Standard B2B Master Agreement for SaaS Technology Services

1 Formation, B2B scope and order of precedence #

1.1 Parties and business nature #

This Agreement is entered into between Sistemas Tecnológicos OSystems SpA, hereinafter also "OSystems", "Druppify" or the "Supplier", and the legal person, sole trader or entity identified as the Customer in the Cover Sheet. Each shall be a "Party" and together the "Parties".

The Customer declares that it contracts the Service for business, institutional or professional purposes and not as an end consumer. Should a mandatory rule apply by reason of the actual nature of a specific transaction, that rule shall prevail solely to the extent that it is mandatory.

1.2 Conclusion of the Agreement #

The Agreement shall be deemed concluded by any of the following means: handwritten signature; simple or advanced electronic signature; acceptance of a proposal or order that incorporates this version; electronic acceptance through an administrator account; or commencement of production use of the Service with knowledge of its terms, where there is sufficient evidence of the Customer's acceptance.

1.3 A single document #

The Cover Sheet and these General Conditions form a single instrument. No annexes are required for its validity. Any additional specification, change order, acceptance minutes or technical document shall form part of the Agreement only when it is expressly identified and accepted by authorised representatives.

1.4 Order of precedence #

In the event of conflict, the following order shall apply: (a) special conditions of the Cover Sheet; (b) the remaining fields of the Cover Sheet; (c) these General Conditions; (d) subsequent change orders; (e) current functional documentation; and (f) proposals, presentations or commercial materials. A subsequent change order shall prevail only in respect of the matter that it expressly amends.

1.5 Separation from the Drupper Terms #

This Agreement does not replace or amend the terms and conditions, privacy policy, authorisations or notices that a Service Provider accepts directly vis-à-vis the Supplier in order to create and use their Druppify account. The Customer may not accept those instruments on the Service Provider's behalf, amend them, set them aside or induce their breach.

2 Definitions #

For the purposes of this Agreement, the following terms shall have the meanings set out below, whether used in the singular or the plural:

2.1 Customer Administrator #

An Authorised User designated by the Customer with powers to create accounts, assign permissions, configure modules, give operational instructions, approve data loads or act as point of contact. The Supplier may reasonably rely on their actions within the apparent scope of their profile.

2.2 Aggregated or Anonymised Data #

Information obtained through aggregation, statistical processing, dissociation or anonymisation in such a way that, using means reasonably available, it does not allow a natural person to be identified, directly or indirectly, or Customer Confidential Information to be reconstructed.

Aggregation alone does not constitute anonymisation. An aggregated dataset shall be deemed anonymised only where, having regard to the granularity of its cells and the auxiliary data reasonably available, it does not allow a natural person to be re-identified. Pseudonymisation, understood as the replacement of direct identifiers while preserving the link to the rest of the record, is not equivalent to anonymisation, and pseudonymised data remains personal data.

The Supplier shall document the anonymisation method applied and the verification of the re-identification risk, and shall retain that documentation for as long as it uses the dataset. In the absence of such documentation, the dataset shall be treated as personal data and shall be subject to the rules and time limits of its source category.

2.3 Business Contact Data #

Name, position, corporate email address, work telephone number, organisation and other details of representatives, administrators, users, suppliers or counterparties, used to negotiate, administer, invoice, support or perform the Agreement.

2.4 Customer Data #

Information, files, instructions, content or records that the Customer, its Authorised Users, principals, integrations or systems provide or upload to the Supplier, or instruct the Supplier to process, on the Customer's behalf. Customer Data does not include Service Provider Data obtained directly by OSystems under the Drupper Terms, Technical Data processed for the Supplier's own legitimate purposes, or Aggregated or Anonymised Data.

2.5 Service Provider Data or Drupper Data #

Personal data and other information that a Service Provider provides directly to the Supplier, or that is generated through their direct interaction with Druppify, under the Drupper Terms and the applicable privacy policy. It may include identification and contact data, account data, documentation, enablement records, bank details, vehicle details, geolocation, evidence, signatures, usage history, and support and security data, depending on the applicable modules and authorisations.

2.6 Personal Data #

Any information relating to an identified or identifiable natural person, including sensitive data or specially protected categories where applicable, in accordance with applicable law.

2.7 Technical Data #

Authentication records, IP addresses, device and session identifiers, telemetry, events, performance metrics, logs, audit, security, error, availability, configuration and consumption records, and any other technical information necessary to operate, protect, diagnose, invoice and improve the Service. Where Technical Data allows a person to be identified, it shall be treated as Personal Data in accordance with the applicable role and purpose.

2.8 Business Day #

Any day other than a Saturday, Sunday or public holiday in the city of Viña del Mar, Chile. Where a period is expressed in calendar days, this shall be stated expressly.

2.9 Documentation #

Manuals, help materials, functional specifications, training materials, release notes and other usage information that the Supplier officially makes available to the Customer.

2.10 Druppify or Platform #

The technology solution owned or lawfully controlled by the Supplier, offered on a Software as a Service basis, comprising web and mobile applications, APIs, modules, structural databases, interfaces, workflows, reports and associated services.

2.11 Security Incident #

A confirmed event that materially compromises the confidentiality, integrity, availability or resilience of systems, Confidential Information or Personal Data, including unauthorised access, disclosure, alteration, loss or destruction.

2.12 Confidential Information #

All non-public information that one Party discloses or makes accessible to the other and that, by reason of its nature, context, manner of disclosure or designation, should reasonably be understood to be confidential. It includes Supplier Confidential Information and Customer Confidential Information as defined in clause 12.

2.13 General Success Story Information #

Truthful, high-level information about the existence and nature of the business relationship, the industry, objectives, modules, phases, coverage, milestones, lessons learned, qualitative benefits and aggregated or anonymised metrics that do not identify individuals or disclose exact financial terms, trade secrets, vulnerabilities, incidents or confidential internal processes.

2.14 Authorised Principal #

An entity connected with the Customer's operations that has been identified in the Cover Sheet or authorised in writing to access an account, module or dataset. Its access shall be under the Customer's responsibility, unless it enters into a direct contract with the Supplier.

2.15 Change Order #

A document or written acceptance that amends the scope, timeline, fee, integration, acceptance criteria, responsibilities or any other particular condition of the Service.

2.16 Brand Policies #

Guidelines, official files, proportions, clear-space areas, colours, attributions, prohibited uses and other instructions that the owner of a trademark communicates in writing or publishes through an official channel.

2.17 Service Provider or Drupper #

A natural or legal person that provides operational, professional or commercial services to the Customer, to an Authorised Principal or to a related third party, using Druppify as a technology tool. The creation of a Druppify account does not in itself determine the legal nature of the relationship between the Service Provider and the Customer.

2.18 Services #

SaaS access to the modules specified in the Cover Sheet, together with the implementation, configuration, support, training, integration or other services expressly contracted.

2.19 Third-Party Services #

Cloud infrastructure, telecommunications, maps, messaging, authentication, email, APIs, gateways, Customer systems or other technologies not fully controlled by the Supplier that are necessary or convenient for certain functions.

2.20 Sub-processor #

A natural or legal person that processes Customer Data on behalf of the Supplier in performance of the processing engagement, with the Customer's authorisation where such authorisation is required.

2.21 Drupper Terms #

The account and usage terms, privacy policy, consents, notices and other instruments accepted directly by the Service Provider vis-à-vis the Supplier.

2.22 Authorised User #

A person enabled by the Customer to use Druppify with an administration, supervision, read-only, audit or other business role profile. The Customer is responsible for its Authorised Users and for any individuals from Authorised Principals that it enables.

2.23 Minimum Commercial Term #

The period during which the Customer undertakes to maintain the contract and pay the minimum fees defined in the Cover Sheet, regardless of the actual level of use, save in the event of termination for the Supplier's uncured material breach.

3 Purpose and nature of the Service #

3.1 Purpose #

The Supplier grants the Customer a limited right to access and use Druppify and shall provide the Services specified in the Cover Sheet to support the configuration, coordination, recording, traceability, monitoring and management of the Customer's own processes.

3.2 B2B technology service #

Druppify is an instrumental technology tool. Unless separately and expressly contracted, the Supplier does not physically perform shifts, delivery rounds, transport, deliveries, logistics services, field services or other operational tasks; does not supply personnel; does not engage Service Providers on the Customer's behalf; and assumes no obligation of result with regard to coverage, productivity, sales, attendance, payments, employment-law compliance or the continuity of the Customer's operations.

3.3 Customer decisions #

It is exclusively for the Customer or the Authorised Principal, according to the actual circumstances of the operation, to determine the need for services, slots, schedules, locations, rates, rules, eligibility, assignments, instructions, supervision, evaluation, payments, contractual penalties and the termination of relationships with Service Providers. Where Druppify automates, calculates or displays decisions, it shall do so on the basis of parameters, data or rules defined or approved by the Customer.

3.4 Configurable SaaS, not bespoke development #

The Agreement does not constitute a general commission for bespoke software development. Implementation shall use the standard capabilities, configurations and parameters available. A special requirement shall bind the Supplier only where there is a Change Order setting out its scope, price, timeline, acceptance criteria and treatment of intellectual property.

3.5 Product evolution #

The Supplier may update, reorganise, replace or improve components, interfaces and workflows in order to enhance security, stability, scalability, compliance or functionality. It shall not be obliged to maintain obsolete versions, integrations or configurations, provided that it does not substantially remove the contracted core without offering a reasonable alternative or a transition period where technically possible.

3.6 No representation #

Neither Party may bind or represent the other. The Agreement does not create any partnership, joint venture, franchise, agency, general commercial mandate, exclusivity, employment relationship or co-ownership of property between the Parties.

4 Functional scope, modules and limits #

4.1 Contracted modules #

Only the modules expressly specified in the Cover Sheet are deemed to be included. References to capabilities available in Druppify do not constitute a promise of automatic enablement.

4.2 Illustrative capabilities #

Depending on the plan contracted, Druppify may include, among others, the following capabilities: operational structure; management of accounts, stores, roles and permissions; onboarding and document validation; publishing, applying for, assigning and managing shifts; attendance and geolocation; orders and deliveries; evidence and signatures; training; calculations, pre-settlements and payment reports; dashboards, reports, APIs and integrations.

4.3 Usage limits #

The plan may provide for limits on users, entities, locations, transactions, storage, API calls, retention, support or consumption. Exceeding them may give rise to charges, controlled degradation or the need to upgrade the plan, in accordance with the Cover Sheet and the current documentation.

4.4 Beta or experimental features #

The Supplier may enable features identified as beta, preview, controlled trial or experimental. Unless expressly agreed otherwise, they are provided without any guarantee of continuity, availability, support or permanence and may be modified or withdrawn at any time.

4.5 General exclusions #

Unless expressly included, the following do not form part of the Service: custom developments; a complete redesign of the Platform; bulk migrations or manual data cleansing; unspecified integrations; running the Customer's operations or a dedicated help desk for Service Providers, without prejudice to the right under clause 23.5; support for the Customer's devices or networks; employment, tax, accounting or legal advisory services; 24x7 availability; recovery with a specific RTO/RPO; or special certifications or audits.

5 Implementation, migration, testing and acceptance #

5.1 Standard phases #

Implementation may comprise: kick-off and governance; requirements gathering; information validation; configuration; data loading or migration; internal testing; user acceptance testing; training; go-live authorisation; production activation; and stabilisation. The phases shall be adjusted to the particular scope.

5.2 Single point of contact and governance #

Each Party shall designate a point of contact with authority to coordinate information, decisions, validations and escalation. The Customer shall internally consolidate the requirements of its departments and Authorised Principals. The Supplier shall not be obliged to carry out contradictory instructions from multiple contacts.

In the absence of a different structure in the Cover Sheet, the following standard allocation shall apply. A single person may take on more than one role, provided that they retain the effective capacity to make decisions and be accountable:

Decisions, dependencies, risks, issues, changes and material acceptances shall be recorded in minutes, tickets, emails or Platform mechanisms that make it possible to identify the person responsible and the date.

5.3 Customer dependencies #

Timelines depend on the Customer's timely, complete, lawful and correct provision of data, access, requirements, users, environments, validations and decisions. Any delay or inconsistency attributable to the Customer shall reasonably extend the schedule and may give rise to billable rework.

5.4 Data quality #

The Customer shall validate the completeness, accuracy, uniqueness, currency, relationships and authorisations of the data before it is loaded. The Supplier may reject files that are insecure, incomplete, inconsistent, excessive or outside the scope. The Supplier's assistance in transforming or loading data does not transfer responsibility for its content.

5.5 Migrations #

A migration shall include only the sources, formats, fields, volumes and iterations specified in the Cover Sheet. The Customer shall keep a backup copy and verify the result. Data reconstruction, normalisation, deduplication, extraction from inaccessible systems or correction of errors at source shall require a Change Order.

5.6 Acceptance testing #

The Customer shall have five Business Days from the time a configuration, integration or deliverable is made available to report in writing any reproducible defects that are materially contrary to the agreed criteria. The report must include the steps, evidence, environment, user, expected result and impact.

5.7 Deemed acceptance #

The component shall be deemed accepted if the Customer: (a) does not raise sufficient objections within the time limit; (b) authorises its go-live; (c) uses it in production; or (d) unjustifiably prevents testing from being carried out. Acceptance does not remove the Supplier's obligation to correct issues covered by support.

5.8 Issue versus enhancement #

An issue is a reproducible behaviour that materially departs from the Documentation or an accepted criterion. Design changes, new rules, special reports, integrations, process variations, features not contracted and requests made for convenience are not issues.

5.9 Change control #

Every new need shall be recorded and classified as standard configuration, issue, general product improvement, custom development, integration or professional service. No request automatically changes the scope, price or timeline. Material changes require a Change Order.

5.10 Roadmap #

The Supplier may consider the Customer's suggestions in its general roadmap, without any obligation to implement them or to grant exclusivity, priority, compensation or a share of revenue.

5.11 Standard activation and final acceptance criteria #

Unless particular criteria have been agreed, activation may be authorised when: (a) the critical structure, users and permissions have been configured; (b) the necessary data has been validated by the Customer; (c) critical workflows have passed reasonable testing; (d) the Administrators have received training or documentation; (e) there are no open P1 issues without an agreed contingency; (f) the support and escalation channels have been confirmed; and (g) the Customer authorises go-live or begins production use.

Final acceptance shall record the scope delivered, authorised deviations, outstanding issues, relevant configurations and the date of transition to ordinary support. It does not constitute a guarantee of commercial results or a waiver of the correction of covered issues.

6 Integrations and Third-Party Services #

6.1 Contracted integrations #

Each integration must identify the systems, endpoints, authentication, fields, frequency, volumes, environments, responsible parties, testing and support. The Customer shall obtain the necessary third-party licences, access rights and authorisations.

6.2 Third-party changes #

The Supplier is not liable for modifications, limits, failures, suspensions, prices or discontinuations of Third-Party Services. If an external change requires additional work, the Parties shall consider a Change Order or a reasonable alternative.

6.3 API security #

The Customer shall protect integration keys, tokens and credentials; limit permissions; rotate secrets where appropriate; and report any compromise. It may not expose APIs, credentials or confidential documentation to unauthorised third parties.

6.4 Customer systems #

The Customer is responsible for the availability, configuration, integrity, licensing and security of its systems, networks, devices and exported data. The Supplier shall not be liable for failures originating outside its reasonable control.

7 Licence of use and access #

7.1 Licence #

During the term and subject to payment in full, the Supplier grants the Customer a limited, revocable, non-exclusive, non-transferable and non-sublicensable licence to access and use Druppify solely for the internal and lawful purposes of its business operations.

7.2 Authorised Users and Principals #

The Customer may enable Authorised Users and Authorised Principals through individual profiles. It must impose on them obligations consistent with the Agreement and shall be liable for their acts and omissions as if they were its own.

7.3 No delivery of software #

The Service is provided remotely. There is no obligation to deliver source code, repositories, models, infrastructure, scripts, structural databases or executable copies, unless specifically agreed in writing.

7.4 Reservation of rights #

All rights not expressly granted are reserved to the Supplier and its licensors. Contracting the Service does not confer ownership of the Platform or of any improvements, reusable configurations or general developments.

7.5 Permitted exports #

The Customer may download reports and Customer Data using the functions enabled for that purpose. Exports do not authorise copying the structure, design, logic or distinctive presentation of Druppify, nor retaining Service Provider Data outside the permitted purposes.

8 Accounts, credentials and administration #

8.1 Customer responsibility #

The Customer shall manage user additions, removals, profiles and permissions; periodically review access; and disable users who change roles or leave its organisation. Actions performed with valid credentials shall be presumed to be authorised, unless there is evidence of a compromise that was notified in a timely manner.

8.2 Individual credentials #

Credentials are personal and non-transferable. Sharing passwords, unapproved generic accounts, tokens or sessions is prohibited. The Customer shall use multi-factor authentication where it is available and required by the plan or by the level of risk.

8.3 Devices and networks #

The Customer shall protect the devices and networks used for access, apply updates, screen locking, antivirus software or equivalent controls, and avoid storing data on personal equipment or unauthorised services where doing so increases the risk.

8.4 Notification of compromise #

The Customer shall notify without delay any loss of devices, compromised credentials, improper access or change of administrator. The Supplier may preventively block sessions, reset credentials or require additional measures.

9 Prohibited uses and protection against copying #

The Customer may not, directly or through third parties:

1. copy, reproduce, decompile, disassemble, reverse engineer, translate, adapt or attempt to obtain the code, algorithms, models, structure or secrets of Druppify, except to the minimum extent permitted by law that cannot be contractually excluded;
2. carry out scraping, mass extraction, unauthorised automated access, bypassing of controls, exploitation of vulnerabilities, load testing, scanning or penetration testing without written authorisation;
3. alter, delete, conceal or tamper with logs, traceability records, evidence, attributions, proprietary notices or security mechanisms;
4. share accounts, demos, documentation, screenshots, videos, workflow maps, specifications or test results with competitors, developers or consultants in order to replicate or replace the Platform;
5. use Supplier Confidential Information to prepare tender documents, RFPs, benchmarks or specifications for a competing solution;
6. train, fine-tune, evaluate or validate artificial intelligence models, automated systems or competing products using access to Druppify or its screens, documentation, outputs or Confidential Information;
7. resell, lease, sublicense, exploit as a service bureau or make the Platform available to unauthorised third parties;
8. introduce malware, harmful code, unlawful content, data obtained without a legal basis or loads that compromise security or availability;
9. use Druppify to impersonate, harass, discriminate against or defraud others, infringe rights or carry out activities contrary to law;
10. use the Druppify brand outside the licence provided for in clause 11;
11. develop a substantially equivalent solution by misappropriating the Supplier's non-public know-how, secrets, workflows or materials; or
12. allow access to any person in respect of whom the Supplier has communicated a reasonable risk of security breach, fraud or infringement.

These restrictions do not prevent the Customer from describing its own needs, contracting competing solutions or developing software in a genuinely independent manner, provided that it does not use Druppify's Confidential Information, intellectual property, access or materials.

10 Intellectual property, data and feedback #

10.1 Supplier ownership #

Druppify, its trademarks, domains, source and object code, architecture, interfaces, workflows, algorithms, data models, structural databases, designs, documentation, manuals, reports, templates, know-how, trade secrets, improvements and developments are and shall remain the exclusive property of the Supplier or of their respective owners.

10.2 Customer rights over its content #

The Customer retains such rights as it holds over the content and non-personal data that it contributes. With regard to Personal Data, no ownership is recognised; instead, roles, duties, legal bases and data subjects' rights are recognised in accordance with the law.

10.3 Technical licence over Customer Data #

The Customer grants the Supplier, for as long as necessary, a limited authorisation to host, make technical copies of, organise, back up, transmit, transform and process Customer Data solely in order to provide, secure and support the Services and to comply with instructions and legal obligations.

10.4 Aggregated or Anonymised Data #

The Supplier may generate and use Aggregated or Anonymised Data for statistics, security, capacity planning, product improvement, general benchmarking, research and communications, provided that such data does not identify individuals or disclose Customer Confidential Information. The Supplier shall not attempt to re-identify it.

10.5 Technical Data #

The Supplier may process Technical Data for authentication, security, fraud prevention, diagnostics, support, measurement, invoicing, continuity, the defence of rights and improvement of the Service, applying data protection rules where applicable.

10.6 Feedback #

The Customer grants the Supplier an irrevocable, worldwide, royalty-free and non-exclusive licence to use suggestions, ideas, comments and improvement requests that do not contain Customer Confidential Information, without any obligation to implement them or to compensate the Customer.

10.7 Special developments #

Unless specifically assigned in writing, any developments, configurations, connectors, templates or improvements made by the Supplier shall be its property, even if they are wholly or partly funded by the Customer. The Customer shall receive the right of use specified in the Change Order. The Customer's data, trademarks and pre-existing materials shall remain its own.

10.8 Third-party and open-source components #

Third-party components are governed by their own licences. Nothing obliges the Supplier to transfer rights that it does not hold. The use of open-source software does not entail disclosing proprietary code beyond the scope required by the relevant licence.

11 Trademarks, publicity and success stories #

11.1 Ownership #

Each Party retains ownership of its trademarks, names, logos, domains and visual identity, whether registered or unregistered. All goodwill arising from their use shall inure exclusively to the benefit of their owner.

11.2 Druppify licence in favour of the Customer #

During the term, the Supplier grants the Customer a non-exclusive, royalty-free, revocable, non-transferable and non-sublicensable licence to use the Druppify brand and its official files in internal and external communications relating in good faith to the implementation, the use of the Service or the Customer's status as a customer, in accordance with the Brand Policies.

The Customer may use it on its intranet and in training, onboarding, manuals, presentations, reports, its website, social media, annual reports, proposals, events and operational documentation, without requiring individual approval for each ordinary use that complies with the Brand Policies. Updates to those policies shall apply prospectively and shall not render lawful material already published infringing, provided that it is corrected within a reasonable period after a substantiated request.

11.3 Limits on use by the Customer #

The Customer may not distort or recolour the brand or create derivative versions of it; incorporate it into its company name, domain, application or product; register confusingly similar signs; use it as a paid keyword without authorisation; remove attributions; or suggest any partnership, representation, certification, exclusivity or guarantee that does not exist. Paid co-branding campaigns, merchandising, sublicences and joint names require written approval.

11.4 Customer licence in favour of the Supplier #

During the term, and for the permitted historical uses, the Customer grants the Supplier a non-exclusive, royalty-free and worldwide licence to use its name, logo and official files in order to identify it as a Druppify customer and to communicate the business relationship and its success story. The licence may be revoked prospectively for just cause, such as materially inaccurate use, breach of brand policies or objective reputational risk, without affecting lawful historical publications. The Supplier shall comply with the brand policies provided to it. The licence does not cover the trademarks of principals or third parties without the authorisation of their owner.

11.5 Use of general information for marketing #

The Supplier may use the General Success Story Information on its website, social media, presentations, proposals, customer lists, sales materials, events, award entries, corporate communications, press and educational content. It may refer to the existence of the service, the industry, objectives, phases, modules, coverage, milestones, qualitative results and aggregated or anonymised metrics.

The inclusion of the Customer in lists, the simple use of its logo and general references shall not require any additional approval, unless a special restriction has been accepted in the Cover Sheet. Personal Data, exact prices or margins, incidents, vulnerabilities, credentials, trade secrets or Confidential Information outside the General Success Story Information may never be disclosed.

11.6 Detailed content #

If a publication includes before-and-after comparisons, specific metrics attributed to the Customer, testimonials, personal quotes, images of people or facilities, non-public operational details or a joint press release, the Supplier shall send the draft to the marketing contact at least five Business Days in advance.

The Customer may object only on the grounds of factual errors, trademark infringements, disclosure of Confidential Information or Personal Data, or unjustified harm to third parties. In the absence of objections, the factual content may be published, except for attributed testimonials, personal images and exact financial terms, which shall always require specific authorisation.

11.7 Correction, termination and historical uses #

Either Party may request the correction or withdrawal of uses that are materially inaccurate, misleading, unlawful or contrary to the brand. Upon termination of the Agreement, new uses suggesting an ongoing relationship shall cease, but truthful archives, annual reports and historical success stories may be kept, stating the relevant period.

12 Confidentiality #

12.1 Supplier Confidential Information #

This includes all non-public information about Druppify or OSystems: code, architecture, models, APIs, integrations, features, workflows, rules, screens, user experience, algorithms, reports, documentation, demos, prototypes, roadmap, prices, margins, proposals, strategies, customers, suppliers, security, vulnerabilities, credentials, logs, backups, know-how, trade secrets and any copy, screenshot, recording, analysis or derivative thereof.

12.2 Customer Confidential Information #

This includes Customer Data and non-public information owned or lawfully controlled by the Customer, such as internal processes, contracts, prices, margins, operations, strategy, customers, principals, suppliers, incidents and plans. Service Provider Data does not become information exclusive to the Customer because it is accessible for the Customer's operations: the Service Provider's identity, account, profile, availability and contact details, and the Service Provider's relationship with the Supplier, do not constitute Customer Confidential Information. The financial terms, instructions, processes, assignment rules, evaluations and other information specific to each of the Customer's operations remain confidential, including information recorded in association with a particular Service Provider.

12.3 General duty #

The receiving Party shall use the Confidential Information solely to perform the Agreement, shall protect it with at least the same degree of care that it applies to its own sensitive information and never less than reasonable care, and shall not disclose it without authorisation.

12.4 Restricted access #

Access shall be limited to employees, directors, advisers and suppliers who need to know the information and are bound by equivalent duties. The receiving Party shall be liable for them.

12.5 Safeguards #

Confidential Information shall not be stored in public repositories, personal accounts or unauthorised tools where doing so increases the risk. Credentials, vulnerabilities, architecture, incidents, logs and backups shall be treated as critical.

12.6 Exclusions #

Information shall not be confidential where the receiving Party demonstrates that: (a) it was public through no breach; (b) the receiving Party lawfully knew it; (c) the receiving Party received it from a third party under no duty of confidentiality; (d) the receiving Party developed it independently without using the disclosed information; or (e) the receiving Party is required to disclose it by law or by a competent authority.

12.7 Compelled disclosure #

Where legally possible, the receiving Party shall give prior notice, limit the disclosure to the minimum necessary and cooperate in obtaining confidential treatment or protection.

12.8 Confidentiality incidents #

The receiving Party shall notify, without undue delay, any materially relevant unauthorised access, loss or disclosure, indicating the information available and the containment and mitigation measures taken.

12.9 Return and destruction #

On request or upon termination, the receiving Party shall return or destroy any copies that it is not required to retain. It may keep copies in automatic backups, legal archives, audit or continuity records, provided that they are protected and not put to any incompatible use until their ordinary deletion.

12.10 Duration #

The general duty shall remain in force during the term and for five years thereafter. Obligations concerning trade secrets, code, architecture, vulnerabilities, credentials, Personal Data and know-how shall survive for as long as such information retains its protected status or the law so requires.

12.11 Authorised communications #

Confidentiality shall not prevent the brand and success story uses authorised in clause 11, within the limits set out therein.

13 Fair competition, trade secrets and independent development #

13.1 Good faith #

The Parties shall act in good faith and shall refrain from acts of confusion, disparagement, unlawful inducement to breach, undue exploitation of another's reputation, misappropriation of trade secrets or any other act of unfair competition.

13.2 Prohibition on misappropriation and replication #

The Customer shall not use Supplier Confidential Information to develop, finance, commission, compare, validate, acquire or operate a solution that substantially reproduces the model, logic, processes, workflows, features, structure, experience, reports or value proposition of Druppify.

13.3 Competitive disclosure #

The Customer shall not provide potential suppliers, consultancies, related companies or competitors with screenshots, videos, documentation, feature lists, tests, data models or descriptions detailed enough to copy or replace the Platform.

13.4 Tenders and RFPs #

The Customer may describe its own operational needs, but may not use non-public information about Druppify to build tender documents or requests for proposal for a competing solution.

13.5 Legitimate independence #

Nothing prevents legitimate competition or independent development based on public information, a party's own experience or lawful sources. Where there are relevant similarities following prior access to Confidential Information, whoever invokes independent development must keep and provide reasonable evidence of their development process, without altering any mandatory rules on the burden of proof.

13.6 Protective measures #

Any infringement shall constitute a serious breach and shall entitle the Supplier to suspend or terminate the Agreement, demand cessation, return or destruction, seek interim measures and claim damages. Any special penalty clause must be set out in the Cover Sheet.

14 Data protection: legal regime and allocation of roles #

14.1 Current regime and transition #

Until 30 November 2026 inclusive, the Parties shall comply with Law No. 19,628 on the Protection of Private Life in its current wording, including the rules on authorisation, information, purpose, accuracy, secrecy, written mandate, diligence and data subjects' rights.

From 1 December 2026, references shall be deemed automatically adapted to Law No. 19,628 as amended by Law No. 21,719 and to the applicable mandatory rules, regulations and instructions. The terms "responsable" (controller), "tercero mandatario" (third-party mandatary) and "encargado" (processor) shall be interpreted in accordance with the regime in force at any given time.

14.2 Roles determined by purpose #

Whether a party acts as controller or processor does not depend on a contractual label or on the ownership of the systems, but on who determines the purposes and essential means of each processing operation. The same category of data may involve different roles depending on the purpose.

14.3 General roles matrix #

14.4 No ownership of personal data #

No provision confers ownership of Personal Data or limits the non-waivable rights of data subjects. The expressions "Customer Data" and "Service Provider Data" identify origin, functional control and responsibilities.

14.5 Mixed operational records #

Shifts, assignments, attendance, evidence, payments, geolocation and other records may combine Customer instructions, Service Provider actions and technical events. The role shall be determined by purpose: the Supplier shall act as processor when it processes data on the Customer's behalf and as controller when it determines its own legitimate purposes notified to the data subject, such as account management, security, support, fraud prevention or compliance.

15 Processing of Customer Data on the Customer's behalf #

15.1 Written mandate #

The Agreement constitutes the written mandate required by current legislation and, from 1 December 2026, the contract governing processing by a processor. The subject matter, duration, purposes, categories, operations and data subjects are determined in the Cover Sheet and in this clause.

15.2 Subject matter and duration #

The Supplier shall process Customer Data in order to enable, host, configure, organise, consult, integrate, back up, secure, support, return, erase or anonymise the data necessary to provide the Service during the term and the exit period.

15.3 Instructions #

The Supplier shall process the data in accordance with the Customer's documented instructions contained in the Agreement, the configuration, tickets, APIs and communications from Administrators. It shall not be obliged to carry out instructions that are ambiguous, unlawful, insecure, incompatible with the architecture or out of scope.

If the Supplier considers that an instruction infringes the law, it shall inform the Customer accordingly and may suspend its execution until it receives clarification or a sufficient basis. If the Customer insists, the Customer shall bear the corresponding liability, and the Supplier shall not be obliged to engage in unlawful conduct.

15.4 Purpose limitation #

The Supplier shall not use Customer Data for its own incompatible purposes, the sale of databases, advertising unrelated to the Service or the training of third parties' general-purpose artificial intelligence models, unless authorised in writing and supported by a sufficient legal basis.

15.5 Personnel and confidentiality #

Access shall be limited to authorised personnel and suppliers who are subject to confidentiality, training and need-to-know requirements. The Supplier shall maintain reasonable processes for granting, reviewing and revoking access.

15.6 Security #

The Supplier shall apply the measures set out in clause 18, taking into account the risk, the nature of the data, the state of the art, costs, scope and context. Security is an obligation to use diligent means and not an absolute guarantee.

15.7 Assistance #

Taking into account the nature of the processing and the information available, the Supplier shall provide reasonable assistance to the Customer in responding to data subject requests, impact assessments, regulatory enquiries, incidents and compliance matters. Extraordinary work not included may be invoiced, unless it is necessary due to a breach attributable to the Supplier.

15.8 Sub-processors #

The initial Sub-processors must be identified in the Cover Sheet. Where the law requires specific written authorisation, the Supplier shall not delegate all or part of the processing engagement without obtaining such authorisation by email, signature or other written means.

The request shall identify the entity, service, location and categories of data. The Customer shall not refuse without an objective ground related to data protection. If there is no reasonable alternative, the Parties may adjust the Service or terminate the affected component without future penalty, while obligations already accrued shall remain in force.

The Supplier shall impose equivalent obligations and shall retain such contractual and legal liability as may apply.

15.9 International transfers #

Transfers shall be made in accordance with the regime in force. From 1 December 2026, the adequacy mechanisms, safeguards, corporate rules, clauses, authorisations or other permitted bases shall be used. The Cover Sheet shall identify known locations and safeguards.

15.10 Incidents #

In the event of a confirmed breach affecting Customer Data, the Supplier shall notify the Customer without undue delay and, where reasonably possible, within forty-eight hours of its confirmation. It shall provide, in phases, information on the nature, categories, scope, likely consequences, containment, recovery and point of contact.

The Supplier shall not notify data subjects or authorities directly on the Customer's behalf, except on instruction, under a legal obligation or where urgently necessary to protect rights. The Customer, as controller, shall decide on and make the notifications incumbent upon it.

15.11 Data subject rights #

If the Supplier receives a request relating to Customer Data, it shall forward it to the Customer without undue delay and, where possible, within two Business Days. It shall not respond on the Customer's behalf except on instruction or under a legal duty.

15.12 Return and erasure #

Upon termination of the Service, the Customer may export Customer Data during the period set out in the Cover Sheet. The Supplier shall then return, erase or anonymise such data from active systems within the applicable period, save for legal obligations, the defence of rights or rotating backups. Backups shall be blocked from ordinary use and deleted in accordance with the normal cycle.

15.13 Audit #

Once a year and with reasonable notice, the Customer may request documentation, a questionnaire or a remote meeting to verify the processing carried out on its behalf. On-site or technical audits shall take place only where required by law, following a material incident or upon well-founded evidence of non-compliance, subject to confidentiality, without access to other customers' data or to secrets, and without disrupting operations. Extraordinary costs shall be borne by the Customer unless the Supplier is in material breach.

15.14 Responsibility #

The Customer remains responsible for lawfulness, legal basis, information provided to data subjects, accuracy, proportionality, time limits, content, instructions, users and any processing outside Druppify. The Supplier is liable for compliance with its obligations as mandatary or processor and for any processing it carries out outside the scope of the processing engagement, under the terms of the law.

16 Service Provider Data, contacts and the Supplier's own purposes #

16.1 Supplier as controller of Service Provider Data #

Where a Service Provider registers directly, accepts the Drupper Terms or provides data to the Supplier, OSystems acts as an independent controller in respect of the purposes notified to the Service Provider, and may manage the account, identity, access, eligibility, support, security, fraud prevention, communications, authorised interoperability, compliance and the defence of rights.

16.2 Obligations of the Supplier #

In that role, the Supplier shall: have a legal basis or consent where applicable; disclose purposes and recipients; keep evidence of acceptance; limit data and access; maintain reasonable accuracy; protect confidentiality, integrity and availability; provide channels for exercising rights; apply retention rules; and not sell or hand over data for incompatible third-party advertising.

16.3 Customer access #

The Customer shall access only such Service Provider Data as is necessary to assess eligibility, assign, coordinate, supervise, pay, comply with obligations or manage its relationship. The fact that a data item is visible does not authorise downloading, combining, profiling, disclosing or retaining it outside those purposes.

16.4 Customer as independent controller #

Where the Customer downloads, integrates, copies, discloses or uses Service Provider Data for its own purposes, it acts as an independent controller of that processing. It shall inform data subjects, have a legal basis, limit access, respond to rights requests, apply security measures and delete the data when no longer necessary.

16.5 Principals #

The Customer shall not provide Service Provider Data to an unauthorised Principal or allow it informal access. If a Principal determines its own purposes, it must assume the corresponding role and legal obligations and be authorised under a contract.

16.6 Business Contact Data #

Each Party may process Business Contact Data as an independent controller for the purposes of negotiation, administration, invoicing, support, security, continuity, audit and contractual defence, limiting its use and retention.

16.7 Retention of Service Provider Data #

Termination of the B2B agreement does not in itself oblige the Supplier to delete Service Provider Data processed as controller. Such data shall be retained in accordance with the Drupper Terms, the relevant purposes, statutory periods, security, audit and the defence of rights. The Customer's access shall cease upon termination.

17 Current compliance and readiness for Law No. 21,719 #

17.1 Compliance until 30 November 2026 #

The Parties acknowledge that the regime in force requires, among other matters: legal authorisation or informed written consent where applicable; use for the purposes for which the data were collected; accurate and up-to-date data; secrecy for those who process non-public data; a written mandate setting out the conditions of use; due care; and respect for the rights of information, modification, deletion and blocking.

The Supplier represents that its compliance model provides for, depending on the processing concerned: (a) versioned Drupper Terms and privacy policies; (b) electronic acceptance mechanisms and retention of evidence; (c) information on purposes, recipients and rights; (d) a written mandate for Customer Data; (e) profiles, least privilege and access reviews; (f) duties of secrecy for personnel and vendors; (g) logging of instructions, transmissions and relevant events where applicable; (h) channels and procedures for information, rectification, updating, blocking or erasure; (i) backup, continuity and traceability; (j) contractual assessment of vendors; and (k) reasonable technical and organisational measures, within the scope of its systems and responsibilities.

This statement describes the operational framework to which the Supplier commits and does not amount to an absolute certification. The Supplier shall keep reasonable evidence of the controls it claims to apply and shall remedy any material gaps it detects within a period proportionate to the risk.

17.2 Application from 1 December 2026 #

From that date, the Parties shall observe the principles of lawfulness and fairness, purpose limitation, proportionality, data quality, accountability, security, transparency and confidentiality, as well as the applicable obligations relating to data protection by design and by default, information, security, incidents, rights and transfers.

17.3 Automatic contractual adaptation #

If a provision must be adjusted to comply with a mandatory rule, it shall be interpreted and amended to the minimum extent necessary, preserving the economic balance and the remaining clauses. The Parties shall sign reasonable supplementary documents if required by an authority or by law.

17.4 Impact assessments and high risk #

The Customer shall assess whether its purposes, rules or instructions require an impact assessment, particularly in the case of large-scale processing, systematic monitoring, profiling with significant effects or sensitive data. The Supplier shall cooperate in respect of the Platform, without assuming decisions that belong to the Customer.

18 Information security #

18.1 Risk-based standard #

The Supplier shall maintain technical and organisational measures appropriate to the risk, the state of the art, costs, scope, context, purposes and nature of the data. It may replace controls with equivalent or superior ones without materially reducing the overall level of protection.

18.2 Reference measures #

18.3 No implied certification #

These measures do not constitute ISO, SOC, PCI or any other certification, unless the Cover Sheet identifies a current certification and its scope. No system is absolutely invulnerable.

18.4 Obligations of the Customer #

The Customer shall apply controls over its users, permissions, devices, networks, integrations, credentials and exported data; keep its contact information up to date; protect copies; and not disable controls or share vulnerabilities.

18.5 Incidents under the Customer's control #

The Customer shall notify the Supplier within twenty-four hours of becoming aware of an incident in its environments or involving its users that may affect Druppify, credentials, Service Provider Data or the Supplier's Confidential Information. It shall contain the incident, preserve evidence and follow reasonable instructions.

18.6 Regulatory communications #

The Party acting as controller shall make the notifications to data subjects or authorities incumbent upon it. The other Party shall cooperate and shall not make public statements attributing responsibility without prior coordination, unless required by law.

18.7 Incident costs #

Each Party shall bear the costs attributable to its own acts, omissions or environments. Where there is concurrent liability, costs shall be allocated according to proven contribution and contractual limits.

18.8 Security testing #

The Customer shall not carry out or commission penetration testing, scanning, simulated attacks, social engineering, code review or load testing without written authorisation and an agreed scope, schedule and rules. Responsible disclosure of a vulnerability must be made through a private channel.

18.9 Security information #

Security questionnaires, diagrams, reports, tests, vulnerabilities, measures and responses shall be the Supplier's Confidential Information and may not be shared with third parties except where there is a legitimate need and an equivalent duty of confidentiality.

19 Obligations of the Supplier #

The Supplier undertakes to:

1. provide access in accordance with the contracted plan and scope;
2. perform the configurations, training and activities expressly included;
3. maintain reasonably qualified personnel;
4. use commercially reasonable efforts to ensure availability, continuity and security;
5. handle issues in accordance with their priority and the applicable support;
6. handle Confidential Information and Data in accordance with the Agreement;
7. maintain the rights necessary to provide Druppify;
8. give notice, where reasonably possible, of material changes affecting the contracted use;
9. maintain reasonable backup, traceability and recovery mechanisms; and
10. comply with the regulations applicable to its role as a technology provider and as a data controller or processor.

20 Obligations of the Customer #

The Customer undertakes to:

1. pay fees, taxes and charges in full and on time;
2. provide lawful, complete, accurate, relevant and validated information;
3. appoint counterparts with decision-making authority;
4. meet the milestones, tests and validations for which it is responsible;
5. train and supervise its users and promote adoption;
6. obtain the necessary contracts, consents, authorisations and legal bases;
7. use Druppify in accordance with the law, its purpose, the Documentation and the applicable limits;
8. manage permissions and the security of its environments;
9. keep the copies or exports necessary for its own obligations;
10. supervise Authorised Principals, vendors and third parties;
11. comply with labour, civil, tax, social security, safety, transport, consumer protection and other regulations applicable to its operations;
12. not make statements on behalf of the Supplier or present it as an employer, principal, operational contractor or debtor of payments;
13. report relevant risks, changes and incidents; and
14. indemnify the Supplier in the cases provided for.

21 Relationship with Service Providers and absence of any employment or operational relationship #

21.1 Primary relationship #

The Customer or the relevant Principal shall be the party that requests, offers, engages, assigns, directs, supervises, receives and pays for the Service Provider's services, according to the legal and operational reality. It shall document the relationship and comply with labour, civil, commercial, tax, social security, safety and risk-prevention obligations.

21.2 Limited role of the Supplier #

Unless separately agreed, the Supplier does not: select or engage Service Providers to perform services for the Customer; unilaterally set remuneration or fees; direct or supervise the actual work; control working hours in the capacity of an employer; apply labour sanctions; dismiss anyone; supply operational equipment; assume the risks inherent in the activity; or owe payment for the service performed.

21.3 Technology orchestration #

Druppify may publish opportunities, receive applications and record assignments, attendance, evidence, validations, calculations and statuses. These functions give effect to decisions or relationships of the operational parties and do not in themselves make the Supplier an employer, contracting party, employment agency, transport company or the party materially performing the services.

21.4 Drupper Terms #

Acceptance of the Drupper Terms governs the account, licence, security, support and data processing in relation to the Supplier. It does not in itself constitute a contract to perform the operational service or an employment relationship with OSystems.

21.5 Actual facts and mandatory rules #

The Parties acknowledge that legal classification depends on the facts and on mandatory rules. No clause is intended to conceal an employment or contractual relationship that actually exists. The Customer shall keep its configuration, communications, payments and instructions consistent with the declared model.

21.6 Claims #

The Customer shall assume and defend claims by Service Providers, workers, trade unions, authorities, principals or third parties arising from its engagement, direction, payment, safety, discrimination, termination or operations, except to the extent directly caused by an independent breach by the Supplier.

22 Payment, calculation and pre-settlement modules #

22.1 Calculation tool #

Unless a separate financial service is expressly contracted, the payment, statement or pre-settlement modules are calculation, recording and orchestration tools based on the Customer's rules and data. They do not constitute custody of funds, a bank account, a payment guarantee, a collection service or tax or labour advice.

22.2 Customer verification #

The Customer shall verify rates, formulas, taxes, withholdings, deductions, statuses and data before approving or making payment. The display of an amount does not replace settlement statements, receipts, invoices, contracts or documents required by law.

22.3 Payments to Service Providers #

The Customer or the relevant party shall remain the debtor and be responsible for making the payment. The Supplier is not liable for lack of funds, bank rejections, incorrect data, withholdings, disputes or defaults by the paying party.

23 Availability, maintenance and support #

23.1 Availability #

The Supplier shall use commercially reasonable efforts to keep the Service operational. A contractual percentage target shall apply only if one is entered in the Cover Sheet.

23.2 Calculation #

Where there is an SLA, monthly availability shall be calculated on the total minutes in the month less exclusions, taking into account confirmed unavailability of the core production functionality attributable to the Supplier. Minor degradation and non-contracted functions shall not be counted.

23.3 Exclusions #

The following are excluded: scheduled maintenance; emergencies; force majeure; failures of the internet, telecommunications, devices or systems of the Customer or of third parties; acts of the Customer; credential issues; external integrations; authorised suspension; attacks that could not be prevented with reasonable diligence; beta features; and periods of unmet dependencies.

23.4 Maintenance #

The Supplier may carry out corrective, preventive, evolutionary or security maintenance. Where reasonably possible, it shall give notice of scheduled maintenance with a material impact and shall endeavour to carry it out in low-usage windows.

23.5 Standard Support #

Unless otherwise agreed, support shall be provided to the Customer's Administrators during the hours set out in the Cover Sheet and shall cover issues with the general operation of the Platform. It does not include additional training, the Customer's day-to-day operations, devices, networks, external systems, development work or consultancy.

The Supplier may handle queries about the use of the Platform raised both by the Customer's Authorised Users and by Service Providers, in accordance with its internal service guidelines and with any arrangements it agrees with each operator for specific operational matters. This assistance is a discretionary right of the Supplier and not a committed service level, a vested right of the Customer or the Service Provider, or an obligation of continuity; its scope, channel and hours may be adjusted by informing the Customer with reasonable advance notice.

Such assistance is confined to the use of the Platform. Matters pertaining to the relationship between the Service Provider and the Customer or its Authorised Principals, such as assignment, economic terms, payments, evaluation, operational instructions and termination, shall be referred to the Customer, without the Supplier intervening in them or assuming any responsibility in respect of them.

23.6 Priorities and response targets #

The following targets are times to acknowledge receipt and begin triage, not guaranteed resolution times, and apply unless otherwise agreed:

23.7 Complete ticket #

The Customer must state the date, user, account, environment, module, steps, evidence, impact, frequency and contact details. The response clock may be paused while necessary information or access is missing.

23.8 Resolution #

The Supplier shall prioritise according to impact, severity, reproducibility, security and scope. It may resolve issues by means of a fix, configuration, workaround, rollback, update, replacement or usage instructions.

23.9 Service credits #

Service credits shall apply only if the Cover Sheet sets out their scale. They shall be the sole financial remedy for failure to meet the SLA, must be requested within ten calendar days of the end of the month and shall not exceed the percentage of the monthly fee indicated. They do not apply if the Customer is late in payment or in breach.

24 Prices, invoicing, taxes and late payment #

24.1 Fees #

The Customer shall pay the fixed, variable and minimum charges, implementation fees, professional services, overage charges and expenses set out in the Cover Sheet or Change Order, plus VAT and any other applicable taxes.

24.2 Measurement #

Druppify's records shall be the basis for measuring users, shifts, transactions, storage or other metrics, save for proven manifest error. The Customer shall use the Platform regularly and shall not omit records in order to reduce charges.

24.3 Invoicing and payment #

Invoicing shall follow the frequency set out in the Cover Sheet. The Customer shall pay without set-off or unauthorised withholding. Non-use does not eliminate minimum charges or minimum-term commitments.

24.4 Objections #

Any objection to an invoice must be specific and raised within ten calendar days of its receipt. The undisputed portion shall be paid on time. Silence does not prevent the correction of a manifest error, but does not suspend the due date.

24.5 Late payment #

Late payment shall accrue interest at the maximum rate permitted by law for the relevant obligation, plus reasonable collection costs. The Supplier may suspend the Service after notice and a reasonable period, except in cases of risk or repeated late payment.

24.6 Indexation #

In the absence of a specific rule, the fees shall be adjusted on each anniversary by the positive variation in the Consumer Price Index (IPC) since the last adjustment. If the currency is the UF (Unidad de Fomento), payment shall be made at its value in Chilean pesos on the invoice date or the payment date, as set out in the Cover Sheet.

24.7 Regulatory and third-party costs #

The Supplier may propose reasonable adjustments where taxes, regulation, licences, cloud services, messaging, maps or Third-Party Services materially increase costs. If the adjustment exceeds the ordinary indexation and substantially affects the Customer, it shall be notified at least thirty calendar days in advance.

24.8 Additional services #

Out-of-scope work shall be quoted or invoiced at professional rates, subject to prior authorisation. Emergency work requested by the Customer may be authorised by its Administrator and documented subsequently.

24.9 Discounts #

Discounts are granted in consideration of volume, term and conditions. If the Customer terminates or fails to comply with the minimum term, the Supplier may recover conditional discounts, in addition to accrued amounts, to the extent indicated in the Cover Sheet.

25 Term, activation and renewal #

25.1 Legal effectiveness #

The Agreement takes effect upon its acceptance. Implementation and confidentiality obligations may begin before production activation.

25.2 Commercial activation #

Fees shall start on the date indicated or, failing that, on the first enablement in production. Delays attributable to the Customer shall not indefinitely postpone invoicing if the Supplier has fulfilled its essential dependencies and the Platform is available for activation.

25.3 Minimum term #

During the Minimum Commercial Term, the Customer shall maintain the contracted services and pay the minimum fees. Ceasing use, migrating, developing its own solution or changing its operations does not extinguish this commitment.

25.4 Renewal #

The Agreement shall renew in accordance with the Cover Sheet. A Party that does not wish to renew shall give notice within the applicable period. The Supplier may propose conditions and fees for the renewal with reasonable notice.

25.5 Non-exclusivity #

The Agreement does not grant exclusivity. The Supplier may provide services to third parties and the Customer may contract other systems, subject to confidentiality, intellectual property and obligations in force.

26 Suspension #

The Supplier may suspend the Service in whole or in part where:

1. payments are overdue after the applicable notice;
2. the use is unlawful, fraudulent or contrary to the Agreement;
3. there is a risk to security, integrity, availability or third parties;
4. the Customer shares credentials, carries out unauthorised tests or infringes intellectual property;
5. an authority or critical vendor so requires;
6. authorisations, information or essential dependencies are missing;
7. limits are exceeded materially and persistently; or
8. it is necessary to contain a Security Incident.

Where reasonably possible, the Supplier shall notify the cause, scope and actions to restore the Service. If the cause is attributable to the Customer, fees shall continue to accrue and reactivation costs may be invoiced. Suspension does not limit other rights.

27 Termination #

27.1 Mutual agreement #

The Parties may terminate the Agreement in writing, making provision for payments, transition and data.

27.2 Breach capable of remedy #

A Party may terminate if the other commits a material breach and fails to remedy it within fifteen Business Days of a detailed notice. For late payment, the period may be ten calendar days.

27.3 Immediate termination #

The Supplier may terminate with immediate effect in the event of a serious infringement involving intellectual property, copying, reverse engineering, critical confidentiality, unlawful data, security, fraud, repeated late payment, criminal use, deliberate damage, unauthorised assignment to a competitor or conduct that materially exposes it to liability.

27.4 Insolvency #

A Party may terminate if the other enters into liquidation, dissolution, substantial cessation of business or insolvency proceedings that threaten performance, or loses essential authorisations, unless prohibited by law.

27.5 Prolonged force majeure #

Either Party may terminate the affected component if a force majeure event substantially prevents the Service for more than sixty calendar days.

27.6 Termination for convenience by the Customer #

The Customer may terminate for convenience during the minimum term only if the Cover Sheet so permits and it pays the agreed charge, accrued amounts, recoverable discounts and unamortised costs. If such termination is not permitted, the remaining minimum fees shall remain payable as a contractual commitment, without prejudice to the duty to mitigate where required by law.

27.7 Termination for convenience by the Supplier #

The Supplier shall not terminate for convenience during the minimum term, unless a special condition so provides. It may elect not to renew by giving the applicable notice.

28 Effects of termination and exit #

28.1 Cessation of access #

Upon termination, the licence and access shall cease, save for any agreed export or transition window. The Customer shall discontinue any use of the brand that suggests a continuing relationship.

28.2 Export #

The Customer may export Customer Data during the period set out in the Cover Sheet using the standard formats available. Special exports, transformation, assisted migration or transition support may be invoiced.

28.3 Payment #

Invoices, usage, services, taxes, interest, minimum commitments, authorised charges and other accrued obligations shall be payable.

28.4 Service Provider Data #

The Customer's access to Service Provider Data shall cease. The Supplier may retain such data as controller in accordance with clause 16. The Customer shall delete any copies it no longer needs or for which it lacks a legal basis.

28.5 Erasure of Customer Data #

Clause 15.12 shall apply. A copy may be retained for legal obligations, audit, security or defence purposes, with restricted access and without incompatible use.

28.6 Transition #

Upon request and subject to availability, the Supplier may provide exit assistance at an agreed rate and under an agreed plan. It is not obliged to hand over secrets, code, internal tools or third-party data.

28.7 Survival #

Provisions on payments, intellectual property, historical brand use, confidentiality, data, security, liability, indemnification and jurisdiction, and any other provisions that by their nature should continue, shall survive.

29 Representations, warranties and disclaimers #

29.1 Mutual representations #

Each Party represents that it is validly incorporated, has the necessary powers and, in entering into the Agreement, does not breach any known obligations.

29.2 Limited warranty of the Supplier #

The Supplier warrants that it will provide the Service with reasonable professional diligence and that the contracted core functionality will perform materially in accordance with its Documentation, subject to dependencies and exclusions. In the event of a covered defect, its principal obligation shall be to correct it, offer a workaround, re-perform or, if this is not reasonably possible, allow termination of the affected component with a pro rata refund of prepaid fees not yet accrued.

29.3 Warranties of the Customer #

The Customer warrants that it holds sufficient rights and legal bases in respect of data, content, instructions, trademarks, users, integrations and operations; that it will not introduce unlawful material; and that its relationship with Service Providers and third parties complies with the law.

29.4 Exclusions #

Except as expressly warranted, the Service is provided on an as-available basis and in accordance with its SaaS nature. The Supplier does not warrant that it will be uninterrupted, error-free, compatible with every system or fit for an undisclosed purpose, or that it will produce specific commercial, logistical, labour, financial or regulatory results.

29.5 Decisions and data #

The Supplier is not liable for the Customer's decisions, parameters, rules, inaccurate data, omissions, use out of context or exclusive reliance without reasonable controls.

29.6 No professional advice #

Reports, calculations, alerts and documentation do not constitute legal, labour, tax, accounting, financial, physical security or transport advice. The Customer shall obtain specialist advice.

30 Indemnification #

30.1 Indemnification in favour of the Supplier #

The Customer shall defend and indemnify the Supplier, its affiliates, directors and personnel against third-party claims, penalties, costs and damages arising from:

1. any employment, civil, commercial, tax, social security or safety relationship with Service Providers;
2. operational services, accidents, losses, products, deliveries or actions of the Customer, Principals or Service Providers;
3. Customer Data, content, instructions or communications lacking sufficient rights, basis or information;
4. improper use or disclosure of Service Provider Data;
5. infringement of intellectual property, trademarks, confidentiality, prohibited uses or fair competition;
6. regulatory non-compliance by the Customer or its third parties;
7. fraud, discrimination, harassment or unlawful conduct under the Customer's control; and
8. taxes, payments or obligations arising from the Customer's operations.

This shall not apply to the extent directly caused by an independent breach, wilful misconduct or gross negligence of the Supplier.

30.2 Intellectual property indemnification by the Supplier #

The Supplier shall defend the Customer against a third-party claim alleging that the authorised use of the core of Druppify infringes a copyright, patent or trademark in Chile, and shall pay any final judgment or approved settlement, subject to the applicable procedure.

It does not apply to combinations not supplied by the Supplier, modifications by the Customer, use outside the scope, non-compliance with the Documentation, obsolete versions maintained contrary to instructions, the Customer's data or materials, or third-party components governed by their own licences.

The Supplier may obtain a right of use for, modify, replace or terminate the affected component and refund prepaid fees not yet accrued on a pro rata basis. These measures constitute the exclusive remedy for that claim.

30.3 Procedure #

The indemnified Party shall give timely notice, allow control of the defence and cooperate. No settlement admitting fault or imposing non-monetary obligations on the indemnified Party shall be entered into without its consent, which shall not be unreasonably withheld.

31 Limitation of liability #

31.1 Indirect damages #

To the maximum extent permitted by law, neither Party shall be liable for loss of profits, loss of opportunity, damage to reputation, loss of anticipated savings or business, loss of data that has not been backed up, or indirect, special, incidental, punitive or consequential damages, even if advised of their possibility.

31.2 Operational exclusions #

The Supplier is not liable for failures or damage arising from acts of the Customer, users, Service Providers or Principals, incorrect data, integrations, Third-Party Services, the internet, devices, force majeure, unauthorised use, instructions, the Customer's failure to keep its own backups or failure to follow recommendations.

31.3 General limit on the Supplier's liability #

The Supplier's aggregate liability arising from the Agreement shall be limited to the amount set out in the Cover Sheet. That limit is cumulative and applies to all claims for the period defined in the Cover Sheet itself, regardless of the number of events, the nature of the action brought or the Party bringing it.

In the absence of an indication in the Cover Sheet, the limit shall be the net fees paid or payable for the affected Service during the twelve months preceding the first event giving rise to the claim; if the Service had been in place for a shorter time, the limit shall be the fees for the actual period on an annualised basis, not exceeding the twelve-month commitment.

Where the limit is expressed by reference to an invoicing period, it shall be calculated on the net fees actually paid by the Customer in the period immediately preceding the first event giving rise to the claim, excluding taxes, indexation adjustments, interest and third-party charges.

31.4 Enhanced limit #

A limit higher than that in clause 31.3 shall apply only if the Cover Sheet expressly provides for it, indicating the matters it covers and its amount. In the absence of such a provision, the limit in clause 31.3 shall apply to all matters, including confidentiality, processor obligations, security and intellectual property indemnification.

The foregoing is without prejudice to clause 31.5, which admits no limitation.

31.5 Mandatory exceptions #

The limits do not apply to wilful misconduct or gross negligence, to death or personal injury giving rise to legal liability, or to matters that cannot be limited by law. They do not restrict the powers of authorities or the rights of data subjects against the relevant controller.

31.6 Customer obligations not subject to the limit #

The limit shall not apply to the Customer's payment obligations or to indemnities for copying, reverse engineering, intellectual property, unlawful use, Customer Data without a legal basis, misuse of Service Provider Data, employment or operational relationships, fraud, wilful misconduct or gross negligence.

31.7 Regulatory fines #

Each Party shall bear fines imposed for its own infringement. As between the Parties, reimbursement may be claimed to the extent permitted and caused by an indemnifiable breach by the other Party, subject to the applicable limits.

31.8 Time limit for claims #

Except for non-waivable rights, a contractual claim must be notified within twelve months from when the Party became aware, or should have become aware, of the facts and, in any event, within eighteen months of the event, except for claims relating to payments, intellectual property, critical confidentiality and data.

31.9 Basis of the bargain #

The Parties acknowledge that the fees, warranties, exclusions and limits allocate risks and are essential to the price and availability of the Service.

32 Records, evidence and audit #

32.1 Platform records #

Logs, events, timestamps, approvals, electronic signatures, statuses and records generated in the ordinary course shall constitute technical evidence of use, subject to proof to the contrary. The Supplier does not warrant that they replace documents required by law.

32.2 Usage audit #

Where there are reasonable indications of excess use, improper access or infringement, the Supplier may review the related configurations and records, preserving confidentiality. If a material breach is confirmed, the Customer shall pay the omitted charges and reasonable costs.

32.3 Security review by the Customer #

The Customer may request an annual documentary review. It shall not have access to code, other customers' data, secrets, exploitable vulnerabilities or third-party facilities without authorisation.

32.4 Retention of evidence #

Each Party shall retain the contracts, authorisations, instructions, acceptances, invoices, tickets, incident records and other records necessary for the statutory periods and the periods required for the defence of rights.

33 Regulatory compliance and ethics #

33.1 General compliance #

Each Party shall comply with the laws applicable to its activity, including those on data protection, intellectual property, competition, anti-corruption, economic crimes, cybersecurity, taxation and labour relations, according to its role and the extent to which it is actually subject to them.

33.2 Business conduct #

Neither Party shall offer improper payments, falsify records, use the Service for money laundering, unlawful financing, fraud or evasion, or ask the other Party to breach any rule.

33.3 Investigations #

The Parties shall cooperate reasonably with legal requests, preserving privileges, confidentiality and the principle of minimum disclosure. Costs caused by a Party's breach shall be borne by that Party.

34 Assignment, change of control and subcontracting #

34.1 Assignment by the Customer #

The Customer shall not assign the Agreement, sublicense the Service or transfer accounts without the Supplier's written consent. A change of control in favour of a direct competitor may be treated as an assignment and entitle the Supplier to impose protective measures or not to renew.

34.2 Assignment by the Supplier #

The Supplier may assign the Agreement to an affiliate, successor or acquirer of the Platform or of a substantial part of the business, by notifying the Customer and ensuring the continuity of obligations. Any other assignment shall require consent, which shall not be unreasonably withheld.

34.3 Subcontracting #

The Supplier may subcontract technical activities, support or infrastructure and shall remain responsible in accordance with the Agreement. The processing of Customer Data by Sub-processors shall be governed by clause 15.8.

35 Force majeure #

Neither Party shall be liable for delays caused by unforeseeable or irresistible events beyond its reasonable control, including disasters, fires, widespread telecommunications or cloud failures, acts of authority, war, civil unrest, epidemics, power outages, large-scale attacks that could not be prevented with reasonable diligence or external labour disputes.

The affected Party shall give notice, mitigate and resume performance. Force majeure does not excuse accrued payments or confidentiality and security obligations that can reasonably be performed. If it is prolonged, clause 27.5 shall apply.

36 Notices #

36.1 Contractual channels #

Notices of breach, termination, non-renewal, assignment or amendment shall be sent to the email and postal addresses set out in the Cover Sheet. Each Party shall keep its details up to date.

36.2 Deemed receipt #

An email shall be deemed received on the Business Day on which it is sent if it is sent before 18:00 and no delivery error occurs; otherwise, on the following Business Day. A letter shall be deemed received on the recorded delivery date.

36.3 Security and privacy #

Incidents and data requests shall be sent to the specialised contacts set out in the Cover Sheet or, failing these, to the contractual email address. In urgent cases, telephone or another channel may be used, followed by written confirmation.

36.4 Operational communications #

Tickets, minutes, in-Platform messages and operational emails are valid for ordinary instructions, but do not modify fees, liability, term or ownership unless they constitute an authorised Change Order.

37 Amendments and regulatory changes #

37.1 Updates to the General Conditions #

The Supplier may update these General Conditions to reflect the evolution of the Service or changes in regulation, security or Third-Party Services, by publishing a new version identified by its number and effective date.

The update shall be communicated to the Customer at the contractual email address set out in the Cover Sheet at least thirty calendar days before it enters into force, indicating the version, the date and a summary of the material changes. Once that period has elapsed without rejection, the new version shall govern the Agreement.

Within that period, the Customer may reject the new version in writing where it materially reduces the Customer's rights, materially increases its obligations, introduces charges or extends the purposes, categories of data or recipients of the processing. In that case, the version in force shall continue to apply until the end of the current contracted period, and the Customer may terminate the Agreement without cost or penalty by giving thirty calendar days' notice, without prejudice to accrued amounts and to obligations that by their nature survive.

A rejection based on changes other than those indicated shall not suspend the entry into force of the new version.

This clause does not alter the particular conditions of the Cover Sheet, which may only be modified by written agreement of the Parties or by means of a Change Order.

37.2 Operational policies #

The Supplier may update the Documentation, the Brand Policies, its security and acceptable use policies and its operational processes to reflect the evolution of the Service, provided that it does not materially reduce essential rights or contradict the Cover Sheet.

37.3 Mandatory changes #

The Supplier may implement changes necessary to comply with the law, authorities, security requirements or Third-Party Services, giving notice where possible. If such changes generate material costs or render a function unviable, the Parties shall adjust the scope or fee in good faith.

38 Entire agreement, waiver and severability #

38.1 Entire agreement #

The Agreement supersedes all prior understandings regarding its subject matter. A proposal or presentation is binding only to the extent incorporated into it.

38.2 No waiver #

Forbearance does not constitute a waiver or an amendment. A waiver must be in writing and specific.

38.3 Severability #

If a clause is invalid, it shall be adjusted to the minimum extent necessary to make it enforceable and the remaining clauses shall continue in effect. The Parties shall replace the provision while preserving its economic and protective purpose.

38.4 Headings and interpretation #

Headings are for ease of reading only. "Includes" means includes without limitation. The singular includes the plural. No provision shall be construed against a Party on the ground that it drafted the template.

38.5 Days #

Periods are in calendar days unless Business Days are indicated. If a contractual deadline falls on a day that is not a Business Day, it shall be moved to the following Business Day, except for payments with a fixed date and statutory periods.

38.6 Independence of the Parties #

The Parties are independent contractors. No relationship with Service Providers, users or Principals confers third-party beneficiary rights against the Supplier, except for non-waivable statutory rights.

39 Governing law and jurisdiction #

The Agreement shall be governed by the laws of the Republic of Chile. For all legal purposes, the Parties establish their domicile in Viña del Mar and submit to the jurisdiction of the ordinary courts of justice sitting in that city, without prejudice to urgent measures that may be sought before a competent court and to non-derogable rules of jurisdiction.

Before bringing legal proceedings, representatives with decision-making authority shall endeavour to resolve the dispute for ten Business Days following a notice, except in matters of urgency, limitation periods, intellectual property, security, data or interim measures.

40 Electronic signature, counterparts and acceptance #

The Agreement may be executed in separate counterparts, by handwritten signature, by simple or advanced electronic signature and through electronic acceptance platforms. Digital copies and acceptance records shall have the effects and evidentiary value recognised by applicable law.

The Parties declare that they have read, understood and accepted the Cover Sheet and the General Conditions.