Terms of Use

In this Agreement, the following capitalised terms have the meanings set out below. Terms defined in the singular include the plural and vice versa.

In this Agreement: (a) “including”, “includes” and “in particular” are illustrative and do not limit the generality of the preceding words; (b) references to a Clause or Annex are to a clause of or annex to this Agreement; (c) references to legislation include that legislation as amended, extended or re-enacted from time to time; (d) headings are for convenience only and do not affect interpretation; (e) references to “written” or “in writing” include email unless expressly stated otherwise; and (f) any obligation on a Party not to do something includes an obligation not to permit or allow that thing to be done.

No rule of construction shall apply to the disadvantage of a Party on the basis that it prepared or proposed this Agreement or any part of it. This Agreement has been negotiated between commercial parties of comparable sophistication.

Subject to Customer’s continuing compliance with this Agreement and payment of all Fees when due, Barricade grants to Customer, for each Subscription and for the duration of the applicable Subscription Term only, a limited, revocable, non-exclusive, non-transferable, non-sublicensable right to access and use the Platform, within the Territory specified in the Order Form, for: (a) Customer’s internal business purposes; (b) the provision of security and premises-protection services to End Users at the relevant Protected Location; and (c) the marketing, resale and onward supply of Subscriptions to Channel Partners and End Users in accordance with Clause 3.12.

The licence granted under Clause 3.1 includes the right for Customer to permit Channel Partners, Authorised Users and End Users to access and use those parts of the Platform intended for their respective use, provided that Customer: (a) ensures that each such person complies with the terms of this Agreement as if they were Customer; and (b) remains fully responsible and liable for all acts and omissions of Channel Partners, Authorised Users and End Users as if they were the acts and omissions of Customer.

The Platform is licensed, not sold. Nothing in this Agreement transfers to Customer any ownership of, or any right, title or interest in, the Software, the Platform, any Barricade Materials or any Intellectual Property Rights therein. All rights not expressly granted in this Clause 3 are expressly reserved to Barricade.

Customer shall not, and shall not permit or enable any third party to:

Barricade may, without prejudice to any other right or remedy, monitor and audit Customer’s use of the Platform for the purposes of verifying compliance with this Agreement and correctly determining the number of Protected Locations. Barricade’s records generated by the Platform shall constitute prima facie evidence of such use, absent manifest error demonstrated by Customer.

Where an audit or Barricade’s records reveal that Customer has used the Platform in excess of the Subscriptions paid for, Customer shall, within thirty (30) days of written notice, pay the Licence Fees applicable to such excess use for the entire period of unlicensed use, together with interest in accordance with Clause 6.7.

The licence granted under this Clause 3 terminates automatically and immediately, without any requirement for notice, upon expiry or termination of the relevant Subscription or of this Agreement, howsoever arising.

Territory, non-exclusivity and absence of distribution rights. The licence is granted for the Territory specified in the Order Form and is non-exclusive in all respects. Without limiting the generality of the foregoing:

Branding and presentation to Customer’s customers. Customer markets and supplies its own offering under its own brand. Accordingly:

Benchmarking, testing and publication. Customer shall not, and shall procure that its Channel Partners, Authorised Users, End Users, advisers and contractors shall not, without Barricade’s prior written consent:

All data and results of the kind described in Clause 3.10, however obtained or generated, constitute the Confidential Information of Barricade and are subject to Clause 16. Where Barricade consents to any exercise under Clause 3.10, it may impose conditions, including as to methodology, environment, timing, scope, verification of results, prior review of any output and the form and extent of any permitted disclosure. Barricade may withhold consent at its discretion. This Clause 3.11 is without prejudice to Clauses 3.4(d), 3.4(h) and 18.6, and survives expiry or termination of this Agreement.

Resale through Channel Partners. The Parties acknowledge that Customer’s business model involves the onward supply of Subscriptions to Channel Partners, which in turn supply End Users. Accordingly, and notwithstanding Clause 3.4(c):

Flow-down of terms. Each Channel Agreement shall be in writing and shall, as a minimum, impose on the Channel Partner obligations that are no less protective of Atlo AS than those set out in Clauses 3.4, 3.9, 3.10, 10, 16, 17 and 20.3, and shall expressly:

Customer shall, on Barricade’s reasonable written request, certify in writing that its Channel Agreements comply with Clause 3.13, and shall promptly remedy any non-compliance. Barricade’s failure to request such certification, or its knowledge of any non-compliance, shall not constitute a waiver of Clause 3.13 or a consent to any breach.

During the Subscription Term, Barricade shall make the Platform available to Customer as a hosted service in accordance with this Agreement and the Documentation. A Subscription grants access to the complete Barricade software platform applicable to the subscription tier purchased, including, where applicable and as made generally available by Barricade from time to time:

The Subscription is a software licence and hosted service only. It does not include, and Barricade is under no obligation to supply, and no ownership of any software, hardware or intellectual property is transferred in respect of: (a) Gateways, alarm panels, sensors, cameras, SIM cards, routers or any other hardware or equipment; (b) installation, commissioning, cabling, maintenance or field services at any Protected Location; (c) alarm receiving centre, guarding, keyholding or response services; (d) telecommunications, mobile network, internet or utility services; or (e) any Third-Party Services. Any such items or services are supplied, if at all, under separate terms and against separate charges.

Barricade shall host the Platform on cloud infrastructure located within the European Union or European Economic Area, save where otherwise stated in the DPA or agreed in writing. Barricade may change its hosting providers, regions (within the EU/EEA), architecture, sub-processors and technical implementation at its discretion, provided that it does not thereby materially degrade the functionality or security of the Platform.

Barricade continuously develops the Platform. Barricade may add, modify, improve, re-package, rename, re-tier or discontinue individual features, modules or integrations, provided that Barricade shall not, during a Subscription Term, remove functionality in a manner that materially and adversely reduces the core functionality of the Platform as described in the Documentation without providing Customer with at least ninety (90) days’ prior written notice. Deprecation of individual integrations with Third-Party Services, of features that are unused by Customer, or of features withdrawn for security, legal or licensing reasons, shall not constitute a material and adverse reduction.

Barricade may make features, modules or APIs available on a trial, pilot, early-access, “beta” or evaluation basis. Such features are provided “as is”, may be modified or withdrawn at any time without notice, are excluded from Clause 11 (SLA), Clause 19.2 (performance warranty) and Support Services, and are used by Customer entirely at its own risk.

Barricade may perform its obligations under this Agreement itself or through Affiliates, subcontractors, hosting providers and other suppliers, provided that Barricade remains responsible to Customer for the performance of its obligations under this Agreement.

Planned maintenance shall, where reasonably practicable, be performed outside Business Hours and notified in advance through the Platform, by email or via a status page. Emergency maintenance and security remediation may be performed at any time without prior notice.

Each Subscription has an Initial Term of twelve (12) months commencing on the Activation Date of the relevant Protected Location.

Upon expiry of the Initial Term, each Subscription shall automatically renew for successive Renewal Terms of twelve (12) months each in accordance with Clause 8, unless cancelled in accordance with Clause 8.3 or otherwise terminated under this Agreement.

This Agreement commences on the Effective Date and shall remain in force for as long as any Subscription remains active, and thereafter until terminated in accordance with Clause 24. Termination of an individual Subscription does not terminate this Agreement in respect of other Subscriptions. Where no Subscription has been active for a continuous period of thirty (30) days, either Party may terminate this Agreement on thirty (30) days’ written notice.

Subscriptions are non-cancellable and non-refundable during the Initial Term and during each Renewal Term, save as expressly provided in Clauses 9.4, 19.3, 22.4, 24.5, 26.4 and 26.5 and in Section 6.4 of the DPA. Removal, disconnection, replacement or decommissioning of a Gateway, or the cessation of use of a Protected Location, during a Subscription Term does not reduce, suspend, terminate or give rise to any refund of the Licence Fee for that Subscription Term.

Where Customer wishes to align the renewal dates of multiple Subscriptions to a common billing anniversary, Barricade may, at its discretion and upon written request, co-terminate Subscriptions with a pro-rated adjustment to the Licence Fees for the transitional period.

The Licence Fee is the amount specified in the Order Form, charged per Protected Location per year unless the Order Form expressly provides otherwise. The Licence Fee is charged for each Protected Location that has an active Subscription, irrespective of the extent to which the Platform is actually used at that Protected Location and irrespective of the number of Gateways, devices, Authorised Users or End Users associated with it, unless otherwise stated in the Order Form.

Fees are stated and payable in the currency specified in the Order Form, and in the absence of such specification in euro (EUR). Where invoicing in another currency is agreed, conversion shall be made at Barricade’s applicable rate on the invoice date.

Unless otherwise specified in the Order Form, the Licence Fee for each Subscription is invoiced annually in advance for the applicable Initial Term or Renewal Term. Barricade may aggregate all Subscriptions activated within a calendar month into a single monthly invoice for administrative convenience.

Subscriptions activated during a period for which Customer has been invoiced on a consolidated or aligned billing cycle shall be invoiced on a pro-rated basis from the Activation Date to the end of the then-current billing period, calculated on a daily basis (1/365th of the annual Licence Fee per day), rounded to the nearest whole euro cent.

All invoices are payable within thirty (30) days of the invoice date, without deduction, set-off, counterclaim, withholding or delay of any kind, to the bank account nominated by Barricade. Payment is deemed made when the full invoiced amount has been credited to Barricade’s account.

If Customer disputes an invoice in good faith, it shall notify Barricade in writing within fifteen (15) days of the invoice date, specifying the disputed amount and the grounds for the dispute. Customer shall pay all undisputed amounts by the due date. Amounts not disputed within that period are deemed accepted. A disputed invoice does not entitle Customer to withhold payment of any other invoice.

Any amount not paid when due shall bear late-payment interest in accordance with the Norwegian Act on Interest on Overdue Payments of 17 December 1976 No. 100 (lov om renter ved forsinket betaling, forsinkelsesrenteloven), at the rate determined pursuant to Section 3 of that Act and published semi-annually by the competent Norwegian authority, accruing from the due date until payment is received in full. In addition, Barricade is entitled to: (a) the standard compensation for recovery costs prescribed under Section 3a of that Act; (b) reminder and collection fees in accordance with the Norwegian Debt Collection Act of 13 May 1988 No. 26 (inkassoloven) and regulations thereunder; and (c) recovery of all reasonable costs of collection, including legal and debt-collection agency fees.

Except as expressly stated in this Agreement, all Fees are non-refundable and non-cancellable, and all payment obligations are unconditional. Fees are payable in full irrespective of any downtime, incident, failure to meet an SLA target, suspension under Clause 23 caused by Customer, or any failure or degradation of Third-Party Services.

Price adjustment on renewal. Barricade may adjust the Licence Fee and any other recurring Fees with effect from the commencement of any Renewal Term by giving Customer not less than ninety (90) days’ prior written notice (which may be given by email) before the end of the then-current Subscription Term. No index, cap, formula or other limitation applies to such adjustment, which is at Barricade’s discretion.

Where Customer does not wish to accept an adjusted Fee notified under Clause 6.9, its sole remedy is to cancel the affected Subscriptions in accordance with Clause 8.3, so that they expire at the end of the then-current Subscription Term. The Parties acknowledge that a notice given in accordance with Clause 6.9 leaves Customer not less than forty-five (45) days in which to exercise that right before the cancellation deadline in Clause 8.3 falls. If Customer does not validly cancel by that deadline, the adjusted Fees apply automatically with effect from the commencement of the Renewal Term, without further act by either Party. Fees for the then-current Subscription Term are not affected by Clause 6.9.

In addition to Clauses 6.9 and 6.10, Barricade may pass through to Customer, with thirty (30) days’ written notice and at any time, any increase in costs directly attributable to: (a) new or increased taxes, levies, duties or regulatory charges; (b) increases in charges imposed by telecommunications, connectivity, SIM or mandatory third-party licence providers; or (c) statutory or regulatory requirements imposed on the Platform. Where the aggregate of increases passed through under this Clause 6.11 exceeds five per cent (5%) of the Licence Fee in any twelve (12) month period, Customer may terminate the affected Subscriptions with effect from the end of the then-current Subscription Term by written notice given within fifteen (15) days of Barricade’s notice of the relevant increase.

Barricade may require payment by direct debit, card mandate or advance payment, and may require security, a deposit or a shortened payment term where Customer has a history of late payment or where Barricade reasonably assesses a deterioration in Customer’s creditworthiness.

Customer shall maintain accurate records of Protected Locations and shall, on reasonable request and not more than twice in any twelve (12)-month period, provide Barricade with such information as is reasonably necessary to verify the number of Protected Locations.

All Fees are stated exclusive of value added tax (merverdiavgift) and of any other sales, use, consumption, service, digital services, excise, withholding or similar taxes, duties, levies or charges of any nature imposed by any authority in any jurisdiction (together, “Taxes”).

Customer shall pay, in addition to the Fees, all Taxes properly chargeable in respect of the supply of the Platform and Support Services, except for taxes imposed on Barricade’s net income, profits or capital, or Barricade’s employment taxes.

Where the supply is subject to the reverse-charge mechanism or a comparable rule, Customer shall self-account for the applicable VAT in its own jurisdiction. Customer shall provide Barricade with a valid VAT/registration number and any exemption certificate, and shall promptly notify Barricade of any change. If Customer fails to provide a valid VAT number or exemption evidence, Barricade may charge and Customer shall pay Norwegian VAT or such other Taxes as Barricade is required to collect.

If Customer is required by law to make any deduction or withholding from any payment under this Agreement, Customer shall gross up the payment so that Barricade receives and retains a net amount equal to the amount it would have received had no such deduction or withholding been required. Customer shall provide Barricade with official receipts or certificates evidencing any amounts withheld and remitted.

Customer shall indemnify Barricade against any Taxes, interest, penalties and costs assessed against Barricade as a result of Customer’s failure to comply with this Clause 7 or as a result of incorrect information provided by Customer.

Each Subscription shall automatically renew at the end of the Initial Term, and at the end of each Renewal Term, for a further period of twelve (12) months on the terms of this Agreement then in force, unless cancelled in accordance with this Clause 8.

Renewal occurs automatically and requires no act by either Party. No separate renewal notice, purchase order, confirmation or countersignature is required for a Subscription to renew, and the absence of such documentation shall not affect the validity or enforceability of the renewal.

Cancellation. Either Party may cancel a Subscription with effect from the end of the then-current Subscription Term by giving written notice by email, received by the other Party no later than forty-five (45) calendar days before the end of the then-current Subscription Term.

If notice of cancellation is received after the deadline in Clause 8.3, the cancellation shall be ineffective in respect of the forthcoming Renewal Term, and the Subscription shall automatically renew for a further period of twelve (12) months. Such late notice shall, unless withdrawn in writing, take effect as a cancellation with effect from the end of that Renewal Term.

Cancellation is only valid when submitted by email to the address specified for that purpose in the Order Form or published for that purpose on Barricade’s website, or to such other address as Barricade notifies in writing in accordance with Clause 31.1, or, where no such address has been specified or notified, to Barricade’s address for contractual notices. Notice of cancellation given by any other means, including verbally, by telephone, by post, through a support ticket, through the Platform user interface, via a third party, or by removal or disconnection of a Gateway, shall be invalid and of no effect.

A valid notice of cancellation must identify: (a) Customer and the relevant account; (b) each Protected Location or Subscription to be cancelled, or state that all Subscriptions are cancelled; and (c) the date from which cancellation is to take effect. Barricade shall confirm receipt of a valid cancellation notice by email. Customer is responsible for retaining evidence of despatch and receipt; the date of receipt by Barricade governs.

Cancellation under this Clause 8 takes effect only at the end of the then-current Subscription Term. It does not entitle Customer to any refund, credit or rebate of Fees paid or payable in respect of the then-current Subscription Term, and all Fees for that term remain payable in full.

Nothing in this Clause 8 limits either Party’s rights of termination for cause under Clause 24.

A Subscription becomes automatically active and billable immediately upon a Gateway being added to a Protected Location through the Platform. No further order, confirmation, signature or approval is required for a Subscription to come into existence, and the act of adding a Gateway to a Protected Location constitutes Customer’s binding order for a Subscription in respect of that Protected Location on the terms of this Agreement.

The Activation Date, and the identity and number of Protected Locations, shall be determined by the records of the Platform. Such records shall constitute prima facie evidence between the Parties, absent manifest error demonstrated by Customer within fifteen (15) days of the relevant invoice in accordance with Clause 6.6.

Customer is responsible for all Subscriptions activated under its account or hierarchy, including those activated by Channel Partners at any tier and by its and their Authorised Users, employees, installers, subcontractors, agents and any other person using credentials issued under Customer’s account, whether or not such activation was authorised internally by Customer. Customer shall implement appropriate internal controls over who may add Gateways and create Protected Locations.

Activation in error does not of itself terminate or reverse a Subscription. Where Customer demonstrates to Barricade’s reasonable satisfaction that a Subscription was activated in obvious error and notifies Barricade within fourteen (14) days of the Activation Date, and the Protected Location has not been placed into operational use, Barricade shall cancel the Subscription and credit the corresponding Licence Fee. This is a discretionary accommodation and Barricade is under no obligation to grant it in any other circumstances.

Replacement of a Gateway at an existing Protected Location, whether due to fault, upgrade or otherwise, does not create a new Subscription and does not give rise to an additional Licence Fee for the then-current Subscription Term, provided the Protected Location remains the same.

Moving a Gateway to a different physical premises constitutes a new Protected Location and gives rise to a new Subscription and a new Licence Fee, unless Barricade agrees otherwise in writing.

Deactivation, removal or disconnection of a Gateway does not constitute cancellation of the Subscription. Cancellation may only be effected in accordance with Clause 8.

Customer shall, at its own cost and risk, and as a condition of Barricade’s performance:

Customer shall further:

Barricade shall have no liability for any failure or delay in performance, any incident, any loss of data, any unavailability or any degradation of the Platform to the extent caused or contributed to by Customer’s failure to comply with this Clause 10, and any resolution times under Clause 11 shall be extended accordingly.

Customer acknowledges that Barricade may be unable to provide the Platform or Support Services where Customer fails to provide required cooperation, and that Fees remain payable in full in such circumstances.

Barricade shall use commercially reasonable efforts to respond to and resolve incidents reported by Customer in accordance with the priority classifications and target times set out in the table below. The same table is reproduced, with supplementary operational detail, in Annex A.

The response and resolution times stated in Clause 11.1 are target estimates only. They are indicative internal objectives and do not constitute guaranteed, committed or contractually binding service levels, availability commitments, performance guarantees or conditions of this Agreement.

Barricade’s sole obligation in respect of service levels is to use commercially reasonable efforts to meet the stated targets. Barricade does not warrant or guarantee that any target will be met in any individual case or at all.

Actual response and resolution times may vary, and may materially exceed the stated targets, depending on factors including:

Barricade reserves the right to classify and reclassify the severity of any incident at its reasonable discretion, based on its assessment of actual operational impact. Where Customer disagrees with a classification, the matter shall be escalated in accordance with Annex A, but Barricade’s determination shall apply pending resolution.

Barricade may modify, expand, restructure or supplement this SLA and Annex A from time to time, including by introducing new priority levels, changing target times, or adding operational or support-tier detail, provided that Barricade shall not reduce the overall level of support materially and adversely during a Subscription Term without giving Customer at least thirty (30) days’ prior written notice. In the event of any inconsistency between the table in Clause 11.1 and Annex A as amended in accordance with this Clause 11.6, Annex A shall prevail.

Immediate amendment. Notwithstanding Clause 11.6, Barricade may amend, restrict or suspend the operation of this SLA and Annex A with immediate effect and without prior notice where the amendment is required or reasonably necessary in order to:

Barricade shall notify Customer of any amendment made under Clause 11.6A as soon as reasonably practicable after the event, and shall use commercially reasonable efforts to limit the amendment in scope and duration to what the circumstances require. No amendment made under Clause 11.6A shall entitle Customer to any refund, credit, damages or right of termination.

No remedies for failure to meet targets. Save as provided in Clause 21.5 and to the fullest extent permitted by applicable law, any failure by Barricade to meet a target response time or estimated resolution time set out in Clause 11.1 or Annex A shall not entitle Customer to, and Customer irrevocably waives any claim to:

The targets in Clause 11.1 do not apply to, and no support obligation arises in respect of: (a) trial, pilot, beta or early-access features; (b) incidents caused by Third-Party Services as described in Clause 13; (c) incidents caused by Customer’s breach of Clause 10; (d) planned or emergency maintenance; (e) Force Majeure Events; (f) periods of suspension under Clause 23; or (g) any use of the Platform outside the scope of this Agreement or the Documentation.

The commercial terms of this Agreement, and in particular the level of the Licence Fee, have been agreed on the express basis of the allocation of risk in this Clause 11 and in Clauses 13, 20 and 21. Customer acknowledges that Barricade would not make the Platform available at the Licence Fee stated in Clause 6.1 on any other basis.

During the Subscription Term, Barricade shall provide Support Services in respect of the Platform in accordance with this Clause 12 and Annex A, at no additional charge save as provided in Clause 12.6.

Support Services are provided in English and Norwegian, during Business Hours, through the channels specified in Annex A (primarily an email channel). Barricade may, but is not obliged to, respond to P1 – Critical incidents outside Business Hours.

Support Services comprise: (a) receipt, triage, classification and investigation of incident reports; (b) diagnosis of faults in the Platform; (c) provision of corrections, patches, workarounds or configuration guidance in respect of reproducible defects in the Platform; and (d) reasonable technical guidance on the configuration and use of the Platform consistent with the Documentation.

First-line support. Customer shall act as the sole point of contact for, and shall provide first-line support to, its Channel Partners, Authorised Users and End Users, and shall ensure that each Channel Partner provides first-line support to its own Authorised Users and End Users. Customer shall triage and resolve all enquiries capable of resolution using the Documentation and shall escalate to Barricade only genuine, reproducible defects in the Platform, accompanied by the diagnostic information reasonably required. Barricade has no obligation to communicate with, and shall have no direct contractual relationship with, any Channel Partner, Authorised User or End User, and may decline to accept any incident report, enquiry or communication received other than from Customer’s designated contacts.

Support Services exclude, and Barricade is under no obligation to provide:

Barricade may charge for work performed at the Customer’s request that falls outside the scope of Support Services, and for time spent investigating a reported incident that proves not to be attributable to a defect in the Platform. The scope and price of any such work shall be agreed in writing in advance, and Barricade is not obliged to perform work that has not been so agreed. Where investigation time proves not to be attributable to a defect in the Platform, Barricade shall notify the Customer before continuing to incur chargeable time and shall agree the basis of charge before doing so.

Barricade may withhold or limit Support Services while any invoice is overdue, while a Subscription is suspended under Clause 23, or where Customer is in material breach of this Agreement.

Customer acknowledges that the Platform is designed to operate in conjunction with equipment, networks, systems and services that are supplied, owned, controlled or operated by third parties, and that the correct functioning of the Platform is dependent on the correct functioning of such Third-Party Services. Barricade has no control over Third-Party Services and does not adopt, endorse, warrant, guarantee or assume responsibility for them.

Exclusion of liability for third-party causes. To the fullest extent permitted by applicable law, Barricade shall not be liable — whether in contract, tort (including negligence), under statute or on any other basis — for any downtime, unavailability, delay, latency, degradation, reduced or lost functionality, false alarm, failure to detect or transmit an alarm or event, corruption or loss of data, or interruption, defect or deficiency of any kind arising directly or indirectly from, or caused or contributed to by, any of the following:

Any interoperability, compatibility, integration or connectivity between the Platform and a Third-Party Service is provided as a convenience and on an “as available” basis. Barricade may modify, limit, suspend or discontinue any integration with a Third-Party Service at any time, including where the third party changes its terms, technology, pricing or availability, or where continued integration would expose Barricade to legal, security or commercial risk. Such modification or discontinuation shall not constitute a breach of this Agreement, and shall not entitle Customer to any refund, credit, damages or right of termination.

Customer’s use of any Third-Party Service is governed exclusively by Customer’s agreement with the relevant third party. Customer is solely responsible for procuring, licensing, paying for, configuring, maintaining and enforcing its rights in respect of Third-Party Services, and for pursuing any claim it may have against the relevant third party. Customer shall not bring, and shall procure that its End Users do not bring, any claim against Barricade in respect of a Third-Party Service.

Where Barricade resells, procures or facilitates the supply of any Third-Party Service to Customer, it does so as agent or intermediary only and, to the fullest extent permitted by law, Barricade’s liability shall be limited to passing through to Customer the benefit of any remedy actually obtained by Barricade from the relevant third-party supplier.

Customer shall indemnify Barricade in accordance with Clause 22.2 against any claim brought by an End User or other third party against Barricade to the extent arising out of or relating to a Third-Party Service.

Barricade shall make Updates to the Platform available as part of the Subscription. Updates to the hosted components of the Platform are deployed by Barricade centrally and take effect automatically without any act by Customer.

Customer shall accept and, where applicable, install, deploy or permit the deployment of all Updates without undue delay, including firmware updates to Gateways and version updates to installer and mobile applications. Customer shall ensure that Authorised Users and End Users keep applications on their devices updated to a supported version.

Updates may change, add, restrict, replace or remove features, user interfaces, workflows, data formats, APIs or system requirements. Barricade shall endeavour to maintain backward compatibility of APIs where commercially reasonable, and shall give at least ninety (90) days’ notice before introducing a breaking change to a generally available, documented, non-deprecated API, save where a shorter period is required for security, legal or third-party reasons.

Barricade is not obliged to maintain, support or continue to operate: (a) superseded versions of the Software; (b) legacy APIs or protocol versions following the applicable deprecation period; (c) integrations with equipment or Third-Party Services that have reached end-of-life or end-of-support; or (d) functionality dependent on technologies no longer supported by their providers.

Barricade may deploy security updates and emergency patches at any time, without prior notice and without regard to any notice period in this Agreement, where it reasonably considers this necessary to protect the security, integrity, legality or availability of the Platform or the data of its customers.

Barricade shall have no liability for any incident, degradation, loss or non-performance to the extent caused by Customer’s failure to implement an Update, by Customer’s continued use of an unsupported version, or by Customer’s use of equipment or firmware that is not at a supported revision level.

Updates are provided subject to and form part of the Platform for the purposes of this Agreement, including Clause 3 (Grant of Licence), Clause 15 (Intellectual Property Rights) and Clause 21 (Limitation of Liability). No Update shall be construed as creating any new or expanded warranty.

All Intellectual Property Rights in and to the Barricade Materials are and shall remain the exclusive property of Atlo AS (or its licensors). This includes, without limitation, all Intellectual Property Rights in:

Customer receives only the limited, revocable, non-exclusive, non-transferable, non-sublicensable licence expressly set out in Clause 3, exercisable solely during the period in which the relevant Subscription is active. No other rights, licences, assignments or immunities are granted, whether expressly, by implication, by estoppel, by course of dealing or otherwise.

Customer shall not register, apply to register, use or authorise the use of any trade mark, trade name, domain name, company name or social media identifier that consists of or incorporates “Barricade”, “Atlo”, or any mark confusingly similar thereto, and shall not challenge or assist any third party in challenging Barricade’s Intellectual Property Rights. Customer may use Barricade’s word marks solely as necessary to identify the Platform in the ordinary course of promoting and supplying services to End Users, in accordance with any brand guidelines notified by Barricade.

Customer shall promptly notify Barricade in writing upon becoming aware of any actual, threatened or suspected infringement, misappropriation or unauthorised use of the Barricade Materials, and shall provide Barricade with all reasonable assistance, at Barricade’s cost, in investigating and enforcing its rights. Barricade has the sole right to decide whether and how to pursue any such matter.

Customer Data. Customer retains all right, title and interest in and to Customer Data. Customer grants Barricade and its Affiliates and sub-processors a non-exclusive, worldwide, royalty-free licence to host, store, copy, transmit, display, adapt and otherwise Process Customer Data to the extent necessary to: (a) provide, maintain, secure and support the Platform; (b) perform Barricade’s obligations and exercise its rights under this Agreement; (c) prevent or address technical, security or fraud issues; and (d) comply with applicable law. Where Customer Data comprises Personal Data, such Processing is governed additionally by Clause 17 and the DPA.

Usage Data. Barricade may collect, generate and use Usage Data for any lawful business purpose, including operating, securing, benchmarking, analysing and improving the Platform, developing new products and features, capacity planning, and producing aggregated statistics and industry insights. Barricade shall not publish or disclose Usage Data in a form that identifies Customer, any Authorised User, any End User or any Protected Location. All Intellectual Property Rights in Usage Data vest in Atlo AS.

Feedback. Where Customer, an Authorised User or an End User provides any suggestion, idea, feature request, enhancement proposal, evaluation, error report or other feedback relating to the Platform (“Feedback”), Customer hereby assigns, and shall procure the assignment to Atlo AS of, to the fullest extent permitted by law, all Intellectual Property Rights in such Feedback, and to the extent any such assignment is ineffective, grants Atlo AS a perpetual, irrevocable, worldwide, royalty-free, transferable and sublicensable licence to use, modify, exploit and commercialise the Feedback without restriction, attribution or compensation. Feedback shall not be deemed Customer’s Confidential Information.

Nothing in this Agreement obliges Barricade to escrow, disclose or make available any source code. Customer waives any right to demand source code escrow or disclosure, save where required by mandatory law.

This Clause 15 survives termination or expiry of this Agreement.

For the purposes of this Agreement, “Confidential Information” means all information disclosed by or on behalf of one Party (the “Disclosing Party”) to the other (the “Receiving Party”), whether before or after the Effective Date, in any form or medium, whether or not marked or identified as confidential, which is of a confidential, proprietary or commercially sensitive nature, including:

The Receiving Party shall: (a) keep the Confidential Information strictly confidential; (b) use it solely for the purpose of performing its obligations and exercising its rights under this Agreement (the “Permitted Purpose”); (c) protect it using at least the same degree of care as it applies to its own confidential information of like importance, and in no event less than a reasonable standard of care; and (d) not disclose it to any third party except as permitted by Clause 16.3.

The Receiving Party may disclose Confidential Information to its Affiliates, officers, employees, professional advisers, auditors, subcontractors, sub-processors, in the case of Customer its Channel Partners (to the extent strictly necessary for them to market, supply and support Subscriptions), and, in the case of Barricade, hosting and service providers, in each case only: (a) to those persons who need to know it for the Permitted Purpose; (b) after informing them of its confidential nature; and (c) where they are bound by obligations of confidentiality no less protective than those in this Clause 16. The Receiving Party remains liable for any breach by such persons.

The obligations in this Clause 16 do not apply to information which the Receiving Party can demonstrate by contemporaneous written evidence: (a) was lawfully in its possession without obligation of confidence before disclosure; (b) is or becomes publicly available other than through breach of this Agreement or any other duty of confidence; (c) is lawfully received from a third party free of any obligation of confidence; or (d) is independently developed by the Receiving Party without use of or reference to the Confidential Information.

The Receiving Party may disclose Confidential Information to the extent required by law, by a court or regulatory authority of competent jurisdiction, or by the rules of a securities exchange, provided that (to the extent legally permitted) it gives the Disclosing Party prompt prior written notice, limits the disclosure to the minimum required, cooperates with any lawful attempt by the Disclosing Party to resist or narrow the disclosure, and continues to treat the information as confidential for all other purposes.

Upon expiry or termination of this Agreement, or upon the Disclosing Party’s written request, the Receiving Party shall promptly return or irretrievably destroy all Confidential Information and all copies thereof, and confirm such destruction in writing, save that it may retain: (a) one copy to the extent required by law, regulation or bona fide internal compliance and record-retention policies; and (b) copies contained in routine backups made in the ordinary course, which shall be deleted in accordance with the Receiving Party’s ordinary retention cycle. Retained copies remain subject to this Clause 16.

Neither Party shall issue any press release or public statement referring to this Agreement or the other Party without the other Party’s prior written consent. Notwithstanding the foregoing, Barricade may identify Customer as a customer of the Platform, and refer to Customer by name, in customer lists, on its website and in tender submissions and investor materials. Use of Customer’s logo, or of any quotation or endorsement attributed to Customer, requires Customer’s prior written consent, which shall not be unreasonably withheld or delayed.

The Receiving Party acknowledges that a breach of this Clause 16 may cause irreparable harm for which damages alone would be an inadequate remedy, and that the Disclosing Party shall be entitled to seek interim and injunctive relief in addition to any other remedy.

The obligations in this Clause 16 survive expiry or termination of this Agreement for a period of five (5) years, and indefinitely in respect of source code, trade secrets (forretningshemmeligheter within the meaning of the Norwegian Trade Secrets Act of 27 March 2020 No. 15) and Personal Data.

Each Party shall comply with its respective obligations under Applicable Data Protection Law in connection with this Agreement. Neither Party shall cause the other to be in breach of Applicable Data Protection Law by any act or omission.

The Parties acknowledge and agree that, in respect of Personal Data contained in Customer Data and Processed through the Platform, Customer acts as controller (or, where Customer Processes such Personal Data on behalf of another controller, as processor) and Barricade acts as processor (or sub-processor, as applicable) within the meaning of Article 4 of the GDPR.

Such Processing is governed by the Data Processing Agreement set out in Annex B, which forms an integral part of this Agreement and which satisfies the requirements of Article 28(3) of the GDPR. Where the Parties execute a separate data processing agreement or where a customer of Customer requires bespoke processor terms, the Parties shall enter into such separate data processing agreement in writing, and in the event of conflict the separately executed data processing agreement shall prevail over Annex B in respect of the Processing to which it relates.

Customer warrants and undertakes that: (a) it has and shall maintain a valid legal basis under Article 6 of the GDPR (and, where applicable, Article 9) for all Processing that it instructs Barricade to perform; (b) it has provided all information and notices required under Articles 12– 14 of the GDPR to data subjects, including End Users and their household members and personnel; (c) it has obtained all consents and completed all assessments required under national law for any monitoring, image capture, camera surveillance or recording at Protected Locations; and (d) its instructions to Barricade shall not require Barricade to Process Personal Data in breach of Applicable Data Protection Law.

Barricade shall Process Personal Data only on the documented instructions of Customer, which instructions are constituted by this Agreement, the DPA, the Documentation and Customer’s configuration and use of the Platform, and as otherwise required by Union or Norwegian law.

In respect of Personal Data that each Party Processes for its own purposes — including business contact details of the other Party’s personnel, account administration data, billing data, and Barricade’s Processing for the purposes of security monitoring, fraud prevention, compliance with legal obligations and generation of Usage Data — each Party acts as an independent controller and is separately responsible for compliance with Applicable Data Protection Law.

Any transfer of Personal Data to a country outside the EEA that is not the subject of an adequacy decision shall be made only on the basis of an appropriate transfer mechanism under Chapter V of the GDPR, including the European Commission’s Standard Contractual Clauses, supplemented by a transfer impact assessment where required. The Parties agree that the Standard Contractual Clauses are deemed incorporated in accordance with Section 11 of the DPA where relevant.

Each Party shall bear its own costs of compliance with Applicable Data Protection Law, save that Barricade may charge on a time-and-materials basis at its then-current rates for assistance requested by Customer that materially exceeds the assistance required of a processor under Articles 28, 32–36 of the GDPR, or for assistance arising from Customer’s own non-compliance.

Nothing in this Agreement limits or excludes either Party’s liability to a data subject or to a supervisory authority under Applicable Data Protection Law. As between the Parties, liability arising from a breach of this Clause 17 or the DPA shall be apportioned in accordance with Article 82 of the GDPR and shall be subject to the limitations in Clause 21, save to the extent such limitation is prohibited by mandatory law.

Territories outside the EEA. Where Customer markets, sells, supports or otherwise makes its offering available in any territory outside the European Economic Area, including in Asia:

Customer shall indemnify Barricade in accordance with Clause 22.2 in respect of any claim, investigation, enforcement action or fine arising out of Customer’s breach of Clause 17.10.

Barricade shall implement and maintain appropriate technical and organisational measures designed to protect the Platform and Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing and the risks involved. Such measures are described in Appendix 2 to the DPA.

Barricade’s security programme shall, as a minimum and as further described in Appendix 2 to the DPA, address: (a) encryption of Customer Data in transit over public networks and at rest; (b) logical access control, least-privilege administration, authentication and credential management; (c) network segregation, firewalling and intrusion detection; (d) secure software development practices, code review and dependency management; (e) vulnerability management and patching; (f) logging, monitoring and alerting; (g) backup and disaster recovery; (h) personnel screening, confidentiality undertakings and security awareness training; (i) supplier and sub-processor assurance; and (j) documented incident response procedures.

Barricade shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, in accordance with Section 8 of the DPA, and shall provide such information and cooperation as Customer reasonably requires to comply with its own notification obligations.

Barricade shall use commercially reasonable efforts to align its information security management practices with recognised industry standards, including the principles of ISO/IEC 27001. Nothing in this Clause 18 constitutes a warranty of certification unless a certificate is expressly stated in Annex A.

Customer shall comply with its own security obligations under Clause 10.1(d) and shall not: (a) share, publish or embed credentials, API keys or tokens insecurely; (b) grant access to persons who are not Authorised Users; or (c) circumvent or weaken any security control of the Platform. Customer shall notify Barricade without undue delay of any suspected compromise of credentials or of Customer’s own systems that may affect the Platform.

Customer shall not conduct any penetration test, vulnerability scan, red-team exercise, stress test or security assessment against the Platform without Barricade’s prior written consent and compliance with any conditions Barricade imposes. Barricade may require that findings be disclosed to it under Clause 16 and not to any third party.

No absolute security. Customer acknowledges that no system, network, product or service can be made completely secure, and that Barricade does not warrant or guarantee that the Platform, Customer Data or any Protected Location cannot be compromised, circumvented, defeated, jammed, intercepted or attacked. Compliance with this Clause 18 discharges Barricade’s security obligations under this Agreement and, save as provided in Clause 21.5 and to the fullest extent permitted by applicable law, Barricade shall not be liable for security incidents occurring notwithstanding such compliance.

Each Party warrants and represents to the other that: (a) it is duly incorporated and validly existing under the laws of its jurisdiction of incorporation; (b) it has full power, capacity and authority to enter into and perform this Agreement, and the person executing this Agreement on its behalf is duly authorised to do so; (c) this Agreement constitutes a legally binding obligation upon it; (d) it is not subject to any insolvency, bankruptcy or comparable proceedings and is not aware of any circumstances likely to give rise to such proceedings; and (e) it shall comply with all laws applicable to its performance of this Agreement, including anti-bribery, anti-money laundering, competition, export control and sanctions laws.

Limited performance warranty. Barricade warrants only that the Platform will, during the Subscription Term, perform substantially in accordance with the then-current Documentation when used normally and in accordance with this Agreement and the Documentation. This is the only warranty given by Barricade in respect of the Platform.

Sole remedy. Where Customer notifies Barricade in writing of a breach of the warranty in Clause 19.2 within thirty (30) days of the date on which Customer first became aware, or ought reasonably to have become aware, of the non-conformity, and provides sufficient information for Barricade to reproduce it, Barricade shall at its option and expense: (a) correct or replace the non-conforming part of the Platform; (b) provide a commercially reasonable workaround; or (c) if none of the foregoing is achievable using commercially reasonable efforts within a reasonable period, terminate the affected Subscriptions and refund the Licence Fees paid in respect of the unexpired portion of the then-current Subscription Term for those Subscriptions, calculated on a pro rata temporis basis. The remedies in this Clause 19.3 are Customer’s sole and exclusive remedies for breach of the warranty in Clause 19.2, and are given in place of any right to price reduction (prisavslag), rectification, damages or termination that might otherwise arise, to the fullest extent permitted by applicable law.

The warranty in Clause 19.2 does not apply, and Barricade shall have no obligation under Clause 19.3, to the extent the non-conformity arises from or relates to: (a) any Third-Party Service or any matter described in Clause 13.2; (b) Customer’s breach of Clause 10 or Clause 14.2, including use of unsupported hardware, firmware, browsers, operating systems or application versions; (c) modification, misuse, misconfiguration, unauthorised use or combination of the Platform with items not authorised by Barricade; (d) trial, pilot, beta or free-of-charge features; (e) any failure attributable to Customer Data or to Customer’s instructions; or (f) any act or omission of Customer, an Authorised User, an End User or any third party.

Customer warrants and represents that: (a) it has independently satisfied itself that the Platform meets its requirements and those of its End Users, and has not relied on any statement, representation, demonstration or assurance not expressly set out in this Agreement or the Documentation; (b) it holds all licences, permits, authorisations and registrations required to carry on its business, including any required for the provision of security or alarm services; and (c) it shall not use the Platform in a manner that could reasonably be expected to bring Barricade or the Barricade brand into disrepute.

Save for the express warranties set out in Clause 19, and to the fullest extent permitted by applicable law, the Platform, the Software, the Documentation, the Support Services and all other Barricade Materials and services are provided “as is” and “as available”, and Barricade expressly excludes and disclaims all other warranties, conditions, terms, representations, guarantees and undertakings of any kind, whether express, implied, statutory or arising from course of dealing, usage or trade practice, including any implied warranty, term or condition as to:

To the extent permitted by law, the Parties agree that the Norwegian Sale of Goods Act of 13 May 1988 No. 27 (kjøpsloven) and any comparable statutory default rules on defects, non-conformity, notification, price reduction and termination do not apply to this Agreement, and that the statutory and non-statutory background rules of Norwegian contract law relating to non-conformity, notification, rectification, price reduction (prisavslag), damages (erstatning) and termination are hereby derogated from and replaced by the express provisions of Clauses 11, 13, 19, 20 and 21.

Not a life-safety or emergency service. Customer acknowledges and agrees, and shall ensure that its End Users are informed in writing, that:

Customer shall not make, and shall procure that its personnel and resellers do not make, any statement to any End User or third party that is inconsistent with Clause 20.3. Where Customer does so, Customer shall indemnify Barricade in accordance with Clause 22.2.

Nothing in this Clause 20 excludes or limits any liability or right that cannot lawfully be excluded or limited under mandatory Norwegian law.

This Clause 21 sets out the entire financial liability of each Party (including any liability for the acts and omissions of its Affiliates, employees, agents, subcontractors and sub-processors) to the other in respect of: (a) any breach of this Agreement; (b) any use made of the Platform, the Software, the Documentation or the Support Services; and (c) any representation, statement, or tortious act or omission (including negligence) arising under or in connection with this Agreement.

Excluded losses. To the fullest extent permitted by applicable law, Barricade shall have no liability whatsoever, whether in contract, tort (including negligence), for breach of statutory duty or otherwise, for any of the following, whether direct or indirect and whether or not foreseeable or in the contemplation of the Parties:

Aggregate cap. Except where prohibited by applicable law, Barricade’s total aggregate liability arising out of or in connection with this Agreement, whether in contract, tort (including negligence), for breach of statutory duty, in restitution or otherwise, shall in no circumstances exceed the total Fees actually paid by Customer to Barricade under this Agreement during the twelve (12) month period immediately preceding the event giving rise to the claim. Where a series of connected events gives rise to more than one claim, they shall be treated as a single claim arising on the date of the first such event. The cap in this Clause 21.3 is a single aggregate cap and is not applied per claim, per Subscription, per Protected Location or per contract year.

Where the claim arises before twelve (12) months’ Fees have become payable, the cap shall be the Fees actually paid during the shorter period preceding the event giving rise to the claim. In no case shall the cap exceed the Fees actually paid, nor shall it be increased by reference to Fees paid more than twelve (12) months before the event giving rise to the claim.

Carve-outs. Nothing in this Agreement excludes or limits either Party’s liability for: (a) death or personal injury caused by its negligence; (b) fraud or fraudulent misrepresentation; (c) wilful misconduct (forsett) or gross negligence (grov uaktsomhet); (d) Customer’s obligation to pay Fees when due; (e) breach of Clause 3.4 (licence restrictions) or Clause 16 (Confidentiality) by Customer; (f) either Party’s indemnity obligations under Clause 22, subject to Clause 22.5; or (g) any other liability that cannot lawfully be excluded or limited under mandatory Norwegian law.

Barricade shall have no liability under this Agreement to the extent that a loss is caused or contributed to by: (a) Customer’s breach of this Agreement, including Clauses 10 and 14.2; (b) Customer’s failure to mitigate its loss; (c) Customer’s failure to maintain adequate backups, insurance or contingency arrangements; (d) any Third-Party Service; or (e) any act or omission of Customer, an Authorised User, an End User or a third party. Damages shall be reduced accordingly having regard to the contributory cause.

Limitation period. To the fullest extent permitted by applicable law, and notwithstanding the longer limitation periods provided by the Norwegian Limitation Act of 18 May 1979 No. 18 (foreldelsesloven), any claim by Customer arising out of or in connection with this Agreement must be notified to Barricade in writing, with reasonable particulars, within twelve (12) months of the date on which Customer first became aware, or ought reasonably to have become aware, of the circumstances giving rise to the claim, failing which the claim shall be barred and unenforceable. This Clause 21.7 does not apply to any claim falling within Clause 21.5(a) to (c).

Customer shall notify Barricade of any claim, and shall take all reasonable steps to mitigate any loss, promptly upon becoming aware of the relevant circumstances.

Allocation of risk. The Parties acknowledge that: (a) the exclusions and limitations in Clauses 11, 13, 20 and 21 are a fundamental and integral element of the bargain between them, and that the Fees have been set in express reliance upon them; (b) they have had the opportunity to obtain independent legal advice and to procure insurance in respect of the risks so allocated; and (c) but for these exclusions and limitations, Barricade would not have entered into this Agreement or would have charged materially higher Fees. Each Party, acting as a commercial undertaking and having had the opportunity to negotiate and to obtain independent advice, considers the allocation of risk in this Agreement to be reasonable and balanced.

To the fullest extent permitted by law, Customer shall not bring any claim arising out of or in connection with this Agreement against any director, officer, employee, Affiliate, subcontractor or supplier of Atlo AS personally, and shall pursue any such claim exclusively against Atlo AS.

Each provision of this Clause 21 operates separately. If any provision is held to be unenforceable, the remaining provisions shall continue in full force and effect, and the unenforceable provision shall be modified to the minimum extent necessary to make it enforceable while preserving the Parties’ intended allocation of risk.

Barricade IP indemnity. Subject to Clauses 22.3 to 22.5, Barricade shall defend Customer against any claim brought by a third party alleging that Customer’s use of the Platform in accordance with this Agreement and the Documentation infringes that third party’s Intellectual Property Rights subsisting in the EEA, and shall indemnify Customer against damages and costs finally awarded against Customer by a court of competent jurisdiction, or agreed in a settlement approved in writing by Barricade, in respect of such claim.

Customer indemnity. Customer shall indemnify, defend and hold harmless Barricade, Atlo AS and their Affiliates, and their respective directors, officers, employees and agents, against all claims, demands, actions, proceedings, liabilities, losses, damages, fines, penalties, costs and expenses (including reasonable legal fees) arising out of or in connection with:

Conditions. The indemnified Party shall, in respect of any claim for which it seeks an indemnity under this Clause 22: (a) notify the indemnifying Party in writing promptly and in any event within ten (10) Business Days of becoming aware of the claim; (b) grant the indemnifying Party sole control of the defence, negotiation and settlement of the claim; (c) provide all reasonable assistance and information requested, at the indemnifying Party’s cost; and (d) not make any admission, compromise, settlement or public statement in relation to the claim without the indemnifying Party’s prior written consent. Failure to comply with this Clause 22.3 relieves the indemnifying Party of its obligations to the extent it is prejudiced thereby.

Exclusions from the Barricade IP indemnity. Clause 22.1 does not apply to any claim to the extent it arises from or relates to:

Barricade’s aggregate liability under Clause 22.1 is subject to, and counts towards, the cap in Clause 21.3. Customer’s liability under Clause 22.2 is not subject to the cap in Clause 21.3.

All amounts payable under this Clause 22 shall be paid within thirty (30) days of written demand accompanied by reasonable supporting documentation, and shall be paid free of any deduction, set-off or withholding.

Barricade may, at its discretion and with immediate effect, suspend or restrict the access of Customer, of any Channel Partner at any tier, or of any Authorised User or End User, to the Platform, in whole or in part, including by disabling individual accounts, sub-accounts, Channel Partner hierarchies, API keys, integrations or individual Protected Locations, where:

Barricade shall, where reasonably practicable and lawful, give Customer prior notice of suspension and an opportunity to remedy the relevant circumstance. Where the ground for suspension concerns security, unlawful activity, a legal requirement or a risk of material harm, Barricade may suspend without prior notice and shall notify Customer as soon as reasonably practicable thereafter.

Suspension does not: (a) constitute termination of this Agreement or of any Subscription; (b) relieve Customer of any obligation, including the obligation to pay all Fees, which continue to accrue and remain payable in full during any period of suspension; or (c) extend the Subscription Term.

Barricade shall restore access promptly after the circumstance giving rise to suspension has been remedied to Barricade’s reasonable satisfaction and all outstanding amounts, including interest and collection costs, have been paid. Barricade may charge a reasonable reinstatement fee reflecting the work required to restore the service; any such fee shall be agreed in writing before reinstatement, and Barricade is not obliged to reinstate access until the ground for suspension is remedied, all outstanding amounts are paid and any reinstatement fee has been agreed.

To the fullest extent permitted by law, Barricade shall have no liability to Customer, any Authorised User or any End User for any loss, damage, cost or claim arising out of or in connection with a suspension made in accordance with this Clause 23, and Customer shall indemnify Barricade against any claim brought by an End User in respect of such suspension.

Suspension is without prejudice to Barricade’s right to terminate under Clause 24. Barricade’s exercise or non-exercise of its rights under this Clause 23 shall not be construed as a waiver of any other right or remedy.

Subscriptions may be brought to an end at the expiry of a Subscription Term by cancellation in accordance with Clause 8. Save as expressly provided in this Agreement, neither Party may terminate a Subscription for convenience during a Subscription Term.

Termination by Barricade with immediate effect. Barricade may terminate this Agreement and/or any or all Subscriptions immediately by written notice to Customer (or, in the case of limb (f) below, on thirty (30) days’ written notice) where:

Termination by Customer. Customer may terminate this Agreement and all Subscriptions by written notice to Barricade with immediate effect where Barricade: (a) commits a material breach of this Agreement which is incapable of remedy or which has not been remedied within thirty (30) days of written notice requiring remedy; or (b) becomes subject to an insolvency event of the kind described in Clause 24.2(b). For the avoidance of doubt, and without limiting Clause 11.7, a failure to meet an SLA target does not constitute a material breach.

Either Party may terminate for prolonged Force Majeure in accordance with Clause 26.4.

Discontinuation of the Platform. Barricade may terminate this Agreement and all Subscriptions on not less than ninety (90) days’ written notice if it decides to discontinue the Platform generally or to withdraw from the market or territory concerned. In such case Barricade shall refund the Licence Fees paid in respect of the unexpired portion of the then-current Subscription Term, calculated pro rata temporis, which refund shall be Customer’s sole and exclusive remedy in respect of such termination.

Termination of this Agreement automatically terminates all Subscriptions. Termination of an individual Subscription does not terminate this Agreement or any other Subscription.

Termination or expiry of this Agreement, howsoever arising, is without prejudice to any right, remedy, obligation or liability accrued to either Party as at the date of termination.

Upon expiry or termination of this Agreement or of any Subscription:

Data export. For a period of thirty (30) days following the effective date of termination, Barricade shall, upon Customer’s written request, make available to Customer a reasonable export of Customer Data in a commonly used machine-readable format, or provide limited read-only access for the purpose of extraction. Barricade may charge on a time-and-materials basis for any assistance beyond the provision of standard export functionality, and may make the provision of such chargeable assistance conditional upon payment of all outstanding Fees; Barricade shall not, however, withhold the export of Personal Data by reason of unpaid Fees. Barricade is under no obligation to retain or provide Customer Data after this period.

Deletion. Following the period referred to in Clause 25.2, and in any event within ninety (90) days after the effective date of termination, Barricade shall delete or irreversibly anonymise Customer Data from its production systems, and shall delete Customer Data from backups in accordance with its ordinary backup retention cycle, save to the extent Barricade is required or permitted to retain data: (a) to comply with a mandatory legal or regulatory retention obligation, including under the Norwegian Bookkeeping Act (bokføringsloven); (b) to establish, exercise or defend legal claims; or (c) in the form of Usage Data. Retained data shall continue to be protected in accordance with Clauses 16 and 18 and shall be deleted upon expiry of the applicable retention period. Customer is solely responsible for exporting and retaining any Customer Data it requires before deletion occurs.

Customer acknowledges that following termination the Platform will cease to receive, process, transmit or store data from Gateways and other equipment at Protected Locations, that alarms and events will no longer be handled by the Platform, and that Customer is solely responsible for informing its End Users and for making alternative arrangements in good time. Barricade shall have no liability to Customer, any Authorised User or any End User in respect of the consequences of such cessation.

Survival. The following Clauses survive expiry or termination of this Agreement: Clause 1.2, Clause 2 (Definitions), Clause 3.7, Clause 6 (Fees and Payment, in respect of accrued and payable amounts), Clause 7 (Taxes), Clause 11.7, Clause 13 (Third-Party Services and Dependencies), Clause 15 (Intellectual Property Rights), Clause 16 (Confidentiality), Clause 17 (Data Protection and GDPR) and the DPA to the extent of any continuing Processing, Clause 18.7, Clause 20 (Warranty Disclaimer), Clause 21 (Limitation of Liability), Clause 22 (Indemnification), Clause 23.5, Clause 25 (Effect of Termination), Clause 27 (Governing Law), Clause 28 (Dispute Resolution), Clause 30 (Entire Agreement) and Clause 31 (Miscellaneous), together with any other provision which by its nature is intended to survive.

Continuity for Channel Partners and End Users. Customer acknowledges that termination of this Agreement will cause the access of every Channel Partner, Authorised User and End User to cease. Accordingly, on or at any time after service of a notice of termination or cancellation:

Clause 25.6 does not oblige Barricade to contract with any person, to continue any Subscription, or to accept any Channel Partner as a customer, and is without prejudice to Clauses 25.1 and 25.4.

Neither Party shall be in breach of this Agreement, nor liable for any delay in performing or failure to perform any of its obligations (other than an obligation to pay money), if such delay or failure results from a “Force Majeure Event”, being any event or circumstance beyond that Party’s reasonable control, including:

The affected Party shall notify the other Party in writing as soon as reasonably practicable, and in any event within thirty (30) days, of the Force Majeure Event, describing its nature, its effect on performance and the expected duration, and shall keep the other Party informed of material developments.

The affected Party shall use reasonable endeavours to mitigate the effect of the Force Majeure Event and to resume performance as soon as reasonably practicable. Its obligations shall be suspended for the duration of the Force Majeure Event, and any applicable time for performance, including any SLA target, shall be extended accordingly.

If a Force Majeure Event prevents a Party from performing a material obligation for a continuous period exceeding ninety (90) days, either Party may terminate this Agreement and all affected Subscriptions on thirty (30) days’ written notice. In such case, Barricade shall refund the Licence Fees paid in respect of the unexpired portion of the then-current Subscription Term for Subscriptions rendered wholly unusable by the Force Majeure Event, calculated pro rata temporis, which refund shall be the terminating Party’s sole and exclusive remedy.

A Force Majeure Event does not suspend, excuse or postpone Customer’s obligation to pay Fees that have accrued or that fall due, save in respect of Subscriptions rendered wholly unusable for a continuous period exceeding thirty (30) days, for which the Licence Fee shall be abated pro rata temporis for the period of unusability in excess of thirty (30) days.

Lack of funds, inability to obtain credit, changes in market conditions, and the affected Party’s own failure to maintain its systems, licences or supplier relationships shall not constitute a Force Majeure Event.

This Agreement, and any dispute, controversy, proceeding or claim of whatever nature arising out of or in any way relating to it or its subject matter, formation, validity, interpretation, performance, breach, enforceability or termination (including non-contractual disputes or claims), shall be governed by and construed exclusively in accordance with the laws of the Kingdom of Norway.

The application of any conflict-of-laws rules or principles that would result in the application of the law of any other jurisdiction is expressly excluded.

The United Nations Convention on Contracts for the International Sale of Goods (CISG) of 11 April 1980, and the Norwegian Act of 13 May 1988 No. 28 relating to the ratification thereof, shall not apply to this Agreement.

Where this Agreement provides that a provision applies “to the fullest extent permitted by law” or uses comparable wording, that provision shall be construed and applied so as to give it the maximum effect permitted under mandatory Norwegian law, and shall be deemed modified only to the minimum extent necessary to render it enforceable. Where any common-law drafting convention, term of art or construction used in this Agreement conflicts with mandatory Norwegian law, Norwegian law shall prevail and the provision shall be interpreted so as to achieve, as nearly as possible, the commercial result intended by the Parties within the limits of Norwegian law.

The Parties shall attempt in good faith to resolve any dispute arising out of or in connection with this Agreement by negotiation. A Party wishing to invoke this Clause shall give written notice to the other setting out the nature of the dispute and its proposed resolution, and the Parties shall each nominate a senior representative with authority to settle the dispute, who shall meet (in person or remotely) within fifteen (15) Business Days of the notice.

If the dispute is not resolved within thirty (30) days of the notice under Clause 28.1, either Party may commence proceedings in accordance with Clause 28.3. Compliance with Clause 28.1 is not a condition precedent to, and shall not delay, the commencement of proceedings where a Party seeks interim or injunctive relief, seeks to recover an undisputed debt, or where a limitation period is at risk of expiring.

Customers domiciled within the EEA, Switzerland, the United Kingdom or Denmark. Where the Customer is domiciled in a State bound by the Convention on Jurisdiction and the Recognition and Enforcement of Judgments in Civil and Commercial Matters signed at Lugano on 30 October 2007 (the “Lugano Convention”), any dispute, controversy or claim arising out of or relating to this Agreement, including its formation, validity, interpretation, performance, breach or termination, shall be subject to the exclusive jurisdiction of the ordinary courts of Norway, and the Parties irrevocably agree that Hordaland District Court (Hordaland tingrett), Bergen, Norway, shall be the exclusive legal venue (verneting). This Clause 28.3 constitutes an agreement on jurisdiction within the meaning of Article 23 of the Lugano Convention, to which both the Kingdom of Norway and the European Union are party, and the courts of any other State shall decline jurisdiction accordingly.

Customers domiciled elsewhere — arbitration. Where the Customer is domiciled in any other State, including any State in Africa, Asia, the Middle East or the Americas, any dispute, controversy or claim arising out of or relating to this Agreement, including its formation, validity, interpretation, performance, breach or termination, shall be referred to and finally resolved by arbitration on the following terms:

The Customer irrevocably waives any objection to the forum determined by Clause 28.3 or 28.4 on the grounds of inconvenient forum or otherwise, and waives any right it may have to commence or maintain proceedings in any other court, tribunal or forum, including in its own place of domicile. Where there is any doubt as to which of Clauses 28.3 and 28.4 applies, Barricade may elect, and its election shall be binding on the Customer.

Notwithstanding Clauses 28.3 and 28.4, Barricade may: (a) apply to any court of competent jurisdiction for interim, protective, injunctive or enforcement relief, including in respect of its Intellectual Property Rights or Confidential Information; and (b) pursue the recovery of undisputed sums due through the Norwegian Conciliation Board (forliksrådet), the Norwegian enforcement authority (namsmyndighetene), debt-collection proceedings, or the equivalent procedures in any jurisdiction in which Customer has assets.

The language of any court proceedings under Clause 28.3 shall be Norwegian unless the court determines otherwise, and documents in the English language may be submitted without translation to the extent the court permits. The language of any arbitration under Clause 28.4 shall be English.

Each Party shall continue to perform its obligations under this Agreement during the currency of any dispute, save where entitled to suspend or terminate under this Agreement.

Customer shall not assign, transfer, novate, charge, encumber, declare a trust over, subcontract or otherwise dispose of any or all of its rights or obligations under this Agreement, in whole or in part, without Barricade’s prior written consent. Any purported assignment in breach of this Clause is void.

For the purposes of Clause 29.1, a change of control of Customer, a merger, demerger, or a sale of all or substantially all of Customer’s business or assets shall be treated as an assignment requiring Barricade’s prior written consent, which shall not be unreasonably withheld save where the transferee is a competitor of Barricade, is subject to sanctions, or does not meet Barricade’s reasonable creditworthiness requirements. Customer shall notify Barricade in writing not less than thirty (30) days before any such event, or as soon as legally permitted.

Barricade may, without Customer’s consent and without notice: (a) assign, transfer or novate this Agreement, in whole or in part, to any Affiliate or to any successor in title, or to any acquirer of all or substantially all of its business or assets relating to the Platform; (b) assign or charge its right to receive payment, including by way of factoring or invoice financing; and (c) subcontract or delegate the performance of any of its obligations, provided that Barricade remains responsible to Customer for the performance of its subcontractors.

Sub-processing of Personal Data is governed by Section 6 of the DPA.

This Agreement is binding upon and shall benefit each Party’s permitted successors and assigns.

This Agreement, comprising these Platform Terms, the Annexes and any Order Form accepted by Barricade, constitutes the entire agreement between the Parties in respect of its subject matter and supersedes all prior and contemporaneous agreements, arrangements, understandings, negotiations, proposals, term sheets, letters of intent, memoranda of understanding, quotations, presentations and representations, whether written or oral, relating to that subject matter.

Each Party acknowledges that in entering into this Agreement it does not rely on, and shall have no remedy in respect of, any statement, representation, assurance, warranty, demonstration, roadmap, marketing material or understanding (whether made negligently or innocently) other than as expressly set out in this Agreement. Nothing in this Clause 30 limits liability for fraud or fraudulent misrepresentation.

Order of precedence. In the event of any conflict, ambiguity or inconsistency, the following order of precedence applies (highest first): (a) any separately executed data processing agreement entered into pursuant to Clause 17.3, in respect of Processing of Personal Data only; (b) Annex B (Data Processing Agreement); (c) the Order Form; (d) the main body of these Platform Terms, Clauses 1 to 31; (e) Annex A (Service Levels and Support Specification); and (f) the Documentation.

No customer terms. Any term or condition contained in or referred to in any purchase order, vendor portal, supplier registration, procurement platform, standard terms of purchase, acknowledgement, invoice portal, click-through or other document or communication issued or referred to by Customer shall be of no effect and shall not form part of this Agreement, notwithstanding that Barricade may have signed, acknowledged, registered on, invoiced under or otherwise appeared to accept such document, unless expressly agreed in a written amendment signed by an authorised signatory of Atlo AS that specifically identifies the term to be incorporated and states that it overrides this Clause 30.4.

This Agreement supersedes any previous licence, subscription, reseller, pilot or trial agreement between the Parties relating to the Platform. Subscriptions activated before the Effective Date shall, with effect from the Effective Date, be governed by this Agreement, without alteration to their existing Activation Dates or Subscription Terms.

Notices. Save as otherwise expressly provided in this Agreement, any notice under or in connection with this Agreement shall be in writing in the English or Norwegian language and shall be delivered: (a) by email to the addresses specified in the Order Form; (b) by hand; or (c) by registered post or internationally recognised courier to the registered addresses stated in Clause 1.1. A notice sent by email is deemed received at the time of transmission, or, if transmitted after 16:00 CET on a Business Day or on a non-Business Day, at 09:00 CET on the next Business Day, provided no delivery-failure message is received. A notice delivered by hand is deemed received on delivery; a notice sent by registered post or courier is deemed received on signature of a delivery receipt. Each Party shall keep its notice details current and shall notify the other of any change in accordance with this Clause.

Notices of cancellation under Clause 8 must be given by email in accordance with Clause 8.5 and are effective only upon actual receipt by Barricade at the email address designated for that purpose.

Amendments. Save as expressly provided in Clauses 4.4, 6.9, 6.10, 6.11, 11.6, 14 and 31.4, no variation of this Agreement is effective unless made in writing and signed by an authorised representative of each Party. Neither Party’s course of conduct, acquiescence or performance shall constitute a variation.

Updates to the Agreement taking effect on renewal. Barricade may amend, restate or replace any term of this Agreement, including its Annexes and the DPA, with effect from the commencement of the next Renewal Term, by giving Customer not less than ninety (90) days’ prior written notice (which may be given by email) before the end of the then-current Subscription Term. Where Customer does not wish to accept the amended terms, its sole remedy is to cancel the affected Subscriptions in accordance with Clause 8.3, and the Parties acknowledge that a notice given under this Clause 31.4 leaves Customer not less than forty-five (45) days in which to do so before the cancellation deadline falls. If Customer does not validly cancel by that deadline, the amended terms apply automatically from the commencement of the Renewal Term and govern the relationship thereafter, without further act, signature or countersignature by either Party. Continued use of the Platform after the commencement of the Renewal Term constitutes acceptance of the amended terms.

Mid-term amendments. In addition, and with effect at any time during a Subscription Term, Barricade may amend the non-commercial terms of this Agreement (excluding Clauses 20 to 22, 27 and 28), Annex A and the DPA where reasonably necessary to reflect: (a) changes in applicable law, regulation, binding guidance or industry standards; (b) changes in the technical operation, architecture, security posture or supplier arrangements of the Platform; or (c) the introduction of new features or modules, by giving Customer not less than thirty (30) days’ prior written notice. Where such a mid-term amendment would materially and adversely affect Customer, Customer may, by written notice given within fifteen (15) days of Barricade’s notice, terminate the affected Subscriptions with effect from the end of the then-current Subscription Term, in which case the amendment shall not apply to Customer for the remainder of that term unless required by applicable law. Amendments to the SLA under Clause 11.6A, and security or emergency changes under Clause 14.5, take effect immediately and are not subject to this Clause 31.4A.

The powers in Clauses 31.4 and 31.4A do not permit Barricade to: (a) amend the Licence Fee otherwise than in accordance with Clauses 6.9, 6.10 and 6.11; (b) reduce the protections afforded to data subjects or to Customer below the minimum requirements of Article 28 of the GDPR; (c) divest Customer of any right, claim or remedy that has already accrued to it; or (d) impose any new or increased liability on Customer in respect of a period before the amendment takes effect.

Severability. If any provision of this Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable while preserving as far as possible the Parties’ commercial intention. If such modification is not possible, the provision shall be deemed deleted. Any modification or deletion of a provision shall not affect the validity and enforceability of the remainder of this Agreement.

No waiver. No failure or delay by a Party in exercising any right or remedy under this Agreement or at law shall constitute a waiver of that or any other right or remedy, nor shall it prevent or restrict its further exercise. No single or partial exercise of a right or remedy shall prevent or restrict the further exercise of that or any other right or remedy. A waiver is effective only if in writing and signed by the waiving Party, and applies only to the specific instance identified.

Cumulative remedies. Except as expressly stated in this Agreement (including Clauses 11.7, 19.3, 22.4 and 24.5, where the stated remedy is exclusive), the rights and remedies provided under this Agreement are cumulative and in addition to, and not exclusive of, any rights or remedies provided by law.

No partnership or agency. Nothing in this Agreement is intended to, or shall be deemed to, establish any partnership, joint venture, agency, franchise, fiduciary relationship or employment relationship between the Parties. Neither Party has authority to bind, contract in the name of, or incur liability on behalf of the other, and neither shall hold itself out as having such authority.

No third-party rights. This Agreement is made for the benefit of the Parties and their permitted successors and assigns only. No End User, Authorised User or other third party shall have any right to enforce any term of this Agreement, save that Atlo AS’s Affiliates, directors, officers and employees may rely upon and enforce Clauses 20, 21 and 22.2.

Electronic acceptance, counterparts and electronic execution. The Customer agrees that acceptance of these Platform Terms by an Administrator through the Platform in accordance with Clause 1.2 creates a valid, binding and enforceable agreement in writing, and irrevocably waives any defence or objection based on the absence of a handwritten signature, the absence of a paper original, or the fact that the Agreement was concluded by electronic means.

Counterparts and execution of Order Forms. This Agreement may be executed in any number of counterparts, each of which when executed constitutes an original and all of which together constitute one and the same instrument. Execution by electronic signature, including through a recognised electronic signature service, and delivery of a scanned or electronic copy of a signature page, shall be valid, binding and admissible, and the Parties waive any right to object to the validity or enforceability of this Agreement on the ground that it was executed electronically.

Language. This Agreement is executed in the English language, which shall be the governing and authoritative language for all purposes of interpretation and construction. Any translation is provided for convenience only and shall not affect interpretation. Norwegian statutory terms in italics are included for reference and do not alter the meaning of the English text.

Compliance, sanctions and export control. Each Party warrants that it is not, and is not owned or controlled by, a person subject to sanctions administered by Norway, the European Union, the United Kingdom, the United Nations or the United States, and shall not make the Platform available to any such person or in any sanctioned territory. Customer shall not export, re-export or transfer the Software in breach of any applicable export control law. Barricade may suspend or terminate immediately under Clause 23 or 24 where compliance with this Clause is or may be breached.

Anti-bribery. Each Party shall comply with all applicable anti-bribery and anti-corruption laws, including Sections 387 to 389 of the Norwegian Penal Code (straffeloven), and shall maintain adequate procedures to prevent bribery by its personnel and associated persons.

Records and audit. Customer shall maintain complete and accurate records relating to its use of the Platform and the number of Protected Locations for the duration of this Agreement and for three (3) years thereafter. Barricade may, on not less than ten (10) Business Days’ written notice, not more than once in any twelve (12)-month period (or at any time following a suspected breach of Clause 3.4), audit such records during normal business hours, at its own cost, save that Customer shall bear the reasonable cost of the audit where it reveals an underpayment exceeding five per cent (5%).

Non-solicitation. During the term of this Agreement and for twelve (12) months thereafter, neither Party shall directly solicit for employment any employee of the other Party who has been materially involved in the performance of this Agreement, save in response to a bona fide public recruitment advertisement not specifically targeted at such person.

Further assurance. Each Party shall, at the other’s reasonable request and cost, execute such documents and do such acts as may reasonably be required to give full effect to this Agreement.

Interest on late payment of any sum. Any sum payable by either Party under this Agreement that is not paid when due shall bear interest in accordance with Clause 6.7.

Headings and construction. Headings, the table of contents and the numbering of Clauses and Annexes are for convenience only and shall not affect the interpretation of this Agreement.

This Data Processing Agreement (“DPA”) governs Barricade’s Processing of Personal Data on behalf of Customer in connection with the provision of the Platform under the Agreement.

Terms defined in the Agreement have the same meaning in this DPA. “Controller”, “Processor”, “Data Subject”, “Personal Data Breach”, “Supervisory Authority” and “Special Categories of Personal Data” have the meanings given in the GDPR.

In the event of conflict between this DPA and the remainder of the Agreement, this DPA prevails in respect of the Processing of Personal Data, in accordance with Clause 30.3.

This DPA applies to Atlo AS as Processor. Where Customer itself acts as a processor for another controller, Barricade acts as sub-processor and references to Customer’s instructions shall be read as instructions ultimately originating from that controller.

Customer is the Controller and Barricade is the Processor in respect of the Personal Data described in Appendix 1.

Barricade shall Process Personal Data only: (a) in accordance with Customer’s documented instructions, which are constituted by the Agreement, this DPA, the Documentation, and Customer’s configuration and use of the Platform; and (b) where required to do so by Union or Norwegian law, in which case Barricade shall inform Customer of that legal requirement before Processing, unless prohibited from doing so.

Barricade shall inform Customer without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law. Barricade may suspend performance of the instruction pending resolution, without liability.

Customer is solely responsible for: (a) the lawfulness, fairness and transparency of the Processing; (b) the existence and maintenance of a valid legal basis; (c) the accuracy, quality and legality of the Personal Data and the means by which it was obtained; (d) providing all required information to Data Subjects; and (e) the configuration choices it makes within the Platform, including retention settings, camera and recording functionality, alarm escalation contacts and access permissions.

Customer shall not instruct Barricade to Process Special Categories of Personal Data, or Personal Data relating to criminal convictions and offences, save as necessarily incidental to the ordinary operation of the Platform, and shall not upload such data to free-text fields. Barricade’s security measures are designed for the categories of data set out in Appendix 1.

Barricade shall not sell Personal Data, and shall not Process Personal Data for its own purposes, save that Barricade may Process technical and operational data as an independent controller in accordance with Clause 17.6 and may generate and use Usage Data in accordance with Clause 15.6.

This DPA takes effect on the Effective Date and remains in force for as long as Barricade Processes Personal Data on behalf of Customer, notwithstanding expiry or termination of the Agreement, and thereafter in respect of Sections 5, 12 and 14.

Barricade shall: (a) Process Personal Data only to the extent and in such manner as is necessary for the purposes set out in Appendix 1; (b) implement and maintain the technical and organisational measures described in Section 7 and Appendix 2; (c) assist Customer in ensuring compliance with Articles 32 to 36 of the GDPR, taking into account the nature of the Processing and the information available to Barricade; and (d) make available to Customer the information necessary to demonstrate compliance with Article 28 of the GDPR.

Barricade shall maintain a record of Processing activities carried out on behalf of Customer, to the extent required by Article 30(2) of the GDPR.

Barricade shall appoint a contact point for data protection matters, notified in Section A.3.

Barricade shall ensure that access to Personal Data is limited to those of its personnel who need such access for the performance of the Agreement, and that each such person: (a) is bound by a written or statutory duty of confidentiality that survives termination of their engagement; (b) is subject to appropriate background verification consistent with applicable law and the sensitivity of the data; and (c) receives regular data protection and information security training.

The obligations in this Section 5 survive termination of the Agreement indefinitely.

Customer grants Barricade general written authorisation to engage sub-processors for the Processing of Personal Data, subject to this Section 6. The sub-processors approved as at the Effective Date are listed in Appendix 3.

Barricade shall impose on each sub-processor, by way of a written contract, data protection obligations that are no less protective than those set out in this DPA, and in particular those required by Article 28(3) of the GDPR.

Barricade maintains the current list of sub-processors in the Platform, and shall notify any intended addition or replacement by updating that list. The Customer’s Administrator is responsible for reviewing the list from time to time. Barricade shall give not less than thirty (30) days’ prior notice of any such change, save where the change is necessary to maintain, restore or continue the operation of the Platform — including where a sub-processor fails, is withdrawn, suffers a security incident, or where continuity or security otherwise requires it — in which case Barricade may make the change on shorter notice or with immediate effect and shall update the list and notify the Customer as soon as reasonably practicable. No change that is not necessary for the continued operation of the Platform shall be made on less than thirty (30) days’ notice. The Customer may object to a change on reasonable and documented data protection grounds within fifteen (15) days of the notice.

Where Customer objects in accordance with Section 6.3, the Parties shall discuss the objection in good faith. If the Parties cannot agree a resolution within thirty (30) days, and Barricade is unable to provide the Platform without the sub-processor in question, either Party may terminate the affected Subscriptions on written notice with immediate effect, and Barricade shall refund Licence Fees paid in respect of the period from the date on which the sub-processor change took effect to the end of the then-current Subscription Term, calculated pro rata temporis. This is Customer’s sole remedy in respect of such an objection. Absence of a timely objection constitutes approval.

Barricade may replace a sub-processor with immediate effect and without prior notice where necessary for security or continuity reasons, or where the existing sub-processor ceases to provide the relevant service, and shall notify Customer as soon as reasonably practicable thereafter.

Barricade remains liable to Customer for the performance of its sub-processors’ data protection obligations, subject to Clause 21 of the Agreement and Section 14 of this DPA.

Barricade shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. The measures in force as at the Effective Date are described in Appendix 2.

Barricade may update the measures in Appendix 2 from time to time, provided that the overall level of security is not materially reduced.

Customer is responsible for assessing whether the measures described in Appendix 2 are appropriate to the risks presented by its own Processing, and for configuring the Platform, managing access rights and securing its own systems and devices accordingly.

Barricade shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data Processed on behalf of Customer.

The notification shall, to the extent then known and as further information becomes available, describe: (a) the nature of the breach, including the categories and approximate number of Data Subjects and records concerned; (b) the likely consequences; (c) the measures taken or proposed to address the breach and mitigate its effects; and (d) the contact point from whom further information may be obtained.

Barricade shall provide Customer with reasonable cooperation and assistance to enable Customer to comply with its obligations under Articles 33 and 34 of the GDPR. Customer is solely responsible for assessing whether a breach is notifiable and for making any notification to a Supervisory Authority or to Data Subjects. Barricade shall not notify any Supervisory Authority or Data Subject on Customer’s behalf unless required by law or instructed in writing by Customer.

Barricade’s notification of, or response to, a Personal Data Breach shall not be construed as an acknowledgement of fault or liability.

Customer shall notify Barricade without undue delay of any Personal Data Breach originating in Customer’s own systems, credentials or devices that may affect the Platform.

Barricade shall, taking into account the nature of the Processing, assist Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling Customer’s obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR.

The Platform provides functionality enabling Customer to access, rectify, restrict, export and delete Personal Data. Customer shall use that functionality to respond to Data Subject requests in the first instance.

Where Barricade receives a request directly from a Data Subject relating to Personal Data Processed on behalf of Customer, Barricade shall not respond substantively but shall, without undue delay, forward the request to Customer and inform the Data Subject that the request has been forwarded to the Controller.

Barricade may charge for assistance under this Section 9 in accordance with Clause 17.8 where the assistance requested materially exceeds the provision of standard Platform functionality.

Barricade shall provide Customer, on reasonable request, with such information regarding the Platform and its Processing as is reasonably necessary for Customer to carry out a data protection impact assessment under Article 35 of the GDPR or to engage in prior consultation with a Supervisory Authority under Article 36, taking into account the nature of the Processing and the information available to Barricade. Barricade may satisfy this obligation by providing its standard security and privacy documentation.

Barricade shall Process and store Personal Data within the EU/EEA, save as stated in Appendix 3 or as otherwise agreed in writing.

Where Barricade or a sub-processor transfers Personal Data to a country outside the EEA that is not the subject of an adequacy decision under Article 45 of the GDPR, such transfer shall be made on the basis of an appropriate safeguard under Chapter V of the GDPR.

To that end, the Parties agree that the Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (“SCCs”) are hereby incorporated into this DPA by reference and shall apply to any such transfer, with effect as follows: (a) Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to sub-processor) applies where Customer is itself a processor; (b) the data exporter is Customer and the data importer is Barricade or the relevant sub-processor; (c) Clause 7 (docking clause) applies; (d) in Clause 9, Option 2 (general written authorisation) applies, with the notice period stated in Section 6.3; (e) in Clause 11, the optional independent dispute resolution provision does not apply; (f) in Clause 17, the governing law is the law of Norway, being an EEA State which has incorporated the GDPR into its national law and whose law provides for third-party beneficiary rights, and if and to the extent that the law of an EU Member State is required for the SCCs to be effective, the governing law shall instead be the law of Ireland; (g) in Clause 18(b), the forum is the courts of Norway or, where the courts of an EU Member State are required, the courts of Ireland; (h) Annexes I, II and III to the SCCs are populated by Appendices 1, 2 and 3 to this DPA respectively; and (i) the SCCs shall be read as adapted, where applicable, in accordance with the Norwegian implementation of the GDPR through Section 1 of the Personal Data Act (personopplysningsloven) and the EEA Agreement.

Where a transfer impact assessment is required, Barricade shall provide reasonable information about the relevant jurisdiction, applicable laws and supplementary measures, and shall implement such supplementary technical, organisational and contractual measures as are appropriate.

Where the SCCs are invalidated, replaced or superseded, the Parties shall in good faith implement the replacement mechanism without undue delay, and the replacement mechanism shall be deemed incorporated in place of the SCCs.

Upon expiry or termination of the Agreement, and subject to Section 12.2, Barricade shall, at Customer’s election notified in writing within thirty (30) days of the effective date of termination, either return Personal Data to Customer in a commonly used machine-readable format, or delete it, in each case in accordance with Clauses 25.2 and 25.3 of the Agreement. Where Customer makes no election within that period, Barricade shall delete the Personal Data in accordance with Clause 25.3 of the Agreement.

Barricade may retain Personal Data to the extent and for so long as required by Union or Norwegian law, or as necessary to establish, exercise or defend legal claims, in which case Barricade shall Process such data only for those purposes and shall continue to apply the measures in Appendix 2.

Barricade shall, on written request, certify in writing that it has complied with this Section 12.

Barricade shall make available to Customer, on reasonable written request, such information as is reasonably necessary to demonstrate compliance with this DPA, which may be satisfied by providing security documentation, completed standard questionnaires, summary penetration test reports, or third-party audit reports or certifications where available.

Where the information provided under Section 13.1 is demonstrably insufficient, Customer (or an independent auditor appointed by Customer who is not a competitor of Barricade and who is bound by confidentiality obligations) may audit Barricade’s compliance with this DPA, subject to the following conditions: (a) not more than once in any twelve (12)-month period, save where required by a Supervisory Authority or following a confirmed Personal Data Breach; (b) on not less than thirty (30) days’ prior written notice; (c) during normal business hours and in a manner that does not disrupt Barricade’s operations or compromise the confidentiality, security or availability of other customers’ data; (d) subject to the auditor executing a confidentiality undertaking acceptable to Barricade; and (e) at Customer’s cost, including Barricade’s reasonable costs of participation at its then-current professional services rates.

Audits shall not extend to Barricade’s source code, to data or systems of other customers, to commercially sensitive information unrelated to the Processing, or to physical access to third-party data centres (for which the relevant provider’s certifications shall be relied upon).

Barricade shall cooperate with, and comply with the lawful instructions of, any competent Supervisory Authority in relation to the Processing.

Each Party’s liability under or in connection with this DPA is subject to the exclusions and limitations set out in Clause 21 of the Agreement, save to the extent that such exclusion or limitation is prohibited by Applicable Data Protection Law or other mandatory law.

Nothing in this DPA affects the rights of Data Subjects under the GDPR or the powers of any Supervisory Authority.

This DPA is governed by the laws of Norway and subject to Clauses 27 and 28 of the Agreement, save where the SCCs provide otherwise in respect of a transfer to which they apply.

Barricade may update this DPA and its Appendices in accordance with Clause 31.4 of the Agreement, provided that no such update shall reduce the protections afforded to Data Subjects or to Customer below the requirements of Article 28 of the GDPR.