1. INTRODUCTION

These terms and conditions apply to all business transactions and agreements concluded by Syndis ehf., reg. no. 580113-0600 ("Syndis" or "the company") with the company's customers.

These terms and conditions, along with the framework agreement for services, appendices to the framework agreement, accompanying documents, and instructions, generally form the parties' overall agreement on their business dealings ("the agreement" or "the parties' agreement"). If provisions of these terms and conditions conflict with provisions found in the parties' framework agreement, the provisions of the latter shall prevail over these terms and conditions.

An agreement is considered concluded between the company and the customer upon the occurrence of any of the following: (a) the parties have signed a framework agreement for services, (b) the customer has accepted special terms, contract appendices, or the company's offer for services within the validity period of such an offer, or (c) the customer begins to use the company's services.

Unless otherwise specified in the agreement, the agreement shall remain in force indefinitely until terminated. The customer may terminate the agreement by giving written notice 3 months in advance, with termination taking effect at the end of a calendar month.

The company may terminate the agreement with a customer at any time, without notice or compensation, due to the customer's breach of contractual obligations. If more than one agreement is in force between the customer and the company, a breach of contract in one agreement shall entitle the company to terminate any or all agreements then in force between the concerned parties.

Upon termination of the agreement, for any reason, each party shall promptly return to the other, all properties and materials, including all types of equipment, that have been provided and are owned by the other party or over which the other party has the right of disposal. Any work arising from the customer's off-boarding upon termination of the agreement shall be invoiced to the customer in accordance with the company's price list.

2. SYNDIS SERVICES

Syndis provides the customer with services in the field of cybersecurity. The services are described in the relevant appendices to the framework agreement between the parties, and may include, but are not limited to, consulting, monitoring, incident response or other professional services and/or access to hardware or software ("the services").

Syndis shall make the services available to the customer in accordance with the parties' agreement, provided that the customer uses the services in accordance with the provisions thereof. Syndis shall provide the customer with appropriate documentation and instructions necessary for the use of the services.

Syndis may schedule periods during which the services or software will be unavailable, in order to improve, repair, or carry out upgrades or maintenance of the services. When reasonably practicable, Syndis shall take the customer's business interests into account by providing the customer with prior notice by email, of any upgrades, maintenance, or other planned measures that may result in a significant interruption of the services. In exceptional circumstances, emergency maintenance may be required to address significant security incidents or technical issues affecting access to the services that cannot reasonably be deferred until scheduled maintenance. Syndis shall endeavour to notify the customer of emergency maintenance via email with at least one (1) hour's prior notice.

Access to software provided by parties other than the company ("third parties") is supplied subject to the

applicable terms and conditions of the relevant third party, i.e., the manufacturer or the rights holder. This generally involves the sale of a non-transferable licence to use the software in a defined way. The software and all associated intellectual property rights remain the property of the relevant third party or rights holder.

Accordingly, ownership of the software is not transferred to the customer, but only a licence to use it, subject to the restrictions and conditions imposed by the relevant third party or rights holder. The customer shall not sell, lease, assign, transfer or otherwise make the software available to any third party. Any terms that apply to third-party services, including terms of use and terms governing the processing of personal data, shall apply solely as between the customer and the relevant third party. Unless otherwise expressly provided in the framework agreement for services, including its appendices, Syndis neither warrants, guarantees nor endorses any third-party services.

3. USE OF THE SERVICE

The customer, and any users acting on the customer's behalf, shall use the services only in accordance with these general terms and conditions, and the parties' framework agreement, including applicable appendices and any applicable instructions and/or documentation.

The customer shall be responsible for the acts and omissions of all users acting on its behalf, and shall ensure that such users comply with the provisions of the agreement.

The customer shall implement and maintain appropriate security measures to prevent unauthorised access to or use of the services, including any customer account.

The customer shall not, in connection with the use of the services, access, store, distribute, or transmit any content that is unlawful, including any unauthorised attempt to gain access to computer systems or similar activities, or any content that otherwise violates applicable law or causes damage or harm to any person or property.

The customer and its users shall comply with all applicable laws and regulations and shall obtain and maintain all permits, licences and authorisations required for their activities. The customer shall enable the company to carry out those parts of the services that are to be carried out at the customer's premises and, where applicable, at the premises of a third party, for example by providing the company's personnel with adequate access to the relevant premises.

The customer shall also provide the company with adequate information for the performance of the services. Furthermore, the customer shall be responsible for any instructions and directives it provides to the company, as well as for the accuracy of any information provided to the company.

4. FREE AND TRIAL SERVICES

Services designated as trial services or free services are provided by Syndis on an "as is" basis, without warranties of any kind. Syndis shall bear no liability for, and shall not be liable for any loss or damage arising out of or in connection with the use of such services. If such exclusion of liability is deemed invalid under the laws governing

the agreement, Syndis's maximum liability shall be limited to ISK 150,000.

5. ADDITIONAL SERVICES

The customer may, at any time after signing the initial framework agreement, request additional services from Syndis. In such event, the parties shall sign a new updated framework agreement covering such additional services. For customised projects, the parties may sign a separate work plan or specification, which may include

provisions regarding fees, milestones, deadlines or other applicable terms and conditions. Any such work plan or specification shall form an integral part of the parties' agreement.

6. DATA PROTECTION AND DATA SECURITY

Syndis acts as the controller, within the meaning of applicable data protection legislation, in relation to the processing of personal data relating to individuals who conduct business with the company, as well as contact persons acting on behalf of companies and other legal entities in their dealings with the company. With regard

to the company's processing of such information, reference is made to the company's Privacy Policy which is available on Syndis's website.

Where Syndis processes personal data on behalf of the customer in connection with the services, the customer shall act as the controller of such processing, within the meaning of applicable data protection legislation, and the company shall act as the processor. In such circumstances, the company's terms for processing personal

data ("Syndis processing terms") shall apply.

To the extent that general, aggregated, or statistical data does not contain personal data and cannot be directly traced to the customer, the customer authorises Syndis to use such data generated during the provision of the services or resulting from the customer's use of the services, for analytical purposes and for the improvement of Syndis's service.

7. CONFIDENTIALITY

The parties shall treat as confidential all information obtained by either party in connection with the performance of the parties' agreement, including information about the content and terms of the agreement and pricing, technical information, product plans and designs, business and marketing plans, customers, business relationships, operations, business activities, financial matters and business practices of the other party ("confidential information").

The following shall not constitute confidential information: information that: (i) is or becomes generally available to the public, (ii) was already in the possession of the receiving party without breach of any confidentiality obligation, (iii) is obtained from a third party without breach of any confidentiality obligation, or (iv) was independently developed by the receiving party.

8. INTELLECTUAL PROPERTY RIGHTS

These terms and conditions shall not affect any intellectual property rights in or relating to any software or other equipment sold by the company to the customer or made available by the company to the customer. The customer's right to use such intellectual property shall be governed by the applicable appendices relating to the relevant services and/or where a third party is the rights holder, the applicable terms and conditions of such third party.

Where the services provided by Syndis include access to any materials, including, without limitation, equipment, databases, manuals or similar materials, developed by Syndis or in respect of which Syndis is the rights holder, all intellectual property rights therein shall belong to Syndis. Such intellectual property rights include, among other things, without limitation, all copyrights, trademark rights, design rights, trade and business secrets, know-

how, and patent rights. The foregoing shall also apply to any materials created by the company pursuant to the parties' agreement, unless otherwise specifically agreed upon. Accordingly, no assignment or transfer of any intellectual property rights shall take place between the parties. However, based on the parties' agreement, the

customer shall be granted a non-transferable licence to use the relevant materials during the term of the parties' agreement, to the extent applicable.

Where the parties jointly develop or create any intellectual property-protected material, both parties shall own the rights thereto. Each party shall be entitled to use and dispose of such right independently, to the extent that such use or disposal does not infringe the other party's rights.

Should the customer choose to provide suggestions or recommendations regarding improvements of the services or the business operations of Syndis or its affiliated companies ("feedback"), Syndis shall be entitled to use such feedback, including, without limitation, to improve the services.

All intellectual property rights in any material created, designed or developed by the customer without the involvement of Syndis shall belong to the customer, and no assignment or transfer of any such rights or material shall take place unless otherwise agreed upon. Where the customer makes any such materials available to the

company in connection with the services, the customer thereby grants the company a non-transferable licence to use such material during the term of the agreement and the customer shall indemnify and hold the company harmless from any and all claims brought by a third party alleging that Syndis's use of such material infringes the

rights of such third party. Should any uncertainty arise regarding the company's intellectual property rights licensed to the customer pursuant to the parties' agreement, e.g., due to a third-party claim alleging that the company's materials infringe such third party's rights, the company shall decide whether to modify the material,

provide the customer with comparable material, or negotiate with the third party regarding the continued use of the material while the dispute remains unresolved.

The customer agrees to defend Syndis against any and all claims, accusations, allegations, or legal proceedings brought against Syndis by a third party: (a) alleging that the customer's data, or the customer's use thereof in connection with the services, infringes such third party's intellectual property rights; or (b) arising out of the

customer's unlawful use of the services or use of the services in breach of the parties' agreement. The customer shall indemnify and hold Syndis harmless from and against any and all losses, damages, costs, legal costs, settlement payments, and attorney's fees finally awarded against or incurred by Syndis as a result of such claim.

The use of the party's company name or trademark in marketing materials, on websites, or in promotional materials shall be permitted only with the prior written consent of the party concerned, for example by email. Any such use shall be limited to referring to the parties' business relationship or identifying Syndis as the

customer's service provider and the customer as a customer of Syndis.

Unless otherwise specifically agreed upon, all press releases, public statements and announcements, and other promotional activities by either party concerning the parties' agreement, including the use of the other party‘s name and trademark, shall be subject to the prior approval of both parties before such announcements or

promotional activities are undertaken.

9. FEES AND PAYMENTS

The fees for Syndis's equipment and services shall be the list prices set out in the company's price lists in force at any given time, special prices, or other specified prices in the agreement. All prices are stated exclusive of value added tax (VAT) unless otherwise expressly stated.

The company reserves the right to change price lists and fee schedules from time to time as required. The company reserves the right to adjust its prices, including to reflect changes in applicable price indices and/or fluctuations in the exchange rate of the Icelandic króna against other currencies in respect of third-party services for which the company pays in foreign currency. Such price adjustments shall generally be announced with 30 days' notice on the Syndis website. In unusual circumstances, such as a rapid currency devaluation, the company may notify the customer of price adjustments with 3 days' prior notice.

Payment for equipment and services shall be made in advance, unless invoicing terms are specifically agreed upon. In such cases, the company shall issue the customer with a monthly invoice for the service provided. The company shall be entitled to invoice services provided under the agreement, one month in advance or in

accordance with terms imposed by its suppliers where advance payment is required for the use of any kind of services, software, or hardware. Services charged on a usage basis shall generally be invoiced at the end of the relevant month or the beginning of the next month, provided that all necessary usage information is available. Value added tax (VAT) shall be added to all invoices. The due date of each invoice is based on the date of issue, but the final payment date shall generally be 20 days after the due date. If an invoice or any other contractual payment obligations are not fulfilled by the final payment date, the customer shall pay default interest in

accordance with Chapter III of the Interest Act No. 38/2001 from the final payment date until the date of payment.

Any objections to an invoice shall be made without undue delay and no later than the final payment date. Failing such objection, the invoice shall be deemed accepted by the customer. Fees for the services are non-refundable. Additional services are all services that do not fall within the scope of the parties' agreement. The customer shall pay for all additional services performed by the company at the customer's request in accordance with Syndis's applicable price list or such agreed business terms between the parties. Where necessary, the company shall be entitled to take such measures to prevent or mitigate damage to the customer without the customer‘s consent, and any such measures shall be treated as additional services. Unless otherwise agreed, the customer shall reimburse the company for all out-of-pocket expenses, travel expenses and transport costs incurred in connection with the provision of the services.

10. LIABILITY FOR DEFECTS

The company is responsible for ensuring that the services are provided in accordance with the parties' agreement, subject to the limitations of liability set out in these terms and conditions and the parties' agreement.

If the customer does not submit a complaint within one year from the date they received the services, or within two years in the case of consumer service purchases, they shall thereafter be barred from relying on the defect. The customer may not bring any claim against the company, of whatever nature or on whatever grounds, after

more than two years have passed since the cause of action arose.

The company's liability for software developed by the company is contingent on the use of the software being in accordance with the company's system documentation and specifications, manuals, and other instructions for use. The same applies to any kind of service provided by the company.

The company does not warrant that the software is free of errors, free from interruptions, or that all defects have been corrected. The company shall provide the warranty applicable for software developed by the company. Where the company acts as a reseller of software, the warranty limitations imposed by the software owner or licensor shall apply, provided that such limitations do not conflict with Icelandic law.

11. EXCLUSIONS OF LIABILITY

All services are provided without any commitments regarding response time. The company does not warrant that any equipment or the services will be free from defects, operate without interruption, that any software will function correctly, or that all software defects or other errors have or will be corrected. Syndis's services may, where applicable, rely on information and data provided by the customer. Syndis does not warrant the availability or quality of such information or data and shall bear no liability for any issues arising from or relating to such information or data.

Except as expressly provided in the parties' agreement, neither party gives the other any warranty of any kind. The company does not warrant, among other things, that the services are fit for any particular purpose.

12. LIMITATIONS ON LIABILITY FOR DAMAGES

If the customer suffers loss or damage as a result of the company's services, the customer may be entitled to compensation from the company.

However, the customer's right to compensation from the company shall be limited to direct loss, and the company's liability shall not extend to any indirect or consequential loss or damage, including loss of business or interruption of operations, penalties or fines, loss of data arising from the use of, or inability to use, software, loss of profits or goodwill, or the customer's breach of any agreement with a third party. Furthermore, the company shall not be liable for any loss or damage unless such loss or damage is attributable to the company or its employees' wilful misconduct or gross negligence.

Where the company becomes liable for damages, the company's aggregate liability shall be limited to an amount equivalent to ISK 1,200,000, or an amount equal to three months' service fees for the services giving rise to the loss, whichever is lower. If the relevant service fees have varied, the amount referred to above shall be calculated on the basis of the median of the monthly service fees paid by the customer for the relevant services during the twelve (12) months immediately preceding the date on which the claim arose.

13. FORCE MAJEURE

If, as a result of a Force Majeure event, the company is unable to perform its obligations towards the customer, the company shall be relieved of its obligations for the duration of such Force Majeure event, and the contracting party shall not be entitled to exercise any remedies for breach against the company, including claims for refund, discount or price reductions, damages, termination, or rescission.

Force Majeure events mean any event or circumstance beyond the company's control, provided that the company could not have prevented or overcome such event or circumstance by reasonable means. Without limiting the generality of the foregoing, such events and circumstances shall include, but shall not be limited to, wars, insurrection, sabotage, riots, pandemics, natural disasters, governmental actions, including measures

related to foreign exchange and trade, trade embargoes, port closures (and blockades), general transport disruptions, transportation bans, energy shortages, cyberattacks of any kind, force force majeure events affecting subcontractors and suppliers, and any other similar events or circumstances that disrupt the company's performance, including where the company's suppliers or service providers are unable to perform their obligations towards the company due to force majeure events, resulting in the company being unable to perform its obligations towards the other party. Should a Force Majeure event persist for 30 consecutive days or longer, the company may rescind or terminate the agreement without notice and without incurring any liability for damages.

14. BREACH OF CONTRACT

The company reserves the right to cease providing the services to the customer and, where applicable, to block the customer's access to the services ("suspension") in the event of a breach of the agreement by the customer. For the avoidance of doubt, the customer shall not be entitled to any service units or credits under the applicable appendices during the suspension.

In addition to the company's other rights, the company shall be entitled, without prior notice to the customer, to:

• deny the customer access to data stored on the company's equipment if an invoice has not been paid within 60 days of the final payment date,
• delete the customer's data stored on the company's equipment if an invoice has not been paid within 150 days of the final payment date.

Either party may rescind the agreement without notice in the event of a material breach of the agreement by

the other party, in accordance with the applicable general principles of law. Notwithstanding the foregoing, the company shall furthermore be entitled to exercise any remedies for breach,

including rescission, if:

• the customer fails to pay the company's invoice within 30 days after the final payment date,
• the customer fails to fulfil its contractual obligation towards the company within 30 days from the date of a written demand from the company to fulfil such obligation,
• the customer is granted a moratorium on payments, is authorised to seek a composition with creditors or becomes bankrupt, or if a trustee in bankruptcy, liquidator, liquidation committee, receiver, administrator, or other comparable party is appointed over all or a substantial part of the customer's assets, or the customer enters into a composition with its creditors, or any analogous circumstances arise under the laws of the relevant jurisdiction.
• there is a change of control of the customer.

Among the remedies for breach of contract that the company shall be entitled to exercise if the customer has breached its obligations towards the company, including in the manner described above, is the right to take possession of equipment, including software, or render it unusable.

If the agreement is rescinded by the company, the customer shall pay all accrued fees under the parties' agreement, in addition to all costs incurred by the company. Furthermore, the customer shall indemnify and hold the company harmless against all expenses and loss of income that the company may incur as a result of the customer's breach of the agreement.

15. MISCELLANEOUS PROVISIONS

All provisions which, by their nature or wording, are intended to remain in effect following the termination or the rescission of the agreement shall remain in full force and effect for as long as necessary to ensure their implementation, including Article 4 (Free and trial services), Article 7 (Confidentiality), Article 8 (Intellectual Property Rights), Article 9 (Fees and payments), Article 11 (Liability) and Article 12 (Limitations of liability) and

Article 15 (Miscellaneous provisions).

Should any provision or part of a provision in the parties' agreement be found to be unlawful or unenforceable, in whole or in part, such provision or part thereof shall be deemed invalid to that extent, without affecting the validity or implementation of the other provisions of the agreement, which shall remain in full force and effect. Neither party may assign its rights or obligations under the parties' agreement, in whole or in part, without the

prior written consent of the other party, with the exception of an assignment by Syndis to an affiliate or partner of Syndis.

16. GOVERNING LAW AND JURISDICTION

Any dispute or matter arising out of or in connection with these general terms and conditions or the parties' agreement shall be governed by Icelandic law and shall be subject to the exclusive jurisdiction of Icelandic courts.