Birch Cline Technologies, INC.
Master Services Agreement Version 8.18

This SECURITY SERVICES CUSTOMER MASTER SERVICES AGREEMENT (“MSA”) is entered into by Birch Cline Technologies, INC. (“Birch Cline”), and Customer and/or one of its Affiliates (as defined in Section 2.8 below) as of the Effective Date (as defined by the latest date in the signature block of the Service Order or SOW or if Customer purchased Services online, the date which such online purchase was accepted by Birch Cline). Birch Cline and Customer hereby agree to the following terms and conditions:

1.0  Services; Equipment and Order of Precedence.

1.1  Services. During the term of this MSA and subject to the terms and conditions herein, Birch Cline agrees to provide certain: (i) managed security services (“MSS Services”), and/or (ii) security risk consulting services (“Consulting Services”) purchased by Customer in accordance with the terms of this Section 1.1. The MSS Services and Consulting Services are collectively referred to hereafter as the “Services”.

The Services being purchased are specified in a physical, electronic or online service order (“Service Order”) or statement of work (“SOW”) executed (or, if online, accepted pursuant to an online order process) by the parties which references this MSA. A detailed description of the specific MSS Services being purchased is set forth in the service description and service level agreement (“SLA”) for such MSS Services and attached to the Service Order (or linked to if the Customer is purchasing online) and incorporated therein by reference. Certain Consulting Services may be purchased online. If Customer is purchasing Consulting Services online, a link to an SLA for the applicable Consulting Service is provided. All Service Orders (whether signed or accepted pursuant to an online order process) and all SOWs are subject to the terms and conditions of this MSA and will include the following: (i) the particular Services to be performed, including, if applicable, any SLAs; (i) the term of the Services; (iii) the compensation and billing method for the Services; and (iv) any other applicable information agreed to by the parties.

1.2  Order of Precedence. In the event of a conflict between the terms of the MSA and a Service Order/SOW (including any exhibits or attachments thereto), the terms of the Service Order/SOW shall govern.

2.  Service Fees; Taxes; Invoicing and Payment.

2.1  Services Fees. Birch Cline’ fees for the Services are set forth on each Service Order/SOW.

2.2 MSS Service Fees. The MSS Services ordered on each Service Order/SOW will commence on the first day in which Birch Cline has established communication with the contracted Customer device(s) and/or Equipment/Customer Purchased Equipment, (the “Service Commencement Date”), and Birch Cline shall invoice Customer for such MSS Services on or after the Service Commencement Date. Birch Cline has the unilateral right to cancel any Service Order, or portion thereof, as to Services that are not implemented within six (6) months after execution of the Service Order.

2.3 Change Control. “Change” means any change to the Services that (i) would modify or alter the delivery of the Services or the composition of the Services, (ii) would alter the cost to Customer for the Services, or (iii) is agreed by Customer and Birch Cline in writing to be a Change. From time to time during the term of the Services, Customer or Birch Cline may propose Changes to the Services. Any Change to the applicable Service Order/SOW shall be: (i) approved by both Birch Cline and Customer, (ii) executed by an authorized representative of Customer and Birch Cline, and (iii) memorialized in a change order (“Change Order”) or other written amendment that specifically identifies the portion of the Service Order/SOW that is the subject of the modification or amendment and the changed or new provision.

2.4 Work on Customer Premises. Only in the event  implementation, performance or delivery of the Services requires Birch Cline to be present at the Customer’s facilities, then, upon receiving travel approval from Customer as indicated by Customer’s execution of a Service Order/SOW with terms indicating that travel is required, subject to Birch Cline’ adherence to the Birch Cline travel reimbursement policy, or other travel reimbursement guidelines set forth in the applicable Service Order/SOW, Customer shall reimburse Birch Cline for all reasonable and actual out-of-pocket travel expenses, including, but not limited to, hotel, airfare and meals, incurred in connection with the implementation, performance or delivery of the Services as such travel shall be reasonably described in the applicable Service Order or Statement of Work and travel is pre-approved by Customer as indicated by the execution of the applicable Service Order or Statement of Work.

2.5 Taxes. Customer shall be responsible, on behalf of itself and its Affiliate(s), for the payment of all taxes and fees assessed or imposed on the Services provided or the amounts charged under the Service Order/SOW in any country or territory in which the Customer receives the benefit of the Services, including any sales, use, excise, value-added, or comparable taxes, but excluding taxes: (i) for which the Customer has provided a valid resale or exemption certificate, or (ii) imposed on Birch Cline’ income or arising from the employment relationship between Birch Cline and its employees. If Customer is required by law to withhold or deduct an amount from payments due to Birch Cline under this MSA, Customer shall include such additional amount to Birch Cline with its payment to ensure that Birch Cline receives, after such withholding or deduction, the amount that it would have been paid had no withholding or deduction been required.

2.6 Invoices and Payment. Birch Cline will invoice Customer in accordance with the billing terms set forth and detailed on the applicable Service Order or SOW. Unless otherwise specified on the Service Order or SOW, (i) all charges, fees, payments and amounts hereunder will be in United States dollars, and (ii) all undisputed amounts due hereunder are payable within thirty (30) days from the date of the invoice, which shall be submitted to Customer electronically (the “Invoice Due Date”).

2.7 Disputes and Nonpayment. Customer shall have the right to reasonably, and in good faith, dispute any invoice or any portion of any invoice claimed by Birch Cline as due and payable provided that, prior to the Invoice Due Date, Customer (i) timely pays any undisputed portion of the amount due and payable, and (ii) provides Birch Cline with written notice specifying the disputed amount and the basis for the dispute in reasonable detail.

Except for amounts that are disputed in good faith by Customer in accordance with this Section 2.7, Birch Cline reserves the right to charge Customer a late fee of one and a half percent (1.5%) per month or the maximum rate permitted by law, whichever is less, for invoices not paid on or before the Invoice Due Date. In addition, Birch Cline, without waiving any other rights or remedies to which it may be entitled, shall have the right, upon prior written notice to Customer, to suspend the Services until such payment is received.

2.8 Affiliates. As used herein, the term “Affiliate” with respect to a party means any entity that, directly or indirectly, through one or more intermediaries, controls, is controlled by or is under common control with such party. “Customer” may include Customer’s Affiliate(s): (i) receiving the benefit of the Services through Customer’s purchase of the Services, or (ii) whose data is included, accessed or received by Birch Cline in connection with the performance of the Services for Customer. With respect to such Customer Affiliate(s), Customer hereby represents and warrants that: (A) Customer has obtained the necessary consent from each Customer Affiliate for Birch Cline to access such Customer Affiliate’s networks and data in connection with providing the Services, and (B) each Customer Affiliate agrees to, and is hereby legally bound by, the terms of this MSA. The parties acknowledge and agree that Customer Affiliate(s) are not intended to be third party beneficiaries to this MSA. Customer shall be fully liable for any breach of the terms of this MSA by its Affiliate(s) receiving or having access to the Services hereunder.

In addition, in the event that a Customer Affiliate with a location outside of the United States is purchasing Services under this MSA (“Customer International Affiliate”), (i) such Customer International Affiliate shall enter into a Service Order and/or SOW directly with the Birch Cline local Affiliate (“Birch Cline Local Affiliate”) for such Services, and (ii) Customer shall execute a local country addendum specifying any local country required terms on behalf of Customer’s International Affiliate. For the purposes of either party’s Affiliate(s) performing, receiving or purchasing Services hereunder, references to Birch Cline and Customer herein shall be deemed references to such party’s respective Affiliate(s).

2.9 Third-Party Product Purchases. If Customer is purchasing any third-party products or services (“Third-Party Purchases”) as specified on the Service Order and/or SOW, Customer agrees that it will comply with any flow down terms and conditions, applicable to Third Party Purchases including but not limited to, any third-party end-user license agreement incorporated into an applicable SLA or referenced in or attached to the Service Order or SOW (or similar document) relating to such Third-Party Purchases.

3. Term of MSA; Service Order(s) and SOW(s).

3.1 Term of MSA. The term of this MSA shall commence on the Effective Date and shall continue until the completion or expiration of the Services set forth on the Service Order/ SOW or until this MSA is terminated pursuant to the provisions hereof.

3.2 Term of Service Orders/SOW(s). The term for the Services is specified on the Service Order and/or SOW.

4. Termination.

4.1 Termination for Breach. Either party may terminate this MSA or the Service Order and/or SOW in the event that the other party materially defaults in performing any obligation under this MSA (including any Service Order/SOW) and such default continues un-remedied for a period of thirty (30) days following written notice of default. If this MSA or the Service Order and/or SOW is terminated by Customer prior to the Service term expiration date for any reason other than Birch Cline’ breach, Customer agrees to pay to Birch Cline: (i) for the Consulting Services, all unpaid Consulting Service fees as set forth on the Service Order and/or SOW for the Consulting Services performed through the effective termination date; and (ii) for MSS Services, all unpaid MSS Service fees as set forth on the Service Order for the MSS Services performed through the effective termination date plus a termination fee equal to the MSS Service fees that will become due during the remaining term of the Service Order(s). If Customer terminates this MSA or the Service Order and/or SOW as a result of Birch Cline’ breach, then to the extent that Customer has prepaid any Service fees, Birch Cline shall refund to Customer any prepaid Service fees on a pro-rata basis to the extent such Service fees are attributable to the period after such termination date.

4.2 Termination for Insolvency. This MSA and the Services hereunder will terminate, effective upon delivery of written notice by either party to the other party upon the following: (a) the institution of insolvency, receivership or bankruptcy proceedings or any other proceedings for the settlement of debts of the other party; (b) the making of an assignment for the benefit of creditors by the other party; or (c) the dissolution of the other party.

5. Proprietary Rights.

5.1 Customer’s Proprietary Rights. Customer represents and warrants that it has the necessary rights, power and authority to transmit Customer Data (as defined below) to Birch Cline under this MSA and that Customer has and shall continue to fulfill all obligations with respect to individuals as required to permit Birch Cline to carry out the terms hereof, including with respect to all applicable laws, regulations and other constraints applicable to Customer Data. As between Customer and Birch Cline, Customer will own all right, title and interest in and to (i) any data provided by Customer and/or its Affiliate(s) to Birch Cline and/or Customer and/or its Affiliate(s)’ data accessed or used by Birch Cline or transmitted by Customer and/or its Affiliate(s) to Birch Cline or Birch Cline Equipment in connection with Birch Cline’ provision of the Services, including, but not limited to, Customer and/or its Affiliate(s)’ data included in any written or printed summaries, analyses or reports generated in connection with the Services (Customer and its Affiliate(s)’ data, collectively, the “Customer Data”), (ii) all intellectual property, including patents, copyrights, trademarks, trade secrets and other proprietary information (“IP”) of Customer that may be made available to Birch Cline in the course of providing Services under this MSA, and (iii) all confidential or proprietary information of Customer or Customer Affiliates, including, but not limited to, Customer Data, Customer Reports (as defined in Section 6.3), and other Customer files, documentation and related materials, in each case under this clause (iii), obtained by Birch Cline in connection with this MSA.

Customer grants to Birch Cline a limited, non-exclusive license to use the Customer Data to perform the Services. Birch Cline may process Security Event Data during and after the term hereof to develop and enhance its products and services. “Security Event Data” means information, collected during Birch Cline provision of Services, related to security events. Customer grants to Birch Cline a limited, non-exclusive, perpetual, worldwide, irrevocable license to use and otherwise process the Security Event Data during and after the term hereof to develop, enhance and/or improve its security services and the products and services it offers and provides to customers. To the extent such Security Event Data includes information about individuals, Birch Cline will be the controller. This MSA does not transfer or convey to Birch Cline or any third party any right, title or interest in or to the Customer Data or any associated IP rights, but only a limited right of use as granted in and revocable in accordance with this MSA.

5.2 Birch Cline’ Proprietary Rights. As between Customer and Birch Cline, Birch Cline will own all right, title and interest in and to the Products and Services. This MSA does not transfer or convey to Customer or any third party any right, title or interest in or to the Products and Services or any associated IP rights, but only a limited right of use as granted in and revocable in accordance with this MSA. Birch Cline will retain ownership of all copies of the Documentation. Birch Cline agrees to transfer to Customer all right, title and interest in and to any Customer Purchased Equipment, excluding any right, title or interest in and to the Software and any other Birch Cline IP loaded onto such Customer Purchased Equipment. In addition, Customer agrees that Birch Cline is the owner of all right, title and interest in all IP in any work, including, but not limited to, all inventions, methods, processes, and computer programs including any source code or object code, (and any enhancements and modifications made thereto) contained within the Services and/or Products (collectively, the “Works”), developed by Birch Cline in connection with the performance of the Services hereunder and of general applicability across Birch Cline’ customer base, and Customer hereby assigns to Birch Cline all right, title and interest in and to any copyrights that Customer may have in and to such Work; provided, however, that such Work shall not include Customer’s Confidential Information (as defined in Section 7), Customer Data, Customer Reports (as defined in Section 5.3) or other information belonging, referencing, identifying or pertaining to Customer or Customer Affiliates. Without limiting the foregoing, Birch Cline will own all right, title and interest in all IP in any advisory data, threat data, vulnerability data, analyses, summaries, bulletins and information made available to Customer in Birch Cline’ provision of its Counter Threat Intelligence Services (the “TI Reports”).

During the term of the Services, Birch Cline grants to Customer a limited, non-exclusive license to use such Works and TI Reports solely for Customer to receive the Services and for Customer’s or its Affiliate’s internal security purposes only. Customer acknowledges that any license to the Birch Cline Products, Services, Works and TI Reports expires upon the expiration or termination of any individual Service Order/SOW and/or this MSA.

5.3 Customer Reports; No Reliance by Third Parties. Customer shall own all right, title and interest in and to any written summaries, reports, analyses, and findings or other information or documentation prepared uniquely and exclusively for Customer in connection with the Services and as specified in the Service Order/SOW (the “Customer Reports”). The provision by Customer of any Customer Report or any information therein to any unaffiliated third party shall not entitle such unaffiliated third party to rely on the Customer Report or the contents thereof in any manner or for any purpose whatsoever, and Birch Cline specifically disclaims all liability for any damages whatsoever (whether foreseen or unforeseen, direct, indirect, consequential, incidental, special, exemplary or punitive) to such unaffiliated third party arising from or related to reliance by such unaffiliated third party on any Customer Report or any contents thereof.

This Section 5 shall survive any expiration or termination of this MSA.

6. Customer Cooperation.

Customer acknowledges that Birch Cline’ performance and delivery of the Services are contingent upon: (A) Customer providing safe and hazard-free access to its personnel, facilities, equipment, hardware, network and information, and (B) Customer’s timely decision-making and provision of timely, accurate and complete information and reasonable assistance, including, granting of approvals or permissions, as (A) and (B) are deemed reasonably necessary and reasonably requested for Birch Cline to perform, deliver and/or implement the Services. Customer will promptly obtain and provide to Birch Cline any required licenses, approvals or consents necessary for Birch Cline’ performance of the Services. Birch Cline will be excused from its failure to perform its obligations under this MSA to the extent such failure is caused solely by Customer’s delay in performing or failure to perform its responsibilities under this MSA and/or the Service Order/SOW.

If Birch Cline is requested by Customer, or required by Government regulation, regulatory agency, subpoena, or other legal process to produce Customer Reports, documentation or Birch Cline personnel for testimony or interview with respect to the Services, Customer will reimburse Birch Cline’ and its counsel’s expenses and professional time incurred in responding to such a request.

7. Confidentiality.

In the performance of the Services, Customer and Birch Cline may have access to or be exposed to information of the other party not generally known to the public, including, but not limited to software, product plans, marketing and sales information, customer lists, “know-how,” or trade secrets which may be designated as being confidential or which, under the circumstances surrounding disclosure, ought to be treated as confidential (collectively, “Confidential Information”). Confidential Information may not be shared with third parties unless such disclosure is to personnel of Birch Cline or Customer, including employees, agents and subcontractors, on a “need-to-know” basis in connection with its performance obligations pursuant to this MSA, so long as such personnel have agreed to treat such Confidential Information under terms at least as restrictive as those herein. Each party agrees to take precautions to maintain the confidentiality of Confidential Information by using at least the same degree of care as such party employs with respect to its own Confidential Information of a like-kind nature, but in no case less than a commercially reasonable standard of care. The foregoing shall not include information, which, (A) was known by one party prior to its receipt from the other or is or becomes public knowledge without the fault of the recipient, (B) is received by the recipient from a source other than a party to this MSA, (C) is independently developed by a party without causing a breach of the terms hereunder, or (D) a party is required to disclose in response to an order by a court or governmental agency, provided that advance notice of the disclosure is provided to other party. During the term of this MSA and the Services, Birch Cline shall employ and maintain reasonable and appropriate safeguards designed to: (a) reasonably protect all Customer Data in Birch Cline’ possession from unauthorized use, alteration, access or disclosure; (b) detect and prevent against a Breach (as defined below); and (c) ensure that Birch Cline’ employees and agents are appropriately trained to maintain the confidentiality and security of Customer Data in Birch Cline’ possession.

Birch Cline shall not be liable for any breach of this Section 7 (“Confidentiality”) resulting from a hack or intrusion by a third party (except any third-party subcontractor of Birch Cline) into Customer’s network or systems unless the hack or intrusion was through endpoints or devices monitored by Birch Cline and was caused directly by Birch Cline’ gross negligence or willful misconduct.

Birch Cline agrees to notify Customer promptly (within 48 hours), upon becoming aware of a confirmed use, accidental or unlawful destruction, loss or unauthorized disclosure of Customer Data or Customer Information in violation of this MSA (a “Security Breach”).

This Section 7 shall survive for three (3) years following any termination or expiration of this MSA; provided that with respect to any Confidential Information remaining in the receiving party’s possession following any termination or expiration of this MSA, the obligations under this Section 7 shall survive for as long as such Confidential Information remains in such party’s possession.

8. Warranties; Limitation of Liability.

8.1 Warranties. BIRCH CLINE WARRANTS THAT: (I) ITS PERSONNEL ARE ADEQUATELY TRAINED AND COMPETENT TO PERFORM THE SERVICES, AND (II) THE SERVICES SHALL BE PERFORMED IN A PROFESSIONAL MANNER IN ACCORDANCE WITH THE SERVICE ORDER/SOW AND THIS MSA. EXCEPT AS EXPRESSLY STATED IN THIS SECTION 8.1, BIRCH CLINE (INCLUDING ITS AFFILIATES, SUBCONTRACTORS AND AGENTS) AND EACH OF THEIR RESPECTIVE EMPLOYEES, DIRECTORS AND OFFICERS (COLLECTIVELY, THE “BIRCH CLINE PARTY(IES)”) MAKES NO EXPRESS OR IMPLIED WARRANTIES WITH RESPECT TO ANY OF THE PRODUCTS, SERVICES OR CUSTOMER REPORTS, INCLUDING BUT NOT LIMITED TO, ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, SUITABILITY OR NON-INFRINGEMENT. CUSTOMER UNDERSTANDS THAT BIRCH CLINE’ SERVICES DO NOT CONSTITUTE ANY GUARANTEE OR ASSURANCE THAT THE SECURITY OF CUSTOMER’S SYSTEMS, NETWORKS AND ASSETS CANNOT BE BREACHED OR ARE NOT AT RISK.

8.2 Limitation of Liability.

8.2.1 NEITHER THE BIRCH CLINE PARTIES NOR CUSTOMER WILL BE LIABLE FOR ANY INCIDENTAL, INDIRECT, PUNITIVE, SPECIAL OR CONSEQUENTIAL DAMAGES, ARISING OUT OF OR IN CONNECTION WITH THIS MSA.

8.2.2. NEITHER THE BIRCH CLINE PARTIES NOR CUSTOMER, SHALL HAVE ANY LIABILITY FOR THE FOLLOWING: (A) LOSS OF REVENUE, INCOME, PROFIT, OR SAVINGS, (B) LOST OR CORRUPTED DATA OR SOFTWARE, LOSS OF USE OF SYSTEM(S) OR NETWORK, OR THE RECOVERY OF SUCH, (C) LOSS OF BUSINESS OPPORTUNITY, OR (D) BUSINESS INTERRUPTION OR DOWNTIME.

8.2.3 EXCEPT AS PROVIDED IN SECTIONS 10.1 AND 10.2, THE BIRCH CLINE PARTIES’ AND CUSTOMER’S RESPECTIVE AGGREGATE LIABILITY (WHETHER IN CONTRACT, TORT OR OTHERWISE) FOR ALL CLAIMS OF LIABILITY ARISING OUT OF, OR IN CONNECTION WITH, THIS MSA SHALL NOT EXCEED: (A) FOR THE MSS SERVICES: THE AMOUNTS PAID BY CUSTOMER FOR THE SPECIFIC MSS SERVICE(S) GIVING RISE TO SUCH CLAIM DURING THE PRIOR TWELVE (12) MONTH PERIOD; AND (B) FOR THE CONSULTING SERVICES: THE AMOUNT OF THE SOW.

8.2.4 The foregoing limitations, exclusions and disclaimers shall apply, regardless of whether the claim for such damages is based in contract, warranty, strict liability, negligence, and tort or otherwise. Insofar as applicable law prohibits any limitation herein, the parties agree that such limitation will be automatically modified, but only to the extent so as to make the limitation permitted to the fullest extent possible under such law. The parties agree that the limitations on liabilities set forth herein are agreed allocations of risk constituting in part the consideration for Birch Cline’ sale of Services and/or Products to Customer, and such limitations will apply notwithstanding the failure of essential purpose of any limited remedy and even if a party has been advised of the possibility of such liabilities.

This Section 8 shall survive any expiration or termination of this MSA.

9. Data Privacy.

9.1 Customer authorizes Birch Cline to collect, use, store, transfer and otherwise process the personal data Birch Cline obtains from Customer as a result of providing the Services for the purpose of complying with Birch Cline’ rights and obligations under this MSA and for any additional purposes described pursuant to this MSA.

9.2 Each party expressly agrees that the Data Protection Agreement set out in Appendix A to this MSA shall apply and govern all activities concerning the processing of personal data for the purposes of this MSA.

10. Indemnification.

“Indemnified Parties” shall mean, in the case of Birch Cline, Birch Cline, its Affiliates and subcontractors, and each their respective directors, officers, employees, contractors and agents and, in the case of Customer, Customer, its Affiliates, and each of their respective directors, officers, employees, contractors and agents.

10.1 Birch Cline Indemnity. Birch Cline shall defend, indemnify and hold harmless the Customer Indemnified Parties from any damages, costs and liabilities, expenses (including reasonable and actual attorney’s fees) (“Damages”) actually incurred or finally adjudicated as to any third-party claim or action alleging that the Products, Services or any Customer Reports prepared or produced by Birch Cline and delivered pursuant to this MSA infringe or misappropriate any third party’s patent, copyright, trade secret, or other intellectual property rights enforceable in the country(ies) in which the Products, Services or any Customer Reports are performed or prepared for Customer by Birch Cline (“Indemnified Claims”). If an Indemnified Claim under this Section 10.1 occurs, or if Birch Cline determines that an Indemnified Claim is likely to occur, Birch Cline shall, at its option: (A) obtain a right for Customer to continue using such Products, Services or Customer Reports; (B) modify such Products, Services or Customer Reports to make them non-infringing; or (C) replace such Products, Services or Customer Reports with a non-infringing equivalent. If (A), (B) or (C) above are not reasonably available, either party may, at its option, terminate this MSA and/or the Service Order and/or SOW and Birch Cline will refund any pre-paid fees on a pro-rata basis for the allegedly infringing Products, Services or Customer Reports that have not been performed or provided. Notwithstanding the foregoing, Birch Cline shall have no obligation under this Section 10.1 for any claim resulting or arising from: (A) modifications made to the Products, Services or Customer Reports that were not performed or provided by or on behalf of Birch Cline; or (B) the combination, operation or use by Customer, or anyone acting on Customer’s behalf, of the Products, Services or Customer Reports in connection with a third-party product or service (the combination of which causes the infringement).

THE EXCLUSIONS AND LIMITATIONS SET OUT IN SECTION 8.2.3 DO NOT APPLY TO BIRCH CLINE’ INDEMNITY OBLIGATIONS UNDER THIS SECTION 10.1.

10.2 Customer Indemnity. Customer shall defend, indemnify and hold harmless the Birch Cline Indemnified Parties from any Damages actually incurred or finally adjudicated as to any third party claim, action or allegation (i) that the Customer Data infringes a copyright or misappropriates any trade secrets enforceable in the country(ies) where the Customer Data is accessed, provided to or received by Birch Cline or was improperly provided to Birch Cline in violation of any individual’s rights, Customer’s privacy policies or applicable laws (or regulations promulgated thereunder), (ii) asserting that any action undertaken by Birch Cline in connection with Birch Cline’ performance under this MSA violates law or the rights of a third party, including without limitation claims or allegations related to the decryption, analysis of, collection or transfer of data to Birch Cline, (iii) by Customer Affiliates (other than Signing Customer Affiliate(s)) arising from or relating to the Services, and (iv) arising from a third party’s reliance on a Customer Report, any information therein or any other results or output of the Services. For the avoidance of doubt, Customer’s indemnity obligations in clause (ii) of this Section 10.2 shall not affect Customer’s rights or remedies under this MSA.

THE EXCLUSIONS AND LIMITATIONS OF LIABILITY SET OUT IN SECTION 8.2.3 DO NOT APPLY TO CUSTOMER’S INDEMNITY OBLIGATIONS UNDER THIS SECTION 10.2.

10.3 Mutual General Indemnity. Each party agrees to indemnify and hold harmless the other party from any third-party claim or action (i) for personal bodily injuries, including death, or tangible property damage resulting from the indemnifying party’s gross negligence or willful misconduct (as to which the exclusions and limitations of liability set out in Section 9 shall not apply) and (ii) relating to the indemnifying party’s violation or alleged violation of Section 11, below.

10.4 Indemnification Procedures. The Indemnified Party will (i) promptly notify the indemnifying party in writing of any claim, suit or proceeding for which indemnity is claimed, provided that failure to so notify will not remove the indemnifying party’s obligation except to the extent it is prejudiced thereby, and (ii) allow the indemnifying party to solely control the defense of any claim, suit or proceeding and all negotiations for settlement. In no event may either party enter into any third-party agreement which would in any manner whatsoever affect the rights of the other party or bind the other party in any manner to such third party, without the prior written consent of the other party.

This Section 10 states each party’s exclusive remedies for any third-party claim or action, and nothing in this MSA or elsewhere will obligate either party to provide any greater indemnity to the other.

This Section 10 shall survive any expiration or termination of this MSA.

11. Export. Birch Cline and Customer acknowledge that Products, Customer Purchased Equipment and/or Services provided under this MSA may incorporate encryption, functionality, and are subject to the customs and export control laws and regulations of the United States and other countries to which the Products, Customer Purchased Equipment and/or Services are delivered. Each party agrees to comply with all customs and export control laws and regulations of the United States and other countries to which the Products, Customer Purchased Equipment and/or Services are delivered applicable to such party in the course of performance of its obligations under this MSA. This Section 11 shall apply notwithstanding any other terms of this MSA or any Service Order or SOW issued hereunder. This Section 11 shall survive any expiration or termination of this MSA.

11.1 Birch Cline Responsibilities. Birch Cline agrees that it is responsible for ensuring that the delivery of Products and any Customer Purchased Equipment to Customer is in compliance with U.S. export regulations, including by applying for and obtaining any required U.S. export licenses. Birch Cline’ acceptance of any order for Products and any Customer Purchased Equipment is contingent upon the issuance of any export license required by the U.S. Government. Birch Cline will not be liable for delays or failure to deliver Products and any Customer Purchased Equipment resulting from the inability to obtain such license.

11.2 Customer Responsibilities. Customer agrees to comply with, and to cause and require its Affiliates to comply with all applicable U.S. export regulations governing the retransfer and use of the Products and any Customer Purchased Equipment purchased from Birch Cline, and neither Customer nor its Affiliates will transfer or re-export the Products without written permission from Birch Cline. Without limiting the generality of the foregoing, Customer agrees that neither it nor its Affiliates will re-export, transfer, or share Products or any Customer Purchased Equipment to or with any Sanctioned Person (defined below) or otherwise allow any Sanctioned Person to benefit from the Products, any Customer Purchased Equipment or Services provided by Birch Cline. Customer further agrees that it and its Affiliates are solely responsible for compliance with the applicable laws, rules and regulations governing the importation and use of the Products and any Customer Purchased Equipment in the countries to which Products or any Customer Purchased Equipment will be delivered, including, but not limited to, by making any required customs entry or declaration, paying all duties, taxes and fees owed as a result of the importation or use of Products and any Customer Purchased Equipment by Customer, and obtaining all necessary licenses, permits or other authorizations, including those required under regulations governing the importation and use of encryption products.

11.3 Cooperation.

Customer agrees to cooperate, and to cause and require its Affiliates to cooperate in providing the information necessary for Birch Cline to apply for any required U.S. export licenses. Birch Cline agrees to cooperate with Customer and Customer Affiliates by providing the information necessary for Customer or Customer Affiliates to apply for any required licenses, permits or other authorizations in connection with the importation and use of the Products and Customer Purchased Equipment Notwithstanding the foregoing or any other terms of this MSA or any Service Order or SOW issued hereunder, under no circumstances shall Birch Cline be required to provide any source code, or proprietary information in connection with the pursuit of any license, permit or other authorization to Customer, Customer Affiliates, or any government authority.

This Section 11 shall survive any expiration or termination of this MSA.

12. OFAC Warranty.

Each party warrants that neither it, nor any of its Affiliates nor any of its employees, officers or directors, nor to the knowledge of the party, any agent, or other person acting on its behalf (i) has been or is designated on the Specially Designated Nationals and Blocked Persons List maintained by the Office of Foreign Assets Control of the United States Department of the Treasury (“OFAC”), or, to the extent applicable, any similar list of sanctioned persons issued by the United Nations Security Council, the European Union, Her Majesty’s Treasury or any other relevant governmental authority administering sanctions, including the U.S. Department of State, (ii) is a national or citizen of, organized under the laws of, or resident or operating in any country or territory which is itself the subject of country-wide or territory-wide sanctions, including, but not limited to, as of the date of this MSA, Iran, Cuba, Syria, Sudan, Crimea, and North Korea, (iii) is a Person owned or controlled by any Persons described in clauses (i) and/or (ii) of this sentence, or (iv) is a person identified on the United States Department of Commerce, Bureau of Industry and Security’s “Denied Persons List” or “Entity List” (persons described in clauses (i), (ii) and/or (iii) collectively, “Sanctioned Persons”). Each party agrees that it will promptly notify the other party in writing if the notifying party becomes aware of any changes to this warranty or if to the notifying party’s knowledge any change is threatened. In such event, the notified party shall have the ability to terminate this MSA without affording the notifying party an opportunity to cure.

This Section 12 shall survive any expiration or termination of this MSA.

13. Important Additional Terms.

13.1 Independent Contractor Relationship; No Publicity; Assignment; Subcontracting. The parties are independent contractors. Neither party will have any rights, power or authority to act or create an obligation, express or implied, on behalf of another party except as specified in this MSA. Birch Cline has the right to assign, subcontract or delegate in whole or in part this MSA, or any rights, duties, obligations or liabilities under this MSA, by operation of law or otherwise, provided that Birch Cline shall remain responsible for the performance of Services under this MSA. Otherwise, neither party may assign this MSA without the permission of the other party which such permission shall not be unreasonably withheld or delayed; except that either party may assign this MSA without the consent of the other party to a successor in connection with a merger, sale of all or substantially all of such party’s assets, or other change of control.

13.2 Entire Agreement; Amendments; Severability; Section Headings. This MSA, including any appendices, applicable Service Orders and/or SOW(s) are the entire agreement between Birch Cline and Customer with respect to its subject matter and supersede all prior oral and written understandings, agreements, communications, and terms and conditions between the parties including, without limitation, any terms contained within a purchase order issued by Customer in connection with the Services, including, but not limited to, any separate security or privacy agreements executed by the parties. No amendment to or modification of this MSA, in whole or in part, will be valid or binding unless it is in writing and executed by authorized representatives of both parties; provided, however, that the SLA(s) may be amended from time to time by Birch Cline, as reasonably necessary, in its reasonable discretion as long as such amendments (a) will have no material adverse impact on the Services, Service Levels or Service credits currently being provided to Customer by Birch Cline; and (b) are being effected with respect to all similarly situated Birch Cline customers. If any provision of this MSA is void or unenforceable, the remainder of this MSA will remain in full force and effect. Section headings are for reference only and shall not affect the meaning or interpretation of this MSA.

13.3 Force Majeure. Neither party shall be liable to the other party for any failure to perform any of its obligations under this MSA during any period in which such performance is delayed by circumstances beyond its reasonable control including, but not limited to, fire, flood, war, embargo, strike, riot or the intervention of any governmental authority (a “Force Majeure”). In such event, however, the delayed party must promptly provide the other party with written notice of the Force Majeure. The delayed party’s time for performance will be excused for the duration of the Force Majeure, but if the Force Majeure event lasts longer than thirty (30) days, or fifteen (15) business days as to a Force Majeure delaying Customer’s performance of its payment obligations, the other party may immediately terminate the applicable Service Order and/or SOW by giving written notice to the delayed party.

13.4 Notices. Notices to Birch Cline under this MSA must be in writing and sent by postage prepaid first-class mail or receipted courier service or to such other address including facsimile or electronic as specified in writing and will be effective upon confirmed receipt.

This Section 13.4 shall apply for formal contract notices only and shall not limit the parties’ ability to communicate via electronic mail or other methods as agreed to by the parties for routine communications.

13.5 Governing Law, Forum and Language. THE PARTIES AGREE THAT THIS MSA, ANY THE SERVICES HEREUNDER, OR ANY CLAIM, DISPUTE OR CONTROVERSY (WHETHER IN CONTRACT, TORT, OR OTHERWISE, WHETHER PREEXISTING, PRESENT OR FUTURE, AND INCLUDING STATUTORY, COMMON LAW, AND EQUITABLE CLAIMS) BETWEEN CUSTOMER AND BIRCH CLINE ARISING FROM OR RELATING TO THIS MSA, THE SERVICES, ITS INTERPRETATION, OR THE BREACH, TERMINATION OR VALIDITY THEREOF, THE RELATIONSHIPS WHICH RESULT FROM THIS MSA OR ANY RELATED PURCHASE SHALL BE GOVERNED BY THE LAWS OF THE STATE OF TEXAS, WITHOUT REGARD TO CONFLICTS OF LAW.

The parties agree that any and all claims, causes of action or disputes (regardless of theory) arising out of or relating to the MSA and/or the Services its interpretation, or the breach, termination or validity thereof, the relationships which result from this MSA or any related purchase shall be brought exclusively in the courts located in Dallas County, Texas. Customer and Birch Cline agree to submit to the personal jurisdiction of the courts located within Dallas County, Texas, and agree to waive any and all objections to the exercise of jurisdiction over the parties by such courts and to venue in such courts.

This MSA will be interpreted and construed in accordance with the English language.

13.6 Compliance with Laws. Each party agrees to comply with all laws and regulations applicable to such party in the course of performance of its obligations under this MSA.

13.7 Third Party Beneficiaries. The parties do not intend, nor will any Section hereof be interpreted, to create for any third party beneficiary rights with respect to either of the parties.

13.8 Dispute Resolution. The parties will attempt to resolve any claim, or dispute or controversy (whether in contract, tort or otherwise) arising out of or relating to this MSA or the Services hereunder (a “Dispute”) through face-to-face negotiation with persons fully authorized to resolve the Dispute or through mediation utilizing a mutually agreeable mediator, rather than through litigation. The existence or results of any negotiation or mediation will be treated as confidential. Notwithstanding the foregoing, either party will have the right to seek from a court of competent jurisdiction a temporary restraining order, preliminary injunction or other equitable relief to preserve the status quo, prevent irreparable harm, avoid the expiration of any applicable limitations period, or preserve a superior position with respect to other creditors, although the merits of the underlying Dispute will be resolved in accordance with this paragraph. In the event the parties are unable to resolve the Dispute within thirty (30) days of notice of the Dispute to the other party, the parties shall be free to pursue all remedies available at law or equity.

Appendix A
Data Protection Agreement

 

This Data Protection Agreement (“DPA”) forms part of the MSA between the Customer and Birch Cline and shall apply where the provision of Services by Birch Cline to Customer involves the processing of Personal Data (as defined below) which is subject to Privacy Laws. Except as otherwise expressly stated, Customer is the controller and Birch Cline is the processor (as defined below) of the Personal Data processed under this MSA. In the event of a conflict between this DPA and the MSA, this DPA shall control with respect to its subject matter.

1. Definitions: References in this DPA to “controller”, “data subject”, “processor” and “supervisory authority” shall have the meanings ascribed to them under Privacy Laws. Capitalised terms that are not defined in this DPA shall have the meaning set out in the MSA. In this DPA:

1.1 “Data Breach” means an actual breach by Birch Cline of the security obligations under this DPA leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, the Personal Data transmitted, stored or otherwise processed.

1.2 “Personal Data” means any information relating to an identified or identifiable natural person which is processed by Birch Cline, acting as a processor on behalf of the Customer, in connection with the provision of the Services and which is subject to Privacy Laws.

1.3 “Privacy Laws” means any United States and/or European Union data protection and/or privacy related laws, statutes, directives, or regulations (and any amendments or successors thereto) to which a party to the MSA is subject and which are applicable to the Services including, without limitation, the General Data Protection Regulation 2016/679 when it comes into effect.

1.4 “processing” (and its derivatives) means any operation(s) performed on personal data, whether or not by automated means, including the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1.5 “Security Event Data” means information related to security events which is collected during Birch Cline’ provision of Services.

1.6 “Services” means the managed security services and/or professional services provided by Birch Cline to Customer.

1.7 “Subprocessor” means a third party engaged by Birch Cline (including without limitation an Affiliate and/or subcontractor of Birch Cline) in connection with the processing of the Personal Data.

2. Description of processing: a description of the processing activities to be undertaken as part of the MSA and this DPA are set out in Annex 1.

3. Compliance with laws: the parties agree to comply with their respective obligations under Privacy Laws. In particular, Customer warrants and represents (on its behalf and on behalf of each of its Affiliates where applicable) that it has obtained all necessary authorizations and consents required for compliance with Privacy Laws prior to disclosing, transferring, or otherwise making available any Personal Data to Birch Cline and that it has provided appropriate notifications to data subjects describing the purpose for which their personal data will be used pursuant to this DPA and MSA.

4. Birch Cline obligations

4.1 Instructions: Birch Cline shall process the Personal Data only in accordance with Customer’s reasonable and lawful instructions (unless otherwise required to do so by applicable law). Customer hereby instructs Birch Cline to process the Personal Data to provide the Services and comply with Birch Cline’ rights and obligations under the MSA and this DPA. The MSA and DPA comprise Customer’s complete instructions to Birch Cline regarding the processing of Personal Data. Any additional or alternate instructions must be agreed between the parties in writing, including the costs (if any) associated with complying with such instructions. Birch Cline is not responsible for determining if Customer’s instructions are compliant with applicable law, however, if Birch Cline is of the opinion that a Customer instruction infringes applicable Privacy Laws, Birch Cline shall notify Customer as soon as reasonably practicable and shall not be required to comply with such infringing instruction.

4.2 Confidentiality: To the extent the Personal Data is confidential (pursuant to applicable law), Birch Cline shall maintain the confidentiality of the Personal Data in accordance with Section 8 of the MSA and shall require persons authorized to process the Personal Data (including its Subprocessors) to have committed to materially similar obligations of confidentiality.

4.3 Disclosures: Birch Cline may only disclose the Personal Data to third parties (including without limitation its Affiliates and Subprocessors) for the purpose of:

(a) complying with Customer’s reasonable and lawful instructions

(b) as required in connection with the Services and as permitted by the MSA and/or this DPA, and/or

(c) as required to comply with Privacy Laws, or an order of any court, tribunal, regulator or government agency with competent jurisdiction to which Birch Cline, its Affiliates and/or Subprocessors is subject PROVIDED that Birch Cline will (to the extent permitted by law) inform the Customer in advance of any disclosure of Personal Data and will reasonably co-operate with Customer to limit the scope of such disclosure to what is legally required.

4.4 Assisting with data subject rights: Birch Cline shall, as required in connection with the Services and to the extent reasonably practicable, assist Customer to respond to requests from data subjects exercising their rights under Privacy Laws (including without limitation the right of access, rectification and/or erasure) in respect of the Personal Data. Birch Cline reserves the right to charge Customer for such assistance if the cost of assisting exceeds a nominal amount. Birch Cline shall notify Customer as soon as practicable of any request Birch Cline receives from data subjects relating to the exercise of their rights under applicable Privacy Laws during the Term of the MSA (to the extent such request relates to the Personal Data).

4.5 Security: Taking into account industry standards, the costs of implementation, the nature, scope, context and purposes of the processing and any other relevant circumstances relating to the processing of the Personal Data, Birch Cline shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk in respect of any Personal Data in accordance with Birch Cline policies. The parties agree that the security measures described in Annex 2 (Information Security Measures) provide an appropriate level of security for the protection of Personal Data to meet the requirements of this clause.

4.6 Subprocessors: Customer agrees that Birch Cline may appoint and use Subprocessors which are identified on the subcontractor list posted on the Portal, as updated from time to time) to process the Personal Data in connection with the Services PROVIDED that:

(a) Birch Cline puts in place a contract in writing with each Subprocessor that imposes obligations that are (i) relevant to the services to be provided by the Subprocessors and (ii) materially similar to the rights and/or obligations granted or imposed on Birch Cline under this DPA; and

(b) where a Subprocessor fails to fulfil its data protection obligations as specified above, Birch Cline shall be liable to the Customer for the performance of the Subprocessor’s obligations.

4.7 Deletion of Personal Data: Upon termination of the Services (for any reason) and if requested by Customer in writing, Birch Cline shall as soon as reasonably practicable delete the Personal Data, PROVIDED that Birch Cline may: (a) retain one copy of the Personal Data as necessary to comply with any legal, regulatory, judicial, audit or internal compliance requirements; and/or (b) defer the deletion of the Personal Data to the extent and for the duration that any Personal Data or copies thereof cannot reasonably and practically be expunged from Birch Cline’ systems; and for such retention or deferral periods as referred to in subparagraphs (a) or (b) of this clause, the provisions of this DPA shall continue to apply to such Personal Data. Birch Cline reserves the right to charge Customer for any reasonable costs and expenses incurred by Birch Cline in deleting the Personal Data pursuant to this clause.

5. Data Breaches: Where a Data Breach is caused by Birch Cline’ failure to comply with its obligations under this DPA, Birch Cline shall:

5.1 notify Customer without undue delay after establishing the occurrence of the Data Breach and shall, to the extent such information is known or available to Birch Cline at the time, provide Customer with details of the Data Breach, a point of contact and the measures taken or to be taken to address the Data Breach

5.2 reasonably cooperate and assist Customer with any investigation into, and/or remediation of, the Data Breach (including, without limitation and where required by Privacy Laws, the provision of notices to regulators and affected individuals)

5.3 not inform any third party of any Data Breach relating to the Personal Data without first obtaining Customer’s prior written consent, except as otherwise required by applicable law provided that nothing in this clause shall prevent Birch Cline from notifying other customers whose personal data may be affected by the Data Breach, and

In the event Customer intends to issue a notification regarding the Data Breach to a supervisory authority, other regulator or law enforcement agency, Customer shall (unless prohibited by law) allow Birch Cline to review the notification and Customer shall have due regard to any reasonable comments or amendments proposed by Birch Cline.

6. Liability and Costs: Neither Birch Cline nor any Subprocessor shall be liable for any claim brought by Customer or any third party arising from any action or omission by Birch Cline and/or Subprocessors to the extent such action or omission resulted from compliance with Customer’s instructions.

7. Security Event Data: Birch Cline will process Security Event Data as part of its provision of Services. Customer acknowledges that Birch Cline may also process Security Event Data in order to develop, enhance and/or improve its security services and the products and services it offers and provides to customers. Birch Cline shall be the controller in respect of any personal data in the Security Event Data and, for the duration of its processing of such Security Event Data, Birch Cline shall (i) comply with applicable Privacy Laws and (ii) safeguard such Security Event Data with security measures that are no less protective than those set out in this DPA. Restrictions on the disclosure and transfer of Personal Data in this DPA shall not apply in connection with Birch Cline’ processing of the Security Event Data for the purposes described in this clause, however, Birch Cline shall not disclose any Security Event Data that is traceable to Customer to any third parties (other than Affiliates and Subprocessors) unless permitted under the MSA and/or this DPA, or the disclosure is required in order to comply with applicable law or legal process. Birch Cline shall not be required to return or delete Security Event Data upon termination of the Services (for any reason). Customer shall ensure its personnel and any other data subjects whose personal data is processed by Birch Cline in connection with the Services are appropriately notified of the fact their personal data may be processed in connection with the development, enhancement and/or provision of Birch Cline’ products or services as described in this clause. If Customer is compelled by a legally binding order (e.g. of a court or regulatory authority of competent jurisdiction) to have the Security Event Data deleted, then Birch Cline agrees, as appropriate, to anonymize, pseudonymize or delete the Security Event Data that is the subject of the binding order as soon as practicable.

8. Privacy Impact Assessments: Birch Cline shall provide reasonable cooperation and assistance to Customer, to the extent applicable in relation to Birch Cline’ processing of the Personal Data and within the scope of the agreed Services, in connection with any data protection impact assessment(s) which the Customer may carry out in relation to the processing of Personal Data to be undertaken by Birch Cline, including any required prior consultation(s) with supervisory authorities. Birch Cline reserves the right to charge Customer a reasonable fee for the provision of such cooperation and assistance.