## Subscription Services Agreement for NetSuite CPQ This Subscription Services Agreement for NetSuite CPQ (' Agreement ') is between Oracle Information Systems (Japan) G.K. (' Oracle '), and the entity which has accepted this Agreement through a document which references this Agreement (' Customer '). Capitalized terms not defined elsewhere in this Agreement shall have the meaning given to them in the Definitions section below. This Agreement sets forth the terms and conditions that govern Estimates/Order Forms placed under this Agreement. Oracle and Customer hereby agree as follows: ## Definitions. - 'NetSuite CPQ' means, collectively, the CPQ Platform, LLC online business application suite (and any optionally procured modules), as further described in the applicable User Guides, that is procured by Customer from Oracle in the Estimate/Order Form and any subsequent Estimate/Order Form including associated offline components, but excluding Third Party Applications, Support Services and Professional Services. - 'Customer Data' means all electronic data or information submitted to and stored in the NetSuite CPQ by Users. - 'Electronic Communications' means any transfer of signs, signals, text, images, sounds, data or intelligence of any nature transmitted in whole or part electronically received and/or transmitted through the NetSuite CPQ. - 'Estimate/Order Form' means an Oracle estimate, renewal notification or order form in the name of and executed by Customer and accepted by Oracle which specifies the NetSuite CPQ, and any Support Services and/or Professional Services to be provided by Oracle subject to the terms of this Agreement. - 'Oracle NetSuite Written Materials' means, collectively, the Data Processing Agreement, the NetSuite CPQ Data Security Addendum, the Oracle Service Privacy Policy, URL Terms, the User Guides and any other Oracle documents that are referenced in, or incorporated into, Customer's Estimate/Order Form for Services. - 'Professional Services' means the general consulting, implementation and/or training services to be provided to Customer pursuant to the terms hereof, the additional terms of the applicable version of the Professional Services Addendum (the 'Professional Services Addendum and an Estimate/Order Form or Statement of Work, as applicable. - 'Statement of Work' or ' SOW ' means a separate document or Estimate/Order Form between Oracle and Customer that details the Professional Services to be delivered by Oracle. - 'Support Services' means the technical support services to be provided to Customer for the NetSuite CPQ as further described in Customer's Estimate/Order Form. - 'Third Party Applications' means applications, integrations, services, or implementation, customization and other consulting services related thereto, provided by a party other than Oracle, that interoperate with the NetSuite CPQ as further described in the section below entitled 'Third-Party Applications'. - 'Users' means individuals who are authorized by Customer to use the NetSuite CPQ pursuant to this Agreement or as otherwise defined, restricted or limited in an Estimate/Order Form or amendment to this Agreement. Users may include but are not limited to Customer's and Customer's affiliates' employees, consultants, contractors and agents. - 'User Guides' mean the English language user guides for the NetSuite CPQ, included in the Oracle documentation at https://www.oracle.com/corporate/contracts/cloud-services/netsuite/contracts.html, as updated from time to time. - 'URL Terms' means the terms with which Customer must comply, which are located at a URL, referenced in this Agreement and are hereby incorporated by reference. 1. Services. Subject to the terms and conditions of this Agreement, Customer shall have the non-exclusive, worldwide, limited right to use the NetSuite CPQ, Support Services and Professional Services ordered by Customer (collectively, the ' Services ') during the applicable period set forth in Customer's applicable Estimate/Order Form or SOW solely for the internal business operations of Customer. Customer may allow its Users to use the Services for this purpose, and Customer is responsible for their compliance with this Agreement and Customer's applicable Estimate/Order Form or SOW. The terms of this Agreement shall also apply to updates and upgrades subsequently provided by Oracle to Customer for the NetSuite CPQ. 2. Estimates/Order Forms. The Services shall be ordered by Customer pursuant to Estimates/Order Forms. Each Estimate/Order Form shall include at a minimum a listing of the NetSuite CPQ and any Support Services and/or Professional Services being ordered and the associated fees. Except as otherwise provided on the Estimate/Order Form, Statement of Work or this Agreement, once placed, each Estimate/Order Form and Statement of Work is non-cancellable and all sums paid are non-refundable. If Customer exceeds the quantity of Services ordered, then Customer promptly must purchase and pay fees for the excess quantity. ## Subscription Services Agreement for NetSuite CPQ Any one of Customer's majority owned subsidiaries may also order Services under this Agreement by entering into an Estimate/Order Form or SOW, signed by such subsidiary and Oracle, and agreeing to be bound by the terms of this Agreement and such Estimate/Order Form or SOW. For the purposes of such Estimate/Order Form or SOW, 'Customer' as used in such Estimate/Order Form or SOW and this Agreement, shall be deemed to refer to the majority owned subsidiary executing such Estimate/Order Form or SOW. ## 3. Restrictions. ## 3.1. General Restrictions. - 3.1.1. Customer may not, and may not cause or permit others to: (a) use the Services to harass any person; cause damage or injury to any person or property; publish any material that is false, defamatory, harassing or obscene; violate privacy rights; promote bigotry, racism, hatred or harm; send unsolicited bulk e-mail, junk mail, spam or chain letters; infringe property rights; or otherwise violate applicable laws, ordinances or regulations; (b) perform or disclose any benchmarking, availability or performance testing of the Services; or (c) perform or disclose any performance or vulnerability testing of the Services without Oracle's prior written approval, perform or disclose network discovery, port and service identification, vulnerability scanning, password cracking, remote access or penetration testing of the Services (the ' Acceptable Use Policy '). In addition to other rights that Oracle has in this Agreement and Customer Estimate/Order Form, Oracle has the right to take remedial action if the Acceptable Use Policy is violated, and such remedial action may include removing or disabling access to material that violates the policy. - 3.1.2. Customer may not, and may not cause or permit others to: (a) modify, make derivative works of, disassemble, decompile, reverse engineer, reproduce, republish, download, or copy any part of the Services (including data structures or similar materials produced by programs); (b) access or use the Services to build or support, directly or indirectly, products or services competitive to Oracle; or (c) license, sell, transfer, assign, distribute, outsource, permit timesharing or service bureau use of, commercially exploit, or make available the Services to any third party except as permitted by this Agreement or Customer Estimate/Order Form. - 3.2. HIPAA. Customer agrees that: (i) Oracle is not acting on Customer's behalf as a Business Associate or subcontractor; (ii) the NetSuite CPQ may not be used to store, maintain, process or transmit protected health information ('PHI') and (iii) the NetSuite CPQ will not be used in any manner that would require Oracle or the NetSuite CPQ to be compliant with the Health Insurance Portability and Accountability Act of 1996, as amended and supplemented ('HIPAA'). In the preceding sentence, the terms 'Business Associate,' 'subcontractor,' 'protected health information' or 'PHI' shall have the meanings described in HIPAA. ## 4. Term, Fee, Payment & Taxes. - 4.1. Term. The term of this Agreement shall commence on the Effective Date and shall continue for the length of time referenced in all Estimate/Order Forms and SOWs for the Services (the 'Term'). The initial subscription term of the NetSuite CPQ and/or Support Services procured by Customer shall continue for the term applicable to such Services specified in the applicable Estimate/Order Form. If Customer has not entered into an Estimate/Order Form with Oracle regarding renewal of Customer's NetSuite CPQ and/or Support Services prior to the expiration of the initial term or then-current renewal term of such Services, then the subscription term for such Services shall be automatically renewed for a term of one (1) year unless either party provides written notice of non-renewal to the other at least thirty (30) days before expiration of the applicable initial term or then-current renewal term. - 4.2. Fees and Payment. All fees payable are due no later than the end of the month following the month in which the Oracle invoice is issued unless otherwise specified in the applicable Estimate/Order Form. All fees are non-refundable, except as otherwise explicitly stated in the applicable Estimate/Order Form or this Agreement. - 4.3. The fees and the term of use for additional capacity of the applicable NetSuite CPQ metric and other items procured during an existing subscription term will co-terminate with and be prorated through the end date of the subscription term for the applicable NetSuite CPQ. Pricing for subsequent renewal Estimate/Order Forms shall be set at then current Oracle pricing, unless otherwise agreed to by the parties. - 4.4. Taxes. Oracle fees do not include any local, state, federal or foreign taxes, levies or duties of any nature, including value-added, sales use or withholding taxes (" Taxes "). Customer is responsible for paying all Taxes, excluding only taxes based on Oracle's net income. If Oracle has the legal obligation to pay or collect Taxes for which Customer is responsible under this Section, the appropriate amount shall be invoiced to and paid by Customer unless Customer provides Oracle with a valid tax exemption certificate authorized by the appropriate taxing authority. ## 5. Proprietary Rights. ## Subscription Services Agreement for NetSuite CPQ - 5.1. Ownership of Customer Data. As between Oracle and Customer, all title and intellectual property rights in and to the Customer Data is owned exclusively by Customer. Customer acknowledges and agrees that in connection with the provision of the Services, Oracle may store and maintain Customer Data for a period of time consistent with Oracle's standard business processes for the Services. Following expiration or termination of the Agreement or a Customer account, if applicable, Oracle may deactivate the applicable Customer account(s) and delete any data therein. Customer grants Oracle the right to host, use, process, display and transmit Customer Data to provide the Services pursuant to and in accordance with this Agreement and the applicable Estimate/Order Form or SOW. Customer has sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of Customer Data, and for obtaining all rights related to Customer Data required by Oracle to perform the Services. - 5.2. Oracle Intellectual Property Rights. All rights, title and interest in and to the Services (including without limitation all intellectual property rights therein and all modifications, extensions, customizations, scripts or other derivative works of the Services provided or developed by Oracle) and anything developed or delivered by or on behalf of Oracle under this Agreement (including without limitation Deliverables and Tools as such terms are defined in the Professional Services Addendum ) are owned exclusively by Oracle or its licensors. Except as provided in this Agreement, the rights granted to Customer do not convey any rights in the Services, express or implied, or ownership in the Services or any intellectual property rights thereto. Customer grants Oracle a royalty free, worldwide, perpetual, irrevocable, transferable right to use, modify, distribute and incorporate into the Services (without attribution of any kind) any suggestions, enhancement request, recommendations, proposals, correction or other feedback or information provided by Customer or any Users related to the operation or functionality of the Services. Any rights in the Services or Oracle's intellectual property not expressly granted herein by Oracle are reserved by Oracle. Oracle and NetSuite service marks, logos and product and service names are marks of Oracle (the " Oracle Marks "). Customer agrees not to display or use the Oracle Marks in any manner without Oracle's express prior written permission. The trademarks, logos and service marks of Third Party Application providers (" Marks ") are the property of such third parties. Customer is not permitted to use these Marks without the prior written consent of such third party which may own the Mark. - 5.3. US Government Rights . The NetSuite CPQ is a 'commercial item' as that term is defined at FAR 2.101. If Customer or User is a US Federal Government (' Government ') Executive Agency (as defined in FAR 2.101), Oracle provides the NetSuite CPQ, including any related software, technology, technical data, and/or professional services in accordance with the following: (a) if acquired by or on behalf of any Executive Agency (other than an agency within the Department of Defense (' DoD '), the Government acquires, in accordance with FAR 12.211 (Technical Data) and FAR 12.212 (Computer Software), only those rights in technical data and software customarily provided to the public as defined in this Agreement; or (b) if acquired by or on behalf of any Executive Agency within the DoD, the Government acquires, in accordance with DFARS 227.7202-3 (Rights in commercial computer software or commercial computer software documentation), only those rights in technical data and software customarily provided in this Agreement. In addition, DFARS 252.227-7015 (Technical Data Commercial Items) applies to technical data acquired by DoD agencies. Any Federal Legislative Agency or Federal Judicial Agency shall obtain only those rights in technical data and software customarily provided to the public as set forth in this Agreement. If any Federal Executive Agency, Federal Legislative Agency, or Federal Judicial Agency has a need for rights not conveyed under the terms described in this Section, it must negotiate with Oracle to determine if there are acceptable terms for transferring such rights, and a mutually acceptable written addendum specifically conveying such rights must be included in any applicable contract or agreement to be effective. This U.S. Government Rights Section is in lieu of, and supersedes, any other FAR, DFARS, or other clause, provision, or supplemental regulation that addresses Government rights in computer software or technical data under this Agreement. ## 6. Terms of Service. - 6.1. Accuracy of Customer's Contact Information. Customer shall provide accurate, current and complete information on Customer's legal business name, address, email address and phone number, and maintain and promptly update this information if it should change. - 6.2. Notice . Any notice required under this Agreement shall be provided to the other party in writing. If Customer has a legal dispute with Oracle or if Customer wishes to provide a notice under the Indemnification Section of this Agreement, or if any one of the following events occurs; (1) if Customer suspend payment, (2) if a third party provisionally seizes, provisionally disposes, seizes, or executes important assets or assets received from Oracle based on this Agreement, or (3) if a petition for dissolution, bankruptcy, civil rehabilitation, corporate rehabilitation, or liquidation is filed, Customer will promptly send written notice to: Oracle Information Systems (Japan) G.K., 2-5-8, Kita-Aoyama, Minato-ku, Tokyo 107-0061 Japan, Attention: General Counsel, Legal Department. - 6.3. Users: Passwords, Access and Notification. Customer shall authorize access to and assign unique passwords and user names to its Users. Customer will be responsible for the confidentiality and use of User's passwords and user names. Customer will also be responsible for all Electronic Communications, including those containing business information, account registration, account holder information, financial information, Customer Data, and all other data of any kind contained within emails or otherwise entered electronically through the NetSuite CPQ or under Customer's account. Oracle will act as though any Electronic Communications it receives under Customer's passwords, user name, and/or account number will have been ## Subscription Services Agreement for NetSuite CPQ sent by Customer. Customer shall use commercially reasonable efforts to prevent unauthorized access to or use of the NetSuite CPQ and shall promptly notify Oracle of any unauthorized access or use of the NetSuite CPQ and any loss or theft or unauthorized use of any User's password or name and/or NetSuite CPQ account numbers. - 6.4. Transmission of Data. Customer understands that the technical processing and transmission of Customer's Electronic Communications is fundamentally necessary to use of the NetSuite CPQ. Customer is responsible for securing DSL, cable or another high speed Internet connection and up-to-date 'browser' software in order to utilize the NetSuite CPQ. Customer expressly consents to Oracle's interception and storage of Electronic Communications and/or Customer Data as needed to provide the Services hereunder, and Customer acknowledges and understands that Customer's Electronic Communications will involve transmission over the Internet, and over various networks, only part of which may be owned and/or operated by Oracle. Customer further acknowledges and understands that Electronic Communications may be accessed by unauthorized parties when communicated across the Internet, network communications facilities, telephone or other electronic means. Without limiting Oracle's applicable obligations under the Security or Confidentiality Sections of this Agreement, Oracle is not responsible for any Electronic Communications and/or Customer Data which are delayed, lost, altered, intercepted or stored during the transmission of any data whatsoever across networks not owned and/or operated by Oracle, including, but not limited to, the Internet and Customer's local network. - 6.5. Third-Party Applications. Oracle or third party providers may offer Third Party Applications. Except as expressly set forth in the Estimate/Order Form, Oracle does not warrant any such Third Party Applications, regardless of whether or not such Third Party Applications are provided by a third party that is a member of an Oracle partner program or otherwise designated by Oracle as 'Built For NetSuite,' "certified," "approved" or 'recommended.' Any procurement by Customer of such Third Party Applications or services is solely between Customer and the applicable third party provider. Customer may not use Third Party Applications to enter and/or submit transactions to be processed and/or stored in the NetSuite CPQ, unless Customer has procured the applicable subscription to the NetSuite CPQ for such use and access. Oracle is not responsible for any aspect of such Third Party Applications that Customer may procure or connect to through the NetSuite CPQ, or any interoperation, descriptions, promises, or other information related to the foregoing. If Customer installs or enables Third Party Applications for use with the NetSuite CPQ, Customer agrees that Oracle may enable such third party providers to access Customer Data for the interoperation of such Third Party Applications with the NetSuite CPQ, and any exchange of data or other interaction between Customer and a third party provider is solely between Customer and such third party provider pursuant to a separate privacy policy or other terms governing Customer's access to or use of the Third Party Applications. Oracle shall not be responsible for any disclosure, modification or deletion of Customer Data resulting from any such access by Third Party Applications or third party providers. No procurement of such Third Party Applications is required to use the NetSuite CPQ. If Customer was referred to Oracle by a member of one of Oracle's partner programs, Customer hereby authorizes Oracle to provide such member or its successor entity with access to Customer's business information related to the procurement and use of the NetSuite CPQ pursuant to this Agreement, including but not limited to User names and email addresses, support cases and billing/payment information. - 6.6. Support Services. As part of the NetSuite CPQ, Oracle will provide limited online resources to assist Customer in its use of the NetSuite CPQ. - 6.7. Updates. During the Services Period, Oracle may update the Services and the Oracle NetSuite Written Materials to reflect changes in, among other things, laws, regulations, rules, technology, industry practices, patterns of system use, and availability of Third Party Applications. Oracle updates to the Services or the Oracle NetSuite Written Materials will not materially reduce the level of performance, functionality, security or availability of the Services during the term of Customer's Estimate/Order Form or SOW. ## 6.8. Service Monitoring and Analyses - 6.8.1 Oracle continuously monitors the NetSuite CPQ to facilitate Oracle's operation of the Services; to help resolve Customer service requests; to detect and address threats to the functionality, security, integrity, and availability of the Services as well as any content, data, or applications in the Services; and to detect and address illegal acts or violations of the Acceptable Use Policy. Oracle monitoring tools do not collect or store any Customer Data residing in the Services, except as needed for such purposes. Oracle does not monitor, and does not address issues with, non-Oracle software provided by Customer or any of Customer's Users that is stored in, or run on or through, the Services. Information collected by Oracle monitoring tools (excluding Customer Data) may also be used to assist in managing Oracle's product and service portfolio, to help Oracle address deficiencies in its product and service offerings, and for license management purposes. - 6.8.2 Oracle may (i) compile statistical and other information related to the performance, operation and use of the Services, and (ii) use data from the Services in aggregated form for security and operations management, to create statistical analyses, and for research and development purposes (clauses (i) and (ii) are collectively referred to as 'Service Analyses'). Oracle may make Service Analyses publicly available; however, Service Analyses will not incorporate Customer Data, personal ## Subscription Services Agreement for NetSuite CPQ information or Confidential Information in a form that could serve to identify Customer or any individual. Oracle retains all intellectual property rights in Service Analyses. - 6.9. Security. Oracle shall maintain commercially reasonable administrative, physical and technical safeguards designed for the protection, confidentiality and integrity of Customer Data, as described in the NetSuite CPQ Data Security Addendum available at https://www.oracle.com/corporate/contracts/cloud-services/netsuite/cloud-delivery-policies.html. - 6.10. PCI-DSS Compliance . Customer is responsible for ensuring that its use of the NetSuite CPQ to store or process credit card data complies with applicable Payment Card Industry Data Security Standards (' PCI DSS ') requirements and shall not store credit card and social security data in the NetSuite CPQ except in the designated encrypted fields for such data. During the Term, Oracle shall maintain PCI DSS compliance for those portions of the NetSuite CPQ that are designated by Oracle as being designed to store and process credit card data. Any changes made to the NetSuite CPQ by the Customer or at the Customer's direction may affect the Customer's compliance with PCI DSS requirements and Customer shall be solely responsible for ensuring that any such changes are compliant with PCI DSS requirements. ## 6.11. Data Protection - 6.11.1 In performing the Services, Oracle will comply with the Oracle Services Privacy Policy, which is available at http://www.oracle.com/html/Services-privacy-policy.html and incorporated herein by reference. The Oracle Services Privacy Policy is subject to change at Oracle's discretion; however, Oracle policy changes will not result in a material reduction in the level of protection provided for Customer's Personal Information (as defined in the Data Processing Agreement) provided as part of Customer Data during the term of Customer's Estimate/Order Form. - 6.11. 2 Unless otherwise provided in the applicable Estimate/Order Form, the Data Processing Agreement for Cloud Services (the 'Data Processing Agreement'), which is provided at Exhibit A and incorporated herein by reference, describes the parties' respective roles for the processing and control of Personal Information that Customer provides to Oracle as part of the Services. Unless otherwise provided in the applicable Estimate/Order Form, Oracle will act as a data processor, and will act on Customer instructions concerning the treatment of Customer's Personal Information residing in the services environment, as specified in this Agreement, the Data Processing Agreement and the applicable Estimate/Order Form. Customer agrees to provide any notices and obtain any consents related to Customer's use of the Services and Oracle's provision of the Services, including those related to the collection, use, processing, transfer and disclosure of Personal Information. - 6.12.3 The Data Processing Agreement does not apply to any (1) demonstration accounts, trials, beta releases, or other similar versions of the services or (2) any features, services or products which are provided pursuant to a separate agreement or by a party other than Oracle (e.g., where Oracle is merely a billing/collection agent). ## 7. Suspension/Termination. - 7.1. Suspension for Delinquent Account. Oracle reserves the right to suspend Customer's access to and/or use of the Services if any payment is due but unpaid but only after Oracle has provided Customer two (2) delinquency notices, and at least thirty (30) days have passed since the transmission of the first notice. Customer agrees that Oracle shall not be liable to Customer or other third party for any suspension pursuant to this Section. - 7.2. Suspension for Ongoing Harm. Oracle may suspend Customer's or Users' access to, or use of, the Services if Oracle believes that (a) there is a significant threat to the functionality, security, integrity, or availability of the Services or any content, data, or applications in the Services; (b) Customer or Users are accessing or using the Services to commit an illegal act; or (c) there is a violation of the Acceptable Use Policy. When reasonably practicable and lawfully permitted, Oracle will provide Customer with advance notice of any such suspension. Oracle will use reasonable efforts to re-establish the Services promptly after Oracle determines that the issue causing the suspension has been resolved. During any suspension period, Oracle will make Customer Data (as it existed on the suspension date) available to Customer. Any suspension under this Section shall not excuse Customer from Customer's obligation to make payments under this Agreement. - 7.3. Termination for Cause. If either Customer or Oracle breaches a material term of this Agreement or any Estimate/Order Form or SOW and fails to correct the breach within 30 days of written specification of the breach, then the breaching party is in default and the non-breaching party may terminate (a) in the case of breach of any Estimate/Order Form or SOW, the Estimate/Order Form and any applicable SOW under which the breach occurred; or (b) in the case of breach of the Agreement, the Agreement and all Estimates/Order Forms and SOWs that have been placed under the Agreement. If Oracle terminates any orders as specified in the preceding sentence, Customer must pay within 30 days all amounts that have accrued prior to such termination, as well as all sums remaining unpaid for the Services under such Estimates/Order Forms and SOWs plus related taxes and expenses. Except for nonpayment of fees, the nonbreaching party may agree in its sole discretion to extend the 30 day period for so long as the breaching party continues reasonable efforts to cure the breach. Customer agrees that if it is in default under this Agreement, Customer may not use those Services ordered. ## 8. Confidentiality. - 8.1. By virtue of this Agreement, the parties may disclose to each other information that is confidential ('Confidential Information'). Confidential Information shall be limited to the terms and pricing under this Agreement and Customer's Estimate/Order Forms, Customer Data residing in the NetSuite CPQ, and all information clearly identified as confidential at the time of disclosure. - 8.2. A party's Confidential Information shall not include information that: (a) is or becomes a part of the public domain through no act or omission of the other party; (b) was in the other party's lawful possession prior to the disclosure and had not been obtained by the other party either directly or indirectly from the disclosing party; (c) is lawfully disclosed to the other party by a third party without restriction on the disclosure; or (d) is independently developed by the other party. - 8.3. Each party agrees not to disclose the other party's Confidential Information to any third party other than as set forth in the following sentence for a period of five years from the date of the disclosing party's disclosure of the Confidential Information to the receiving party; however, Oracle will protect the confidentiality of Customer Data residing in the NetSuite CPQ for as long as such information resides in the NetSuite CPQ. Each party may disclose Confidential Information only to those employees, agents or subcontractors who are required to protect it against unauthorized disclosure in a manner no less protective than required under this Agreement, and each party may disclose the other party's Confidential Information in any legal proceeding or to a governmental entity as required by law. Oracle will protect the confidentiality of Customer Data residing in the Services in accordance with the Oracle security practices applicable to Customer's Estimate/Order Form as described in this Agreement or such Estimate/Order Form. ## 9. Warranties, Disclaimers and Exclusive Remedies. - 9.1. Each party represents that it has validly entered into this Agreement and that it has the power and authority to do so. Oracle warrants that during the Term, Oracle will perform (i) the NetSuite CPQ using commercially reasonable care and skill in all material respects as described in the Oracle NetSuite Written Materials, and (ii) any Professional Services and Support Services in a professional manner consistent with industry standards (the warranties described by the foregoing clauses (i) and (ii), collectively, the 'Services Warranty'). If the Services provided to Customer were not performed as warranted, Customer must promptly provide Oracle with a written notice that describes the deficiency in the Services (including, as applicable, the service request number notifying Oracle of the deficiency in the Services). For Professional Services, Customer must notify Oracle of any warranty deficiencies within 60 days from performance of the deficient Professional Services. - 9.2. ORACLE DOES NOT WARRANT THAT THE SERVICES WILL BE PERFORMED ERROR-FREE OR UNINTERRUPTED, THAT ORACLE WILL CORRECT ALL SERVICES ERRORS, OR THAT THE SERVICES WILL MEET CUSTOMER'S REQUIREMENTS OR EXPECTATIONS. ORACLE IS NOT RESPONSIBLE FOR ANY ISSUES RELATED TO THE PERFORMANCE, OPERATION OR SECURITY OF THE SERVICES THAT ARISE FROM CUSTOMER DATA OR THIRD PARTY APPLICATIONS OR SERVICES PROVIDED BY THIRD PARTIES. - 9.3. FOR ANY BREACH OF THE SERVICES WARRANTY, CUSTOMER'S EXCLUSIVE REMEDY AND ORACLE'S ENTIRE LIABILITY SHALL BE THE CORRECTION OF THE DEFICIENT SERVICES THAT CAUSED THE BREACH OF WARRANTY, OR, IF ORACLE CANNOT SUBSTANTIALLY CORRECT THE DEFICIENCY IN A COMMERCIALLY REASONABLE MANNER, CUSTOMER MAY END THE DEFICIENT SERVICES AND ORACLE WILL REFUND TO CUSTOMER THE FEES FOR THE TERMINATED SERVICES THAT CUSTOMER PRE-PAID TO ORACLE FOR THE PERIOD FOLLOWING THE EFFECTIVE DATE OF TERMINATION. - 9.4. TO THE EXTENT NOT PROHIBITED BY LAW, THESE WARRANTIES ARE EXCLUSIVE AND THERE ARE NO OTHER EXPRESS OR IMPLIED WARRANTIES OR CONDITIONS INCLUDING FOR SOFTWARE, HARDWARE, SYSTEMS, NETWORKS OR ENVIRONMENTS OR FOR MERCHANTABILITY, SATISFACTORY QUALITY AND FITNESS FOR A PARTICULAR PURPOSE. ## 10. Limitations of Liability. - 10.1. IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, INCIDENTAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES, OR ANY LOSS OF REVENUE, PROFITS (EXCLUDING FEES UNDER THIS AGREEMENT), SALES, DATA, DATA USE, GOODWILL, OR REPUTATION. - 10.2. IN NO EVENT SHALL THE AGGREGATE LIABILITY OF ORACLE AND ITS AFFILIATES ARISING OUT OF OR RELATED TO THIS AGREEMENT OR CUSTOMER'S ESTIMATE/ORDER FORM OR SOW, WHETHER IN CONTRACT, TORT, OR OTHERWISE, EXCEED THE TOTAL AMOUNTS ACTUALLY PAID UNDER CUSTOMER'S ESTIMATE/ORDER FORM OR SOW FOR THE SERVICES GIVING RISE TO THE LIABILITY DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO SUCH LIABILITY. ## Subscription Services Agreement for NetSuite CPQ ## 11. Indemnification. - 11.1. If a third party makes a claim against either Customer or Oracle ('Recipient' which may refer to Customer or Oracle depending upon which party received the Material), that any information, design, specification, instruction, software, service, data, hardware, or material (collectively, 'Material') furnished by either Customer or Oracle ('Provider' which may refer to Customer or Oracle depending on which party provided the Material) and used by the Recipient infringes the third party's intellectual property rights, the Provider, at the Provider's sole cost and expense, will defend the Recipient against the claim and indemnify the Recipient from the damages, liabilities, costs and expenses awarded by the court to the third party claiming infringement or the settlement agreed to by the Provider, if the Recipient does the following: - a. notifies the Provider promptly in writing, not later than 30 days after the Recipient receives notice of the claim (or sooner if required by applicable law); - b. gives the Provider sole control of the defense and any settlement negotiations; and - c. gives the Provider the information, authority and assistance the Provider needs to defend against or settle the claim. - 11.2. If the Provider believes or it is determined that any of the Material may have violated a third party's intellectual property rights, the Provider may choose to either modify the Material to be non-infringing (while substantially preserving its utility or functionality) or obtain a license to allow for continued use, or if these alternatives are not commercially reasonable, the Provider may end the license for, and require return of, the applicable Material and refund any unused, prepaid fees the Recipient may have paid to the other party for such Material. If such return materially affects Oracle's ability to meet obligations under the relevant order, then Oracle may, upon 30 days prior written notice, terminate the order. If such Material is third party technology and the terms of the third party license do not allow us to terminate the license, then Oracle may, upon 30 days prior written notice, end the Services associated with such Material and refund any unused, prepaid fees for such Services. - 11.3. The Provider will not indemnify the Recipient if the Recipient (a) alters the Material or uses it outside the scope of use identified in the Provider's user or program documentation or the User Guides, or (b) uses a version of the Material which has been superseded, if the infringement claim could have been avoided by using an unaltered current version of the Material which was made available to the Recipient. The Provider will not indemnify the Recipient to the extent that an infringement claim is based upon any Material not furnished by the Provider. Oracle will not indemnify Customer to the extent that an infringement claim is based on a Third Party Application or any Material from a third party portal or other external source that is accessible or made available to Customer within or by the Services (e.g., a social media post from a third party blog or forum, a third party Web page accessed via a hyperlink, marketing data from third party data providers, etc.). - 11.4. This Section 11 provides the parties' exclusive remedy for any infringement claims or damages. 12. Governing Law and Jurisdiction . This Agreement is governed by the substantive and procedural laws of Japan and each party agrees to submit to the exclusive jurisdiction of, and venue in, the Tokyo District Court in any dispute arising out of or relating to this Agreement. ## 13. Export . - 13.1 Export laws and regulations of the United States and any other relevant local export laws and regulations apply to the Services. Such export laws govern use of the Services (including technical data) and any Services deliverables provided under this Agreement, and Customer and Oracle each agree to comply with all such export laws and regulations (including 'deemed export' and 'deemed re-export' regulations). Customer agrees that no data, information, software programs and/or materials resulting from the Services (or direct product thereof) will be exported, directly or indirectly, in violation of these laws, or will be used for any purpose prohibited by these laws including, without limitation, nuclear, chemical, or biological weapons proliferation, or development of missile technology. - 13.2 Customer acknowledges that the Services are designed with capabilities for Customer and Customer Users to access the Services without regard to geographic location and to transfer or otherwise move Customer Data between the Services and other locations such as User workstations. Customer is solely responsible for the authorization and management of User accounts across geographic locations, as well as export control and geographic transfer of Customer Data. ## 14. General Provisions. ## 14.1. Entire Agreement. - 14.1.1. This Agreement incorporates by reference all URL Terms, Exhibits and Estimate/Order Forms, and this Agreement, together with such referenced items, constitute the entire understanding between Customer and Oracle and are intended to be the final and entire expression of their agreement. The parties expressly disclaim any reliance on any and all prior discussions, emails, RFP's and/or agreements between the parties. There are no other verbal agreements, representations, warranties undertakings or other agreements between the parties. ## Subscription Services Agreement for NetSuite CPQ - 14.1.2. Under no circumstances will the terms, conditions or provisions of any purchase order, invoice or other administrative document issued by Customer in connection to this Agreement be deemed to modify, alter or expand the rights, duties or obligations of the parties under, or otherwise modify, this Agreement, regardless of any failure of Oracle to object to such terms, provisions, or conditions. In the event of any inconsistencies between the terms of an Estimate/Order Form and the Agreement, the Estimate/Order Form shall take precedence. - 14.1.3. The Agreement shall not be modified, or amended, except as expressly set forth herein, or in writing and signed or accepted electronically by the party against whom the modification, amendment or waiver is to be asserted, or by a properly executed Estimate/Order Form or Statement of Work. ## 14.2. Other General Provisions. - 14.2.1. This Agreement shall inure to benefit and bind the parties hereto, their successors and assigns, but neither party may assign this Agreement without written consent of the other, except that Oracle may assign without consent to a related entity or the successor of all or substantially all of the assignor's business or assets to which this Agreement relates. There are no third-party beneficiaries to this Agreement. - 14.2.2. This Agreement does not create any joint venture, partnership, agency, or employment relationship between the parties. - 14.2.3. Oracle's business partners and other third parties, including any third parties with which the Services have integrations or that are retained by Customer to provide consulting services, implementation services or applications that interact with the Services, are independent of Oracle and are not Oracle's agents. Oracle is not liable for, bound by, or responsible for any problems with the Services or Customer Data arising due to any acts of any such business partner or third party, unless the business partner or third party is providing Services as Oracle's subcontractor on an engagement ordered under this Agreement and, if so, then only to the same extent as Oracle would be responsible for our resources under this Agreement. - 14.2.4. If any provision is held by a court of competent jurisdiction to be contrary to law, such provision shall be eliminated or limited to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect. A waiver of any breach under this Agreement should not constitute a waiver of any other breach or future breach. - 14.2.5. Force Majeure. Neither party shall be liable for loss, delay, nonperformance (including failure to meet the service level commitment but excluding payment obligations) to the extent resulting from any force majeure event, including, but not limited to, acts of God, strike, riot, fire, explosion, flood, earthquake, natural disaster, terrorism, act of war, civil unrest, criminal acts of third parties, failure of the Internet, governmental acts or orders or restrictions, failure of suppliers, labor stoppage or dispute (other than those involving Oracle employees), or shortage of materials, provided that such party uses reasonable efforts, under the circumstances, to notify the other party of the circumstances causing the delay and to resume performance as soon as possible and any delivery date shall be extended accordingly. - 14.2.6. Non-Impediment. Nothing in this Agreement shall be construed as precluding or limiting in any way the right of Oracle to provide consulting, development, or other services of any kind to any individual or entity (including without limitation performing services or developing materials which are similar to and/or competitive with the Professional Services and/or deliverables hereunder). - 14.2.7. Audit. Upon forty-five (45) days written notice and no more than once every twelve (12) months, Oracle may audit Customer's use of the NetSuite CPQs to ensure Customer's use of the NetSuite CPQs is in compliance with the terms of the applicable Estimate/Order Form and this Agreement. Any such audit shall not unreasonably interfere with Customer's normal business operations. Customer agrees to cooperate with Oracle's audit and to provide reasonable assistance and access to information reasonably requested by Oracle. The performance of the audit and non-public data obtained during the audit (including findings or reports that result from the audit) shall be subject to the provisions of section 8 (Confidentiality) of this Agreement. If the audit identifies non-compliance, Customer agrees to remedy (which may include, without limitation, the payment of any fees for additional NetSuite CPQs) such non-compliance within 30 days of written notification of that noncompliance. Customer agrees that Oracle shall not be responsible for any of Customer's costs incurred in cooperating with the audit. - 14.2.8. The Section headings used in this Agreement are included for reference purposes only and shall not affect the meaning or interpretation of this Agreement in any way. Provisions that survive termination or expiration of this Agreement are those relating to limitation of liability, indemnification, payment and others which by their nature are intended to survive. This Agreement may be executed in counterparts and/or by facsimile or electronic signature and if so executed shall be equally binding as an original copy of this Agreement executed in ink by both parties. ## Subscription Services Agreement for NetSuite CPQ ## EXHIBIT A - DATA PROCESSING AGREEMENT FOR NETSUITE CPQ SERVICES ('Data Processing Agreement') ## 1. Definitions ' Applicable Data Protection Law ' means all data privacy or data protection laws or regulations globally that apply to the Processing of Personal Information under this Data Processing Agreement, which may include Applicable European Data Protection Law. ' Applicable European Data Protection Law ' means (i) the EU General Data Protection Regulation EU/2016/679, as supplemented by applicable EU Member State law and as incorporated into the EEA Agreement; (ii) the Swiss Federal Act of 19 June 1992 on Data Protection, as amended; and (iii) the UK Data Protection Act 2018. ' Data Subject ', ' Process/Processing ', ' Controller ', ' Processor ', ' Supervisory Authority ' and ' Binding Corporate Rules ' (or the equivalent terms) have the meaning set forth under Applicable Data Protection Law. ' Europe ' means for the purposes of this Data Processing Agreement (i) the European Economic Area, consisting of the EU Member States, Iceland, Lichtenstein and Norway; (ii) Switzerland and (iii) the UK after it withdraws from the EU. ' Oracle ' means the Oracle Affiliate that has executed Services Agreement. Oracle has been acquired by Oracle Corporation. ' Oracle and Oracle Affiliate(s) ' means the subsidiar(y)(ies) of Oracle and Oracle Corporation that may Process Personal Information as set forth in Sections 2.2 and 7. ' Personal Information ' shall have the same meaning as the term 'personal data', 'personally identifiable information (PII)' or the equivalent term under Applicable Data Protection Law. ' Services ' or the equivalent terms 'Service Offerings' or 'services' means the services specified in the Services Agreement. ' Services Agreement ' means (i) the applicable Estimate/Order Form for the Services you have purchased from Oracle; (ii) the applicable master agreement referenced in the applicable order, and (iii) any applicable service specifications or descriptions. ' Third Party Subprocessor ' means a third party, other than a Oracle or Oracle Affiliate, which Oracle subcontracts with and which may Process Personal Information as set forth in Sections 2.2 and 7. ' You ' means the customer entity that has executed the Services Agreement. Other capitalized terms have the definitions provided for them in the Services Agreement or as otherwise specified in this Data Processing Agreement. ## 2. Scope, Order of Precedence and Applicability - 2.1 This Data Processing Agreement applies to Oracle's Processing of Personal Information on Your behalf as a Processor for the provision of the Services specified in Your Services Agreement. Unless otherwise expressly stated in Your Services Agreement, this version of the Data Processing Agreement shall be effective and remain in force for the term of Your Services Agreement. - 2.2 Except as expressly stated otherwise in this Data Processing Agreement or Your Services Agreement, in the event of any conflict between the terms of the Services Agreement, including any policies or schedules referenced therein, and the terms of this Data Processing Agreement, the relevant terms of this Data Processing Agreement shall take precedence. ## 3. Controller and Processor of Personal Information and Purpose of Processing - 3.1 You are the Controller and Oracle is a Processor for the Processing of Personal Information as part of the provision of the Services. Each party is responsible for compliance with its respective obligations under Applicable Data Protection Law. ## Subscription Services Agreement for NetSuite CPQ - 3.2 Oracle and any persons acting under the authority of Oracle, including any Oracle or Oracle Affiliates and Third Party Subprocessors as set forth in Section 7, will Process Personal Information solely for the purpose of providing the Services in accordance with the Services Agreement and this Data Processing Agreement. ## 4. Categories of Personal Information and Data Subjects - 4.1 In order to perform the Services and depending on the Services You have ordered, Oracle may Process some or all of the following categories of Personal Information: personal contact information such as name, home address, home telephone or mobile number, fax number, email address, and passwords; information concerning lifestyle and social circumstances including age, date of birth, marital status; business contact details; financial details; goods and services provided; unique IDs collected from mobile devices, network carriers or data providers, IP addresses, and online behavior and interest data. - 4.2 Categories of Data Subjects whose Personal Information may be Processed in order to perform the Services may include, among others, Your representatives and end users, such as Your employees, contractors, collaborators, partners, suppliers, customers and clients. - 4.3 Additional or more specific categories of Personal Information and/or Data Subjects may be described in the Services Agreement. Unless otherwise specified in the Services Agreement, You may not provide Oracle with any sensitive or special Personal Information that imposes specific data security or data protection obligations on Oracle in addition to or different from those specified in the Data Processing Agreement or Services Agreement. ## 5. Your Instructions - 5.1 Oracle will process Personal Information on Your written instructions as specified in the Services Agreement and this Data Processing Agreement. - 5.2 To the extent required by Applicable Data Protection Law, Oracle will inform You if, in its opinion, Your instruction infringes Applicable Data Protection Law. You acknowledge and agree that Oracle is not responsible for performing legal research and/or for providing legal advice to You. - 5.3 Oracle will follow Your instructions at no additional cost to You. To the extent Oracle expects to incur additional charges or fees not covered by the fees for Services payable under the Services Agreement, such as additional license or third party contractor fees, it will promptly inform You thereof upon receiving Your instructions. Without prejudice to Oracle's obligation to comply with Your instructions, the parties will then negotiate in good faith with respect to any such charges or fees. ## 6. Rights of Data Subjects - 6.1 You control access to Your Services environment that holds Personal Information about Your end users, and Your end users should direct any requests related to their rights under Applicable Data Protection Law to You. - 6.2 To the extent such access is not available to You, Oracle will provide assistance with requests from individuals to access, delete or erase, restrict, rectify, receive and transmit, block access to or object to processing related to Personal Information held in Your Services environment on Oracle systems, insofar as reasonably and technically possible. - 6.3 If Oracle directly receives any requests or inquiries from Your end users that have identified You as the Controller, it will promptly pass on such requests to You without responding to the end user. ## 7. Personal Data Transfers - 7.1 Oracle may access and Process Personal Information on a global basis as necessary to perform the Services, including for IT security purposes, maintenance and performance of the Services and related infrastructure, Services technical support and Service change management. - 7.2 To the extent such global access involves a transfer of Personal Information subject to any data transfer restrictions under Applicable European Data Protection Law, such transfer shall be subject to the Oracle Processor Code (Binding Corporate Rules for Processors). The most current version of the Oracle Processor Code is available on https://www.oracle.com/corporate/contracts/cloud-services/contracts.html#data-processing, and is incorporated by reference into the Services Agreement and this Data Processing Agreement. Oracle has obtained EEA authorization for its Processor Code and will maintain such authorization for the duration of the Services Agreement. - 7.3 To the extent such global access involves a transfer of Personal Information subject to cross-border transfer restrictions under Applicable Data Protection Law, such transfers shall be subject to the terms of the Oracle Intra- ## Subscription Services Agreement for NetSuite CPQ Company Data Transfer and Mandate Agreement. ## 8. Oracle Affiliates and Third Party Subprocessors - 8.1 Subject to the terms and restrictions specified in Sections 3.2, 7 and 8, You provide Oracle general written authorization to engage Oracle and Oracle Affiliates and Third Party Subprocessors to assist in the performance of the Services. - 8.2 Oracle maintains lists of Oracle and Oracle Affiliates and Third Party Subprocessors that may Process Personal Information. These lists are available to You via the applicable primary support tool provided for the Services or upon request via Your support contact. If You would like to receive notice of any intended changes to these lists, You can sign up to receive notifications or Oracle will provide you notice of intended changes where a sign up mechanism is not available. - 8.3 Within fourteen (14) calendar days of Oracle providing such notice to You, You may object to the intended involvement of a Third Party Subprocessor or Oracle or Oracle Affiliate in the performance of the Services, providing objective justifiable grounds related to the ability of such Third Party Subprocessor or Oracle or Oracle Affiliate to adequately protect Personal Information in accordance with this Data Processing Agreement or Applicable Data Protection Law in writing by submitting a 'service request' via the applicable primary support tool or process provided for the Services. In the event Your objection is justified, You and Oracle will work together in good faith to find a mutually acceptable resolution to address such objection, including but not limited to reviewing additional documentation supporting the Third Party Subprocessors' or Oracle or Oracle Affiliate's compliance with this Data Processing Agreement or Applicable Data Protection Law, or delivering the Services without the involvement of such Third Party Subprocessor. To the extent You and Oracle do not reach a mutually acceptable resolution within a reasonable timeframe, You shall have the right to terminate the relevant Services (i) upon serving thirty (30) days prior notice; (ii) without liability to You and Oracle and (iii) without relieving You from Your payment obligations under the Services Agreement up to the date of termination. If the termination in accordance with this Section 7.3 only pertains to a portion of Services under an order, You will enter into an amendment or replacement order to reflect such partial termination. - 8.4 Oracle remains responsible at all times for the performance of the Oracle and Oracle Affiliates' and Third Party Subprocessors' obligations in compliance with the terms of this Data Processing Agreement and Applicable Data Protection Law. ## 9. Technical and Organizational Measures, and Confidentiality of Processing - 9.1 Oracle has implemented and will maintain appropriate technical and organizational security measures for the Processing of Personal Information. These measures take into account the nature, scope and purposes of Processing as specified in this Data Processing Agreement, and are intended to protect Personal Information against the risks inherent to the Processing of Personal Information in the performance of the Services, in particular risks from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Information transmitted, stored or otherwise Processed. - 9.2 All Oracle and Oracle Affiliate staff, as well as any Third Party Subprocessors that Process Personal Information are subject to appropriate written confidentiality arrangements. ## 10. Audit Rights and Cooperation with You and Your Supervisory Authorities - 10.1 To the extent provided in your Services Agreement, You may at Your sole expense audit Oracle's compliance with the terms of this Data Processing Agreement by sending Oracle a written request, including a detailed audit plan, at least six weeks in advance of the proposed audit date. You and Oracle will work cooperatively to agree on a final audit plan. - 10.2 The audit shall be conducted no more than once during a twelve-month period, during regular business hours, subject to Oracle's on-site policies and regulations, and may not unreasonably interfere with business activities. If You would like to use a third party to conduct the audit, the third party auditor shall be mutually agreed to by the parties and the third-party auditor must execute a written confidentiality agreement acceptable to Oracle. Upon completion of the audit, You will provide Oracle with a copy of the audit report, which is subject to the confidentiality terms of Your Services Agreement. - 10.3 Oracle will contribute to such audits by providing You with the information and assistance reasonably necessary to conduct the audit, including any relevant records of processing activities applicable to the Services. If the requested audit scope is addressed in a SOC 1 or SOC 2, ISO, NIST, PCI DSS, HIPAA or similar audit report issued by a qualified third party auditor within the prior twelve months and Oracle provides such report to You confirming there are no known material changes in the controls audited, You agree to accept the findings presented in the third party audit report in lieu of requesting an audit of the same controls covered by the report. Additional audit terms may be included in your Services Agreement. ## Subscription Services Agreement for NetSuite CPQ ## 11. Incident Management and Personal Information Breach Notification - 11.1 Oracle promptly evaluates and responds to incidents that create suspicion of or indicate unauthorized access to or Processing of Personal Information ('Incident'). - 11.2 To the extent Oracle becomes aware and determines that an Incident qualifies as a breach of security leading to the misappropriation or accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information transmitted, stored or otherwise Processed on Oracle systems or the Services environment that compromises the security, confidentiality or integrity of such Personal Information ('Personal Information Breach'), Oracle will inform You of such Personal Information Breach without undue delay. - 11.3 As information regarding the breach is collected or otherwise reasonably becomes available to Oracle and to the extent permitted by law, Oracle will provide You with additional relevant information concerning the breach reasonably known or available to Oracle. - 11.4 Within the timeframes required for You to meet Your Personal Information Breach notification obligations under Applicable Data Protection Law, You agree to coordinate with Oracle in good faith on the content of Your intended public statements or required notices for the affected Data Subjects and/or notices to the relevant Supervisory Authorities regarding the Personal Information Breach. ## 12. Return and Deletion of Personal Information - 12.1 Upon termination of the Services, Oracle will promptly return, including by providing available data retrieval functionality, or delete any remaining copies of Personal Information on Your Services production environment, except as otherwise stated in the Services Agreement. - 12.2 For Services for which no data retrieval functionality is provided by Oracle as part of the Services, You are advised to take appropriate action to back up or otherwise store separately any Personal Information while the production Services environment is still active prior to termination. ## 13. Legal Requirements - 13.1 Oracle may be required by law to provide access to Personal Information, such as to comply with a subpoena or other legal process, or to respond to government requests, including public and government authorities for national security and/or law enforcement purposes. - 13.2 Oracle will promptly inform You of requests to provide access to Personal Information, unless otherwise required by law.