, or capacities purchased and set forth in the applicable Order, including but not limited to the number of Named Users, Concurrent Sessions, Endpoints, or other authorized usage metrics.

“Facilities” means the application software, operating system software, firmware, networks, communication devices and lines and all other equipment, software, devices and related materials provided by or used by ControlUp in providing access to the Software, the Customer Data maintained by ControlUp for Customer and/or Hosted Services under the applicable Order.

“Fee” means the fee for the Services and Software as specified in the relevant Order.

“Hosted Services” means the Services described in Section ‎2.1 of the Agreement.

“Implementation Date” means the implementation date set out in an applicable Order for the respective Services and Software.

“Input” means any data, content, prompt, instruction, or material submitted by or on behalf of Customer to the Software, the Services, or the AI Features. 

“Named User/s” refers to any individual on Customer’s behalf who has been authorized by Customer to use the Software.

“Order” means each duly executed ordering document under which Customer or its Affiliates purchase Software, Services, or Professional Services, including any order form, quote, schedule, statement of work, or similar document, in each case that references or incorporates this Agreement. 

“Order Term” means the period during which an Order is in effect, as specified in that Order. Each Order Term is non-cancellable, and neither Customer nor any Affiliate may terminate an Order for convenience prior to the expiration of the applicable Order Term. 

“Output” means any content, recommendation, script, insight, analysis, prediction, or other result generated by the AI Features in response to Customer’s Inputs. Output does not include Customer Data. 

“Professional Services” means any time-bound, project-based services provided by ControlUp to Customer pursuant to an applicable Order or Statement of Work, including but not limited to implementation, configuration, integration, training, consulting, and advisory services. Professional Services do not include the Services or Support Services provided under this Agreement.

“Representatives” means each party’s officers, directors, employees, partners, resellers, vendors, attorneys, accountants, agents and independent subcontractors (and their employees) and other representatives.

“Service Levels” means the service level commitments applicable to the Services as set out in the Service Level Agreement. 

“Services” means all services described in the Agreement, including the relevant Order(s), the Hosted Services, Support Services and the Facilities.

“Software” means the current version of the computer programs licensed hereunder as of the Order Effective Date and each new version available during the applicable Order Term licensed to Customer and to its Affiliates under an Order and all Documentation, error-corrections, patches and bug fixes.

“Subcontractor” means any third party engaged by ControlUp to perform, or to assist ControlUp in performing, all or any part of the Services, in accordance with Section 2.6. Sub-processors are not Subcontractors for the purposes of this Agreement.

“Sub-processor” means any third party engaged by ControlUp to process personal data on ControlUp’s behalf in connection with the provision of the Services. Sub-processors are governed exclusively by the applicable Data Processing Addendum and are not subject to the subcontracting requirements of Section 2.6.

“Support Services” means the maintenance and support services described in https://support.controlup.com/docs/service-level-agreement-and-support-definitions.

“System” means any of Customer’s, its Affiliates’ or, with respect to those third parties permitted to access and use the Facilities and Software pursuant to the Agreement, any such third party’s, software, firmware, hardware, computer systems and devices, and networks, whether owned, leased or rented by Customer, any of its Affiliates or, as applicable, any such third party, or otherwise provided for the benefit, or under the control, of any of the above.