## SUBSCRIPTION SERVICES AGREEMENT FOR NETSUITE CONNECTORS This SUBSCRIPTION SERVICES AGREEMENT FOR NETSUITE CONNECTORS (' Agreement ') is made between the individual or entity which has executed this Agreement (the ' Subscriber ', 'You' or 'Your'), and Oracle Canada ULC ( 'Oracle ', or 'We'). Capitalized terms not defined elsewhere in this Agreement shall have the meaning given to them in the Definitions section below. ## DEFINITIONS: 'Order' means the Oracle pricing proposal, quote or statement of work in the name of and executed by Subscriber and accepted by Oracle that specifies the subscription services, support services and/or professional services to be provided by Oracle subject to the terms of this Agreement. 'Electronic Communications' means any transfer of signs, signals, text, images, sounds, data or intelligence of any nature transmitted in whole or part electronically received and/or transmitted through the Oracle Cloud Service. ' Oracle Cloud Service ' as used in this Agreement means the subscription based Oracle cloud service that offers connectors for use exclusively with Oracle NetSuite, specified on the Order, and any documentation related thereto. ' Professional Services ' as used in this Agreement means the optional consulting or implementation services provided by Oracle pursuant to a Statement of Work. 'Subscriber Data' means all electronic data or information submitted to and transmitted through the Oracle Cloud Service by Your Users. 'Support Services' means the supplemental, technical support services provided by Oracle to Subscriber for the Oracle Cloud Service, pursuant to the terms hereof, and other online technical support resources that may be provided by Oracle from time to time. Support Services may be subject to additional fees. ' Statement of Work ', or ' SOW ' means the separate document or Order between Oracle and You that details the optional consulting and implementation services ordered by You. 'Third Party Content' means all software, data, text, images, audio, video, photographs and other content and material, in any format, that are obtained or derived from third party sources outside of Oracle Cloud Service. Examples of Third Party Content include data feeds from a third party e-commerce source. ' User(s) ' means individuals who are authorized by Subscriber to use the Oracle Services pursuant to this Agreement. Users may include but are not limited to Subscribers employees, consultants, contractors and agents. ## 1. LICENSE, RIGHTS AND RESTRICTIONS - 1.1 Oracle Cloud Service. Subject to the terms and conditions of this Agreement, and Subscriber's timely payment of fees due under the applicable Order(s) (' Fees '), Subscriber shall have the non-exclusive, worldwide, limited right to use the Oracle Cloud Service, Support Services and Professional Services ordered by Subscriber (collectively, the ' Services ') for the first month following Oracle's provision of access to the Services following the Effective Date hereof (' Initial Term '), and each subsequent month thereafter during which Subscriber remains a subscriber (each month, a ' Renewal Term '). Subscriber is authorized to use the Oracle Cloud Service during the Initial Term and applicable Renewal Terms solely for Subscriber's internal business operations and, except as authorized by Oracle in its sole discretion, solely to interoperate with Subscriber's Oracle NetSuite systems. Theterms of this Agreement shall also apply to updates and upgrades subsequently provided by Oracle to Subscriber for the Oracle Cloud Service. - 1.2 Users. Subscriber may allow its Users to use the Services in accordance with and subject to this Agreement, and Subscriber is responsible for their compliance with this Agreement and Subscriber's applicable Order or SOW. ## 1.3 Professional Services Subscriber may purchase Professional Services from Oracle pursuant to a SOW and subject to the terms of this Agreement. Each SOW will include fixed scope of services and estimated fixed fee for the Professional Services ordered. Revisions to the scope of services or estimated fixed fees in the SOW require amendment of the SOW or an additional SOW. Payments for Professional Services are payable in accordance with the 'Fees and Payment Terms' section of this Agreement. ## 2. SUBSCRIBER RESTRICTIONS AND RESPONSIBILITIES - 2.1 Restrictions. Subscriber may not, and may not cause or permit others to: (a) use the Services to harass any person; cause damage or injury to any person or property; publish any material that is false, defamatory, harassing or obscene; violate privacy rights; promote bigotry, racism, hatred or harm; send unsolicited bulk e-mail, junk mail, spam or chain letters; infringe property rights; or otherwise violate applicable laws, ordinances or regulations; (b) perform or disclose any benchmarking or availability testing of the Services; (c) perform or disclose any performance or vulnerability testing of the Services without Oracle's prior written approval, or perform or disclose network discovery, port and service identification, vulnerability scanning, password cracking or remote access testing of the Services; or (d) use the Services to perform cyber currency or crypto currency mining ((a) through (d) collectively, the ' Acceptable Use Policy '). In addition to other rights that Oracle has in this Agreement and Subscriber's Order, Oracle has the right to take remedial action if the Acceptable Use Policy is violated, and such remedial action may include removing or disabling access to material that violates the policy. - 2.2 Subscriber may not, and may not cause or permit others to: (a) modify, make derivative works of, disassemble, decompile, reverse engineer, reproduce, republish, download, or copy any part of the Services (including data structures or similar materials produced by programs); (b) access or use the Services to build or support, directly or indirectly, products or services competitive to Oracle; or (c) license, sell, transfer, assign, distribute, outsource, permit timesharing or service bureau use of, commercially exploit, or make available the Services to any third party except as permitted by this Agreement or Subscriber's Order. - 2.3 HIPAA . Subscriber agrees that: (i) Oracle is not acting on Subscriber's behalf as a Business Associate or subcontractor; (ii) the Oracle Cloud Service may not be used to store, maintain, process or transmit protected health information (' PHI ') and (iii) the Oracle Cloud Service will not be used in any manner that would require Oracle or the Oracle Cloud Service to be compliant with the Health Insurance Portability and Accountability Act of 1996, as amended and supplemented (' HIPAA '). In the preceding sentence, the terms 'Business Associate,' 'subcontractor,' 'protected health information' or 'PHI' shall have the meanings described in HIPAA. - 2.4 Transmission of Data. Subscriber understands that the technical processing and transmission of Subscriber's Electronic Communications is fundamentally necessary to use of the Oracle Cloud Service. Subscriber is responsible for securing DSL, cable or another high speed Internet connection and up-to-date 'browser' software in order to utilize the Oracle Cloud Service. Subscriber expressly consents to Oracle's interception and storage of Electronic Communications and/or Subscriber Data as needed to provide the Services hereunder, and Subscriber acknowledges and understands that Subscriber's Electronic Communications will involve transmission over the Internet, and over various networks, only part of which may be owned and/or operated by Oracle. Subscriber further acknowledges and understands that Electronic Communications may be accessed by unauthorized parties when communicated across the Internet, network communications facilities, telephone or other electronic means. Without limiting Oracle's applicable obligations under the Confidentiality Section of this Agreement, Oracle is not responsible for any Electronic Communications and/or Subscriber Data which are delayed, lost, altered, intercepted or stored during the transmission of any data whatsoever across networks not owned and/or operated by Oracle, including, but not limited to, the Internet and Subscriber's local network. ## 3. INTELLECTUAL PROPERTY/PROPRIETARY RIGHTS - 3.1 Subscriber Data . As between Oracle and Subscriber, Subscriber and Subscriber's licensors retain all ownership and intellectual property rights in and to Subscriber data. Subscriber grants Oracle the right to host, use, process, display and transmit Subscriber Data to provide the Services pursuant to and in accordance with this Oracle Subscription Services Agreement for NetSuite Connectors v120821 Page 2 of 13 Agreement and the Subscriber's Order. Subscriber has sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of Subscriber's data, and for obtaining all rights related to Subscriber's data required by Oracle to perform the Services. - 3.2 Oracle Intellectual Property Rights. All rights, title and interest in and to the Services (including without limitation all intellectual property rights therein and all modifications, extensions, customizations, scripts or other derivative works of the Services provided or developed by Oracle) and anything developed or delivered by or on behalf of Oracle under this Agreement are owned exclusively by Oracle or its licensors. Except as provided in this Agreement, the rights granted to Subscriber do not convey any rights in the Services, express or implied, or ownership in the Services or any intellectual property rights thereto. Subscriber grants Oracle a royalty free, worldwide, perpetual, irrevocable, transferable right to use, modify, distribute and incorporate into the Services (without attribution of any kind) any suggestions, enhancement request, recommendations, proposals, correction or other feedback or information provided by Subscriber or any Users related to the operation or functionality of the Services. Any rights in the Services or Oracle's intellectual property not expressly granted herein by Oracle are reserved by Oracle. Oracle and NetSuite service marks, logos and product and service names are marks of Oracle (the ' Oracle Marks '). Subscriber agrees not to display or use the Oracle Marks in any manner without Oracle's express prior written permission. The trademarks, logos and service marks of Third Party Application providers ('Marks') are the property of such third parties. Subscriber is not permitted to use these Marks without the prior written consent of such third party which may own the Mark. ## 4. SUPPORT SERVICES/MAINTENANCE/UPDATES - 4.1 Support Services. Limited technical support is provided by Oracle and included in your subscription to the Oracle Cloud Services, pursuant the terms of this Agreement and your Order. Subscribers can also purchase enhanced levels support for an additional fee, as set forth in the Order. - 4.2 Maintenance . Oracle, in its sole discretion, may take the Oracle Cloud Service down for unscheduled maintenance, and in that event will attempt to notify Subscriber. Oracle strives to perform scheduled maintenance outside of regular business hours for each region. - 4.3 Updates to Services. During the Initial Term and any Renewal Term, Oracle may update the Services to reflect changes in, among other things, laws, regulations, rules, technology, industry practices, patterns of system use, and availability of Third Party Content. Oracle updates to the Services will not materially reduce the level of performance, functionality, security or availability of the Services during the Term of the Order or SOW. ## 5. TERMINATION/SUSPENSION - 5.1 Termination for Convenience. Subscriber may cancel its Order at any time by providing 15 days prior written notice to Oracle. Oracle may cancel this Order at any time, for any reason, by providing 60 days prior notice to Subscriber. Subscriber's final invoice will be pro-rated, up to the cancellation date (pro-rating will be to the nearest whole week; i.e., in 25% increments). Subscriber agrees to pay for all Services delivered up to the date of termination. - 5.2 Suspension for Delinquent Account. Oracle reserves the right to suspend Subscriber's access to and/or use of the Services if any payment is due but unpaid, but only after Oracle has provided Subscriber with two (2) delinquency notices, and at least thirty (30) days have passed since the transmission of the first notice. Subscriber agrees that Oracle shall not be liable to Subscriber or other third party for any suspension of the Services pursuant to this Section 5.2. - 5.3 Suspension for Ongoing Harm. Oracle may suspend Subscriber or Subscriber's Users' access to, or use of, the Oracle Services if Oracle believes that (a) there is a significant threat to the functionality, security, integrity, or availability of the Oracle Services or any content, data, or applications in the Oracle Cloud Service; (b) Subscriber or Users are accessing or using the Oracle Services to commit an illegal act; or (c) there is a violation of the Acceptable Use Policy. When reasonably practicable and lawfully permitted, Oracle will provide Subscriber with advance notice of any such suspension. Oracle will use reasonable efforts to re-establish the Oracle Cloud Service promptly after Oracle determines that the issue causing the suspension has been resolved. During any suspension period, we will make Subscriber data (as it existed on the suspension date) available to Subscriber. Any suspension under this Section 5.3 shall not excuse Subscriber from Subscriber's obligation to make payments under this Agreement. - 5.4 Termination for Cause. If either Subscriber or Oracle breaches a material term of this Agreement or any Order or SOW and fails to correct the breach within 30 days of written specification of the breach, then the breaching party is in default and the non-breaching party may terminate (a) in the case of breach of any Order or SOW, the Order or any applicable SOW under which the breach occurred; or (b) in the case of breach of the Agreement, the Agreement and any Orders and SOWs that have been placed under the Agreement. If Oracle terminates any Orders as specified in the preceding sentence, Subscriber must pay within 30 days all amounts that have accrued prior to such termination, as well as all sums remaining unpaid for the Oracle Cloud Service under such Orders and SOWs plus related taxes and expenses. Except for nonpayment of fees, the non-breaching party may agree in its sole discretion to extend the 30 day period for so long as the breaching party continues reasonable efforts to cure the breach. Subscriber agrees that if Subscriber is in default under this Agreement, Subscriber may not use those Services ordered. ## 6. CONFIDENTIALITY By virtue of this Agreement, the parties may disclose to each other information that is confidential (' Confidential Information '). Confidential Information shall be limited to the terms and pricing under this Agreement and Subscriber's Orders and all information clearly identified as confidential at the time of disclosure. A party's Confidential Information shall not include information that: (a) is or becomes a part of the public domain through no act or omission of the other party; (b) was in the other party's lawful possession prior to the disclosure and had not been obtained by the other party either directly or indirectly from the disclosing party; (c) is lawfully disclosed to the other party by a third party without restriction on the disclosure; or (d) is independently developed by the other party. Each party agrees not to disclose the other party's Confidential Information to any third party other than as set forth in the following sentence for a period of five years from the date of the disclosing party's disclosure of the Confidential Information to the receiving party. Each party may disclose Confidential Information only to those employees, agents or subcontractors who are required to protect it against unauthorized disclosure in a manner no less protective than required under this Agreement, and each party may disclose the other party's Confidential Information in any legal proceeding or to a governmental entity as required by law. ## 7. DATA PROTECTION - 7.1 Subscriber is solely responsible in all respects for all use of and for protecting the confidentiality of login details that may be given to Subscriber or selected by Subscriber for use with the Oracle Services. Subscriber may not share these with or transfer them to any third parties. Subscriber must notify Oracle immediately of any unauthorized use of them or any other breach of security regarding it service that comes to Subscriber's attention. . - 7.2 Oracle shall maintain commercially reasonable administrative, physical and technical safeguards designed for the protection, confidentiality and integrity of Subscriber Data, as described in the applicable version of the Data Security Addendum available at www.netsuite.com/tos. - 7.3 Unless otherwise provided in the applicable Order, the Data Processing Agreement for Cloud Services (the 'Data Processing Agreement'), incorporated herein by reference, describes the parties' respective roles for the processing and control of Personal Information (as that term is defined in the applicable data privacy policies and the Data Processing Agreement) that Subscriber provides to Oracle as part of the Services. Unless otherwise provided in the applicable Order, Oracle will act as a data processor, and will act on Subscriber instructions concerning the treatment of Subscriber's Personal Information residing in the services environment, as specified in this Agreement, the Data Processing Agreement and the applicable Order. Subscriber agrees to provide any notices and obtain any consents related to Subscriber's use of the Services and Oracle's provision of the Services, including those related to the collection, use, processing, transfer and disclosure of Personal Data. The version of Oracle Subscription Services Agreement for NetSuite Connectors v120821 the Data Processing Agreement applicable to Your Order is (a) provided at Exhibit A, and (b) will remain in force until the start of the next Renewal Term, at such time Oracle may update the Data Processing Agreement in its sole discretion. - 7.4 Unless otherwise specified in Subscriber's applicable Order, Subscriber Data may not include any sensitive or special data that imposes specific data security or data protection obligations on Oracle in addition to or different from those specified in this Agreement, the Data Processing Agreement or the applicable Order. ## 8. DATA RETRIEVAL AND DELETION Customer is responsible for taking appropriate actions to back up or otherwise store separately Customer Data while Customer's access to the production Cloud Services environment is still active prior to termination. If Customer requires account reactivation or other assistance from Oracle in retrieving Customer Data post termination or to obtain access to or copies of Customer Data, Customer must create a service request or a support case in the Cloud Customer Support Portal applicable to the Cloud Service. The availability of any such assistance is subject to the terms of this section and additional fees may apply. For a period of 60 days upon termination of the Cloud Services (the 'Retrieval Period'), upon Customer's request, Oracle will make available via secure protocols Customer Data residing in the production Cloud Services environment, or keep the service system accessible, for the purpose of data retrieval by the Customer. During this Retrieval Period, Oracle's Cloud Service Level Objective Policy does not apply and the service system may not be used for any production activities. Oracle has no obligation to retain Customer Data after this Retrieval Period. Upon termination of the Cloud Services, Customer Data residing in the production Cloud Services environments is retained in disabled or inactive status during the Retrieval Period. Upon expiry of the Retrieval Period, Customer access to all Customer Data from the Cloud Services is then revoked and Customer Data is queued for deletion. Within ten (10) months following the termination or expiration of the Retrieval Period, and except as may be required by law, Oracle will delete or otherwise render inaccessible any Customer Data in the production Cloud Services environments maintained by Oracle in providing the Cloud Services procured on the Estimate/Order Form. ## 9. FEES AND PAYMENT TERMS - 9.1 Fees and Payment. Oracle will send an invoice for Fees due by Subscriber via e-mail for the Initial Term and Renewal Term(s), if any, which is payable by credit card (MasterCard, Visa or American Express), or by check. All Fees payable are due within 30 days from the invoice date unless otherwise specified in the applicable Order. Subscriber's Order is non-cancelable and all sums paid are nonrefundable, except as provided in this Agreement or Subscriber's applicable Order. Oracle may charge an up-front implementation fee for each additional connector Subscriber purchases. Applicable fees will be invoiced prior to performing any such setup activity. - 9.2 Annual Payment . Subscriber may elect to prepay for their Oracle Cloud Services on an annual basis (the 'Prepay Option'). If Subscriber elects the Prepay Option, the Initial Term of the Subscriber's Order shall be one year from the date of the most recently paid invoice (the ' Prepay Term '). Any prepayment applies to Oracle Cloud Services reflected on the Order in effect at the time of prepayment; Additional Oracle Cloud Services may be purchased during the Prepay Term, and additional fees may apply. Additional services purchased during the Prepay Term will be prorated for the remainder of the Prepay Term, and coterminate at the end of such Prepay Term. - 9.3 Taxes. Oracle Fees do not include any federal, state, local, or foreign taxes, levies or duties of any nature, including, but not limited to sales, value-added, or withholding taxes ("Taxes"). Subscriber is responsible for paying all Taxes imposed by applicable law that Oracle must pay based on the Services You ordered except for taxes based on Oracle's net income. Such Taxes shall be invoiced to and paid by Subscriber unless Subscriber provides Oracle with a valid tax exemption certificate authorized by the appropriate taxing authority. ## 10 . DISCLAIMER OF WARRANTY - 10.1 THE ORACLE CLOUD SERVICE IS PROVIDED AS-IS, WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESSED OR IMPLIED IN LAW, INCLUDING WITHOUT LIMITATION THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT AND WARRANTIES ARISING OUT OF COURSE OF DEALING OR USAGE OF TRADE. ORACLE DOES NOT WARRANT THAT THE ORACLE FAR APP SERVICE WILL BE PERFORMED ERROR-FREE OR UNINTERRUPTED, THAT ORACLE WILL CORRECT ALL SERVICES ERRORS, OR THAT THE SERVICES WILL MEET SUBSCRIBER'S REQUIREMENTS OR EXPECTATIONS. ORACLE IS NOT RESPONSIBLE FOR ANY ISSUES RELATED TO THE PERFORMANCE, OPERATION OR SECURITY OF THE ORACLE CLOUD SERVICE THAT ARISE FROM SUBSCRIBER DATA OR THIRD PARTY CONTENT. ## 11. LIMITATION OF LIABILITY - 11.1 IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, INCIDENTAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES, OR ANY LOSS OF REVENUE, PROFITS (EXCLUDING FEES UNDER THIS AGREEMENT), SALES, DATA, DATA USE, GOODWILL, OR REPUTATION. - 11.2 IN NO EVENT SHALL THE AGGREGATE LIABILITY OF ORACLE AND ITS AFFILIATES ARISING OUT OF OR RELATED TO THIS AGREEMENT OR SUBSCRIBER'S ORDER OR SOW, WHETHER IN CONTRACT, TORT, OR OTHERWISE, EXCEED THE TOTAL AMOUNTS ACTUALLY PAID UNDER SUBSCRIBER'S ORDER OR SOW FOR THE SERVICES GIVING RISE TO THE LIABILITY DURING THE MONTH IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO SUCH LIABILITY. ## 12. INDEMNIFICATION Subscriber will indemnify and hold Oracle and its agents harmless from any third-party claims, damages, costs, and expenses arising out of or related to Subscriber's use of the Services. Subscriber shall permit Oracle to participate in any defense and shall seek written consent from Oracle prior to entering into any settlement. ## 13. GENERAL PROVISIONS. - 13.1 Entire Agreement . This Agreement, together with the applicable Order, is the entire Agreement between Subscriber and Oracle for the Services ordered by Subscriber and supersedes all prior or contemporaneous agreements or representations, written or oral, regarding such Oracle Services. It is expressly agreed that the terms of this Agreement and any Order shall supersede the terms in any purchase order, procurement internet portal, or other similar non-Oracle document and no terms included in any such purchase order, portal, or other non-Oracle document shall apply to the Oracle Services ordered. In the event of any inconsistencies between the terms of an Order and the Agreement, the Order shall take precedence. Except as provided in Section 12.4 below, this Agreement and Order(s) hereunder may not be modified and the rights and restrictions may not be altered or waived except in a writing signed or accepted online by authorized representatives of Subscriber and of Oracle. No third party beneficiary relationships are created by this Agreement. - 13.2 Severability. If any provision is held by a court of competent jurisdiction to be contrary to law, such provision shall be eliminated or limited to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect. A waiver of any breach under this Agreement should not constitute a waiver of any other breach or future breach. - 13.3 Assignment . Subscriber may not assign this Agreement or give or transfer the Services, or any interest in the Services, to another individual or entity. - 13.4 Amendments. Oracle may revise the Agreement at any time and in such case, Oracle will notify Subscriber of any revisions by email or separate notice. Such changes will take effect at the beginning of Subscriber's next Renewal Term. Subscriber's continued use and payment of the Oracle Cloud Services will be deemed as Subscriber's acceptance of the revised Agreement. If Subscriber objects to any such revisions to the Agreement, Subscriber will notify Oracle of such objection prior to the beginning of Subscriber's next Renewal Term. Upon receipt of such notification, Oracle may elect to continue to deliver Subscriber's Services under the Agreement in effect prior to such notification for the current Renewal Term, until the parties agree on new terms applicable to the order and delivery of Services, or Oracle may terminate the Order by providing written notice to Subscriber. ## 13.5 Governing Law. This Agreement shall be governed by the substantive and procedural laws of the province of Ontario and each party agrees to submit to the exclusive jurisdiction of, and venue in, the courts of Toronto, Ontario in any dispute arising out of or relating to this Agreement. - 13.6 Force Majeure. Neither party shall be liable for loss, delay, nonperformance (including failure to meet the service level commitment but excluding payment obligations) to the extent resulting from any force majeure event, including, but not limited to, acts of God, strike, riot, fire, explosion, flood, earthquake, natural disaster, terrorism, act of war, civil unrest, criminal acts of third parties, failure of the Internet, governmental acts or orders or restrictions, failure of suppliers, labor stoppage or dispute (other than those involving Oracle employees), or shortage of materials, provided that such party uses reasonable efforts, under the circumstances, to notify the other party of the circumstances causing the delay and to resume performance as soon as possible and any delivery date shall be extended accordingly. ## 13.7 Independent Contractor Oracle is an independent contractor, and each party agrees that no partnership, joint venture, or agency relationship exists between the parties. ## 13.8 Non-Impediment Nothing in this Agreement shall be construed as precluding or limiting in any way the right of Oracle to provide consulting, development, or other services of any kind to any individual or entity (including without limitation performing services or developing materials which are similar to and/or competitive with the Professional Services and/or deliverables hereunder). - 13.9. Notice . Any notice required under this Agreement shall be provided to the other party in writing. If Subscriber has a legal dispute with Oracle or if Subscriber wishes to provide a notice under the Indemnification Section of this Agreement, or if Subscriber becomes subject to insolvency or other similar legal proceedings, Subscriber will promptly send written notice to: Oracle Canada ULC, 100 Milverton Drive Mississauga, Ontario L5R 4H1, Attention: General Counsel, Legal Department. - 13.10 Headings . The section headings used in this Agreement are included for reference purposes only and shall not affect the meaning or interpretation of this Agreement in any way. Provisions that survive termination or expiration of this Agreement are those relating to limitation of liability, indemnification, payment and others which by their nature are intended to survive. ## 14. AUDIT Upon forty-five (45) days written notice and no more than once every twelve (12) months, Oracle may audit Subscriber's use of the Oracle Services to ensure Subscriber's use of the Oracle Services is in compliance with the terms of the applicable Order and this Agreement. Any such audit shall not unreasonably interfere with Subscriber's normal business operations. Subscriber agrees to cooperate with Oracle's audit and to provide reasonable assistance and access to information reasonably requested by Oracle. The performance of the audit and non-public data obtained during the audit (including findings or reports that result from the audit) shall be subject to the Confidentiality provisions of this Agreement. If the audit identifies non-compliance, Subscriber agrees to remedy (which may include, without limitation, the payment of any fees for additional Oracle Services) such non-compliance within 30 days of written notification of that non-compliance. Subscriber agrees that Oracle shall not be responsible for any of Subscriber's costs incurred in cooperating with the audit. ## 15. EXPORT Export laws and regulations of the United States and any other relevant local, including Canadian, export laws and regulations apply to the Oracle Services. Such export laws govern use of the Oracle Services (including technical data) and any Oracle Services deliverables provided under this Agreement, and Subscriber and Oracle each agree to comply with all such export laws and regulations (including 'deemed export' and 'deemed re-export' regulations). Subscriber agrees that no data, information, software programs and/or materials resulting from the Oracle Services (or direct product thereof) will be exported, directly or indirectly, in violation of these laws, or will be used for any purpose prohibited by these laws including, without limitation, nuclear, chemical, or biological weapons proliferation, or development of missile technology. Subscriber acknowledges that the Oracle Cloud Services are designed with capabilities for Subscriber and Subscriber Users to access the Oracle Services without regard to geographic location and to transfer or otherwise move Subscriber Data between the Oracle Cloud Service and other locations such as User workstations. Subscriber is solely responsible for the authorization and management of User accounts across geographic locations, as well as export control and geographic transfer of Subscriber Data. ## EXHIBIT A - DATA PROCESSING AGREEMENT FOR ORACLE SERVICES ## ('DATA PROCESSING AGREEMENT') ## 1. SCOPE, ORDER OF PRECEDENCE AND APPLICABILITY - 1.1 This Data Processing Agreement applies to Oracle's Processing of Personal Information on Your behalf as a Processor for the provision of the Services specified in Your Services Agreement. Unless otherwise expressly stated in Your Services Agreement, this version of the Data Processing Agreement shall be effective and remain in force for the term of Your Services Agreement. - 1.2 Except as expressly stated otherwise in this Data Processing Agreement or Your Services Agreement, in the event of any conflict between the terms of the Services Agreement, including any policies or schedules referenced therein, and the terms of this Data Processing Agreement, the relevant terms of this Data Processing Agreement shall take precedence. ## 2. CONTROLLER AND PROCESSOR OF PERSONAL INFORMATION AND PURPOSE OF PROCESSING - 2.1 You are the Controller and Oracle is a Processor for the Processing of Personal Information as part of the provision of the Services. Each party is responsible for compliance with its respective obligations under Applicable Data Protection Law. - 2.2 Oracle will Process Personal Information solely for the purpose of providing the Services in accordance with the Services Agreement and this Data Processing Agreement. ## 3. CATEGORIES OF PERSONAL INFORMATION AND DATA SUBJECTS - 3.1 In order to perform the Services and depending on the Services You have ordered, Oracle may Process some or all of the following categories of Personal Information: personal contact information such as name, home address, home telephone or mobile number, fax number, email address, and passwords; information concerning lifestyle and social circumstances including age, date of birth, marital status; business contact details; financial details; goods and services provided; unique IDs collected from mobile devices, network carriers or data providers, IP addresses, and online behavior and interest data. - 3.2 Categories of Data Subjects whose Personal Information may be Processed in order to perform the Services may include, among others, Your representatives and end users, such as Your employees, contractors, collaborators, partners, suppliers, customers and clients. - 3.3 Additional or more specific categories of Personal Information and/or Data Subjects may be described in the Services Agreement. Unless otherwise specified in the Services Agreement, You may not provide Oracle with any sensitive or special Personal Information that imposes specific data security or data protection obligations on Oracle in addition to or different from those specified in the Data Processing Agreement or Services Agreement. ## 4. YOUR INSTRUCTIONS - 4.1 Oracle will Process Personal Information on Your written instructions as specified in the Services Agreement and this Data Processing Agreement. - 4.2 To the extent required by Applicable Data Protection Law, Oracle will inform You if, in its opinion, Your Oracle Subscription Services Agreement for NetSuite Connectors v120821 Oracle Canada ULC instruction infringes Applicable Data Protection Law. You acknowledge and agree that Oracle is not responsible for performing legal research and/or for providing legal advice to You. - 4.3 Oracle will follow Your instructions at no additional cost to You. To the extent Oracle expects to incur additional charges or fees not covered by the fees for Services payable under the Services Agreement, such as additional license or third party contractor fees, it will promptly inform You thereof upon receiving Your instructions. Without prejudice to Oracle's obligation to comply with Your instructions, the parties will then negotiate in good faith with respect to any such charges or fees. ## 5. RIGHTS OF DATA SUBJECTS - 5.1 You control access to Your Services environment that holds Personal Information about Your end users, and Your end users should direct any requests related to their rights under Applicable Data Protection Law to You. - 5.2 To the extent such access is not available to You, Oracle will provide assistance with requests from individuals to access, delete or erase, restrict, rectify, receive and transmit, block access to or object to processing related to Personal Information held in Your Services environment on Oracle systems, insofar as reasonably and technically possible. - 5.3 If Oracle directly receives any requests or inquiries from Your end users that have identified You as the Controller, it will promptly pass on such requests to You without responding to the end user. ## 6. PERSONAL DATA TRANSFERS - 6.1 Oracle may access and Process Personal Information on a global basis as necessary to perform the Services, including for IT security purposes, maintenance and performance of the Services and related infrastructure, Services technical support and Service change management. - 6.2 To the extent such global access involves a transfer of Personal Information subject to any data transfer restrictions under Applicable European Data Protection Law, such transfer shall be subject to the Oracle Processor Code (Binding Corporate Rules for Processors). The most current version of the Oracle Processor Code is available on https://www.oracle.com/corporate/contracts/cloud-services/contracts.html#data-processing, and is incorporated by reference into the Services Agreement and this Data Processing Agreement. Oracle has obtained EEA authorization for its Processor Code and will maintain such authorization for the duration of the Services Agreement. - 6.3 To the extent such global access involves a transfer of Personal Information subject to cross-border transfer restrictions under Applicable Data Protection Law, such transfers shall be subject to the terms of the Oracle Intra-Company Data Transfer and Mandate Agreement. ## 7. ORACLE AFFILIATES AND THIRD PARTY SUBPROCESSORS - 7.1 Subject to the terms and restrictions specified in Sections 2.2, 6 and 7, You provide Oracle general written authorization to engage Oracle and Oracle Affiliates and Third Party Subprocessors to assist in the performance of the Services. - 7.2 Oracle maintains lists of Oracle and Oracle Affiliates and Third Party Subprocessors that may Process Personal Information. These lists are available to You via the applicable primary support tool provided for the Services or upon request via Your support contact. If You would like to receive notice of any intended changes to these lists, You can sign up to receive notifications or Oracle will provide you notice of intended changes where a sign up mechanism is not available. - 7.3 Within fourteen (14) calendar days of Oracle providing such notice to You, You may object to the intended involvement of a Third Party Subprocessor or Oracle or Oracle Affiliate in the performance of the Services, providing objective justifiable grounds related to the ability of such Third Party Subprocessor or Oracle or Oracle Affiliate to adequately protect Personal Information in accordance with this Data Processing Agreement or Applicable Data Protection Law in writing by submitting a 'service request' via the applicable primary support tool or process provided for the Services. In the event Your objection is justified, You and Oracle will work together in good faith to find a mutually acceptable resolution to address such objection, including but not limited to reviewing additional documentation supporting the Third Party Subprocessors' or Oracle or Oracle Affiliate's compliance with this Data Processing Agreement or Applicable Data Protection Law, or delivering the Services without the involvement of such Third Party Subprocessor. To the extent You and Oracle do not reach a mutually acceptable resolution within a reasonable timeframe, You shall have the right to terminate the relevant Services (i) upon serving thirty (30) days prior notice; (ii) without liability to You and Oracle and (iii) without relieving You from Your payment obligations under the Services Agreement up to the date of termination. If the termination in accordance with this Section 7.3 only pertains to a portion of Services under an order, You will enter into an amendment or replacement order to reflect such partial termination. - 7.4 Oracle remains responsible at all times for the performance of the Oracle and Oracle Affiliates' and Third Party Subprocessors' obligations in compliance with the terms of this Data Processing Agreement and Applicable Data Protection Law. ## 8. TECHNICAL AND ORGANIZATIONAL MEASURES, AND CONFIDENTIALITY OF PROCESSING - 8.1 Oracle has implemented and will maintain appropriate technical and organizational security measures for the Processing of Personal Information. These measures take into account the nature, scope and purposes of Processing as specified in this Data Processing Agreement, and are intended to protect Personal Information against the risks inherent to the Processing of Personal Information in the performance of the Services, in particular risks from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Information transmitted, stored or otherwise Processed. - 8.2 All Oracle and Oracle Affiliate staff, as well as any Third Party Subprocessors that Process Personal Information are subject to appropriate written confidentiality arrangements. ## 9. AUDIT RIGHT AND COOPERATION WITH YOU AND YOUR SUPERVISORY AUTHORITIES - 9.1 To the extent provided in your Services Agreement, You may at Your sole expense audit Oracle's compliance with the terms of this Data Processing Agreement by sending Oracle a written request, including a detailed audit plan, at least six weeks in advance of the proposed audit date. You and Oracle will work cooperatively to agree on a final audit plan. - 9.2 The audit shall be conducted no more than once during a twelve-month period, during regular business hours, subject to Oracle's on-site policies and regulations, and may not unreasonably interfere with business activities. If You would like to use a third party to conduct the audit, the third party auditor shall be mutually agreed to by the parties and the third-party auditor must execute a written confidentiality agreement acceptable to Oracle. Upon completion of the audit, You will provide Oracle with a copy of the audit report, which is subject to the confidentiality terms of Your Services Agreement. there are no known material changes in the controls audited, You agree to accept the findings presented in the third party audit report in lieu of requesting an audit of the same controls covered by the report. Additional audit terms may be included in your Services Agreement. ## 10. INCIDENT MANAGEMENT AND PERSONAL INFORMATION BREACH NOTIFICATION - 10.1 Oracle promptly evaluates and responds to incidents that create suspicion of or indicate unauthorized access to or Processing of Personal Information ('Incident'). - 10.2 To the extent Oracle becomes aware and determines that an Incident qualifies as a breach of security leading to the misappropriation or accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information transmitted, stored or otherwise Processed on Oracle systems or the Services environment that compromises the security, confidentiality or integrity of such Personal Information ('Personal Information Breach'), Oracle will inform You of such Personal Information Breach without undue delay. - 10.3 As information regarding the breach is collected or otherwise reasonably becomes available to Oracle and to the extent permitted by law, Oracle will provide You with additional relevant information concerning the breach reasonably known or available to Oracle. - 10.4 Within the timeframes required for You to meet Your Personal Information Breach notification obligations under Applicable Data Protection Law, You agree to coordinate with Oracle in good faith on the content of Your intended public statements or required notices for the affected Data Subjects and/or notices to the relevant Supervisory Authorities regarding the Personal Information Breach. ## 11. RETURN AND DELETION OF PERSONAL INFORMATION - 11.1 Upon termination of the Services, Oracle will promptly return, including by providing available data retrieval functionality, or delete any remaining copies of Personal Information on Your Services production environment, except as otherwise stated in the Services Agreement. - 11.2 For Services for which no data retrieval functionality is provided by Oracle as part of the Services, You are advised to take appropriate action to back up or otherwise store separately any Personal Information while the production Services environment is still active prior to termination. ## 12. LEGAL REQUIREMENTS - 12.1 Oracle may be required by law to provide access to Personal Information, such as to comply with a subpoena or other legal process, or to respond to government requests, including public and government authorities for national security and/or law enforcement purposes. - 12.2 Oracle will promptly inform You of requests to provide access to Personal Information, unless otherwise required by law. ## 13. DEFINITIONS - ' Applicable Data Protection Law ' means all data privacy or data protection laws or regulations globally that apply to the Processing of Personal Information under this Data Processing Agreement, which may include Applicable European Data Protection Law. - ' Applicable European Data Protection Law ' means (i) the EU General Data Protection Regulation EU/2016/679, as supplemented by applicable EU Member State law and as incorporated into the EEA Agreement; (ii) the Swiss - Oracle Subscription Services Agreement for NetSuite Connectors v120821 Oracle Canada ULC Federal Act of 19 June 1992 on Data Protection, as amended; and (iii) the UK Data Protection Act 2018. ' Data Subject ', ' Process/Processing ', ' Controller ', ' Processor ', ' Supervisory Authority ' and ' Binding Corporate Rules ' (or the equivalent terms) have the meaning set forth under Applicable Data Protection Law. ' Europe ' means for the purposes of this Data Processing Agreement (i) the European Economic Area, consisting of the EU Member States, Iceland, Lichtenstein and Norway; (ii) Switzerland and (iii) the UK after it withdraws from the EU. ' Oracle ' means the Oracle Affiliate that has executed Services Agreement. Oracle has been acquired by Oracle Corporation. ' Oracle and Oracle Affiliate(s) ' means the subsidiar(y)(ies) of Oracle and Oracle Corporation that may Process Personal Information as set forth in Section 7. ' Personal Information ' shall have the same meaning as the term 'personal data', 'personally identifiable information (PII)' or the equivalent term under Applicable Data Protection Law. ' Services ' or the equivalent terms 'Service Offerings' or 'services' means the services specified in the Services Agreement. ' Services Agreement ' means (i) the applicable order for the Services you have purchased from Oracle; (ii) the applicable master agreement referenced in the applicable order, and (iii) any applicable service specifications or descriptions. ' Third Party Subprocessor ' means a third party, other than a Oracle or Oracle Affiliate, which Oracle subcontracts with and which may Process Personal Information as set forth in Sections 2.2 and 7. Other capitalized terms have the definitions provided for them in the Services Agreement or as otherwise specified in this Data Processing Agreement.