This First Addendum (“Addendum”) is made and entered into by and between Customer and Heap, Inc. (the “Publisher”) to that certain Standard Contract (updated February 2023) and agreed within the Azure Marketplace or AppSource Marketplace (together with Addendum, “Agreement”).

The terms of this Addendum are incorporated by reference in the Standard Contract. Except as specifically stated herein, each defined term utilized herein shall have the same meaning as is assigned to it in the Standard Contract.

In the event of any inconsistency or conflict between the Standard Contract and this Addendum, the terms and conditions of this Addendum shall govern and control.

Recital

WHEREAS, Customer and Publisher desire to affect the purchase of the Offering under the terms of the Standard Contract, in the manner set forth below.

Agreement

Section I (‘License to Offerings’) shall be amended as follows:

1. License for the ordered Offerings is non-transferable, non-assignable and non-sublicensable.

2. Customer may require the Offering to interact with any other products, technology and/or services separately purchased (outside of an Offering) and installed by Customer from certain third parties (each a “Third-Party Product”) and Publisher may provide certain integration capabilities in order to allow such interactions (“Integrations”). When Customer accesses any such Third-Party Product or uses the Integrations, it does so at its own risk. Any use of a Third-Party Products is subject solely to the terms and conditions governing such Third-Party Products (and Customer shall materially comply with such terms and conditions), and any contract entered into, or any transaction completed via any Third-Party Product, is between Customer and the relevant third party, and not with Publisher. Publisher makes no representation and shall have no liability or obligation whatsoever in relation to the content or use of, or correspondence with, any such Third-Party Product, Integration or any contract entered into and any transactions completed by Customer with any such third party. Customer acknowledges that use of the Third-Party Products or Integrations may involve the exchange of Customer Data with the Offering. Customer acknowledges and agrees that, if Customer or a User installs or enables a Third-Party Product or Integration, Customer grants Publisher permission to allow the provider of such Third-Party Product to access Customer Data solely to the extent required for the interoperation of the Third-Party Product with the Offering and as Customer authorizes or directs. Without limiting the generality of the foregoing, if Customer subscribes in an Offering to any Third-Party Product or Integration, Customer is expressly agreeing to be bound by the terms and conditions applicable to such product and/or services.

3. Customer hereby grants Publisher and its Affiliates a revocable, non-exclusive, non-sublicensable, worldwide royalty-free, right and license to use the Customer Data solely to the extent necessary to perform its obligations under the Standard Contract. Customer also grants Publisher and its Affiliates a non-exclusive, perpetual, worldwide, royalty-free, right and license to compile and use Customer Data, strictly in order to research, develop, modify, improve or support the services provided by Publisher, provided that such data is used in an anonymous or aggregated form where no such information could directly identify or will reasonably be used to identify Customer, Customer’s Users or its Visitors. In no event shall Publisher sell or transfer Customer Data to third parties for marketing or advertising purposes.

Section II (‘Privacy’) shall be amended as follows:

1. The processing of Personal Data by Publisher under the Standard Contract is subject to the Publisher’s Data Processing Agreement (“DPA”) as available at: Data Processing Agreement. Customer agrees that the DPA shall be incorporated into the Standard Contract by reference. Acceptance of the Standard Contract and/or any Offering shall be deemed as execution of the DPA and the Standard Contractual Clauses included thereto.

2. Customer acknowledges and agrees that it is Customer’s responsibility to ensure that Customer’s use of the Offering complies with all Data Protection Laws applicable to Customer, including, but not limiting to: (i) ensuring the accuracy and adequacy of Customer Data provided to Publisher by or on behalf of Customer; (ii) providing the appropriate notice to Visitors (e.g., privacy policy conspicuously posted on the Customer Site(s)) that clearly and accurately discloses its privacy practices (including how data is collected and used); (iii) its placement and use of cookies relating to the Offering and its use of the Offering with respect to the collection of Visitor Data; and (iv) if required by law, obtaining and maintaining a record of consent. Customer warrants it has a valid lawful basis to collect and enable the processing of Customer Data pursuant to the terms of the Agreement. Customer shall not commit any act or omit to act in a way which places or is likely to place Publisher in breach of any Data Protection Laws or any other applicable laws or regulations.

3. Through Customer’s configurations and use of the Offering, Customer has control over the types and amounts of Customer Data collected by the Offering. By collecting Customer Data through the Offering, Customer is expressly instructing Publisher to process Customer Data on behalf of Customer pursuant to the terms of the Agreement and the DPA.

4. Customer agrees and acknowledges that the Offering is not intended for the collection of any Restricted Personal Data. For such purpose, Customer shall prevent the transfer of any such Restricted Personal Data to Publisher, including, but not limited to, by implementing the appropriate tools and methods, on such relevant areas of the Customer Site(s) and browser back-end where Restricted Personal Data may be collected by the Offering (e.g., via cookies, JS Error logs or other network communication), inserted by a Visitor (e.g., through keystrokes) or displayed (e.g., prefilled, data within the HTML).

5. In the event Customer becomes aware that Restricted Personal Data has been collected or is being displayed or collected through the Offering, then, without limiting any of the rights or remedies available to a Party under the Agreement or under applicable law, Customer shall contact Publisher immediately and agrees to cooperate in good faith with Publisher to delete any such Restricted Personal Data from the Offering. It is hereby clarified that if Restricted Personal Data is required to be removed pursuant to this Section 5 and it is not commercially reasonable or technically feasible to delete only the Restricted Personal Data (as shall be determined by Publisher), other Customer Data collected may be deleted in the process.

6. Customer Data collected by the Offering shall be available for Customer's use for the duration of the relevant period specified in the Offering.

7. Publisher makes available to Customer the current list of Sub-processors used by Publisher at https://www.heap.io/sub-processors. Any termination right due to a change of Sub-processor(s) by Publisher in accordance with the terms of the Standard Contract will be subject to failure by Publisher to cure such objection by any of the following remediation processes (to be selected at Publisher’s sole discretion): (i) Publisher shall cease to use the Sub-processor with regard to Customer Data; (ii) Sub-processor shall take the corrective steps curing the gaps listed by Customer in its objection (which steps will be deemed to resolve Customer’s objection) and proceed to use the Sub-processor to process Customer Data; or (iii) Publisher may cease to provide, temporarily or permanently, the particular aspect of an Offering that would involve use of the Sub-processor to process Customer Data.

Section VI shall be amended by deleting Section 6.1 in its entirety and replacing it with the following:

1. Mutual Warranties. Each of Publisher and Customer agree that: (a) the Agreement has been duly executed and delivered and constitutes a valid and binding agreement enforceable against it in accordance with the terms of the Agreement; and (b) no authorization or approval from any third party is required in connection with its execution of the Agreement.

2. PUBLISHER DOES NOT WARRANT THAT THE OFFERING, SCRIPTS, DOCUMENTATION, OR ANY SERVICES SHALL MEET CUSTOMER NEEDS, BE ERROR FREE, OR THAT THE OPERATION OF THE OFFERING WILL BE UNINTERRUPTED. CUSTOMER ASSUMES SOLE RESPONSIBILITY FOR RESULTS OBTAINED FROM THE USE OF THE OFFERING BY CUSTOMER AND FOR CONCLUSIONS DRAWN FROM SUCH USE. PUBLISHER SHALL HAVE NO LIABILITY FOR ANY DAMAGES CAUSED BY ERRORS OR OMISSIONS IN ANY INFORMATION, INSTRUCTIONS OR SCRIPTS PROVIDED TO PUBLISHER BY CUSTOMER IN CONNECTION WITH THE OFFERINGS OR ANY ACTIONS BY PUBLISHER AT CUSTOMER’S DIRECTION. CUSTOMER ACKNOWLEDGES AND AGREES THAT IT HAS FULL KNOWLEDGE OF THE CHARACTERISTICS AND CONSTRAINTS OF THE INTERNET AND IN PARTICULAR THAT INFORMATION AND DATA TRANSMISSION, AND ANTI-INTRUSION SYSTEMS, HAVE A LIMITED RELIABILITY AND TECHNICAL SAFETY LEVEL.

Section IX shall be amended as follows:

1. In the event that the Session limits set forth in an Offering are exceed during any given twelve (12)-month period of the Term, Customer will be charged over-usage fees accordingly yearly, based on Publisher’s then-applicable rate or any overage rate agreed in an Offering.

2. Publisher shall have sole discretion and authority to approve the products and services, and pricing therefor, included within the applicable Offering. No change to the products, services, or pricing shall be effective unless confirmed in writing by Publisher.

Section X shall be amended as follows:

1. This Agreement shall not be effective until confirmed in writing by Publisher.

2. Termination without cause shall not apply to this engagement or any Offering ordered by Customer.

3. Any Offering will automatically renew for successive periods of the same duration as the initial Offering term, unless stated otherwise in the Offering, unless either Party gives written notice to the other to terminate the Standard Contract not less than ninety (90) days before the end of the initial Offering term or any subsequent renewal term (as the case may be), in which case the Standard Contract shall terminate at the end of the initial Offering term or any subsequent renewal term (as applicable).

Section XI shall be amended to reflect that:

1. The Standard Contract and any dispute(s) or claim(s) arising out of or in connection with it or its subject matter or formation (including non-contractual dispute(s) or claim(s)) shall be governed by and construed in accordance with the laws of the Applicable State without giving effect to any choice or conflict of law provisions or rule (whether of the Applicable State or any other jurisdiction). In relation to any dispute(s) or claim(s), each Party irrevocably agrees that the courts of the Applicable State shall have exclusive jurisdiction to settle any such dispute(s) or claim(s). The Parties hereby irrevocably waives any and all right to trial by jury in any legal proceeding arising out of or relating to this Agreement or the services contemplated hereby.

Section XII shall be amended to reflect that:

“Account Data” means the data relating to Users processed by Publisher in connection with such Users’ access to the Offering including, but not limited to, name, job position, email address, password.

“Applicable State” means (i) for US and Canada – State of New York; and (ii) for outside of US and Canada – State of France.

“Customer Data” means all data, including (i) all forms of data, materials or information provided or inputted by Customer, Customer Affiliate or a User in connection with the access or use of the Offering (excluding Account Data and Usage Data); (ii) Visitor Data; and (iii) subject to the terms of this Agreement, all information derived from the foregoing, including results of processing the foregoing through the Offering. For the avoidance of doubt, Customer Data does not include any designs, template forms and/or the underlying technology, process, algorithm, component or Publisher Intellectual Property Rights used by the Offering or professional services to generate reports, insights or any form of structured Customer Data.

"Customer Site(s)” means those website URL(s) and/or native mobile application(s) (as applicable) owned and operated by Customer or a Customer Affiliate on which Customer elects, and Publisher agrees, to implement the Script(s) and provide the Offering, as detailed in the Offering. For the avoidance of doubt, the Offering shall not operate for any Customer website or mobile app not listed in an Offering unless otherwise explicitly agreed to in writing by Publisher.

"Fees” means all fees payable by Customer to Publisher as set out in the Offering.

"Initial Term” means the initial term set out in the Offering, commencing on the Offering Effective Date.

“Restricted Personal Data” means any of the following: (i) financial information (including but not limited to, bank account numbers, credit or debit card information, PINs, or information regulated under the Gram-Leach-Bliley Act (GLBA)); (ii) biometric, genetic, medical, health information (including but not limited to any health insurance information or information regulated under the Health Insurance Portability and Accountability Act (HIPAA)); (iii) government issued IDs (including but not limited to driver’s license number, passport number, national ID number, TIN or EIN number, social security number); (iv) password; (v) information regarding children (e.g., under the age of sixteen (16) or information subject to the Children Online Privacy Protection Act (COPPA)); (vi) any information defined as ‘Special Categories of Data’ under Article 9 of the General Data Protection Regulation 2016/679 (GDPR); (vii) information relating to criminal convictions and offenses; and (viii) any “Sensitive Personal Information” as defined under the California Consumer Privacy Act (CCPA).

“Script(s)” means the JavaScript generated by Publisher and provided to Customer which, when implemented on Customer Site(s), interacts with the Offering and enables the Offering to function.

“Session” means a period of Visitor activity from a single Visitor on a Customer Site. When applicable, the maximum number of Sessions per license year on Customer Site(s) is set out in the applicable Order Form or ordering document.

“Sub-processor” means a processor appointed by Publisher to process Customer Data on behalf and under the instructions of Publisher.

“Users” means any and all employees, agents and independent contractors of Customer or its Affiliates who are given access to the Offering in accordance with the Agreement, authorized to that purpose either by Customer or by an Affiliate of Customer. If the User is an agent or independent contractor of Customer, use of the Offering is permitted only if the User is under confidentiality obligations with Customer at least as restrictive as those in this Agreement and is accessing or using the Offering solely to support Customer’s and/or its Affiliates’ internal business purposes.

“Usage Data” means the data, information, or insights generated or derived from the use of the Offering, including, but not limited to, user ID, IP address, online behavioral data and technical data.

“Visitor” means a visitor of the Customer Site(s).

“Visitor Data” means the data relating to a Visitor that is processed by Publisher in connection with Customer’s use of the Offering.