Legal

Licenseware Technology Services S.R.L.
B2B Agreement — Governed by the Laws of Romania (EU Member State)

PLEASE READ THIS LICENCE CAREFULLY. BY PURCHASING, COPYING, INSTALLING, OR USING ALL OR ANY PORTION OF THIS SOFTWARE, YOU ACCEPT ALL THE TERMS AND CONDITIONS OF THIS LICENCE. IF YOU DO NOT AGREE TO THE TERMS OF THIS LICENCE, YOU MAY NOT USE THE SOFTWARE.

This Licence Agreement (Licence) is a legal agreement between you (Licensee) and Licenseware Technology Services S.R.L., incorporated and registered in Romania with company number J2021000238215, VAT no RO42866470, whose registered office is at Afi Park 1, Bdul Vasile Milea 4 E, Bucharest, Romania (Licensor) for the Apps described in the applicable Order Form and associated Documentation.

We, or an authorised Reseller, licence use of the Apps and Documentation to you on the terms set out herein. This Licence is a B2B agreement entered into between entities acting in the course of their business. This is not a consumer contract.

You acknowledge that we may update the terms and conditions of this Licence from time to time and that it is your responsibility to check any updates.

---

Agreed Terms

1. Provision of the Services

1.1 Licensor will provide the Apps materially in accordance with this Licence and the Documentation.

2. Grant and Scope of Licence

2.1 Subject to Licensee's continuous compliance with this Licence and payment of the applicable Licence Fee, Licensor grants Licensee a non-exclusive, non-transferable, revocable and limited licence to install (where applicable) and use the Apps in the Territory during the Licence Term for its own internal business purposes.

2.2 Licensor reserves the right at any time to make any improvement, substitution or modification in the design or configuration of the Apps provided that such change shall not result in any material change in the functionality or performance of the Apps.

2.3 The Licensee may, subject to prior written consent, perform any of its obligations or exercise any of its rights under this Licence through any affiliate, provided that: (a) any act or omission of such person shall be deemed to be the act or omission of the Licensee; (b) performance shall be solely for the business purposes of the Licensee and its Declared Affiliates; and (c) any claim from an affiliate shall be brought through the Licensee and liability caps shall apply in aggregate.

2.4 Where third party suppliers are required to interface with the Apps, Licensor shall at the Licensee's request and expense co-operate with such suppliers.

2.5 The Licensee shall: (a) provide to Licensor the details of the Licensee authorised contact and notify Licensor in writing of any change; (b) take all necessary steps to ensure that its employees, agents and subcontractors abide by the terms of this Licence; (c) comply with the Documentation; and (d) inform Licensor as soon as possible about any change of location.

3. Apps Restrictions

3.1 Except as expressly set out in this Licence or as permitted by any local law, you undertake not to: (a) make copies of the Apps or Documentation except as reasonably necessary for back-up or disaster recovery; (b) rent, lease, sell, sublicense, assign or transfer your rights in the Apps; (c) disassemble, decompile, reverse-engineer or create derivative works based on the Apps except to the extent essential for inter-operability; (d) modify, port, adapt, or translate the Apps; (e) allow any Designated User login to be used by more than one individual; or (f) fail to comply with all applicable technology control or export laws and regulations.

3.2 You may: (a) use the Apps for your internal business purposes only; (b) receive and use free Updates as provided by us from time to time; and (c) use Documentation in support of the permitted use.

4. Intellectual Property Rights

4.1 All Intellectual Property Rights in the Apps and Documentation throughout the world belong to us. Rights in the Apps are licensed (not sold) to you. You have no Intellectual Property Rights in the Apps other than the right to use them in accordance with this Licence.

4.2 You acknowledge that you have no right to access the Apps in source code form.

4.3 The Licensor shall defend and indemnify the Licensee against all damages finally awarded against the Licensee in connection with any third-party IPR Claim. The maximum aggregated liability for such indemnification shall not exceed €1,000,000 (one million euros) and shall count towards the overall cap in Clause 8.3.

4.4 If an IPR Claim is brought or is likely to be made, the Licensor may at its own expense ensure the Licensee is still able to use the Licence by either: (a) modifying the provisions of the Licence so as to avoid the infringement without reducing performance and functionality; or (b) procuring a licence or permission to use the Licence on acceptable terms.

4.5 The Licensee shall promptly notify the Licensor if any IPR Claim or demand is made against the Licensee.

4.6 The Licensee shall fully indemnify the Licensor from any claims arising because the Licensee or its end users modify, alter, or combine the Apps with other software or data in a way that infringes third-party intellectual property rights. This indemnity survives termination.

5. Confidentiality

5.1 Each party agrees to treat all Confidential Information disclosed to it by the other party as strictly confidential and to use it solely for the purposes of this Licence. Neither party shall disclose Confidential Information to any third party without the prior consent of the disclosing party.

5.2 Each party may disclose Confidential Information to its employees, agents, sub-contractors and professional advisers who need to know such information for the purposes of this Licence, provided such persons are bound by equivalent confidentiality obligations.

5.3 Confidentiality obligations shall not apply to information which: (a) is publicly known other than through breach of this Licence; (b) was rightfully in the receiving party's possession prior to disclosure; (c) is required to be disclosed by law; or (d) was independently developed by the receiving party.

5.4 Confidentiality obligations survive termination for five (5) years, except for trade secrets which remain confidential for as long as they constitute trade secrets under applicable law.

6. Limited Warranty

6.1 Licensor warrants that: (a) it has all necessary rights and authority to grant the licences herein; and (b) the Apps, when used in accordance with their documentation and this Licence, will materially conform to the functionality described in their specifications.

6.2 Except as expressly provided in this Licence, all Apps are provided "as is". To the maximum extent permitted by applicable law, Licensor disclaims any implied warranties of non-infringement, merchantability or fitness for a particular purpose.

6.3 The Apps are not designed or intended for high-risk use scenarios where failure could reasonably lead to death, serious bodily injury, or severe damage to property or the environment.

7. Support

7.1 Support is provided as set out in Exhibit A to this Licence. Current support terms are available at https://licenseware.io/legal. Current apps are listed at https://licenseware.io/apps/.

8. Limitation of Liability

8.1 To the maximum extent permitted by applicable law, neither party shall be liable to the other for any indirect or consequential damages, including lost revenues, lost profits, business interruption, or loss of business information or data.

8.2 Neither party shall be liable for any delay or default caused by conditions beyond its reasonable control, including any Force Majeure event.

8.3 Licensor's total aggregate liability under or in connection with this Licence shall not exceed the total Licence Fees paid by the Licensee in the twelve (12) month period immediately preceding the event giving rise to the claim.

8.4 The limitations in Clauses 8.1 and 8.3 shall not apply to: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) any liability that cannot be excluded under applicable mandatory law; or (d) the IPR indemnity cap in Clause 4.3.

9. Data Processing

9.1 To the extent that Licensor processes personal data on behalf of Licensee in connection with this Licence, such processing is governed by the Licenseware Data Processing Addendum, available at https://licenseware.io/legal/#data-protection-agreement, which is incorporated into this Licence by reference.

9.2 Licensee acknowledges that Licensor processes personal data as described in the Data Processing Addendum, including the categories set out in Schedule 2, using the sub-processors set out in the Subprocessor List.

9.3 In the event of a personal data breach affecting Licensee's data, Licensor shall notify Licensee without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach.

9.4 Licensor shall assist Licensee in fulfilling its obligations under applicable data protection law, including in connection with data subject rights requests, Article 32 security measures, data protection impact assessments, and prior consultation with supervisory authorities. Full details are set out in the Data Processing Addendum.

10. Miscellaneous

10.1 Force Majeure. Licensor shall not be liable for any delay or failure to perform its obligations due to any cause beyond its reasonable control, including acts of God, war, terrorism, fire, flood, epidemic, pandemic, or communication failures.

10.2 Notices. All notices shall be in writing. Email is agreed as a valid means of formal notice. Notice is deemed given: (a) on the date sent by email, provided no automated delivery failure is received within 24 hours; (b) on the date of personal delivery; (c) three (3) calendar days after deposit in certified mail; or (d) one (1) calendar day after delivery to a recognised overnight courier. Notices to Licensor: [email protected] and [email protected].

10.3 Amendments. This Licence may be amended only by a document in writing signed by both parties.

10.4 Severability. If any provision of this Licence is held invalid or unenforceable, the remainder shall continue in full force and effect to the fullest extent allowed by law.

10.5 Governing law and jurisdiction. This Licence and any dispute or claim arising out of or in connection with it shall be governed by the laws of Romania, as an EU member state. Each party irrevocably submits to the exclusive jurisdiction of the Romanian courts. The parties confirm that they are each acting in the course of their business and that this Licence is not a consumer contract.

---

Definitions and Interpretation

Term	Definition
Applicable Data Protection Legislation	(a) To the extent the UK GDPR applies, the law of the United Kingdom. (b) To the extent the EU GDPR applies, the law of the European Union or any member state to which Licensor or Licensee is subject.
Business Day	A day other than a Saturday, Sunday or public holiday in Romania when banks in Bucharest are open for business.
Declared Affiliates	The affiliates of the Licensee set out in the Order Form.
Designated User	Any user of the Apps named to the Licensor as a user by the Licensee.
EU GDPR	The General Data Protection Regulation ((EU) 2016/679) as it has effect in EU law.
Force Majeure	Any cause beyond the reasonable control of the affected party including acts of God, war, terrorism, fire, flood, epidemic, pandemic, and communication failures.
Intellectual Property Rights	All patents, rights to inventions, copyright, moral rights, trade-marks, business names, domain names, rights in designs, rights in computer software, database rights, and all other intellectual property rights, whether registered or unregistered, throughout the world.
Licence Fee	The fee for the Apps as set out in the Order Form.
Licence Term	The First Year, automatically renewing for successive 12-month periods (each a Renewal Term) unless terminated in accordance with this Licence.
Order Form	The order form, statement of work or set-up form setting out the number of licences, the Licence Fee, commencement date, and other relevant details.
Reseller	An authorised reseller of the Licensor.
Territory	As set out in the Order Form.
UK GDPR	Has the meaning given in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.
Updates	All updates, upgrades, bug fixes, error corrections, enhancements and other modifications to the Apps.

Schedule 2: Particulars of Data Processing

Category	Details
Types of personal data	Identity and directory data (names, usernames, email addresses, job titles, organisational roles, account identifiers); device and endpoint data (device names, hardware identifiers, OS, compliance/ownership attributes); software installation and usage data; licence and entitlement data; SaaS and cloud application usage data; authentication and access data; business contact information.
Special categories	None.
Purpose	To provide the Apps in accordance with this Licence.
Nature	Storage and processing of Personal Data as necessary to provide the Apps.
Duration	For the duration of the Licence.
Further details	https://licenseware.io/legal/#data-protection-agreement

Schedule 3: Sub-Processor Register

The sub-processors engaged by Licensor are set out in the Subprocessor List published at https://licenseware.io/legal/#sub-processor-list, which forms part of the Data Processing Addendum.

All other platform components are self-hosted within Licenseware's own managed Kubernetes clusters on the infrastructure providers above and do not constitute independent sub-processors. The authoritative register is maintained at https://licenseware.io/legal/#data-protection-agreement.

Exhibit A: Support Agreement

1. Severity Definitions

P1 — Critical. Complete service outage or severe functionality loss impacting all users.

P2 — High. Major functionality issue with significant business impact.

P3 — Medium. Partial, non-critical loss of functionality; manageable impact.

P4 — Low. Cosmetic issue, minor inconvenience, or feature request.

P5 — Informational. General questions, guidance requests, or clarifications with no direct service impact.

2. Scope

Included: The production Licenseware SaaS platform, Licenseware apps, and documented features. Current apps: https://licenseware.io/apps/.

Excluded: Non-production environments, undocumented or custom features, customer infrastructure, unsupported third-party tools, and preview/beta features.

3. Channels and Hours

Email: [email protected]  |  Ticketing: https://help.licenseware.io/raise-a-ticket  |  Hours: 09:00–18:00 UK time, Monday–Friday.

4. Severity Targets

Severity	Response Target	Resolution Target
P1 — Critical	Within 1 hour	Best effort within 4 hours
P2 — High	Within 1 business day	Within 5 business days
P3 — Medium	Within 1 business day	Up to 2 weeks
P4 — Low	Within 1 business day	Addressed in upcoming releases
P5 — Informational	As soon as reasonably possible	Not applicable

Exhibit B: Service Level Agreement

Uptime Commitment: Licenseware targets 99.9% monthly uptime for the production service.

Measurement: Availability is measured per hour in the production environment at the service boundary; compiled monthly.

Scheduled Maintenance: Excluded from uptime where Licenseware provides a minimum of 48 hours' notice.

QBRs: SLA performance may be reviewed during Quarterly Business Reviews and adjusted by mutual agreement.

This Data Processing Addendum (“DPA”) forms part of the agreement between Licenseware Technology Services S.R.L. (“Licenseware”, “Processor”) and the Customer or Partner named in the applicable Order Form or agreement (“Controller”). It applies wherever Licenseware processes personal data on behalf of the Controller in connection with the provision of Licenseware Products and services. For MSP Partners, additional provisions in Section 9 apply to reflect the controller → processor → sub-processor chain.

Capitalised terms not defined herein have the meanings given in the applicable Licenseware agreement (EULA, Reseller Agreement, Appendix 1G, or other).

Definitions

Term	Definition
Applicable Data Protection Law	(a) The EU General Data Protection Regulation (EU) 2016/679 (“EU GDPR”); (b) the UK GDPR as defined in section 3(10) of the Data Protection Act 2018; (c) Romanian Law no. 190/2018 on measures for the implementation of the EU GDPR; and (d) any other applicable data protection legislation in force from time to time.
Personal Data	Has the meaning given in Applicable Data Protection Law.
Processing	Has the meaning given in Applicable Data Protection Law.
Data Subject	Has the meaning given in Applicable Data Protection Law.
Personal Data Breach	Has the meaning given in Applicable Data Protection Law.
Sub-Processor	Any third party engaged by Licenseware to process Personal Data on behalf of the Controller.
Standard Contractual Clauses (SCCs)	The standard contractual clauses for the transfer of personal data to third countries as adopted by the European Commission from time to time.
Regional Instance	A geographically isolated deployment of the Licenseware platform, currently: EU Instance (Netherlands); US Instance (United States); AU Instance (Sydney, Australia).

1. Scope and Nature of Processing

1.1 Licenseware processes Personal Data on behalf of the Controller solely to the extent necessary to provide the Licenseware Products and services in accordance with the applicable agreement.

1.2 Licenseware acts as a data processor with respect to Personal Data processed on behalf of the Controller. The Controller is the data controller and is responsible for the lawfulness of the processing, including obtaining any necessary consents or establishing any other valid legal basis for processing.

1.3 The subject matter, nature, purpose and duration of processing, the types of Personal Data processed, and the categories of Data Subjects are set out in Schedule 1 to this DPA.

1.4 Licenseware shall process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law. Licenseware shall inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law, before carrying out the instruction. Licenseware may suspend the execution of such instruction until the Controller confirms, amends or withdraws it in writing.

2. The Parties' obligations

2.1 The Controller:

• warrants that it has a valid legal basis for processing Personal Data and for instructing Licenseware to process Personal Data on its behalf;
• is responsible for ensuring that Data Subjects have been informed of the processing of their Personal Data by Licenseware as processor/sub-processor, to the extent required by Applicable Data Protection Law;
• shall not instruct Licenseware to process Personal Data in a manner that would cause Licenseware to breach Applicable Data Protection Law.

2.2 Licenseware shall:

• process Personal Data only on the Controller's documented instructions in order to perform the contractual services and for no other purpose;
• ensure that all persons authorised to process Personal Data are subject to appropriate confidentiality obligations;
• implement and maintain appropriate technical and organisational security measures in accordance with Schedule 2;
• assist the Controller in fulfilling its obligations under Applicable Data Protection Law as set out in this DPA;
• delete or return all Personal Data to the Controller on termination of the applicable agreement, in accordance with this DPA;
• make available to the Controller all information necessary to demonstrate compliance with this DPA and cooperate with audits and inspections in accordance with this DPA.

3. Sub-Processors

3.1 General authorisation. The Controller grants the Processor general written authorisation, for the purposes of Article 28 (2) GDPR, to engage subprocessors to process Personal Data in connection with the Services, subject to this clause. The subprocessors authorised as at the date of this Agreement are those initially set out in the list maintained by the Processor at https://licenseware.io/legal/#sub-processor-list (the “Subprocessor List”).

3.2 Subprocessor List. The Processor shall keep the Subprocessor List complete, accurate and up to date at all times. For each subprocessor, the Subprocessor List shall state its legal name, processing location(s), a description of the processing entrusted to it and, where applicable, the basis and safeguards relied upon for any transfer of Personal Data outside the EEA. The Processor shall provide any further information reasonably required by the Controller to assess the subprocessor’s guarantees and the proposed processing.

3.3 Notice of changes. The Processor shall proactively notify the Controller in writing of any intended addition or replacement of a subprocessor at least five (5) calendar days before that subprocessor begins processing Personal Data. The notice shall identify the proposed new Subprocessor List and include, or provide a direct means of accessing such Subprocessor List.

3.4 Right to object. The Controller may object in writing, within five (5) calendar days after notice is received, to the intended addition or replacement on reasonable data-protection grounds, including where the proposed subprocessor does not provide sufficient guarantees under Article 28 (1) GDPR. The objection shall state the relevant legal and technical grounds in reasonable detail. The Parties shall cooperate in good faith to resolve the objection in 30 days, including by agreeing reasonable safeguards or an alternative subprocessor. If the Controller does not object within the notice period, the proposed change shall be deemed authorised.

4. International Data Transfers

4.1 Regional instance isolation. Customer data is processed exclusively within the Regional Instance selected by the Controller. No Personal Data is transferred between Regional Instances. Each Regional Instance is isolated at VPC, cluster, and storage level.

4.2 EU Regional Instance. Where the Controller accesses the EU Regional Instance (Netherlands), Personal Data is processed within the European Union, across Licenseware's Google Cloud (Eemshaven) and Microsoft Azure (West Europe) infrastructure, and is not subject to cross-border transfer for the purposes of Chapter V of the EU GDPR.

4.3 US and AU Regional Instances. Where the Controller accesses the US Regional Instance (United States) or AU Regional Instance (Sydney, Australia), Personal Data is processed within the United States or Australia respectively. Such processing is governed by the Data Processing Addendums of Google Cloud Platform and Microsoft Azure, each of which incorporates Standard Contractual Clauses or equivalent transfer mechanisms as applicable.

4.4 Multi-instance. Where a Controller simultaneously accesses more than one Regional Instance, the data residency and transfer position for each instance is as set out in Clauses 4.2 and 4.3 above.

4.5 Transfer safeguards. Where the processing involves a transfer of Personal Data from the EEA to a country outside the EEA, Licenseware shall ensure that the transfer is covered by:
(a) an adequacy decision of the European Commission, including, for recipients in the United States certified under it, the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795); or
(b) where no adequacy decision applies (including, as at the date of this DPA, for the AU Regional Instance), the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Three (processor to processor). These are concluded by Licenseware with the relevant Sub-Processor or, where the transfer takes place within that Sub-Processor's own processing chain, by that Sub-Processor with its onward sub-processor.

4.6 Before relying on the Standard Contractual Clauses, Licenseware shall carry out and document a transfer impact assessment and implement any supplementary measures it identifies. Licenseware shall provide the Controller with a summary of such assessment on request.

4.7 Controllers established outside the EEA. Where the Controller is established in a country outside the EEA that is not covered by an adequacy decision, and is not a recipient certified under the EU-US Data Privacy Framework, the Standard Contractual Clauses, Module Four (processor to controller), apply to the transfer of Personal Data by Licenseware to the Controller through the Licenseware Products. They are incorporated into this DPA by reference, as follows:
(a) Clause 7 (docking clause) applies;
(b) the optional language in Clause 11(a) does not apply;
(c) Clauses 17 and 18: the law and the courts of Romania;
(d) Annex I: the parties are those identified in the applicable Licenseware agreement, and the transfer is described in Schedule 1.

4.8 United Kingdom. For Personal Data subject to the UK GDPR, transfers from the United Kingdom to Licenseware rely on the transfers to the EEA approved by regulations under the UK GDPR. Licenseware shall ensure that onward transfers to recipients outside the United Kingdom and the EEA are covered by the UK Extension to the EU-US Data Privacy Framework or by the International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK, as amended or replaced from time to time, as applicable.

5. Assistance to the Controller

5.1 Data Subject rights. Licenseware shall assist the Controller in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law (including rights of access, rectification, erasure, restriction, portability and objection). Licenseware shall forward any Data Subject requests it receives directly to the Controller without undue delay.

5.2 Security, breach notification, DPIA and prior consultation. Taking into account the nature of processing and the information available to Licenseware, Licenseware shall assist the Controller in ensuring compliance with the Controller's obligations under Articles 32–36 of the EU GDPR, including:

• implementing and maintaining appropriate security measures;
• notifying the Controller of Personal Data Breaches;
• assisting with Data Protection Impact Assessments where required.

6. Personal Data Breach Notification

6.1 Licenseware shall notify the Controller without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting the Controller's Personal Data.

6.2 Notification shall include, to the extent available at the time:

• a description of the nature of the breach, including categories and approximate numbers of Data Subjects and Personal Data records concerned;
• the name and contact details of Licenseware's Data Protection contact;
• a description of the likely consequences of the breach;
• a description of the measures taken or proposed to address the breach.

6.3 Where complete information is not available at the time of initial notification, Licenseware shall provide the information in phases without undue further delay.

6.4 Licenseware shall cooperate with the Controller in investigating the breach and in fulfilling any notification obligations the Controller may have to supervisory authorities or Data Subjects.

6.5 The Controller remains solely responsible for any notifications to supervisory authorities and Data Subjects required under Articles 33 and 34 of the EU GDPR. Notification of a Personal Data Breach by Licenseware shall not be construed as an acknowledgement of fault or liability.

7. Deletion and Return of Personal Data

7.1 On termination of the applicable agreement or on the Controller's written request, Licenseware shall, at the Controller's election:

• return all Personal Data to the Controller in a standard machine-readable format (CSV, JSON or via API); or
• securely delete all Personal Data, and certify in writing that it has done so.

7.2 Licenseware shall complete deletion or return within thirty (30) days of the termination date or written request, unless applicable law requires Licenseware to retain certain data for a longer period.

7.3 Licenseware shall procure that Sub-Processors delete or return Personal Data on equivalent terms.

8. Audit Rights

8.1 Licenseware shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits and inspections conducted by the Controller or a mandated auditor.

8.2 Licenseware may respond to an audit request by first providing its most recent independent audit reports or certifications and its answers to a reasonable security questionnaire. An audit or inspection of Licenseware's premises or systems shall take place only where such information is not sufficient to demonstrate compliance with this DPA, following a Personal Data Breach, or where required by a supervisory authority.

8.3 Audits shall take place no more than once per twelve (12) month period, upon a minimum of four (4) weeks' prior written notice, during normal business hours, and subject to confidentiality obligations and reasonable data minimisation measures. The Controller shall bear the cost of the audit unless the audit reveals material non-compliance by Licenseware, in which case Licenseware shall bear its own reasonable costs.

8.4 Any auditor engaged by the Controller must be bound by confidentiality obligations at least as protective as this DPA and must not be a competitor of Licenseware.

9. MSP-Specific Provisions

This Section applies only to MSP Partners under Appendix 1G from the main agreement.

9.1 Controller → Processor → Sub-Processor chain. Where the Controller is an MSP Partner:

• each End User Customer of the MSP Partner is the data controller of Personal Data relating to its own staff, devices and systems;
• the MSP Partner is a data processor, processing Personal Data on behalf of each End User Customer;
• Licenseware is a sub-processor, processing Personal Data on behalf of the MSP Partner in the course of providing the platform.

9.2 MSP Partner's DPA obligations. The MSP Partner must have a compliant Data Processing Agreement in place with each End User Customer prior to onboarding that customer. That DPA must accurately reflect the processing chain, incorporate this DPA's obligations (including the Sub-Processor List), and not make commitments to End User Customers that conflict with this DPA.

9.3 Authorisation by End User Customers. The MSP Partner warrants that its instructions to Licenseware are authorised by the relevant End User Customer and that it has obtained from each End User Customer a general written authorisation to engage Licenseware and the Sub-Processors on the Sub-Processor List, in accordance with Article 28 (2) and (4) of the EU GDPR.

9.4 Breach notification chain. Licenseware shall notify the MSP Partner within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting End User Customer data. The MSP Partner shall notify affected End User Customers in accordance with the MSP Partner's own DPA obligations and applicable law.

9.5 Sub-processor notification. The MSP Partner shall forward each notice received under Clause 3.3 to the affected End User Customers within five (5) days of receipt. The MSP Partner shall ensure that the period within which its End User Customers may object to the change expires no later than five (5) days before the end of the notice period under Clause 3.3, so that any objection can be raised with Licenseware within that notice period. The MSP Partner may exercise the right to object under Clause 3.4 on behalf of an End User Customer. A delay or failure by the MSP Partner to forward a notice or to relay an objection shall not extend the periods under Clause 3.

10. General

10.1 Governing law. This DPA is governed by and construed in accordance with the laws of Romania. Each party irrevocably submits to the exclusive jurisdiction of the Romanian courts for any dispute arising out of or in connection with this DPA.

10.2 Order of precedence. In the event of any conflict between this DPA and the applicable Licenseware agreement, this DPA shall prevail to the extent of the conflict in relation to data processing matters only.

10.3 Updates. Licenseware may update this DPA from time to time to reflect changes in Applicable Data Protection Law or Licenseware's technical architecture. Continued use of the Licenseware Products following the effective date of an update constitutes acceptance of the updated DPA.

11. Entire agreement on data processing.

11.1 This DPA constitutes the entire agreement between the Parties with respect to the processing of Personal Data by Licenseware on behalf of the Controller and supersedes any prior data processing provisions embedded in earlier versions of Licenseware's agreements.

Schedule 1 — Subject Matter, Nature, Purpose and Duration of Processing

Category	Details
Subject matter	Processing of personal data in the course of providing the Licenseware SAM/ITAM platform and associated services.
Nature of processing	Collection, storage, organisation, structuring, retrieval, use, disclosure by transmission, and erasure of personal data as necessary to provide the platform.
Purpose of processing	To provide the Licenseware Products and services in accordance with the applicable service agreement and this DPA.
Duration	For the duration of the applicable agreement, and for such further period as may be required by applicable law.
Types of personal data	Identity and directory data (names, usernames, email addresses, job titles, organisational roles, account identifiers); device and endpoint data (device names, hardware identifiers, OS, compliance/ownership attributes); software installation and usage data; licence and entitlement data; SaaS and cloud application usage data; authentication and access data (SSO, directory service, identity provider records); business contact information.
Special categories	None.
Categories of Data Subjects	Employees, contractors, agents and authorised users of the Controller whose personal data is processed in the course of managing the Controller's software estate.
Additional instructions	As provided by the Controller in writing from time to time, provided such instructions are consistent with this DPA and Applicable Data Protection Law.

Schedule 2 — Technical and Organisational Measures

Licenseware implements the following technical and organisational measures:

1. Information security governance: a written information security programme approved by management and reviewed periodically, risk assessment and treatment proportionate to severity.

2. Personnel: written confidentiality obligations, pre-engagement vetting to the extent permitted by law.

3. Access control: role-based access, named individual accounts, multi-factor authentication for production systems and cloud administration consoles, restricted and logged administrative access, and periodic review and prompt revocation of access rights.

4. Encryption: encryption of Personal Data in transit and at rest using industry-standard algorithms and protocols, key management through the infrastructure provider's key management services, and storage of secrets only in approved secret-management tools.

5. Vulnerability management: regular vulnerability scanning, severity-based remediation and periodic independent security testing.

6. Network security: internal components not directly reachable from the internet, and protection against common web attacks.

7. Logging and monitoring: logging and monitoring of security-relevant events, with alerting and defined escalation.

8. Incident management: a documented incident response plan with severity-based procedures, and notification of Personal Data Breaches in accordance with Section 6.

9. Devices and physical security: endpoint security requirements for devices used to access Personal Data, including disk encryption, up-to-date software, anti-malware protection and screen lock, and hosting in data centres of infrastructure providers whose physical and environmental controls are independently audited.

10. Deletion: deletion or return of Personal Data in accordance with Section 7, including deletion from backups in the ordinary backup cycle.

This is the Subprocessor List referred to in Section 3 of the Data Processing Addendum.

Sub-Processor	Parent Company	Processing Role	Processing Locations	Legal Basis for Sub-Processing
Google Cloud Platform	Google LLC	Cloud infrastructure: compute, storage, networking, encryption key management, AI services	Europe (Netherlands) · United States · Australia	Google Cloud DPA, incl. SCCs for non-EU/EEA processing
Microsoft Azure	Microsoft Corporation	Cloud infrastructure: compute, storage, networking, encryption key management	Europe (Netherlands) · United States · Australia	Microsoft Products and Services DPA, incl. SCCs for non-EU/EEA processing
Cloudflare	Cloudflare, Inc.	Reverse proxy, content delivery, security and DDoS protection for the platform APIs (api.licenseware.io, api.us.licenseware.io, api.au.licenseware.io)	Global edge network (the Cloudflare data centre nearest the user)	Cloudflare Data Processing Addendum, incl. SCCs for non-EU/EEA processing
SendGrid	Twilio Inc.	Transactional email delivery for platform account, notification and product information emails (recipient names, email addresses, email content)	Same region as the Controller's Regional Instance: Europe · United States · Australia	Twilio Data Protection Addendum, incl. SCCs for non-EU/EEA processing

All other platform components (databases, identity layer, observability stack, task queuing) are self-hosted within Licenseware's own managed Kubernetes clusters on the infrastructure providers above and do not constitute independent sub-processors.

Please read these Terms and Conditions carefully before using the https://licenseware.io/ website operated by Licenseware ("us", "we", or "our"). Your access to and use of the Service is conditioned on your acceptance of and compliance with these Terms.

License

Unless otherwise stated, Licenseware and/or its licensors own the intellectual property rights for all material on Licenseware. You must not: republish, sell, rent, sub-license, reproduce, duplicate, copy, or redistribute content from Licenseware, or attempt to reverse engineer any software contained on Licenseware's Website.

Links To Other Websites

Our Service may contain links to third-party websites or services that are not owned or controlled by Licenseware. Licenseware has no control over, and assumes no responsibility for, the content, privacy policies, or practices of any third-party websites or services.

Governing Law

These Terms shall be governed and construed in accordance with the laws of Romania, without regard to its conflict of law provisions.

Dispute Resolution

In the event of any dispute, the parties shall first attempt to resolve through good faith negotiation. If a resolution is not reached within sixty (60) days, the parties agree to enter into mandatory mediation in Bucharest, Romania, before escalating to litigation. Any unresolved dispute shall be submitted to the exclusive jurisdiction of the competent courts in Bucharest, Romania.

Changes

We reserve the right, at our sole discretion, to modify or replace these Terms at any time. By continuing to access or use our Service after those revisions become effective, you agree to be bound by the revised terms.

Contact Us

If you have any questions about these Terms, please contact us at [email protected]

1. Who we are and how to contact us

Licenseware Technology Services S.R.L. is incorporated at Afi Park 1, Bdul Vasile Milea 4 E, Bucharest, Romania, VAT no RO42866470, company no J2021000238215. This Privacy Policy applies to our website, social media, marketing campaigns, and use of our products and services. For any question about this policy, or to exercise your rights, contact us at contact@licenseware.io.

2. The personal data we collect

We collect information you provide directly (name, business email, phone), information collected automatically when you visit our site (access times, pages viewed, device and IP data), and information from third-party sources (name, email, job title, company, telephone) obtained from business-contact data providers and publicly available professional sources.

3. How and why we use your personal data

We use personal data for a limited set of clearly defined purposes, and each one has a legal basis. In some cases more than one basis applies, depending on the circumstances.

We use your data to deliver the products and services you have contracted for, to communicate with you, provide support and manage our business operations. For these purposes we rely on the performance of our contract with you, on our legitimate interest in running our operations effectively and on legal obligations.

We also send product updates and marketing communications. We do so either on the basis of your consent or on our legitimate interest in promoting our products to relevant business audiences. You can find more details in the Direct marketing section.

When you visit our website, we use analytics and, where you consent, advertising cookies, and we identify the organisations that visit us. This relies on your consent and on our legitimate interest, as explained in the Cookies section.

We also analyse how our website and products are used in order to improve them, on the basis of our legitimate interest. Finally, we process personal data to keep our site and services secure, to prevent fraud, and to meet our legal, tax and regulatory obligations.

We do not sell your information to any third party.

4. Direct marketing

We process personal data to promote Licenseware’s products and services (newsletters, product news and updates and other commercial communications) and to reach out to organisations that may be interested in our products. We send marketing communications to individuals in their professional capacity at business organisations. We do not market to consumers.

Who we contact and on what basis:

• If you opted in (for example, by submitting a form, requesting a demo) we rely on your consent, which you can withdraw at any time.
• If you are an existing or former customer we may send you communications about products or services similar to those your organisation has obtained from us and you can object at any time.
• If you are a prospective business contact we may process your professional contact details to promote our products.

Every marketing email contains links to unsubscribe and to manage your preferences. You may object to direct marketing at any time and without giving reasons, and we will cease such processing. Where we rely on your consent for any processing (for example, to send certain electronic communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew it.

5. Third parties and recipients

We use third-party providers to operate our website, products, services and business. These providers process personal data on our behalf as processors, under data-processing terms that require appropriate confidentiality and security. They fall into the following categories:

• hosting and infrastructure providers;
• website analytics and advertising providers (website tools used only with your consent);
• CRM, marketing and customer support providers;
• sales and prospecting tools;
• communications, productivity and internal tools, including AI assistant tools that process communications on our behalf;
• contract and electronic signature providers;
• payment and accounting providers;
• automation tools.

We may also share personal data with our professional advisers, and with authorities or other parties where required by law or in connection with a corporate transaction such as a merger, acquisition or sale of assets. The specific providers we currently use are listed below. We update this list when a provider is added or replaced.

Third-party providers processing personal data

Infrastructure, hosting and platform email

Provider	Personal data	Purpose
Google Cloud Platform	Platform user data, End User Customer data	Infrastructure and hosting
Microsoft Azure	Platform user data, End User Customer data	Infrastructure and hosting
Cloudflare	IP addresses, request metadata, device data	CDN, security and DDoS protection
SendGrid (Twilio)	Names, email addresses, email content	Transactional platform emails (account, notification and product information), sent from the region of the user's instance

Internal operations and communications

Provider	Personal data	Purpose
Google Workspace	Names, emails, communications, documents	Internal operations, customer and partner communications
Google Meet	Names, emails, meeting content	Customer, partner and internal calls
Microsoft Teams	Names, emails, meeting content	External calls
Slack	Names, emails, internal communications referencing contacts	Internal operations
Notion	Names, notes, customer and partner context	Internal knowledge management
Superhuman	Names, email addresses, communications content	Email client
Claude (Anthropic)	Email metadata and content accessed during active sessions via Gmail integration	AI assistant for internal operations and communications
Cursor	Any personal data present in code, configuration or test data	AI-assisted software development

CRM and partner management

Provider	Personal data	Purpose
HubSpot	Names, emails, job titles, company, interaction history, chat transcripts, support tickets, IP addresses, company identity inferred via IP lookup, website behavioural data	CRM, marketing, live chat, service desk, website visitor identification
Introw PRM	Names, emails, company, partner contact details	Partner relationship management

Prospecting and outreach

Provider	Personal data	Purpose
LinkedIn	Names, job titles, company, professional profile data	Prospecting and outreach
LinkedIn Sales Navigator	Names, job titles, company, direct contact data	Advanced prospecting
Lemlist	Names, emails, LinkedIn profile data, personalisation data	Email and LinkedIn outreach sequences
Apollo	Names, emails, job titles, company, direct contact details	Prospecting and data enrichment

Advertising

Provider	Personal data	Purpose
Google Ads	Email addresses, behavioural data, cookie and device identifiers	Paid advertising
LinkedIn Ads	Professional profile data, behavioural data, cookie identifiers	Paid advertising

Analytics and tracking

Provider	Personal data	Purpose
Google Analytics	IP addresses, device data, behavioural and session data, cookies	Website analytics
Google Tag Manager	Same data as the tags it manages	Tag management and tracking
PostHog	First name, last name, email address, session data, behavioural data	Product analytics and session replay
Arcade	IP addresses, company identity inferred via IP lookup	Interactive demo tracking and intent data

Automation

Provider	Personal data	Purpose
Zapier	Names, email addresses, data passed between connected systems	Workflow automation between platforms

Contracts

Provider	Personal data	Purpose
DocuSign	Names, emails, signatory details	Contract execution

Finance

Provider	Personal data	Purpose
Stripe	Names, billing contact details, payment data	Payment processing
Xero	Names, billing contact details, invoice data	Accounting and invoicing

6. Cookies and similar technologies

We use cookies and similar technologies (such as local storage and identifiers) to operate our website and, where you allow it, to personalise content, improve our services and support advertising. You can manage these technologies at any time through our consent tool, which lets you reject all non-essential purposes, accept all of them, or choose individually. You can also select how long your consent remains valid (1, 6 or 12 months). Your choices are recorded together with a consent ID and the date and time of your choice, and we will ask you to renew your consent when the period you selected expires. You can withdraw or change your preferences at any time.

We group these technologies into the following purposes:

• Basic Operations (always active). These are necessary to keep the website secure and working properly and do not require your consent. They involve anonymous data such as your browser name and version, and pseudonymous data such as an authentication token.
• Content Personalization (optional). When enabled, these allow us to save your preferences and build a profile so we can deliver personalised content. They involve anonymous data such as device type, model and operating system, pseudonymous data such as your site browsing preferences, and personal data such as your IP address and location.
• Site Optimization (optional). When enabled, these allow us to analyse how visitors use the site so we can improve our services. They involve anonymous data such as the previously visited website, pseudonymous data such as website activity identifiers, and personal data such as your content, search and purchase history.
• Ad Personalization (optional). When enabled, these allow us to share data with our advertising partners, who may build profiles about you across multiple websites. They involve anonymous data such as affiliate referral links, pseudonymous data such as identifiers used to track and profile users, and personal data such as your age, gender and demographics.

The optional purposes are activated only with your prior consent and remain inactive until you enable them.

7. How we secure personal data

We use physical, administrative, and technical safeguards including encryption at rest and in transit, and have implemented best-practice standards aligned with internationally recognized security frameworks. We also maintain a SOC 2 Type II attestation, which is independently audited. For more information, visit: https://help.licenseware.io/licenseware-security

8. Your rights

You may access, correct, delete, object to processing, restrict processing, or export your personal data. Contact us at contact@licenseware.io to exercise any of these rights. You can also submit a request through our data privacy request form. We normally respond within one month, unless an extension is permitted by law.

Where we rely on your consent, you also have the right to withdraw it at any time, without affecting processing carried out before withdrawal.

You also have the right to lodge a complaint with the Romanian supervisory authority: the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul General Gheorghe Magheru nr. 28-30, Sector 1, 010336 Bucharest, Romania.

9. Data retention

We retain information as long as necessary to provide products and services, subject to legal obligations. Information no longer necessary may be de-identified or aggregated.

10. Data processing locations and international transfers

We process data in the Netherlands (EU), the United States and Australia. Transfers outside the EEA are made under an appropriate transfer mechanism, namely an adequacy decision where one applies, or otherwise the European Commission's Standard Contractual Clauses.

11. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date above and, where appropriate, notify you. Please review this policy periodically.

12. Contact Information

Licenseware Technology Services S.R.L. - Afi Park 1, Bdul Vasile Milea 4 E, Bucharest, Romania.

Email: contact@licenseware.io

Licenseware Technology Services S.R.L. has a zero-tolerance approach to modern slavery and is committed to acting ethically and with integrity in all our business dealings. We are committed to ensuring transparency in our own business and in our approach to tackling modern slavery throughout our supply chains, consistent with our disclosure obligations under the Modern Slavery Act 2015.

This policy applies to all persons working for us or on our behalf in any capacity, including employees, directors, agency workers, volunteers, agents, contractors, and business partners.

Responsibility for the Policy

Licenseware has overall responsibility for ensuring this policy complies with our legal and ethical obligations. Management at all levels is responsible for ensuring those reporting to them understand and comply with this policy.

Compliance with the Policy

You must ensure that you read, understand, and comply with this policy. You must notify your line manager or a company Director as soon as possible if you believe or suspect that a conflict with this policy has occurred or may occur in the future.

Communication and Awareness

Training on this policy forms part of the induction process for all individuals who work for us. Our zero-tolerance approach must be communicated to all suppliers, contractors, and business partners at the outset of our business relationship.

Breaches of this Policy

Any employee who breaches this policy will face disciplinary action, which could result in dismissal. We may terminate our relationship with other individuals and organizations working on our behalf if they breach this policy.

Purpose

Licenseware is committed to embedding sustainability and ESG (Environmental, Social, and Governance) principles into its operations as a fully remote, globally distributed SaaS company.

Scope

This policy applies to all employees, contractors, suppliers, and business partners engaged with Licenseware.

Commitments

• Sustainable Remote Work: Encourage energy-efficient home office practices and responsible e-waste disposal.
• Energy Efficiency in Cloud & Infrastructure: Partner with providers prioritizing renewable energy. Continuously optimize infrastructure to minimize unnecessary resource consumption.
• Travel & Events: Limit non-essential travel; prioritize virtual collaboration. Opt for sustainable transport and eco-certified venues when travel is necessary.
• Procurement & Partnerships: Favor environmentally responsible suppliers. Require ESG compliance criteria as part of vendor evaluation.
• Employee Engagement: Provide resources for sustainable living and working.
• Continuous Improvement: Annual review of ESG and sustainability goals. Transparent reporting on progress and challenges.

Accountability

Licenseware's leadership is responsible for ESG strategy and reporting, while every employee shares responsibility for embedding sustainability in daily practices.

This code of conduct sets the expectations for behavior and conduct of employees and stakeholders in our organization. Violation may result in disciplinary action, up to and including termination of employment or contract.

General Principles

• Treat everyone with respect, kindness, and professionalism.
• Avoid discriminatory, harassing, or offensive behavior.
• Respect the privacy and confidentiality of others.
• Uphold high ethical standards and integrity.

Communication

• Use respectful and professional language in all communication.
• Respond to communication in a timely manner.
• Use appropriate channels for different types of communication.
• Be clear and concise.

Collaboration

• Collaborate in a constructive and respectful manner.
• Respect the opinions and contributions of others.
• Offer and be open to constructive feedback.

Remote Work

• Maintain a professional and productive work environment.
• Adhere to work schedules and deadlines.
• Be responsive and available for virtual meetings.
• Maintain a healthy work-life balance.

Security

• Follow all security policies and procedures.
• Protect company assets, including intellectual property and sensitive information.
• Report any security incidents or concerns to the appropriate personnel.
• Use secure passwords and multi-factor authentication for all accounts.

Compliance

• Adhere to all applicable laws and regulations.
• Follow company policies and procedures.
• Report any compliance concerns to the appropriate personnel.
• Participate in compliance training and education.

Purpose

This policy establishes Licenseware's position on preventing bribery and corruption in all jurisdictions where the company operates, ensuring compliance with applicable laws and protecting the integrity of Licenseware's operations, partners, and clients.

Scope

This policy applies to all employees, contractors, founders, executives, advisers, partners, resellers, and any third parties acting on behalf of Licenseware.

Policy Statement

Licenseware prohibits any form of bribery, facilitation payment, kickback, improper advantage, or corrupt practice. No one representing the company may offer, promise, give, request, or accept anything of value intended to improperly influence a decision or secure an unfair business benefit.

Prohibited Conduct

• Offering or accepting cash or cash equivalents intended to influence business outcomes.
• Providing gifts, hospitality, or entertainment that exceed reasonable, customary, and lawful business standards.
• Granting discounts, services, or favourable terms that are not commercially justified.
• Using intermediaries to channel improper payments or benefits.
• Offering anything of value to public officials to influence official actions.
• Making facilitation payments to speed up routine governmental processes.

Gifts and Hospitality

Gifts and hospitality must be reasonable, infrequent, compliant with local laws, and never tied to expected business outcomes. Any questionable or high-value offer must be declared to the compliance lead and approved before acceptance or provision.

Third Parties

Distributors, resellers, partners, consultants, and contractors must comply with this policy. Licenseware will conduct risk-based due diligence and may terminate relationships where bribery or corruption risks are identified or not remediated.

Record Keeping

All financial transactions, expenses, and approvals must be recorded accurately and transparently. No off-book accounts or unreported funds are permitted for any purpose.

Reporting Concerns

Any suspected or actual bribery, corruption, or unethical conduct must be reported immediately to the compliance lead or through internal reporting channels. Retaliation against individuals who raise concerns in good faith is strictly prohibited.

Consequences of Non Compliance

Violations may result in disciplinary action, contract termination, legal penalties, and regulatory reporting. Licenseware will cooperate fully with lawful investigations into suspected misconduct.

Review

This policy will be reviewed annually and updated as necessary to remain aligned with legal requirements, business operations, and global compliance standards.