UPTIVO SERVICE LICENSE AGREEMENT

Edition r2605.23

This Services Agreement (the "Agreement") governs the Customer's acquisition and use of UPTIVO services. Acceptance occurs when the Customer (1) signs this Agreement, (2) executes an Order Form referencing it, or (3) uses the free services. Where acceptance is given on behalf of a legal entity, the signatory affirms authority to bind that entity and its affiliates, and "Customer" means such entity and its affiliates. The Agreement also governs any free trial or free services. Direct competitors of UPTIVO may not access the Services without UPTIVO's prior written consent, and the Services may not be accessed for benchmarking or competitive purposes.

This Agreement was last updated on September 7, 2026 and is effective between the parties as of the Customer's date of acceptance (the "Effective Date").

1. DEFINITIONS

Account Email: The email address provided by Customer in the online subscription process, which Customer may update from the Control Panel.

Affiliate: Any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, where "control" means ownership of more than 50% of voting interests.

Agreement: This Service License Agreement, including its annexes (in particular the Data Processing Agreement at Annex A) and any Order Form incorporated by reference.

Beta Services: UPTIVO services or features designated as beta, pilot, limited release, developer preview, non-production, evaluation, or otherwise indicated as non-final.

Content: Information made available to Customer through the Services from publicly available sources or third-party content providers, as detailed in the Documentation.

Control Panel: Customer's reserved area within the Services, in which Customer manages its Online Subscription ("license management" section).

Customer: The individual or legal entity accepting this Agreement; where acceptance is on behalf of an entity, includes that entity's Affiliates that have entered into Order Forms.

Customer Data: Electronic data and information submitted by or for the Customer to the Services, excluding Content and Non-UPTIVO Applications.

Data Protection Laws: All applicable laws and regulations relating to the processing of Personal Data, including Regulation (EU) 2016/679 ("GDPR"), Italian Legislative Decree 196/2003 as amended, and the e-Privacy Directive (2002/58/EC) as locally implemented.

DPA: The Data Processing Agreement attached as Annex A, entered into pursuant to Article 28 GDPR and forming an integral part of this Agreement.

End User: Any natural person who uses or accesses the Services through Customer or a User, including gym members, training participants, athletes and other natural persons enrolled in programs operated by Customer. The term "End User" includes Users and any other natural persons authorized by Customer to receive or experience the Services.

Non-UPTIVO Application: Any application, software, service or product (web-based, mobile, offline or otherwise) provided by Customer or a third party that interoperates with the Services and is not part of the Services.

Online Subscription: A subscription to the Services (for example UPTIVO SNAP) taken out by Customer directly online, through the online subscription process with card payment handled by Stripe, without an Order Form. Sections 5.8-5.12, 15.5 and 15.6 apply to Online Subscriptions.

Order Form: An ordering document specifying the Services provided hereunder, executed between Customer (or its Affiliate) and UPTIVO, including any addenda.

Personal Data: Has the meaning given in the GDPR. Where used in this Agreement, refers to Customer Data that constitutes personal data.

Plan: The combination of features, term (monthly or annual) and price selected by Customer in the online subscription process.

Purchased Services: Services purchased under an Order Form or online purchasing portal, as distinguished from services provided free of charge or under a free trial.

Services: The products and services ordered by Customer under an Order Form or made available free of charge or under a free trial, including any associated offline or mobile components, as described in the Documentation made available by UPTIVO.

Sub-processor: Any third party engaged by UPTIVO to process Personal Data on behalf of the Customer in connection with the provision of the Services.

Trial Period: The initial free period of an Online Subscription, of the duration indicated in the subscription screen, governed by Section 5.8.

UPTIVO: UPTIVO S.r.l., registered office at Via L. Vitali 1, 20122 Milano (MI), Italy, VAT IT08849150969, certified email (PEC) euvic@legalmail.it.

User: An individual authorized by Customer to use a Service for whom Customer has purchased a subscription (or, for free Services, for whom a Service has been provisioned), and to whom Customer has supplied access credentials.

2. UPTIVO RESPONSIBILITIES

2.1 Provision of Purchased Services. UPTIVO will (a) make the Services and Content available to Customer under this Agreement, the applicable Order Forms and the Documentation, (b) provide standard support at no additional charge (and upgraded support if purchased), (c) use commercially reasonable efforts to meet the Service Levels in Section 3 (excluding planned maintenance and Force Majeure), and (d) deliver the Services in compliance with laws applicable to UPTIVO's general provision of its Services, subject to Customer's compliant use.

2.2 Protection of Customer Data. UPTIVO will maintain administrative, physical and technical safeguards designed to protect the security, confidentiality and integrity of Customer Data, against unauthorized access, disclosure, alteration or destruction. The processing of Personal Data is governed by the DPA. In case of conflict between this Section and the DPA on the processing of Personal Data, the DPA prevails.

2.3 UPTIVO Personnel. UPTIVO is responsible for its personnel's performance and their compliance with UPTIVO's obligations hereunder.

2.4 Beta Services. Beta Services are provided "AS IS" and "AS AVAILABLE", without warranty. Notwithstanding any contrary provision: (a) the Service Levels in Section 3 do not apply, (b) UPTIVO may discontinue Beta Services at any time, and (c) UPTIVO's aggregate liability for Beta Services shall not exceed one hundred Euro (€ 100), in derogation of Section 11.1. The foregoing is subject to Section 11.3 (Mandatory Carve-out).

2.5 Free Trials and Free Services. Free trials and services that UPTIVO provides without charge are governed by this Agreement, are offered "AS IS" without warranty, and may be discontinued by UPTIVO at any time without liability. The Trial Period of Online Subscriptions is governed by Section 5.8.

3. SERVICE LEVELS

3.1 Uptime Commitment. UPTIVO will use commercially reasonable efforts to make the production Purchased Services available with a monthly uptime of at least 99.5%, calculated on a calendar-month basis (the "Service Level").

3.2 Service Credits. Where UPTIVO fails to meet the Service Level in a calendar month, Customer's sole remedy is a service credit calculated on the monthly fee for the affected Services: (a) below 99.5% but at or above 98.5%: 10%; (b) below 98.5% but at or above 95.0%: 20%; (c) below 95.0%: 30%. Total credits per calendar year shall not exceed 30% of the annual fees for the affected Services. Credits are applied to future invoices and are not redeemable for cash. Customer must request the credit in writing within thirty (30) days of the end of the relevant month. Service Credits are Customer's exclusive remedy for failures to meet the Service Level, without prejudice to Section 11.3.

3.3 Planned Maintenance. UPTIVO will use commercially reasonable efforts to schedule maintenance outside Italian business hours and to provide at least forty-eight (48) hours' prior notice. Planned maintenance time is excluded from the uptime calculation.

3.4 Exclusions. The Service Level does not apply to: (a) Beta Services and free Services, (b) issues caused by Customer Data, Non-UPTIVO Applications, or acts/omissions of Customer or Users, (c) failures of third-party wearable devices, third-party networks or end-user devices outside UPTIVO's reasonable control, (d) Force Majeure Events, or (e) suspensions under Section 5.5 or otherwise permitted under this Agreement.

3.5 Third-Party Service Failures. Where any failure to meet the Service Level is caused, in whole or in part, by a failure, outage, degradation or disruption of services provided by a third-party Sub-processor (including, without limitation, hosting providers, AI service providers and database providers listed in Annex 1 of the DPA), UPTIVO's liability and the Service Credits owed to Customer shall not exceed the credits, refunds or remedies actually obtained by UPTIVO from the relevant Sub-processor and attributable to the affected Services. Customer expressly acknowledges that UPTIVO has no control over Sub-processor performance and that this allocation of risk is a material consideration for the pricing of the Services.

4. USE OF SERVICES AND CONTENT

4.1 Subscriptions. The Services and Content are provided on a subscription basis, as specified in the Order Form or the Documentation. Customer purchases are based on the current offering and not on future functionality.

4.2 Wearables Compatibility. The Services interoperate with various third-party heart-rate monitors via Bluetooth and ANT+, as further described in the Documentation. UPTIVO LIVE and the personal UPTIVO app are exclusively used with UPTIVO monitors unless otherwise specified in the Order Form. Signal performance and accuracy of third-party wearable devices not manufactured by UPTIVO are beyond UPTIVO's control and are not UPTIVO's responsibility.

4.3 Fitness Use; No Medical Device. The Services are designed solely for fitness, sport-monitoring and wellness purposes. They are NOT a medical device under Regulation (EU) 2017/745 (MDR) or Italian Legislative Decree 46/1997, are NOT CE-marked as a medical device, and are NOT intended or suitable for the diagnosis, treatment, cure, prevention, monitoring or alleviation of any disease, injury, disability or medical condition. The Services must not be relied upon as medical advice or as a substitute for professional medical judgment. Heart-rate values, performance metrics and any other physiological data displayed through the Services are indicative only and may be inaccurate. Customer expressly acknowledges that: (a) Customer is solely responsible for assessing the suitability of the Services for its End Users, including obtaining medical clearance where appropriate; (b) Customer shall ensure that End Users are informed in writing, prior to use, that the Services are not a medical device and shall not be used for health-related decisions; (c) Customer shall require End Users to consult qualified medical professionals before engaging in physical activity monitored through the Services and before relying on any data generated by the Services; (d) Customer assumes all risk arising from use of the Services by its End Users, including risk of injury, cardiac events, or other adverse health outcomes; (e) Customer shall maintain adequate liability insurance covering its activities and its End Users' use of the Services. Customer further acknowledges that the Services may store clinical and body-measurement data provided by Customer or End Users (including blood pressure, blood glucose, body composition results and fitness test outcomes). Such data is stored as input from Customer's medical, clinical or assessment activities and is NOT processed, validated, interpreted or analyzed by UPTIVO for medical purposes; Customer remains solely responsible for the medical reliability, accuracy and lawful use of such data. UPTIVO disclaims all liability for any health-related outcomes arising from use of the Services, to the maximum extent permitted by Section 11.

4.4 Usage Restrictions. The Services and Content are for the Customer's and Users' own use. Customer shall not (a) resell, sublicense or share access without authorization, (b) use the Services for unlawful activities, (c) disrupt service integrity or bypass usage limits, (d) infringe third-party intellectual property, (e) modify, copy or create derivative works of the Services or Content without authorization, or (f) develop products or services that directly compete with the Services using the Services or Content. Non-UPTIVO Applications are used at Customer's risk.

4.5 PayPal Integration. Customers holding an UPTIVO account may use the PayPal payment services made available through the UPTIVO integration to allow the purchase of club memberships, subscriptions, credits and similar items as a means of payment for club activities, including without limitation individual (personal training) and group classes, gym access, wellness and beauty services provided as part of the club's activities, and online and on-demand fitness services.

PayPal Prohibited Activities. The Customer and its End Users may not use the PayPal service provided as part of the UPTIVO integration for activities that:

(i) violate any law, statute, ordinance or regulation;

(ii) relate to transactions involving (a) narcotics, steroids, certain controlled substances or other products that present a risk to consumer safety, (b) drug paraphernalia, (c) cigarettes, (d) items that encourage, promote, facilitate or instruct others to engage in illegal activity, (e) stolen goods, including digital and virtual goods, (f) the promotion of hate, violence, racial or other forms of intolerance that is discriminatory, or the financial exploitation of a crime, (g) items that are considered obscene, (h) items that infringe or violate any copyright, trademark, right of publicity or privacy or any other proprietary right under the laws of any jurisdiction, (i) certain sexually oriented materials or services, (j) ammunition, firearms, or certain firearm parts or accessories, or (k) certain weapons or knives regulated under applicable law;

(iii) relate to transactions that (a) show the personal information of third parties in violation of applicable law, (b) support pyramid or Ponzi schemes, matrix programs, other "get rich quick" schemes or certain multi-level marketing programs, (c) are associated with purchases of annuities or lottery contracts, lay-away systems, off-shore banking or transactions to finance or refinance debts funded by a credit card, (d) are for the sale of certain items before the seller has control or possession of the item, (e) are by payment processors to collect payments on behalf of merchants, (f) are associated with the sale of traveler's checks or money orders, (g) involve currency exchanges or check cashing businesses, (h) involve certain credit repair, debt settlement services, credit transactions or insurance activities, or (i) involve offering or receiving payments for the purpose of bribery or corruption;

(iv) involve the sale of products or services identified by government agencies to have a high likelihood of being fraudulent.

Any use of the PayPal service in breach of this Section 4.5 constitutes a breach of Section 4.4 (Usage Restrictions).

4.6 Professional Use; Exclusion of Consumers. The Services are intended exclusively for persons acting in the course of their business or professional activity, such as gyms, studios, fitness centers, sports clubs and associations and professionals of the sector; by entering into this Agreement, including online, Customer therefore represents that it acts in that capacity and that it is not a consumer within the meaning of Article 3 of Italian Legislative Decree 206/2005 (Consumer Code), with the consequence that the Consumer Code and the protections reserved to consumers do not apply to this Agreement. UPTIVO may at any time request from Customer its business identification details, such as company name, VAT number or tax code.

5. FEES AND PAYMENT

5.1 Fees. Customer pays all fees set out in Order Forms or service-activation emails. Fees are based on the chosen subscription plan, not on usage, and are non-cancellable and non-refundable for the entire subscription term. Annual subscription fees cover one year and cannot be cancelled once activated; renewal mechanics are governed by Section 5.2. Subscription levels cannot be reduced during the then-current term; reductions are permitted at renewal upon written notice given at least thirty (30) days before the end of the then-current term.

5.2 Renewal.

(a) Monthly Subscriptions. Monthly subscriptions paid by recurring credit card via Stripe shall automatically renew for successive monthly periods unless Customer provides written notice of non-renewal at least thirty (30) days prior to the next renewal date. Where notice is given less than thirty (30) days before the next renewal date, the subscription shall renew for one further monthly period and terminate at the end of that period. Renewal takes place at the list price in force on the renewal date. UPTIVO notifies any price change to the email address of the billing contact at least thirty (30) days before the renewal date from which the change applies. If Customer does not wish to accept the new price, it may give notice of non-renewal up to the renewal date, by way of derogation from the thirty (30) days' notice above, with effect from the end of the then-current period; absent such notice, renewal takes place at the new price. Price changes never apply to a period already paid. UPTIVO shall in any event send a payment notice at least seven (7) days before any auto-renewal charge.

(b) Annual Subscriptions. Annual subscriptions taken out under an Order Form shall not automatically renew; Online Subscriptions renew under Section 5.9. Annual subscriptions under an Order Form expire at the end of the term stated therein, and any renewal requires a new Order Form executed by the parties. UPTIVO shall send Customer a renewal proposal at least sixty (60) days before the end of the then-current annual term, by email to the billing contact in the Order Form. If Customer continues to access or use the Services after expiration of an annual subscription without executing a new Order Form, UPTIVO may suspend or deactivate access without further notice. Should UPTIVO elect to continue providing access, such use shall be governed by this Agreement on a month-to-month basis at the most recent applicable fees, terminable by either party on thirty (30) days' written notice.

5.3 Invoicing. Customer shall provide valid payment information or an approved purchase order. Credit card payments authorize UPTIVO to charge for the subscription period stated in the Order Form, including, for monthly subscriptions, auto-renewals under Section 5.2(a). Customer shall keep billing information up to date. For Online Subscriptions, card payment authorizes UPTIVO to charge the conversion under Section 5.8 and the renewals under Section 5.9.

5.4 Overdue Charges. Late payments accrue interest at the rate of the European Central Bank reference rate plus eight (8) percentage points pursuant to Italian Legislative Decree 231/2002, calculated from the due date until full payment, without need for prior formal notice (costituzione in mora).

5.5 Suspension. If payments are overdue, UPTIVO may, after notice (except for declined payments), demand immediate payment of all fees and suspend the Services until full payment. Suspension does not relieve Customer of payment obligations.

5.6 Taxes. Quoted prices do not include taxes, which are Customer's responsibility. UPTIVO will invoice taxes it is required to collect unless a valid exemption certificate is provided.

5.7 Set-off. Each party may set off any liquid, due and undisputed amount owed by the other party against amounts owed to the other party under this Agreement, provided that written notice of the set-off is given at least fifteen (15) days in advance. Customer shall not be entitled to suspend, withhold or set off any payment due to UPTIVO on the basis of disputed claims, alleged defects or counterclaims that have not been finally determined by the competent forum under Section 17.

5.8 Trial Period and Conversion to a Paid Subscription.

(a) Trial Period. Each Online Subscription begins with a free Trial Period, during which Customer has full access to the features of the selected Plan and whose duration, indicated in the subscription screen before confirmation and repeated in the activation confirmation email, may be changed by UPTIVO for new subscriptions without effect on Trial Periods already in progress. The Trial Period runs from completion of the online subscription process and ends at the same time of day on the last day of the indicated duration; no charge is made during the Trial Period, and any check of the validity of the payment method does not involve a charge. The Trial Period, to which Section 2.5 applies, is granted once per Customer.

(b) Plan and Payment Method. When subscribing, Customer selects the Plan, monthly or annual, and provides a valid payment method (card) handled by Stripe, while the subscription screen shows, before confirmation, the selected Plan, the amount of the first charge and the date on which it will be made (the "First Charge Date"), which coincides with the end of the Trial Period.

(c) Automatic Conversion. At the end of the Trial Period, unless Customer has deactivated the Online Subscription under Section 5.10, the selected Plan is activated automatically and UPTIVO charges the payment method provided with the amount of the Plan for the first period, monthly or annual, with the consequence that, from the First Charge Date, the Online Subscription constitutes a Purchased Service for all purposes of this Agreement.

(d) Reminder. Before the end of the Trial Period, UPTIVO sends to the Account Email a reminder stating the First Charge Date and the related amount.

(e) Customer acknowledges that the conversion takes place without any further confirmation on its part and that, to avoid the charge, it must deactivate the Online Subscription before the end of the Trial Period. Any failure to receive the reminder under letter (d) does not relieve Customer of that burden, the First Charge Date and the related amount having been communicated in the subscription screen before confirmation and in the activation confirmation email.

5.9 Automatic Renewal of Online Subscriptions.

(a) Tacit Renewal. The Online Subscription renews automatically at the end of each period for a period of the same length, namely one month for the monthly Plan and one year for the annual Plan, unless Customer deactivates it before the end of the current period under Section 5.10, no minimum notice being required.

(b) Charge. On the renewal date UPTIVO charges the payment method in use with the amount of the Plan for the new period and, if the charge fails, notifies the Account Email with the right to retry, Section 5.5 applying if payment is not made.

(c) Renewal Price. Renewal takes place at the list price of the Plan in force on the renewal date, it being understood that UPTIVO notifies any price change to the Account Email at least thirty (30) days before the renewal date from which the change applies and that Customer, if it does not wish to accept the new price, may deactivate the Online Subscription before that date, failing which renewal takes place at the new price. Price changes do not apply in any case to a period already paid.

(d) Renewal Notice. UPTIVO sends a notice to the Account Email stating the date and amount of the charge at least thirty (30) days before each renewal of the annual Plan and at least seven (7) days before each renewal of the monthly Plan. Any failure to receive the notice does not relieve Customer of the burden of deactivating the Online Subscription under Section 5.10 to avoid renewal, without prejudice to the notice periods for price changes under letter (c).

5.10 Deactivation.

(a) How to Deactivate. Customer may deactivate the Online Subscription at any time, without penalty and without minimum notice, from the Control Panel, "license management" section; deactivation excludes any subsequent charge and is confirmed by UPTIVO by notice to the Account Email.

(b) Alternative Channel. Deactivation may also be exercised by written notice sent from the Account Email to support@uptivo.fit, stating the company name and the Account Email, and takes effect upon receipt, which UPTIVO confirms by email.

(c) Effects During the Trial Period. If deactivation is exercised during the Trial Period, the conversion under Section 5.8 does not take place and no charge is made, Customer remaining free to use the Services until the end of the Trial Period, at which point access ends.

(d) Effects With an Active Plan. If deactivation is exercised after conversion, the Online Subscription does not renew at the end of the current period and Customer may use the Services until the end of the period already paid, at which point access ends and Section 8.3 (data export and deletion) applies.

(e) No Refund. No refund, in whole or in part, is due for periods already charged and not fully used, unless a mandatory provision of law provides otherwise.

(f) New Subscription. After deactivation, Customer may take out a new Online Subscription, without being granted a new Trial Period.

5.11 Nature of the Fee. The fee for the Online Subscription remunerates the making available of the Services for the contractual period and not their actual use, so that Customer's failure to use, or partial use of, the Services, for any reason not attributable to UPTIVO, does not give rise to any right to refunds, price reductions, credits or extensions of the period, without prejudice to the Service Credits under Section 3.2.

5.12 Precedence for Online Subscriptions. For Online Subscriptions, Sections 5.8-5.11 prevail, in case of conflict, over Sections 5.1, 5.2, 5.3 and 13.2, while Sections 5.4-5.7 also apply to Online Subscriptions.

6. PROPRIETARY RIGHTS AND LICENSES

6.1 Reservation of Rights. Subject to the limited rights granted herein, UPTIVO, its Affiliates, licensors and Content providers reserve all right, title and interest in and to the Services and Content, including all intellectual property rights. No additional rights are granted to Customer.

6.2 Access to and Use of Content. Customer is granted the right to access and use the applicable Content under the relevant Order Forms, this Agreement and the Documentation.

6.3 License by Customer to UPTIVO. Customer grants UPTIVO, its Affiliates and contractors a worldwide, limited-term, non-exclusive license to host, copy, modify (solely as necessary for backup, format conversion and operation of the Services), use, transmit and display Customer Data, Non-UPTIVO Applications and code created by or for Customer in connection with a Service, to the extent necessary to provide and operate the Services. Where Customer uses a Non-UPTIVO Application with a Service, Customer also authorizes UPTIVO to permit the Non-UPTIVO Application and its provider to access Customer Data as necessary for integration. UPTIVO acquires no right, title or interest in Customer Data, Non-UPTIVO Applications or such code beyond the limited license above.

6.4 License to Use Feedback. Customer grants UPTIVO and its Affiliates a worldwide, perpetual, irrevocable, royalty-free license to use, distribute, disclose and integrate any suggestions, enhancement requests, recommendations, corrections or other feedback provided by Customer or Users.

6.5 Marketing Reference. Customer grants UPTIVO a non-exclusive, worldwide, royalty-free license to use Customer's name, trademarks and logo solely to identify Customer as a customer on UPTIVO's website, marketing materials and customer reference lists. Customer may revoke this license at any time by written notice to UPTIVO under Section 15. Following such revocation, UPTIVO will use commercially reasonable efforts to remove Customer's references from digital materials within thirty (30) days; printed and previously distributed materials shall not be required to be recalled, but UPTIVO shall not include Customer's references in any new printing or distribution.

7. CONFIDENTIALITY

7.1 Confidential Information. "Confidential Information" means information disclosed by either party (the "Disclosing Party") to the other (the "Receiving Party") that is marked confidential or that should reasonably be understood as confidential given its nature and the context of disclosure. Customer Data is Confidential Information of Customer; the Services, Content, agreement terms and Order Forms (including pricing) are Confidential Information of UPTIVO. Confidential Information does not include information that is or becomes public without breach, was lawfully known prior to disclosure, is rightfully received from a third party without confidentiality duties, or is independently developed by the Receiving Party.

7.2 Protection. The Receiving Party shall protect Confidential Information using the same care as for its own confidential information (and not less than reasonable care), use it only for purposes of this Agreement, and limit access to authorized personnel and contractors bound by no less protective confidentiality undertakings. Disclosure to third parties requires prior consent, except for disclosures to Affiliates, legal counsel or accountants, or disclosures required by law or regulatory authority.

8. DATA PROTECTION

8.1 Compliance and DPA. Each party shall comply with applicable Data Protection Laws. With respect to Personal Data within Customer Data, Customer is the data controller and UPTIVO is the data processor. The processing of Personal Data is governed by the DPA at Annex A, which sets out (in accordance with Article 28 GDPR) the subject-matter, duration, nature and purpose of processing, categories of Personal Data and data subjects, sub-processors, technical and organizational measures, breach-notification timing, audit rights and international-transfer safeguards.

8.2 Fitness Data. Heart-rate, performance and related metrics processed via the Services are processed for fitness, sport-monitoring and wellness purposes only, and not by UPTIVO for medical diagnosis or treatment (see Section 4.3). Customer is responsible for determining the lawful basis applicable to its Users and for providing all required notices and obtaining all required consents.

8.3 Data Export and Deletion. Upon termination or expiry of this Agreement, Customer shall have a window of thirty (30) days during which the export functionality made available by UPTIVO remains accessible for Customer Data export. After such window, UPTIVO will delete or destroy all Customer Data, unless legally required to retain it. Notwithstanding the foregoing, UPTIVO shall continue to assist Customer, as Data Controller, in responding to data subject rights requests under Chapter III GDPR concerning Personal Data still retained by UPTIVO, in accordance with the DPA. Assisted exports requiring custom engineering effort beyond the standard self-service export functionality shall be billable at UPTIVO's then-current professional services rates.

9. REPRESENTATIONS, WARRANTIES, EXCLUSIVE REMEDIES, DISCLAIMERS

9.1 Representations. Each party represents that it has the authority and legal capacity to enter into this Agreement.

9.2 UPTIVO Warranties. UPTIVO warrants that, throughout the subscription term, (a) the Services will substantially perform as described in the Documentation, (b) UPTIVO will not materially reduce the security of the Services, and (c) UPTIVO will provide the Services in compliance with the DPA. Customer's exclusive remedy for breach is, at UPTIVO's option, repair of the non-conformity or termination of the affected subscription with a pro-rata refund of pre-paid fees for the unused portion of the term. Customer must notify UPTIVO in writing within thirty (30) days of becoming aware of the non-conformity; failure to do so waives the remedies under this Section. The thirty (30) day notification period under this Section is a substantive term specifically agreed by the parties and approved pursuant to Articles 1341 and 1342 of the Italian Civil Code.

9.3 DISCLAIMERS. EXCEPT FOR THE WARRANTIES IN SECTION 9.2, NO OTHER WARRANTIES ARE GIVEN, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE. THE SERVICES AND CONTENT ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. UPTIVO DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE OR FREE FROM HARMFUL COMPONENTS, AND, WITH REASONABLE NOTICE FOR MATERIAL CHANGES, MAY MODIFY THE SERVICES OR RESTRICT ACCESS, PROVIDED THAT NO MODIFICATION SHALL MATERIALLY DEGRADE THE FUNCTIONALITY OF A PURCHASED SERVICE DURING THE THEN-CURRENT TERM. UPTIVO DISCLAIMS, TO THE MAXIMUM EXTENT PERMITTED BY LAW, ALL WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AVAILABILITY, ACCURACY, RELIABILITY OR CONTENT OF THE SERVICES.

10. INDEMNIFICATION

10.1 By UPTIVO. UPTIVO shall defend Customer against any third-party claim alleging that the use of a Purchased Service in accordance with this Agreement infringes such third party's intellectual property rights (an "IP Claim"), and shall indemnify Customer for damages, attorneys' fees and costs finally awarded against Customer (or amounts paid under a settlement approved in writing by UPTIVO). The above does not apply where the claim arises from (a) Customer Data, Non-UPTIVO Applications or third-party content, (b) modification of the Services other than by UPTIVO, (c) use of the Services in combination with anything not provided by UPTIVO where the infringement would not have arisen but for such combination, or (d) use of the Services in violation of this Agreement or applicable law. If the Services become, or in UPTIVO's reasonable opinion are likely to become, the subject of an IP Claim, UPTIVO may, at its sole option and expense: (i) procure for Customer the right to continue using the affected Services; (ii) modify or replace the affected Services so that they no longer infringe, while retaining substantially equivalent functionality; or (iii) if neither (i) nor (ii) is commercially reasonable, terminate the affected subscription and refund any pre-paid fees for the unused portion of the term. The remedies set forth in this Section 10.1 constitute UPTIVO's sole and exclusive liability and Customer's exclusive remedy for any IP Claim.

10.2 By Customer. Customer shall defend UPTIVO and its Affiliates against any third-party claim arising from (a) Customer Data or its use with the Services in violation of this Agreement, (b) Non-UPTIVO Applications used by Customer, (c) Customer's or any User's use of the Services in violation of this Agreement, the Documentation or applicable law, (d) Customer's breach of Section 4.4 (Usage Restrictions), or (e) any claim by an End User or third party for personal injury, health-related damages, medical conditions, or wrongful death arising from or relating to use of the Services, including any reliance on the Services for health-related decisions in violation of Section 4.3, and shall indemnify UPTIVO accordingly.

10.3 Procedure. The indemnified party shall (a) promptly notify the indemnifying party in writing, (b) give the indemnifying party sole control of the defense and settlement (provided that no settlement requiring the indemnified party to admit liability or pay any amount may be made without that party's written consent), and (c) provide reasonable assistance at the indemnifying party's expense.

10.4 Sole Remedies. This Section states the indemnifying party's sole liability and the indemnified party's exclusive remedy with respect to any third-party claim covered hereunder.

11. LIMITATION OF LIABILITY

11.1 Liability Cap. EXCEPT AS SET OUT IN SECTION 11.3, EACH PARTY'S TOTAL CUMULATIVE LIABILITY (INCLUDING ITS AFFILIATES) UNDER OR IN CONNECTION WITH THIS AGREEMENT, WHETHER IN CONTRACT, TORT OR OTHERWISE, SHALL NOT EXCEED THE LESSER OF (I) THE AMOUNT PAID BY CUSTOMER FOR THE AFFECTED PURCHASED SERVICES IN THE TWELVE (12) MONTHS PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY, OR (II) FIVE THOUSAND EURO (€ 5,000). THIS CAP DOES NOT LIMIT CUSTOMER'S PAYMENT OBLIGATIONS UNDER SECTION 5.

11.2 Exclusion of Certain Damages. EXCEPT AS SET OUT IN SECTION 11.3, NEITHER PARTY (NOR ITS AFFILIATES) SHALL BE LIABLE FOR LOST PROFITS, LOST REVENUES, LOST GOODWILL, ANTICIPATED SAVINGS, OR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, EVEN IF ADVISED OF THE POSSIBILITY AND NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY.

11.3 Mandatory Carve-out. Nothing in this Agreement excludes or limits liability where exclusion or limitation is prohibited by mandatory law, including: (a) liability for willful misconduct (dolo) or gross negligence (colpa grave) under Article 1229 of the Italian Civil Code; (b) liability for death or personal injury caused by negligence; (c) liability under Italian Legislative Decree 206/2005 (Consumer Code) where applicable; (d) liability under Article 82 GDPR for damages resulting from infringement of Data Protection Laws; and (e) any other liability that cannot be excluded or limited under applicable law.

12. RISK ALLOCATION

The allocation of risk between the parties is exclusively governed by Section 11 (Limitation of Liability). UPTIVO does not undertake to procure or maintain insurance coverage for the benefit of Customer; Customer is responsible for procuring such insurance as it deems appropriate for its use of the Services.

13. TERM AND TERMINATION

13.1 Term. This Agreement starts on the Effective Date and continues until all subscriptions have expired or been terminated.

13.2 Subscription Terms. Subscription periods are defined in each Order Form. Renewal of monthly subscriptions is governed by Section 5.2(a). Annual subscriptions do not automatically renew, as set out in Section 5.2(b). Online Subscriptions have the term of the selected Plan and renew under Section 5.9.

13.3 Termination for Cause. A party may terminate this Agreement (a) upon thirty (30) days' written notice for material breach not cured within that period, or (b) immediately upon written notice if the other party becomes the subject of a bankruptcy, insolvency, receivership, liquidation or assignment for the benefit of creditors. For the purposes of this Section, "material breach" includes, without limitation: (i) failure by Customer to pay any undisputed amount due within thirty (30) days from a written reminder; (ii) breach of Section 4.4 (Usage Restrictions); (iii) breach of Section 7 (Confidentiality); (iv) breach of the DPA materially affecting Personal Data; (v) any unauthorized assignment in violation of Section 16.5; (vi) any conduct that brings the other party into material public disrepute or causes material damage to its reputation.

13.4 Effects of Termination. Upon termination, (a) all rights and licenses granted to Customer cease, (b) Customer shall pay all outstanding fees due through the effective date, and (c) the data export and deletion process under Section 8.3 applies.

13.5 Surviving Provisions. The following Sections survive termination or expiry: 1 (Definitions), 5.4-5.7 (for amounts due and any residual set-off), 5.10(e) and 5.11 (exclusion of refunds), 6 (Proprietary Rights, except for licenses to Customer that terminate), 7 (Confidentiality), 8.3 (Data Export and Deletion), 9.3 (Disclaimers), 10 (Indemnification), 11 (Limitation of Liability), 12 (Risk Allocation), 13.4-13.5, 15 (Notices), 16 (General Provisions) and 17 (Governing Law and Dispute Resolution), together with the DPA where applicable.

14. FORCE MAJEURE

14.1 Definition and Effect. Neither party shall be liable for any failure or delay in performance (other than payment obligations) caused by an event beyond its reasonable control, including acts of God, natural disasters, war, armed conflict, civil unrest, terrorism, epidemics, pandemics, acts of authority, embargoes, strikes (other than involving solely the affected party's personnel), failures of telecommunications or internet providers, electrical-grid failures, and cyber-attacks not caused by the affected party's negligence (a "Force Majeure Event"). The affected party shall use commercially reasonable efforts to mitigate and resume performance.

14.2 Notice and Termination. The affected party shall promptly notify the other. If the Force Majeure Event continues for more than sixty (60) consecutive days and prevents performance of a material obligation, the unaffected party may terminate this Agreement by written notice without further liability, except for amounts then due.

15. NOTICES

15.1 To UPTIVO. Legal notices to UPTIVO shall be sent by certified email (PEC) to euvic@legalmail.it or by registered mail with return receipt to UPTIVO's registered office. Email to info@uptivo.fit may be used solely for ordinary commercial communications (e.g. invoicing, support, renewal proposals) and shall not constitute valid legal notice under this Agreement.

15.2 To Customer. Legal notices to Customer shall be sent to the contact details on the Order Form, by PEC where available or by registered mail with return receipt. Email to the technical or billing contact specified by Customer may be used solely for ordinary commercial communications and shall not constitute valid legal notice under this Agreement.

15.3 Effectiveness. Notices are effective (a) on confirmation of receipt for PEC, or (b) five (5) business days after dispatch for registered mail with return receipt.

15.4 Modifications. Without prejudice to Section 15.6 for Online Subscriptions, UPTIVO may update this Agreement on at least thirty (30) days' prior written notice via the methods in this Section 15. Modifications affecting (i) fees, (ii) subscription term and renewal mechanics, (iii) limitation of liability, (iv) governing law, or (v) jurisdiction require Customer's express written consent and shall not take effect unilaterally. For other modifications, if Customer objects in writing to a material adverse change before its effective date, Customer may terminate the affected subscriptions without penalty by written notice, and UPTIVO will refund pre-paid fees for the unused portion of the term.

15.5 Notices Relating to Online Subscriptions.

(a) Notwithstanding Sections 15.1, 15.2 and 15.3, for Online Subscriptions all communications relating to the relationship (activation confirmation, Trial Period expiry reminder, renewal notices, price changes, modifications of the Agreement, receipts, failed payment notices, deactivation confirmations) are sent by UPTIVO to the Account Email and are valid and effective for all purposes of this Agreement.

(b) Customer shall keep the Account Email active, monitored and up to date from the Control Panel, and communications sent to it are deemed known to Customer when they reach that address, pursuant to Article 1335 of the Italian Civil Code.

(c) Customer sends UPTIVO communications relating to the Online Subscription, including deactivation under Section 5.10(b), from the Account Email to the addresses indicated in this Agreement or in the Control Panel, while disputes, termination for cause and any other legal notice remain subject to Section 15.1.

(d) Electronic Acceptance. Customer accepts this Agreement electronically at the time of online subscription, by ticking the box accepting the Agreement and, separately, the box specifically approving the clauses listed at the end of this document; UPTIVO records and retains the date, time, edition of the document accepted and account identifier, and that record constitutes evidence of acceptance, Customer being entitled to obtain a copy of the accepted edition from the Control Panel or by writing to the address in Section 5.10(b). Each edition of the Agreement is published at a permanent address communicated in the subscription screen and in the activation confirmation email; the edition accepted by Customer remains available at that address for the entire duration of the relationship.

15.6 Modifications of the Agreement for Online Subscriptions.

(a) Notwithstanding Section 15.4, for Online Subscriptions UPTIVO may modify this Agreement by notifying the modifications and the new version of the document to the Account Email at least thirty (30) days before the effective date indicated in the notice.

(b) Modifications affecting price, term or renewal apply from the first renewal following the effective date, while other modifications apply from the effective date, and no modification applies to Customer's detriment to a period already paid.

(c) If Customer does not accept the modifications, it may deactivate the Online Subscription before the effective date under Section 5.10, without penalty, while continued use of the Services after the effective date constitutes acceptance of the modifications.

(d) Modifications required by law or by an order of a competent authority may take effect immediately, upon notice to the Account Email.

16. GENERAL PROVISIONS

16.1 Export Compliance. The parties shall comply with applicable export laws and shall not use the Services in embargoed regions or in violation of export regulations.

16.2 Entire Agreement; Order of Precedence. This Agreement, together with the DPA (Annex A) and any Order Forms, constitutes the entire agreement between the parties on the subject matter, superseding all prior or contemporaneous agreements. In case of conflict, the order of precedence is (1) the applicable Order Form, (2) the DPA (with respect to Personal Data), (3) this Agreement, (4) the Documentation. Section titles do not affect interpretation.

16.3 Independent Parties; No Third-Party Beneficiaries; Waiver. The parties are independent entities; this Agreement does not create any partnership, joint venture, agency or employment relationship. No third party benefits from this Agreement. Rights are not waived by delayed enforcement.

16.4 Severability. If any provision is held illegal or unenforceable, the remaining provisions remain in full force and effect.

16.5 Assignment. Neither party may assign its rights or obligations without the other party's prior written consent, except in connection with a merger, acquisition, corporate reorganization or sale of all or substantially all of its assets, provided the assignee is not, as reasonably determined by the non-assigning party in good faith, a direct competitor of the non-assigning party. The non-assigning party shall communicate any objection in writing within fifteen (15) days of receiving notice of the proposed assignment.

16.6 Governing Language. This Agreement is executed in Italian, English, French and Spanish for the convenience of the parties. The version corresponding to the language in which the Customer executed the Agreement shall be the binding version for that Customer. In case of doubt as to which version was executed, the Italian version shall prevail.

16.7 Anti-Bribery and Corruption. Each party represents and warrants that it has not, and covenants that it shall not, in connection with this Agreement, directly or indirectly offer, promise, give, request, agree to receive or accept any undue advantage, financial or otherwise, in violation of applicable anti-corruption laws, including Italian Legislative Decree 231/2001, the U.S. Foreign Corrupt Practices Act (FCPA), and the UK Bribery Act 2010. Each party shall maintain adequate internal procedures designed to prevent bribery and corruption. Breach of this Section shall constitute material breach entitling the other party to terminate this Agreement immediately under Section 13.3, without prejudice to any further remedy.

16.8 Non-Disparagement. During the term of this Agreement and for twelve (12) months following its termination, neither party shall make, publish or cause to be published any statement, communication or content (including on social media, review platforms or in press communications) that disparages, denigrates or damages the reputation of the other party, its products, services, officers or employees. This Section does not restrict good-faith statements made in the context of legal proceedings, regulatory investigations, or truthful responses to direct factual inquiries.

17. GOVERNING LAW AND DISPUTE RESOLUTION

17.1 Governing Law. This Agreement is governed by and construed in accordance with the laws of Italy, without regard to its conflict-of-laws provisions.

17.2 Arbitration. Any dispute arising out of or in connection with this Agreement, including any question regarding its existence, validity or termination, where the amount in controversy exceeds fifty thousand Euro (€ 50,000), shall be finally settled by arbitration under the Rules of the Milan Chamber of Arbitration (Camera Arbitrale di Milano) by a sole arbitrator appointed in accordance with said Rules. The seat of arbitration shall be Milan, Italy. The language of the arbitration shall be Italian, unless the parties agree in writing to conduct it in another language. For disputes where the amount in controversy does not exceed fifty thousand Euro (€ 50,000), the exclusive jurisdiction shall be the Court of Milan (Tribunale di Milano). This Section does not prejudice the right of either party to seek interim or injunctive relief from any competent court, nor any mandatory consumer-protection forum where applicable.

SPECIFIC APPROVAL OF CLAUSES PURSUANT TO ARTICLES 1341 AND 1342 OF THE ITALIAN CIVIL CODE

Customer expressly declares to have read, understood and specifically approves the following clauses of this Agreement, pursuant to Articles 1341 and 1342 of the Italian Civil Code:

• Section 3.2 (Service Credits as exclusive remedy)

• Section 3.5 (Third-Party Service Failures)

• Section 5.1 (Fees: non-cancellable, non-refundable nature of fees)

• Section 5.2(a) (Auto-Renewal of Monthly Subscriptions and renewal price changes with right of non-renewal)

• Section 5.5 (Suspension)

• Section 5.7 (Set-off restrictions)

• Section 5.8 (Automatic conversion of the Trial Period into a paid subscription)

• Section 5.9 (Automatic renewal of Online Subscriptions, monthly and annual, and renewal price)

• Section 5.10 (Deactivation: effects and exclusion of refunds)

• Section 5.11 (Nature of the fee: exclusion of refunds, reductions and extensions for non-use)

• Section 9.2 (Warranty notification period and remedy limitation)

• Section 9.3 (Disclaimers)

• Section 10.1 (IP Indemnification: sole remedy)

• Section 10.2 (Indemnification by Customer, including End User personal injury claims)

• Section 11.1 (Limitation of Liability)

• Section 11.2 (Exclusion of Certain Damages)

• Section 13.3 (Termination for Cause)

• Section 15.4 (Modifications)

• Section 15.5 (Notices to the Account Email: presumption of knowledge and evidentiary value of the acceptance record)

• Section 15.6 (Modifications of the Agreement for Online Subscriptions)

• Section 16.5 (Assignment)

• Section 16.8 (Non-Disparagement)

• Section 17 (Governing Law and Dispute Resolution , including the arbitration clause pursuant to Article 808 of the Italian Code of Civil Procedure)

Specific Approval Signature. By signing below, Customer specifically and separately approves the clauses listed above pursuant to Articles 1341 and 1342 of the Italian Civil Code.

ANNEX A · DATA PROCESSING AGREEMENT

A.1 Preamble. This Data Processing Agreement (the "DPA") forms an integral part of the Service Agreement (the "Agreement") entered into between UPTIVO and the Customer. Capitalized terms used but not defined in this DPA have the meanings given to them in the Agreement. This DPA is entered into pursuant to Article 28 of Regulation (EU) 2016/679 ("GDPR") and applies to the Processing of Personal Data carried out by UPTIVO on behalf of the Customer in connection with the Services.

A.2 Definitions. "Personal Data", "Processing", "Controller", "Processor", "Sub-processor", "Personal Data Breach" and "Supervisory Authority" have the meanings given in the GDPR. "SCCs" means the Standard Contractual Clauses for the transfer of personal data to third countries adopted by EU Commission Implementing Decision (EU) 2021/914.

A.3 Roles of the Parties. With respect to the Processing of Personal Data within Customer Data, the Customer acts as Controller and UPTIVO acts as Processor. The Customer is responsible for the lawfulness of the Processing and for the lawful basis under Article 6 GDPR (and, where applicable, Article 9 GDPR).

A.4 Subject-matter and Duration. The subject-matter of the Processing is the provision of the Services by UPTIVO to the Customer. The duration of the Processing corresponds to the term of the Agreement, plus the data export window set out in Section 8.3 of the Agreement, plus any retention period required by applicable law. Within the term of the Agreement, UPTIVO applies the following operational retention limits, consistent with the principle of storage limitation under Article 5(1)(e) GDPR: (a) data of pending or unconfirmed user registrations and unaccepted invitation links: fifteen (15) days; (b) device or application registration requests: seven (7) days; (c) in-app notifications: sixty (60) days; (d) diagnostic, error and Application Insights logs: two (2) months. UPTIVO may update these operational limits from time to time, provided that any update remains consistent with this DPA and applicable law.

A.5 Nature and Purpose of Processing. UPTIVO Processes Personal Data for the following purposes: (a) provision and operation of the Services, including hosting, storage and transmission; (b) heart rate monitoring, fitness tracking and performance analysis; (c) AI-based features and recommendations; (d) account management and authentication; (e) Customer support; (f) security, fraud prevention and audit logging; (g) billing and invoicing; (h) compliance with legal obligations applicable to UPTIVO.

A.6 Categories of Personal Data. (a) identification and contact data (name, surname, nickname, profile image, email address, telephone number, mailing address, tax identifier where required for billing); (b) account credentials (UserId, username, hashed and salted password, JWT authentication tokens, API keys, OAuth device identifiers); (c) demographic and profile data (date of birth, gender, language, country, time zone, occupation); (d) fitness profile and preferences (weight, height, training goals, injury history, activities to avoid, weekly availability, notification, ranking and calendar preferences); (e) club and subscription data (club affiliation, role (athlete or staff), licenses, credits, class bookings); (f) device and sensor data (hardware identifier, device model, sensor name, paired bridge devices and SNAP, application identifiers); (g) external account integrations (connection identifiers and OAuth access tokens for third-party services such as Garmin Connect, Stripe, PayPal, Whoop and Withings); (h) heart-rate and biometric metrics (heart-rate values including minimum, maximum, average and resting; heart-rate zones; target thresholds; heart-rate variability (HRV); SpO2; body mass index (BMI); functional threshold power (FTP) for cycling); (i) training and performance telemetry (date and time, duration, distance, calories, power, cadence, hits, geolocation and position, altitude, elevation gain); (j) integrated health data from third-party providers (steps, stress, body battery, sleep stages, respiration, training plans); (k) clinical and body-measurement data where provided by the Customer or the data subject (blood pressure, blood glucose, body composition such as InBody, fitness test results); (l) Nate AI-generated feedback derived from profile, sleep and HRV data, used to provide performance evaluations; (m) usage and technical data (login records, IP address, session timestamps, device identifiers, User Agent, diagnostic logs and Application Insights metrics); (n) communications (support requests and related correspondence); (o) payment-related identifiers handled by the payment processor (UPTIVO does not store full payment card data). The categories at (h), (i), (j), (k) and (l) include data concerning health within the meaning of Article 4(15) GDPR and constitute special categories of personal data under Article 9 GDPR; the Customer, as Controller, is responsible for ensuring that an appropriate Article 9(2) GDPR derogation applies to its processing.

A.7 Categories of Data Subjects. (a) the Customer's owners, directors, employees, administrators and authorized representatives; (b) the Customer's End Users, including gym members, training participants and any other natural persons enrolled in programs operated by the Customer; (c) trainers and instructors operating under the Customer; (d) any other natural persons authorized by the Customer to access the Services.

A.8 Processor Obligations. UPTIVO shall: (a) Process Personal Data only on documented instructions of the Controller, including with regard to international transfers, except where required by EU or Member State law applicable to UPTIVO; in such case UPTIVO shall inform the Controller before such Processing unless prohibited by law on important grounds of public interest; (b) ensure that persons authorized to Process Personal Data are bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality; (c) implement the technical and organizational measures set out in Annex 2, in accordance with Article 32 GDPR; (d) only engage Sub-processors in accordance with Section A.9; (e) taking into account the nature of the Processing, assist the Controller by appropriate technical and organizational measures, insofar as possible, to fulfil the Controller's obligation to respond to data subject requests under Chapter III GDPR; (f) assist the Controller in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, DPIA and prior consultation), taking into account the nature of Processing and the information available to UPTIVO; (g) at the Controller's choice, delete or return all Personal Data after the end of the provision of Services, in accordance with Section 8.3 of the Agreement, and delete existing copies, unless EU or Member State law requires storage of the Personal Data; (h) make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits in accordance with Section A.10.

A.9 Sub-processors. The Customer hereby grants UPTIVO general written authorization to engage Sub-processors. The list of currently engaged Sub-processors is set out in Annex 1. UPTIVO shall: (a) ensure that any Sub-processor is bound by data protection obligations no less protective than those of this DPA, set out in writing; (b) remain fully liable to the Controller for the performance of the Sub-processor's obligations; (c) notify the Customer of any intended addition or replacement of Sub-processors with at least thirty (30) days prior notice, by email to the Customer's billing contact or via UPTIVO's website. The Customer may object on legitimate grounds within fifteen (15) days of notice; if the parties cannot agree on a solution within thirty (30) days, either party may terminate the affected Services with a pro-rata refund of pre-paid fees for the unused portion.

A.10 Audits. UPTIVO shall make available to the Controller, on a confidential basis and no more than once per calendar year, its then-current SOC 2 Type II report, ISO 27001 certification or equivalent third-party audit reports sufficient to demonstrate UPTIVO's compliance with this DPA. On-site audits shall only be permitted following a confirmed Personal Data Breach materially affecting Customer's Personal Data, subject to reasonable security and confidentiality requirements, with at least thirty (30) days' prior written notice and at the Controller's expense.

A.11 Personal Data Breach. UPTIVO shall notify the Customer without undue delay, and in any event no later than forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Customer's Personal Data. The notification shall, to the extent feasible, contain the information set out in Article 33(3) GDPR and shall be supplemented in phases as further information becomes available. The notification shall be sent by PEC or email to the Customer's data protection contact specified in the Order Form.

A.12 Data Subject Rights. UPTIVO shall, taking into account the nature of the Processing and insofar as possible, assist the Controller by appropriate technical and organizational measures in fulfilling the Controller's obligation to respond to requests for the exercise of data subjects' rights under Chapter III GDPR. If a data subject contacts UPTIVO directly, UPTIVO shall promptly forward such request to the Customer and shall not respond to the data subject except as instructed by the Customer or as required by law.

A.13 International Transfers. UPTIVO Processes Personal Data within the European Economic Area (EEA), with primary storage on servers located in the Netherlands, Ireland and Germany. Where Personal Data is transferred outside the EEA in connection with the Services (in particular through Sub-processors located outside the EEA, as identified in Annex 1), UPTIVO shall ensure that an appropriate transfer mechanism is in place pursuant to Articles 44-49 GDPR, namely: (a) the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where the recipient is a certified participant; or (b) the Standard Contractual Clauses adopted by EU Commission Implementing Decision (EU) 2021/914 where the EU-US Data Privacy Framework is not available; supplemented in each case by appropriate technical and organizational measures.

A.14 Liability. The liability of each party under or in connection with this DPA is governed by Section 11 of the Agreement (Limitation of Liability), with the mandatory carve-outs set out in Section 11.3 of the Agreement.

A.15 Order of Precedence. In case of conflict between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA shall prevail.

A.16 Term and Survival. This DPA is effective on the same date as the Agreement and remains in force for the duration of the Agreement and for any subsequent retention obligation under applicable law. Sections A.8(g), A.10, A.11, A.12, A.13, A.14 and A.15 survive termination of the Agreement.

ANNEX 1 · LIST OF SUB-PROCESSORS

UPTIVO engages the following Sub-processors to Process Personal Data on behalf of the Customer in connection with the Services. UPTIVO will keep this list up to date and will notify the Customer of additions or replacements in accordance with Section A.9.

ANNEX 2 · TECHNICAL AND ORGANIZATIONAL MEASURES

UPTIVO has implemented and maintains the following technical and organizational measures, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons (Article 32 GDPR).

Pseudonymization and encryption. Encryption of Personal Data in transit using TLS 1.2 or higher; encryption at rest using AES-256 or equivalent; hashed and salted authentication credentials.

Confidentiality, integrity, availability and resilience. Role-based access control and principle of least privilege; multi-factor authentication for administrative and privileged access; network segregation and firewall controls; regular operating-system and application updates.

Restoration of availability. Automated regular backups with off-site replication; documented disaster recovery and business continuity procedures; periodic restore testing.

Process for testing and evaluating. Vulnerability monitoring of dependencies; security review of changes to production systems; logging and monitoring of relevant security events; periodic review of access rights.

Personnel measures. Confidentiality undertakings for personnel with access to Personal Data; awareness on data protection and information security; need-to-know access principle.

Sub-processor management. Selection of Sub-processors on the basis of guarantees of compliance with the GDPR; written data protection commitments imposed on Sub-processors; periodic review of Sub-processor compliance.

Incident response. Documented incident response process; defined roles and escalation paths; post-incident review and remediation.

Physical security (where applicable). Personal Data is processed in third-party data centers operated by the Sub-processors listed in Annex 1, which maintain physical security measures consistent with industry standards (ISO 27001 / SOC 2 or equivalent).

ACCEPTANCE OF THE DPA

By executing the Service Agreement to which this DPA is annexed, the Customer expressly accepts the terms of this DPA. The digital signature applied to the Agreement extends to and binds the Customer with respect to this DPA.