<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=4025882&amp;fmt=gif">
Legal

US Master Services Agreement

v1.0 Effective as of June 19, 2026
1

Definitions

1.1

"Affiliate" means, in the context of the Agreement, an entity that directly, or indirectly through one or more intermediaries, controls or is controlled by, or is under common control with, a party, excluding a Franchisee Affiliate.

"Agreement" means this MSA together with the DPA, SLA, and any other schedules or exhibits attached hereto, as well as all executed Services Orders entered into pursuant to and governed by this MSA.

"AI Tool" means any tool, product or service that uses generative artificial intelligence to generate output, and may include Third-Party Tools (defined in Section 2.5 below).

"App" means the web and mobile application developed and offered by Sona for use by End Users in connection with the Services.

"Authorized Users" means Customer's authorized employee or contractor personnel authorized by Customer to access and use the Services on an administrative basis.

"Customer" means the Customer set out in the relevant Services Order(s).

"Customer Data" means any data provided to Sona by Customer or any Authorized User or End User through the Service or collected by Sona through the Service in connection with Customer's or any Authorized User's or End User's use thereof, including without limitation Location Data.

"Dashboard" means the web-based User interface that enables Customer to access and manage portions of the Service.

"DPA" means the Data Processing Addendum containing the data protection requirements and other specifications, including each party's obligations to safeguard the privacy and security of Personal Information, as set forth in the relevant Exhibit to this MSA.

"Documentation" means any User instructions, manuals, on-line help files, or other materials that are provided by Sona in connection with the Services.

"End Users" means Customer's individual employees or contractors, who may access and use the App as authorized by Customer in connection with the Services.

"Fees" has the meaning assigned to it in Section 4.1. Fees relating to Customer's subscription to the SaaS Solution may also be referred to as 'Subscription Fees' or 'Sub. Fees' in the Services Order.

"Franchisee Addendum" means (i) a Services Order that has been executed by a Franchisee Affiliate(s) in addition to Customer and Sona; and/or (ii) any addendum to a Services Order that is executed by a Franchisee Affiliate and Sona.

"Franchisee Affiliate" means a third party company which shares a level of common ownership with Customer in connection with a franchised model but which does not meet the definition of Affiliate.

"Liability" means any liability, whether under contract, tort (including negligence), or otherwise, regardless of whether foreseeable or contemplated by the parties.

"Licenses" means the subscriptions purchased by the Customer which enable Authorized Users and End Users to access and use the Services. Licenses may be 'Seat' based (with each seat being assignable to an individual) or 'Site' based (with each Site being assignable to a physical Customer location), as identified in the Services Order. Sona's 'Raffy' Module shall always be charged per seat unless explicitly set out otherwise in the relevant Services Order.

"Location Data" means information about the geographical location of any End User.

"MSA Term" has the meaning assigned to it in Section 6.1.

"Personal Information" has the meaning assigned to it in the DPA.

"Professional Services" means those professional services performed by Sona as specified in the Agreement, including any implementation and configuration services and maintenance services. Professional Services do not include the SaaS Solution.

"Report" means any output of the Services provided by Sona to Customer, or accessible by Customer through the Services, including without limitation any time reports, payroll records, tax receipts, employee schedules, or other similar documents.

"SaaS Modules" means those modules ordered by Customer that make up the SaaS Solution, as set out in a Services Order.

"SaaS Solution" means Sona's proprietary frontline workforce technology platform as configured for the Customer with the applicable SaaS Modules and integrations documented in the Services Order(s).

"Services" means the SaaS Solution, App, and Professional Services provided under a Services Order. Unless otherwise specified in a Services Order, Sona may perform the Services or any aspect of the Services through Sona's Affiliates or subcontractors, provided Sona shall remain responsible for its obligations under the Agreement.

"Services Order" means an order form based on Sona's standard template that is signed by both parties and references this MSA.

"Services Order Effective Date" means the date a Services Order comes into effect, being the date that the last party to sign the relevant Services Order does so.

"Services Order Term" has the meaning given to it in Section 6.1.

"Sites" means a premises of Customer from which it operates its business, either as a trading premises, administrative premises, headquarters, or similar.

"Sona" means Sona Technologies US, Inc.

"Sona Technology" means, collectively, the SaaS Solution, App, Dashboard, and Documentation provided under the Agreement.

"SLA" means the service level agreement set forth in the relevant Exhibit hereto and made part of the Agreement.

"Taxes" means any duties, customs fees, or taxes (other than taxes based on Sona's net income), including indirect taxes such as goods and services tax and value-added tax, associated with the purchase of the Services, and any related penalties or interest.

"Third-Party Legal Proceeding" means any formal legal proceeding filed by an unaffiliated third party before a court or government tribunal (including any appellate proceeding).

"Upgrades" means (i) maintenance releases and revisions that correct defects or provide other incidental updates and corrections; and/or (ii) changes or additions that improve or add new functionality, and/or replace functionality.

"User" means an End User and/or Authorized User, as appropriate.

2

Services

2.1

Services. Subject to the terms of the Agreement, Sona hereby grants to Customer a non-exclusive, non-transferable, non-sublicensable right for Customer's internal business purposes only, during the applicable Services Order Term, to (a) access and use the SaaS Solution, (b) download a reasonable number of copies of the App to devices owned or controlled by Customer, and (c) access, download, copy, store, display, and use the Reports.

2.2

Professional Services. Subject to the terms of the Agreement, Sona will perform those certain Professional Services in a workman-like manner consistent with generally accepted industry practices. For any breach of the previous sentence, Customer's exclusive remedy, and Sona's entire liability, will be the re-performance of the Professional Services and if Sona fails to re-perform the Professional Services as warranted, Customer's sole and exclusive remedy shall be to recover the Fees paid to Sona for the deficient Professional Services.

Change Requests. Customer's request for any change in Professional Services must be in writing; this requirement pertains to all such requests including but not limited to requests for changes in project plans, scope, specifications, schedule, designs, or requirements. Sona will not be obligated to perform tasks described in Customer's request until the parties agree in writing to the proposed change.

Satisfaction. If Customer is reasonably dissatisfied with the results of any Professional Services, Customer shall notify Sona of its dissatisfaction within ten (10) days of Customer's receipt of the relevant Professional Services, or else such Professional Services shall be deemed accepted. If Customer reasonably rejects any Professional Services, then Customer's remedies set out in this Section 2.2 shall apply.

2.3

Customer Obligations.

Use Restrictions. Customer shall not, and will not allow and shall not authorize any third party, including any Authorized Users, directly or indirectly, to: (a) decompile, disassemble, reverse engineer, or otherwise attempt to derive the source code of the Sona Technology (except to the extent permitted by applicable law notwithstanding this restriction); (b) write or develop any program based upon any portion of the Sona Technology, or otherwise use the Sona Technology for the purpose of developing, distributing or making available products or services that compete with the Sona Technology or the Services; (c) sell, sublicense, transfer, assign, lease, rent, distribute, or grant a security interest in the Sona Technology or Services; (d) distribute the Reports to any third party except as reasonably required in connection with Customer's legal and compliance obligations, nor shall Customer use the Reports for any competitive or benchmarking purposes; (e) permit the Sona Technology or Services to be accessed or used by any persons other than Authorized Users and End Users (App only) accessing or using the Sona Technology in accordance with the Agreement; (f) allow seat License accounts to be used by more than one Authorized User or End User (as applicable); (g) transfer Site Licenses to other Sites without Sona's prior written permission; (h) alter or remove any trademarks or proprietary notices contained in or on the Sona Technology; (i) circumvent or otherwise interfere with any authentication or security measures of the Sona Technology or otherwise interfere with or disrupt the integrity or performance of the foregoing; (j) access or use the Services in a manner that breaches or causes the breach of applicable export control laws; (k) use the Services or Reports in connection with its interactions with End Users in violation of any law, rule, or regulation, including without limitation any applicable employment or consumer protection laws; or (l) collect or use any Location Data without the affirmative consent of the applicable End User. Customer acknowledges that Sona may, but is under no obligation to, monitor Customer's use of the Services.

Compliance. Customer shall ensure and represents and warrants that it complies with all applicable laws, rules, and regulations with respect to Customer's business and its, and its Authorized Users' and End Users' use of the Services.

Consents and Disclosures. Customer shall be solely responsible for: (a) providing any and all legally required notices and disclosures to its employees and contractors; (b) offering all legally required choices to employees and contractors to enable them to exercise any granted privacy rights, and (c) for obtaining all informed consents from employees and contractors required, to permit: (i) Customer to use and receive the Services; (ii) Customer's provision of Customer Data to Sona under the Agreement; and (iii) Sona's use, accessing, storing, and processing of the Customer Data in accordance with the Agreement. Without limiting the foregoing, Customer acknowledges and agrees that Customer shall be solely responsible for ensuring that Customer's collection and use of Customer Data, including Location Data, complies with applicable law.

Cooperation. Customer shall (i) cooperate with Sona in all matters relating to the Services, including providing timely review and approval of any Professional Services and, at Sona's request, appointing an Authorized User with respect to each Services Order to act as the Customer's representative in day-to-day matters relating to that particular Services Order, and otherwise fulfill the activities of the role described in the relevant Services Order; (ii) timely provide to Sona (a) access to office accommodations, facilities, and/or equipment and/or (b) all documents, information (including Customer Data, security access information, and configuration information), items and materials in any form (whether owned by the Customer or a third party) required under a Services Order or otherwise reasonably required by Sona in connection with the Services and ensure that such materials are accurate and complete; (iii) obtain and maintain all necessary licenses and consents required in order to enable Sona's performance of the Services; (iv) ensure that its network and systems comply with the relevant specifications provided by Sona from time to time; (v) be, to the extent permitted by law and except as otherwise expressly provided in the Agreement, solely responsible for procuring, maintaining and securing its network connections and telecommunications links from its systems to Sona's data centers, and all problems, conditions, delays, delivery failures and for all loss or damage arising from or relating to the Customer's network connections or telecommunications links or caused by the internet; (vi) use commercially reasonable efforts to prevent and terminate any unauthorized access to or use of the Services; (vii) promptly notify Sona of any unauthorized access to or use of the Services of which it becomes aware; and (viii) comply with any additional responsibilities of the Customer set out in the applicable Services Order.

In the event of any delays in, or failure by, the Customer in performing its obligations under the Agreement (including any obligations or dependencies set out in a Services Order), Customer acknowledges and agrees that (a) Sona shall not be liable for any resulting delay or failure in complying with its obligations; and (b) Sona shall be entitled to adjust any agreed timetable or delivery schedule as reasonably necessary.

2.4

Service Levels and Support. Subject to the terms of the Agreement, Sona will make the applicable Services available in accordance with and provide the support set forth in the SLA. Customer acknowledges and agrees that Customer's sole and exclusive remedy arising out of any failure by Sona to meet commitments set forth in the SLA are those set forth in the SLA.

2.5

Third-Party Tools. Subject to the terms of the Agreement, Sona may make available to Customer certain third-party tools or services in connection with Customer's use of the Services, including third party integrations, either as set forth in a Services Order or as may be made available to Customer by Sona through the Services (collectively, the "Third-Party Tools"). Sona does not make any representations or warranties with respect to such Third-Party Tools. Sona hereby grants Customer the rights Sona may have in such Third-Party Tool for the applicable Services Order Term solely for Customer's use of such Third-Party Tool in connection with the Services for internal business use. Such Third-Party Tools are not under the control of Sona and do not form part of the Services. Sona is not responsible for any Third-Party Tools, and Customer uses any such Third-Party Tools at its own risk. Additional terms may apply to Customer's use of any Third-Party Tools.

2.6

AI Tools. Certain features of the Services may leverage or include AI Tools. Customer acknowledges and agrees that such AI Tools are made available "AS IS" and "WITH ALL FAULTS" and that Sona does not review or verify any output of any AI Tools. CUSTOMER, AND NOT SONA, SHALL BE SOLELY RESPONSIBLE FOR CUSTOMER'S USE OF THE AI TOOLS. Customer acknowledges and agrees that any actions or omissions taken by Customer in reliance on the information provided by any AI Tools is at Customer's own risk. Information provided by the AI Tools may be inaccurate or incomplete and, like all other information provided by the Services, Customer is encouraged to independently verify such information prior to use of or reliance on any output. Customer expressly acknowledges and agrees that Sona will have no liability to Customer or any third party arising from or related to Customer's use of any AI Tool in connection with the Services.

2.7

Upgrades. Sona may from time to time deploy Upgrades to all or part of the Sona Technology.

3

Data Processing and Security

Sona and any Affiliates involved in processing Customer Data will access, use, and otherwise process any Personal Information contained therein, in accordance with the terms of the DPA. Sona has implemented and will maintain technical, organizational, and physical safeguards to protect Personal Information as further described in the DPA.

4

Fees; Payment

4.1

Invoicing and Payment. Customer will pay Sona all fees of the type and amount set forth in a Services Order ("Fees"). Customer will pay for any excess usage beyond any usage limitations or metrics on which Fees are based at the rates set forth in the Services Order (as may be increased in accordance with the Agreement), or, if no such rates are set forth on the Services Order, then at Sona's then current standard rates for such usage. Fees (if any) for Professional Services will be paid for services to be rendered at Sona's then prevailing time and materials rates. Any daily Fees shall be invoiced on a per-day, rather than hourly, basis. Unless otherwise set forth in a Services Order or required by law: (i) all Fees are non-cancellable, non-refundable, and non-recoupable; and (ii) all invoices for Fees are due and payable in the currency described in the Services Order or invoice, or if no such currency is specified, then in United States Dollars within fourteen (14) days after the invoice date, without deduction or setoff. If Customer's payment is overdue, then Sona may: (i) charge interest from the due date at the lesser of 1.5% per month or the highest rate allowed by law until paid in full; and (ii) suspend the Services if Customer's payment is overdue for more than fifteen (15) days, with advance notice to Customer. Customer will reimburse Sona for all reasonable expenses (including attorneys' fees) incurred by Sona in collecting overdue payments on accurately billed invoices.

4.2

Taxes. The Fees are exclusive of all applicable Taxes and Customer is responsible for all Taxes arising out of the Agreement or the transactions contemplated by the Agreement.

4.3

Sona may adjust its day rates, fee structures and Fees on 1 January each calendar year by (i) a percentage amount equivalent to the percentage increase in the US CPI-U in the previous 12 months; plus (ii) an additional innovation adjustment of 5% per year to reflect any improvement to the Services made in the previous year (for example only, additional features delivered via upgrades).

5

Proprietary Rights

5.1

Intellectual Property Rights. Customer acknowledges that Sona owns and retains all rights, title, and interest, including all intellectual property rights, in and to the Sona Technology, including all technology, software, algorithms, user interfaces, trade secrets, techniques, designs, inventions, works of authorship, and other tangible and intangible material and information pertaining thereto or included therein, and nothing in the Agreement shall preclude or restrict Sona from using or exploiting any concepts, ideas, techniques or know-how of or related to the Sona Technology or otherwise arising in connection with Sona's performance under the Agreement. Other than as expressly set forth in the Agreement, no licenses or other rights in or to the Sona Technology are granted to Customer and all such rights are hereby expressly reserved.

5.2

Feedback. Customer hereby grants Sona a royalty-free, worldwide, transferable, sub-licensable, irrevocable, perpetual license to use or incorporate in the Services any suggestions, enhancement requests, recommendations or other feedback provided by Customer, including its Authorized Users, relating to the Services ("Feedback"). In no event shall Feedback be deemed to be Customer's Confidential Information (as defined below).

5.3

License to Customer Data. Customer acknowledges that performance of certain tools and services that underlie the Services relies on insights derived from data collected from Sona's customers and third-party data sources, which insights are leveraged by Sona to enable customers to optimize scheduling and otherwise improve employee management tools. Accordingly, Customer grants Sona and its Affiliates a worldwide, non-exclusive, irrevocable, perpetual, royalty-free license to use Customer Data, including by combining Customer Data with other data, including data derived from third-party sources in order to operate, analyze, improve its service offering, and otherwise provide the Services requested by Customer pursuant to the terms of the Agreement. Notwithstanding anything in this provision to the contrary, Sona shall only use Customer Data that is Personal Information to provide the Services in conformity with the terms of the Agreement, including the DPA, and all applicable laws, including laws pertaining to individual privacy and security.

6

Term and Termination

6.1

Term. The Agreement will start on the Effective Date and will continue until all Services Orders have terminated (the "MSA Term"). Unless otherwise stated in a Services Order, each Services Order will continue until completion of the Initial Subscription Term of that Services Order (as defined in the applicable Services Order), and upon expiration of such Initial Subscription Term, shall automatically renew for consecutive periods of the same duration as the Initial Subscription Term (each such period with respect to that Services Order, a "Renewal Term") unless either party provides notice of non-renewal at least 180 days prior to the end of the then current Initial Subscription Term or Renewal Term (all Renewal Terms of a Services Order together with the Initial Subscription Term of that Services Order, the "Services Order Term").

6.2

Termination.

Either party may terminate the Agreement: (i) if the other party is in material breach of the Agreement, where such material breach is not cured within thirty (30) days after written notice by the non-breaching party of such breach; or (ii) by written notice if (a) a receiver or similar officer is appointed for the other party's business, property, affairs or revenues and such proceedings continue for forty-five (45) days; (b) the other party becomes insolvent, admits in writing its inability to pay debts generally as they come due, is adjudicated bankrupt, or enters composition proceedings, makes an assignment for the benefit of its creditors or another arrangement of similar import; (c) proceedings under bankruptcy or insolvency laws are commenced by or against the other party and are not dismissed within forty-five (45) days, or (d) the purpose of the Agreement is frustrated by operation of law. Notwithstanding anything to the contrary herein, if Customer fails to pay any amounts owed to Sona within fifteen (15) days after written notice of nonpayment of any amounts owed to Sona, which may be provided any time after any amount becomes past due, Sona may immediately terminate the Agreement. For the avoidance of doubt, Customer's noncompliance with Section 2.3(i) or 2.3(ii) shall be deemed a material breach of the Agreement.

Notwithstanding anything to the contrary in the Agreement, if a Franchisee Affiliate of Customer has executed a Franchisee Addendum under the Agreement, any breach of the Agreement by such Franchisee Affiliate shall be deemed a breach solely by that Franchisee Affiliate and not by any other Affiliate, Franchisee Affiliate, or by Customer or Sona. In the event of a material breach by a Franchisee Affiliate that is not cured within the applicable cure period, Sona's right to terminate under this Section 6.2 shall apply only with respect to the Franchisee Addendum to which the breaching Franchisee Affiliate is a party. Termination of a Services Order due to a Franchisee Affiliate's breach shall not affect the validity or continuation of the Agreement or any other Services Orders between the parties or their respective Franchisee Affiliates that are not in breach. Breach of the Agreement by a Franchisee Affiliate shall not entitle Customer or any other Franchisee Affiliates to terminate the Agreement.

6.3

Effect of Termination. Upon the effective date of the expiration or termination of the Agreement for any reason: (i) Customer's, Authorized Users' and its End Users' access to the Services, and the licenses granted to Customer hereunder will automatically terminate; (ii) all outstanding payment obligations of Customer will become due and payable immediately; and (iii) Customer shall immediately return, or at Sona's request destroy and certify the destruction of any tangible embodiments of Sona's Confidential Information, including any copies of any SDK or API. The following provisions will survive the expiration or termination of the Agreement for any reason: Sections 1, 2.3(i), 3, 4, 5, 6.3, and 7 through 11. This Section shall also apply in the context of terminations of individual Services Orders entered into by Customer, with the necessary changes to the wording of this Section being deemed to be made.

7

Confidentiality

7.1

Definition. "Confidential Information" means: (i) any information disclosed, directly or indirectly, by or on behalf of one party ("Disclosing Party") to the other party ("Receiving Party") pursuant to the Agreement that is designated as "confidential," or in some other manner to indicate its confidential nature; and (ii) any information that otherwise should reasonably be expected to be treated in a confidential manner based on the circumstances of its disclosure or the nature of the information itself. Without limiting the foregoing, the Sona Technology, the functionality and performance of the Sona Technology, including any metrics pertaining thereto, are the Confidential Information of Sona, and the terms (but not the existence, subject to Section 11.7) of the Agreement will be kept confidential, respectively, as each party's Confidential Information. Notwithstanding the foregoing, Confidential Information does not include any information that: (a) is or becomes generally known and available to the public through no act of the Receiving Party; (b) was already in the Receiving Party's possession without a duty of confidentiality owed to the Disclosing Party at the time of disclosure by the Disclosing Party, as shown by the Receiving Party's contemporaneous records; (c) is lawfully obtained by the Receiving Party from a third party who has the express right to make such disclosure; or (d) is independently developed by the Receiving Party without breach of an obligation owed to the Disclosing Party.

7.2

Use; Maintenance. Neither party shall use the Confidential Information of the other party for any purpose except to exercise its rights and perform its obligations under the Agreement. Neither party shall disclose, or permit to be disclosed, either directly or indirectly, any Confidential Information of the other party, except: (i) to its advisors, or prospective investors or purchasers, in each case subject to written obligations of confidentiality, or (ii) where the Receiving Party becomes legally compelled to disclose Confidential Information, notwithstanding the Receiving Party's having given the Disclosing Party prior notice of such legally compelled disclosure and a reasonable opportunity to seek a protective order or other confidential treatment for such Confidential Information (if permitted by applicable law). Each party will take reasonable measures and care to protect the secrecy of and avoid disclosure and unauthorized use of the other party's Confidential Information and will take at least those measures taken to protect its own most highly confidential information.

8

Indemnification

8.1

By Sona. Sona will defend and indemnify Customer against any Liabilities in any Third-Party Legal Proceeding to the extent it alleges that Customer's use, as authorized in the Agreement, of the Services during the applicable Services Order Term constitutes a direct infringement of the U.S. patents or copyrights of any third party. Notwithstanding the foregoing, Sona shall have no obligation under this Section 8 or otherwise with respect to any infringement claim based upon (i) any use of the Services not in accordance with the Agreement or as specified in the Documentation; (ii) any use of the Services in combination with other products, equipment, software or data not supplied by Sona; (iii) any of the circumstances set out in Section 8.2; (iv) any modification of the Services by any person other than Sona or its authorized agents; or (v) the Customer's or its personnel's use of the Services after notice of the alleged or actual infringement from Sona or any third party.

8.2

By Customer. Customer will defend and indemnify Sona against any Liabilities in any Third-Party Legal Proceeding to the extent arising from: (i) allegations that the collection or use by or on behalf of Sona of the Customer Data in accordance with the Agreement violates a third party's rights (including those of any End User) or any laws; (ii) any unauthorized access or use of the Services by Customer, Authorized Users, End Users, or any third party utilizing any access credentials of Customer, Authorized Users, or End Users; (iii) the use of the Services in violation or in connection with a violation of applicable law, rules or regulations; (iv) the operation of Customer's business; (v) any claim or allegation that Sona is an employer or joint employer of any employee or personnel of Customer, or otherwise has control over any Customer's employment practices; or (vi) Customer's or Authorized Users' use of or reliance on Reports, including any allegations that any use of Reports by Customer or Authorized Users infringes or misappropriates any third party's rights or violates any laws.

8.3

Conditions. Any indemnified party must promptly notify the indemnifying party in writing of any allegation(s) that preceded the Third-Party Legal Proceeding and cooperate reasonably with the indemnifying party to resolve the allegation(s) and Third-Party Legal Proceeding. If breach of this Section 8.3 prejudices the defense of the Third-Party Legal Proceeding, the indemnifying party's obligations under Section 8.1 or Section 8.2 (as applicable) will be reduced in proportion to the prejudice.

8.4

Remedies. Notwithstanding anything herein to the contrary, if any intellectual property infringement claim is brought or threatened against Customer, or if Sona reasonably believes that the Services may infringe a third party's intellectual property rights, then Sona may, at its sole option and expense: (i) procure for Customer the right to continue to use the Service; (ii) modify the Services, as applicable, to make it non-infringing without materially reducing their functionality; (iii) replace the affected aspect of the Services with non-infringing technology having substantially similar capabilities; or (iv) terminate the Agreement or a Services Order(s) for the applicable Services, in whole or part.

8.5

Disclaimer. WITHOUT AFFECTING EITHER PARTY'S TERMINATION RIGHTS, THIS SECTION 8 STATES THE ENTIRE LIABILITY OF SONA, AND THE EXCLUSIVE REMEDY OF CUSTOMER, WITH RESPECT TO ANY ACTUAL OR ALLEGED INFRINGEMENT OF ANY INTELLECTUAL PROPERTY RIGHTS BY SONA, THE SONA TECHNOLOGY, OR ANY PART THEREOF.

9

Disclaimer

EXCEPT AS EXPRESSLY SET FORTH IN THE AGREEMENT, SONA HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING ANY AND ALL WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, LOSS OF DATA, OR ACCURACY OF RESULTS. SONA DOES NOT WARRANT THAT THE SONA TECHNOLOGY WILL BE ERROR-FREE, UNINTERRUPTED, OR COMPATIBLE WITH ANY PARTICULAR DEVICE, THAT ANY DATA PROVIDED BY OR THROUGH THE SONA TECHNOLOGY, INCLUDING REPORTS, WILL BE ACCURATE OR COMPLETE, OR, EXCEPT AS EXPRESSLY SET FORTH HEREIN, THAT SONA'S SECURITY MEASURES WILL BE SUFFICIENT TO PREVENT THIRD PARTY ACCESS TO CUSTOMER DATA. CUSTOMER ACKNOWLEDGES AND AGREES THAT (i) SONA AND THE SERVICES ONLY PROVIDE INFORMATION TO ASSIST CUSTOMER IN ITS WORKFORCE MANAGEMENT; (ii) REPORTS ARE MADE AVAILABLE "AS IS" AND "WITH ALL FAULTS" AND ARE NOT GUARANTEED TO BE ACCURATE OR TO SATISFY ANY LEGAL OR THIRD-PARTY STANDARD OR REQUIREMENT; AND (iii) CUSTOMER BEARS ALL RESPONSIBILITY, AND SONA WILL HAVE NO LIABILITY FOR DECISIONS BASED ON ANY REPORTS, OR ANY OTHER INFORMATION PROVIDED TO CUSTOMER VIA THE SERVICE, AS A RESULT OF USING SONA TECHNOLOGY, OR OTHERWISE BY OR THROUGH SONA. CUSTOMER IS RESPONSIBLE FOR INDEPENDENTLY REVIEWING AND VERIFYING THE CONTENTS OF ANY REPORT PRIOR TO USING SUCH REPORT OR RELYING ON SUCH REPORT FOR ANY PURPOSE. SONA SHALL NOT UNDER ANY CIRCUMSTANCES BE DEEMED OR CONSIDERED AN EMPLOYER OR JOINT EMPLOYER OF ANY OF CUSTOMER'S END USERS, AND SONA HAS NO CONTROL OVER ANY CUSTOMER'S EMPLOYMENT PRACTICES.

10

Limitation of Liability

EXCEPT FOR (i) CUSTOMER'S PAYMENT OBLIGATIONS UNDER THE AGREEMENT; (ii) MATTERS FOR WHICH LIABILITY CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW; AND (iii) A PARTY'S INDEMNIFICATION OBLIGATIONS UNDER SECTION 8, (A) IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATING TO THE AGREEMENT, HOWEVER CAUSED, AND BASED ON ANY THEORY OF LIABILITY, WHETHER FOR BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; AND (B) NEITHER PARTY'S TOTAL AGGREGATE LIABILITY (INCLUDING ATTORNEYS' FEES) ARISING OUT OF OR RELATED TO THE AGREEMENT (EXCEPT FOR CUSTOMER'S PAYMENT OBLIGATIONS) WILL EXCEED THE AMOUNT PAID BY CUSTOMER PURSUANT TO THE SERVICES ORDER GIVING RISE TO THE LIABILITY DURING THE 12-MONTH PERIOD PRIOR TO THE DATE THE CLAIM AROSE. NOTWITHSTANDING ANYTHING TO THE CONTRARY HEREIN, SONA'S TOTAL INDEMNIFICATION LIABILITY IN CONNECTION WITH AN INDEMNIFICATION CLAIM SHALL NOT EXCEED TWO TIMES (2x) THE AMOUNT PAID BY CUSTOMER TO SONA DURING THE 12-MONTH PERIOD PRIOR TO THE DATE THE CLAIM AROSE. THESE LIMITATIONS SHALL APPLY NOTWITHSTANDING ANY FAILURE OF THE ESSENTIAL PURPOSE OF ANY LIMITED OR EXCLUSIVE REMEDY.

11

General Provisions

11.1

Notices. Any required notice shall be given in writing by customary means with receipt confirmed at the address of each party set forth in the introductory paragraph to this MSA, or to such other address as either party may substitute by written notice to the other, or by email expressly referencing this Section 11.1. Notices will be deemed to have been given at the time of actual delivery in person, one (1) day after delivery to an overnight courier service, three (3) days after deposit in certified mail, or upon sending of an email with transmission confirmed.

11.2

Franchisee Affiliates. In a Services Order, Franchisee Affiliates of the Customer, and the Licenses they are purchasing, may be listed and be a signatory to that Services Order in addition to Customer, in which case that Services Order as it applies to the Franchisee Affiliate shall be considered a Franchisee Addendum. In addition, at any time during the Services Order Term, Customer and/or any Franchisee Affiliate may request additional Licenses for the benefit of one or more Franchisee Affiliates. Such request shall be made in writing and shall specify the legal entity operating the additional Licenses, the License type, and the proposed commencement date for Services associated with such License. If Sona agrees to the request, it shall use the information provided to create a draft Franchisee Addendum. Each draft Franchisee Addendum is subject to Sona's acceptance. Each Franchisee Addendum shall be, except where stated otherwise in the Franchisee Addendum or elsewhere in the Agreement, deemed a "Services Order" under the MSA and shall be subject to all terms and conditions of the MSA and the original Services Order. For clarity, and by way of example only, references to "Services Order" in the limitation of liability section of this MSA shall refer to "Franchisee Addendum" in reference to the relevant additional Franchisee Affiliate License(s). Each Franchisee Affiliate that manages or controls an additional Franchisee Affiliate License shall be deemed a "Customer" solely in respect of their respective additional Franchisee Affiliate License(s) and be entitled to all the rights and be responsible for performance of all the obligations of the Agreement as "Customer". Franchisee Affiliates are severally (and not jointly) liable for their respective obligations with respect to their own respective additional Franchisee Affiliate Licenses. Sona shall provide implementation services for each additional Franchisee Affiliate License. The scope, fees, and timeline for such implementation services shall be the same as that set forth in the original Services Order unless otherwise set forth in the applicable Franchisee Addendum.

11.3

Assignment; Third Party Beneficiaries. Neither party may assign the Agreement or any of its rights or obligations under the Agreement without the prior written consent of the other party, except that Sona may assign the Agreement without the consent of Customer (i) to an Affiliate, or (ii) as part of a corporate reorganization, or upon a change of control, consolidation, merger, sale of all or substantially all of its business or assets related to the Agreement, or a similar transaction or series of transactions. Subject to the foregoing, the Agreement will be binding upon and inure to the benefit of the parties and their respective successors and permitted assigns. Any Customer Affiliates (excluding for the avoidance of doubt Franchisee Affiliates) identified in a Services Order are third party beneficiaries to the Agreement subject always to the following:

(a) Customer procures that such Affiliate(s) comply with the relevant provisions of the Agreement;

(b) notwithstanding Section 11.3(i), Customer shall be fully liable to Sona for acts and/or omissions of member(s) of such Affiliate(s) as though such acts or omissions were those of Customer; and

(c) any claim arising out of or in connection with the Agreement and relating to Services provided to a Customer Affiliate, will be actionable solely by Customer and not by the relevant Affiliate.

11.4

Force Majeure. Except for the obligation to pay money, neither party will be liable for any failure or delay in its performance under the Agreement due to any cause beyond its reasonable control, including without limitation issues arising from problems in the software, firmware or hardware of Sona's suppliers or technology providers, an act of war, terrorism, act of God, earthquake, flood, pandemic, embargo, riot, sabotage, labor shortage or dispute, governmental act or failure or degradation of the internet. The delayed party shall give the other party notice of such cause and shall use its commercially reasonable efforts to correct such failure or delay in performance.

11.5

Governing Law. THE AGREEMENT SHALL BE GOVERNED BY AND CONSTRUED UNDER THE LAWS OF THE STATE OF DELAWARE WITHOUT REFERENCE TO CONFLICT OF LAWS PRINCIPLES. THE APPLICATION OF THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS IS EXPRESSLY EXCLUDED. SUBJECT FIRST TO SECTION 11.9, IF A LAWSUIT OR COURT PROCEEDING IS PERMITTED UNDER THE AGREEMENT, THE PARTIES WILL BE SUBJECT TO THE EXCLUSIVE JURISDICTION OF THE STATE AND FEDERAL COURTS LOCATED IN DELAWARE, AND THE PARTIES HEREBY AGREE AND CONSENT TO THE EXCLUSIVE JURISDICTION AND VENUE OF SUCH COURTS.

11.6

Non-Solicitation. During the MSA Term and for one (1) year thereafter, neither party will directly or indirectly solicit the services of any employee or consultant of the other party for such party's benefit or for the benefit of any other person or entity, provided that the preceding restriction will not prohibit general advertisements for employment or contracts not specifically directed towards employees or consultants of the other party.

11.7

Publicity. Sona may, with Customer's approval (not to be unreasonably withheld or delayed) use Customer's name as a reference for marketing or promotional purposes on Sona's website and in other communication with existing or potential Sona customers. Customer shall not, without the prior and specific written agreement of Sona, disclose any information regarding the nature of the Services publicly or to any third parties.

11.8

Insurance. During the MSA Term, Sona shall maintain in force insurance policies with reputable insurance companies against all risks that would normally be insured against by a prudent businessperson in connection with the risks associated with the Agreement, and on the Customer's request, produce the relevant insurance certificates to the Customer.

11.9

Arbitration. The parties agree to resolve all disputes arising under or in connection with the Agreement through binding arbitration. A party who intends to seek arbitration must first send a written notice of the dispute to the other party. The parties will use good faith efforts to resolve the dispute directly, but if the parties do not reach an agreement to do so within thirty (30) days after the notice is received, either party may commence an arbitration proceeding. The arbitration will be conducted in accordance with the applicable rules of the American Arbitration Association ("AAA Rules"). The arbitration will be conducted in English in New York, NY, USA. If the parties do not agree on an arbitrator, the arbitrator will be selected in accordance with the applicable rules of the AAA for the appointment of an arbitrator. The selection of an arbitrator under the rules of the AAA will be final and binding on the parties. The arbitrator must be independent of the parties. The arbitrator's decision will be final and binding on both parties, and the arbitrator must issue a reasoned written decision sufficient to explain the essential findings and conclusions on which the decision and award, if any, are based. The costs and expenses of the arbitration will be shared equally by both parties; however, if the arbitrator finds that either the substance of the claim or the relief sought in arbitration is frivolous or brought for an improper purpose (as measured by the standards set forth in Federal Rule of Civil Procedure 11(b)), then the payment of all fees will be governed by the AAA Rules. Notwithstanding the foregoing, this Section 11.9 will not prohibit either party from: (i) bringing an individual action in small claims court; (ii) seeking injunctive or other equitable relief in a court of competent jurisdiction; (iii) pursuing an enforcement action through the applicable federal, state, or local agency if that action is available; or (iv) filing suit in a court of law to address an intellectual property infringement or misappropriation claim. If this Section 11.9 is found to be unenforceable, the parties agree that the exclusive jurisdiction and venue described in Section 11.5 will govern any action arising out of or related to the Agreement.

11.10

Conflicting Terms. In the event of a conflict between the documents that comprise the Agreement, the documents will control in the following order (of decreasing precedence): the DPA, any Services Order, and this MSA. In the event of any conflict between the terms of a Franchisee Addendum and the original Services Order or the MSA, the terms of the Franchisee Addendum shall prevail solely in respect of the additional Franchisee Affiliate License(s) covered thereby.

11.11

Miscellaneous. The Agreement is the sole agreement of the parties concerning the subject matter hereof and supersedes all prior agreements and understandings with respect to said subject matter. Customer may not subcontract or delegate any rights or obligations granted to it under the Agreement to any third parties, including its consultants or contractors, without the prior written consent of Sona. Customer agrees that it is responsible for any liability arising out of End Users' or Authorized Users' access and use of the Sona Technology in violation of the Agreement. No terms of any purchase order, acknowledgement, or other form provided by Customer in connection with a Services Order will modify the Agreement, regardless of any failure of Sona to object to such terms. Any ambiguity in the Agreement shall be interpreted without regard to which party drafted the Agreement or any part thereof. Subject to Section 11.3, there are no third-party beneficiaries to the Agreement. References to a 'year' shall be a reference to the period between February 01 to January 31 (inclusive) and references to a 'quarter' shall be interpreted accordingly. The Agreement may only be amended by a writing signed by both parties. The parties consent to electronic signatures and agree that the Agreement may be executed in counterparts. The headings in the Agreement are inserted for convenience and are not intended to affect the interpretation of the Agreement. The relationship between the parties shall be that of independent contractors. Sona may use subcontractors or otherwise delegate aspects of its performance under the Agreement; provided that Sona shall remain responsible hereunder for any such subcontractor's performance. Waiver of any term of the Agreement or forbearance to enforce any term by either party shall not constitute a waiver as to any subsequent breach or failure of the same term or a waiver of any other term of the Agreement. Any provision found to be unlawful, unenforceable or void shall be severed from the remainder of the Agreement and the remainder of the Agreement will continue in full force and effect without said provision. The parties agree to comply with all applicable export control laws and regulations related to their performance of the Agreement.

Exhibits

Exhibit A Service Level Agreement
1

Definitions

1.1

The following capitalized terms will have the definitions set forth below:

"Force Majeure Downtime" means the total amount of time during any quarter, measured in minutes, during which Customer is not able to access the SaaS Solution due to any act, event, or occurrence beyond Sona's reasonable control, including, without limitation: issues arising from problems in the software, firmware or hardware of Sona's suppliers or technology providers; outages or issues with upstream providers or network carriers; acts of God; fires; floods; storms; landslides; epidemics; lightning; earthquakes; drought; blight, famine; quarantine; blockade; governmental acts or inaction; orders or injunctions; war; insurrection or civil strife; sabotage; explosions; labor strikes; work stoppages; and acts of terror.

"Scheduled Downtime" means the total amount of time during any quarter, measured in minutes, during which Customer is not able to access the SaaS Solution due to system maintenance performed by Sona between the hours of 00:00 - 04:00 (Eastern) or otherwise upon at least 24 hours' prior notice of such maintenance.

"Total Quarterly Time" means the total minutes in the relevant quarter less Scheduled Downtime and Force Majeure Downtime. For any partial quarter during which Customer subscribes to the SaaS Solution, availability will be calculated based on the entire quarter, not just the portion for which Customer subscribed.

"Unscheduled Downtime" means the total amount of time during any quarter, measured in minutes, during which the Customer is not able to access any of the features and functions of the Service, that is not Scheduled Downtime, Force Majeure Downtime or unavailability as a result of (i) non-compliance by Customer with any provision of the Agreement or this SLA; (ii) incompatibility of Customer's equipment or software with the Service; (iii) actions or inactions of Customer or third parties; (iv) Customer's use of the Service after Sona has advised Customer to modify its use of the Service, if Customer did not modify its use as advised; (v) acts or omissions of Customer or Customer's employees, agents, contractors, or vendors, or anyone gaining access to the Service by means of Customer's access credentials or equipment; (vi) performance of Customer's systems or the internet; (vii) any systemic internet failures; or (viii) network unavailability or Customer's bandwidth limitations.

"System Availability" means, with respect to any particular quarter, the ratio obtained by subtracting Unscheduled Downtime during such quarter from the Total Quarterly Time, and thereafter dividing the difference so obtained by the Total Quarterly Time. Represented algebraically, System Availability for any particular quarter is determined as follows:

System Availability = (Total Quarterly Time - Unscheduled Downtime) / Total Quarterly Time

2

System Performance

2.1

System Availability. Sona will undertake commercially reasonable measures to ensure that System Availability equals or exceeds ninety-nine point nine percent (99.9%) during each quarter (the "Service Standard").

3

Customer Requirements

Customer is responsible for maintenance and management of its computer network(s), servers, and software, and any equipment or services related to maintenance and management of the foregoing. Customer is responsible for correctly configuring its systems in accordance with any instructions provided by Sona, as may be necessary for provision of access to the features and functions of the Services.

4

Remedy

4.1

Credits Against Fees. In the event Unscheduled Downtime occurs, Customer will be entitled to credits against its immediately subsequent payment obligations (as set forth in the Agreement) ("Service Credits") according to the following table:

System AvailabilityCredit as a Percentage of Billing
Less than 99.9%5% of the amounts paid by Customer for the SaaS Solution during the applicable quarter.

Customer's rights under this Section 4.1 of this SLA are Customer's sole and exclusive remedy with respect to any Unscheduled Downtime or any failure by Sona to meet the Service Standard required by Section 2.1 of this SLA.

4.2

Requesting Service Credits. As a condition to Sona's obligation to provide Service Credits to Customer, Customer must have submitted a support request during the applicable quarter and request such Service Credits by sending an e-mail identifying the date and time of the Unscheduled Downtime for which Customer is requesting Service Credits, with sufficient evidence (including description of the incident and duration of the incident) to support@getsona.com within two weeks following the end of the quarter in which such Unscheduled Downtime occurred. If Customer fails to request any Service Credits to which Customer is entitled in accordance with this Section 4.2 of this SLA, Sona will have no obligation to issue such Service Credits to Customer.

5

Support Services

Support ServicesDescription
Support services access

Super Admins. 3 x Super Admins who have access to direct line support via Support Agent Live Chat, Email - support@getsona.com, Critical Support Email - criticalsupport@getsona.com, and the support webform. Super Admins are the Users nominated by the Customer (up to a maximum of 3 Users unless agreed otherwise in writing) who have mandates to make changes to the Customer's configuration and rules.

Other Users. All other Users will have access to system support via Email - support@getsona.com and the support webform, plus the extensive Sona Knowledge base with FAQs, training videos and PDF guides. Users who are not designated Super Admins cannot request changes to Customer's configuration and rules. Before Users other than Super Admins utilise the Support Services for a particular query, the Customer shall first use reasonable endeavors to resolve the query via the Super Admins.

Support Hours 9am - 6pm Monday to Friday (ET)

Priority levels and response times:

PDescriptionSLA*Ticket log
0Complete unavailability of the Product4 hoursWebform; Critical Support Email
1Core parts of the Product are non-functional or inaccessible; or immediate staff payroll or shift operation is impacted.4 hours (during Support Hours)Live Chat; Support Email; Webform
2A performance issue, in which the Product is operable but materially incomplete, has significant delays in performance, and/or a single main function of the Product is inoperable.8 hours (during Support Hours)Live Chat; Support Email; Webform
3The Product is usable, but there is a mildly inconvenient impact due to a deviation from intended behavior.48 hours (during Support Hours)Live Chat; Support Email; Webform

*Response time measured from the moment the relevant ticket is logged by the Customer.

Exhibit B Data Processing Addendum
1

Definitions

1.1

For purposes of this DPA, the terms below have the meanings set forth below. Capitalized terms that are used but not defined in this DPA have the meanings given in the Agreement.

"Applicable Data Protection Laws" means the privacy, data protection and data security laws and regulations applicable to Sona's Processing of Personal Data under the Agreement, including, as and to the extent applicable, the State Privacy Laws.

"Controller" means the entity that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, including, as applicable, any "business" as that term is defined by the California Consumer Privacy Act.

"Customer Data" has the meaning given to it in the Agreement.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

"GDPR" means, as and where applicable to Processing concerned: (i) the General Data Protection Regulation (Regulation (EU) 2016/679); and/or (ii) the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (as amended, including by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019), including, in each case (i) and (ii) any applicable national implementing or supplementary legislation.

"Information Security Incident" means a breach of Sona's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Sona's possession, custody or control. Information Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.

"Personal Data" means Customer Data that constitutes "personal data," "personal information," or "personally identifiable information" defined in Applicable Data Protection Laws, except that Personal Data does not include such information received by Sona directly or from other sources (such as its other customers) independent of Sona's relationship with Customer.

"Process" or "Processing" means any operation or set of operations which is performed by Sona on behalf of Customer under the Agreement, on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Processor" means the entity that Processes Personal Data on behalf of the Controller, including, as applicable, any "service provider" as that term is defined by the California Consumer Privacy Act.

"Service Data" means any data relating to the use, support and/or operation of the Services, which is collected directly by Sona from and/or about users of the Services and/or Customer's use of the Service for use for Sona's own purposes.

"Services" means the services that Sona performs for Customer under the Agreement.

"State Privacy Laws" means, collectively, the comprehensive U.S. state data privacy laws currently in effect and applicable to Sona's Processing of Personal Data under the Agreement.

"Subprocessors" means third parties that Sona engages to Process Personal Data in relation to the Services.

"Supervisory Authority" means any entity with the authority to enforce Applicable Data Protection Laws.

2

Duration and Scope of DPA

This DPA will remain in effect so long as Sona Processes Personal Data in its capacity as Processor, notwithstanding the expiration or termination of the Agreement.

Processing of Personal Data subject to the State Privacy Laws with respect to which Customer is a Business, Controller, Processor, or Service Provider (as such terms are defined in State Privacy Laws) shall be subject to Annex 2 (State Privacy Laws Annex) to this DPA.

3

Customer Instructions

Sona will Process Personal Data in its capacity as Processor only in accordance with Customer's instructions to Sona. By entering this DPA, Customer instructs Sona to Process Personal Data to provide the Services and to perform its other obligations and exercise its rights under the Agreement. The Parties acknowledge and agree that the details of Sona's Processing of Personal Data (including the respective roles of the Parties relating to such Processing) are as described in Annex 1 ("Data Processing Details") to the DPA.

4

Security

4.1

Sona Security Measures. Sona will implement and maintain technical, administrative, physical, and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Personal Data.

4.2

Security Compliance by Sona Staff. Sona shall ensure that its personnel who are authorized to access Personal Data are subject to appropriate confidentiality obligations.

4.3

Information Security Incidents. Sona will notify Customer without undue delay of any Information Security Incident of which Sona becomes aware. Sona's notification of or response to an Information Security Incident will not be construed as Sona's acknowledgement of any fault or liability with respect to the Information Security Incident. Customer is solely responsible for complying with notification laws applicable to Customer and fulfilling any third-party notification obligations related to any Security Incident. If Customer determines that a Security Incident must be notified to any Supervisory Authority, any Data Subject(s), the public or others under Applicable Data Protection Laws, to the extent such notice directly or indirectly refers to or identifies Sona, where permitted by applicable laws, Customer agrees to (i) notify Sona in advance, and (ii) in good faith, consult with Sona and consider any clarifications or corrections Sona may reasonably recommend or request to any such notification, which: (i) relate to Sona's involvement in or relevance to such Security Incident; and (ii) are consistent with applicable laws.

4.4

Customer's Security Responsibilities. Customer agrees that, without limitation of Sona's obligations under Section 4 (Security), Customer is solely responsible for its use of the Services, including (a) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of the Personal Data; (b) securing the account authentication credentials, systems and devices Customer uses to access the Services; and (c) securing Customer's systems and devices that Sona uses to provide the Services.

5

Data Subject Rights

5.1

Data Subject Request Assistance. Sona will (taking into account the nature of the Processing of Personal Data) provide Customer with assistance reasonably necessary and technically feasible for Customer to perform its obligations under Applicable Data Protection Laws to fulfill requests by Data Subjects to exercise their rights under Applicable Data Protection Laws ("Data Subject Requests") with respect to Personal Data in Sona's possession or control.

5.2

Customer's Responsibility for Requests. If Sona receives a Data Subject Request, Sona will (i) notify Customer; and (ii) advise the Data Subject to submit the request to Customer. Customer will be solely responsible for responding to any such request.

6

Customer Responsibilities

Customer shall ensure (and is solely responsible for ensuring) that it has given such notices to and obtained such consents and permissions from third parties (including, without limitation, Data Subjects), and has all rights, in each case, as may be required under applicable law or otherwise for Sona to Process Personal Data as contemplated by the Agreement.

Customer represents and warrants that there is, and will be throughout the term of the Agreement, a valid legal basis for the Processing by Sona of Personal Data in accordance with this DPA and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing) for the purposes of all Applicable Data Protection Laws (including Article 6, Article 9(2) and/or Article 10 of the GDPR (where applicable)).

Customer shall ensure that all Data Subjects have (i) been presented with all required notices and statements (including as required by Article 12-14 of the GDPR (where applicable)); and (ii) provided all required consents, in each case (i) and (ii) relating to the Processing by Sona of Personal Data.

7

Subprocessors

7.1

Consent to Subprocessor Engagement. Customer generally authorizes Sona to engage third parties as Subprocessors in accordance with this Section 7.

7.2

Information about Subprocessors. Information about Subprocessors, including their functions and locations, is available at https://www.sona.ai/sub-processors (the "Subprocessor Site"). Sona may continue to use those Subprocessors already engaged by Sona as at the date of this DPA.

7.3

Requirements for Subprocessor Engagement. When engaging any Subprocessor, Sona will enter into a written contract with such Subprocessor containing data protection obligations not less protective than those in this DPA with respect to Personal Data to the extent applicable to the nature of the services provided by such Subprocessor. Sona shall be liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor to the same extent as Sona would have been had it performed the Processing itself.

7.4

Opportunity to Object to Subprocessor Changes. When Sona engages any new Subprocessor after the effective date of the DPA, Sona will notify Customer of the engagement (including the name and location of the relevant Subprocessor and the activities it will perform) by updating the Subprocessor Site or by other written means. If Customer objects to such engagement in a written notice to Sona within 15 days after being informed of the engagement on reasonable grounds relating to the protection of Personal Data, Customer and Sona will work together in good faith to find a mutually acceptable resolution to address such objection.

8

Audits

Reviews and Audits of Compliance. Customer may audit Sona's compliance with its obligations under this DPA up to once every 24 months and on such other occasions as may be required by Applicable Data Protection Laws. Sona will contribute to such audits by providing Customer with the information and assistance reasonably necessary to conduct the audit. If a third party is to conduct the audit, Sona may object to the auditor if the auditor is, in Sona's reasonable opinion, not independent, a competitor of Sona, or otherwise manifestly unsuitable. Such objection by Sona will require Customer to appoint another auditor or conduct the audit itself. To request an audit, Customer must submit a proposed audit plan to Sona at least two weeks in advance of the proposed audit date and any third-party auditor must sign a customary non-disclosure agreement mutually acceptable to the parties (such acceptance not to be unreasonably withheld) providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. Sona will review the proposed audit plan and provide Customer with any concerns or questions (for example, any request for information that could compromise Sona security, privacy, employment or other relevant policies). Sona will work cooperatively with Customer to agree on a final audit plan. Nothing in this Section 8 shall require Sona to breach any duties of confidentiality. If the controls or measures to be assessed in the requested audit are addressed in an SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within twelve (12) months of Customer's audit request and Sona has confirmed there have been no known material changes in the controls audited since the date of such report, Customer agrees to accept such report in lieu of requesting an audit of such controls or measures. The audit must be conducted during regular business hours, subject to the agreed final audit plan and Sona's safety, security or other relevant policies, and may not unreasonably interfere with Sona business activities. Customer will promptly notify Sona of any non-compliance discovered during the course of an audit and provide Sona any audit reports generated in connection with any audit under this Section 8, unless prohibited by Applicable Data Protection Laws. Customer may use the audit reports only for the purposes of meeting Customer's regulatory audit requirements and/or confirming compliance with the requirements of this DPA. Any audits are at Customer's sole expense. Customer shall reimburse Sona for any time expended by Sona and any third parties in connection with any audits or inspections under this Section 8 at Sona's then-current professional services rates, which shall be made available to Customer upon request. Customer will be responsible for any fees charged by any auditor appointed by Customer to execute any such audit.

9

Return and Deletion

(a) Subject to Sections 9(b) and 9(c), upon the date of cessation of any Services involving the Processing of Personal Data (the "Cessation Date"), Sona shall promptly cease all Processing of Personal Data for any purpose other than for storage or as otherwise permitted or required under this DPA.

(b) Subject to Section 9(d), to the extent technically possible in the circumstances (as determined in Sona's sole discretion), on Customer's written request to Sona (to be made no later than thirty (30) days after the Cessation Date ("Post-cessation Storage Period")), Sona shall within fourteen (14) days of such request, at Customer's election either: (i) return a complete copy of all structured Personal Data within Sona's possession to Customer by secure file transfer, promptly following which Sona shall delete all other copies of such Personal Data, or (ii) either (at Sona's option) delete or anonymize all structured Personal Data within Sona's possession.

(c) In the event that during the Post-cessation Storage Period, Customer does not instruct Sona in writing to either delete or return Personal Data pursuant to Section 9(b), Sona shall after the expiry of the Post-cessation Storage Period be entitled to delete all structured Personal Data then within Sona's possession to the fullest extent technically possible in the circumstances.

(d) Sona may retain Personal Data, where permitted or required by applicable law, for such period as may be permitted or required by such applicable law, provided that Sona shall (i) maintain the confidentiality of all such Personal Data, and (ii) Process the Personal Data only as necessary for the purpose(s) specified in the applicable law permitting or requiring such retention.

10

Service Data

10.1

Customer acknowledges that Sona may collect, use and disclose Service Data for its own business purposes, such as:

(a) for accounting, tax, billing, audit, and compliance purposes;

(b) to investigate fraud, spam, wrongful or unlawful use of the Services;

(c) as otherwise set out in the Agreement; and/or

(d) as otherwise permitted or required by applicable law.

10.2

In respect of any such processing described in Section 10.1, Sona:

(a) independently determines the purposes and means of such processing;

(b) shall comply with Applicable Data Protection Laws (if and as applicable in the context);

(c) shall process such Service Data as described in Sona's relevant privacy notices/policies, as updated from time to time; and

(d) shall apply technical and organizational safeguards to any relevant Personal Data.

11

Miscellaneous

Except as expressly modified by the DPA, the terms of the Agreement remain in full force and effect. Notwithstanding anything in the Agreement or any order form entered in connection therewith to the contrary, the parties acknowledge and agree that Sona's access to Personal Data does not constitute part of the consideration exchanged by the parties in respect of the Agreement. Notwithstanding anything to the contrary in the Agreement, any notices required or permitted to be given by Sona to Customer under this DPA may be given (a) in accordance with any notice clause of the Agreement; (b) to Sona's primary points of contact with Customer; or (c) to any email provided by Customer for the purpose of providing it with Services-related communications or alerts. Customer is solely responsible for ensuring that such email addresses are valid.

Sona agrees to cooperate in good faith with Customer concerning any amendments as may be reasonably necessary to address compliance with the Applicable Data Protection Laws.

Sona may on notice vary this DPA to the extent that (acting reasonably) it considers necessary to address the requirements of Applicable Data Protection Laws from time to time.

Limitation of Liability. The total aggregate liability of either Party towards the other Party, howsoever arising, under or in connection with this DPA will under no circumstances exceed any limitations or caps on, and shall be subject to any exclusions of, liability and loss agreed by the Parties in the Agreement.

In the event of any conflict or inconsistency between this DPA and the Agreement, this DPA shall prevail.

A1

Annex 1 - Data Processing Details

Subject matter, nature, scope and purposes of the processing To provide the Services in accordance with this Services Order.
Duration of the processing For the Subscription Term.
Types of personal data

Types of personal data processed can depend on the Modules subscribed to by the Customer, but typical types of personal data include:

Contact details. Email addresses, telephone numbers, addresses, and any additional information Users add to their profile.

Personal details. Names, ages, dates of birth, skills, attributes, job titles, social security numbers, racial or ethnic origin, data concerning sex life or sexual orientation.

Certain employment details. Holiday entitlements and booked holiday, sickness and other absence records, disciplinary records.

Financial information. Salary, bank account details, pension details.

Documentation. Copies of passports, drivers' licenses, employment contracts.

Log data. Including information that the User's browser sends whenever the User visits a website or the mobile app sends when the User is using it. This log data may include the User's Internet Protocol address, the address of the web page the User visited before coming to the Modules, the User's browser type and settings, the date and time of the User's request, information about the User's browser configuration and plug-ins, language preferences, and cookie data.

Device information. Information about the device the User is using the Modules on, including what type of device it is, what operating system the User is using, device settings, unique device identifiers, and crash data.

Geo-location information. GPS from mobile devices is collected only with the User's permission. WiFi and IP addresses received from the User's browser or device may be used to determine approximate location.

Usage information. This is information about which teams, channels, groups, people, features, content, and links the User interacts with within the Modules and what integrations with related services the User uses.

Communication content that Users send and receive within the Modules. This includes message content (messages, pictures, files and video), when messages or files were sent and by whom, when or if they were seen by certain Users, and where a User received them.

Input information. Personal data which may be inputted by Users of Sona's generative AI tools.

Categories of data subject All personnel of the Customer who register with the Subscription Services (i.e. Users) and other categories of data subject which the Customer may use the Services in connection with, such as job candidates or service Users.
A2

Annex 2 - State Privacy Laws Annex

For purposes of this Annex, the terms "business," "commercial purpose," "sell," "share" and "service provider" shall have the respective meanings given thereto in the State Privacy Laws, and "personal information" shall mean Personal Data that constitutes personal information governed by the State Privacy Laws.

It is the parties' intent that with respect to any personal information, Sona is a service provider. Sona (a) acknowledges that personal information is disclosed by Customer only for limited and specified purposes described in the Agreement; (b) shall comply with applicable obligations under the State Privacy Laws and shall provide the same level of privacy protection to personal information as is required by the State Privacy Laws; (c) agrees that Customer has the right to take reasonable and appropriate steps to help to ensure that Sona's use of personal information is consistent with Customer's obligations under the State Privacy Laws; (d) shall notify Customer in writing of any determination made by Sona that it can no longer meet its obligations under the State Privacy Laws; and (e) agrees that Customer has the right, upon notice, including pursuant to the preceding clause, to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

Sona shall not (a) sell or share any personal information; (b) retain, use or disclose any personal information for any purpose other than for the specific purpose of providing the Services, including retaining, using, or disclosing the personal information for a commercial purpose other than the provision of the Services, or as otherwise permitted by the State Privacy Laws; (c) retain, use or disclose the personal information outside of the direct business relationship between Sona and Customer; or (d) combine personal information received pursuant to the Agreement with personal information (i) received from or on behalf of another person, or (ii) or collected from Sona's own interaction with any Consumer to whom such personal information pertains, except as and to the extent necessary as a part of Sona's provision of the Services. Sona hereby certifies that it understands its obligations under this Section 2 and will comply with them.

Giving Customer notice of Subprocessor engagements in accordance with Section 7 of the DPA shall satisfy Sona's obligation under the State Privacy Laws to give notice of and an opportunity to object to such engagements.

Sona agrees that Customer may conduct audits, in accordance with Section 8 of the DPA, to help ensure that Sona's use of personal information is consistent with Sona's obligations under the State Privacy Laws.

The parties acknowledge that Sona's retention, use and disclosure of personal information authorized by Customer's instructions documented in the DPA are integral to Sona's provision of the Services and the business relationship between the parties.