Terms of Service

Latest update: These Terms of Services (the “Terms”) constitute a legal agreement between the organization identified on an Order Form or through Proof-of-Concept Services, and agreeing to these Terms (the “Customer”, “you”) and Flare Systems Inc., with a registered address at 1751 Rue Richardson, Montréal (Quebec) H3K 1G6, Canada (“Flare”, “we”, “us”, “our”).

These Terms are effective upon Customer’s acceptance of such Terms through the Order Form and remain in full force until the Subscription Term is terminated or expired in accordance with this Agreement. If you have any questions on the Agreement, you can reach out to us by e-mail at [email protected].

1. DEFINITIONS

The terms which are not defined elsewhere in this Agreement are defined below.

2. OUR SERVICES

3. ACCEPTABLE USE

Customer agrees and understands that the use of the Services is subject to the restrictions set forth in this Section, and Customer will not authorize or allow the use of the Services in violation of the Agreement. Customer remains liable for the act and omissions of its End Users. In this Section, the term “Customer” is intended to include any End Users, and Customer acknowledges that End Users are required to accept our Terms of Use prior for accessing and using the Services.

The Services allow End Users to conduct queries through real-time monitoring of the dark net and other forums or networks known to be used for fraudulent or criminal purposes, such as for the reseller of stolen credentials (the “Dark Web”). The following restrictions are applicable to the use of these query functions, as well as for any monitoring capabilities made available as part of the Services:

Data insights may be provided by combining different datasets and augmenting Customer Data with Risk Data to provide Outputs (as defined below). Customer agrees and understands that (a) these Outputs may not be used for discriminatory purposes, or in violation of Applicable Law and (b) Flare is not responsible for any actions or decisions taken based on any Output. Customer must ensure that it verifies assumptions and conducts independent reviews prior for making decisions or taking actions which can affect individuals, or the conduct of its affairs.

The Services may not be used in high-risk situations such as (a) to prevent death and bodily harm on individuals; (b) to conduct criminal inquiries for a forensic report; (c) in high-risk industries and settings such as nuclear power facilities; (d) to conduct criminal checks and

(e) as part of automated decision-making, especially for making decisions affecting the rights and freedoms of individuals.

Customer represents and warrants that it will not use the Services, nor authorize the use of the Services, in a manner:

If you breach this Section 3, or if we reasonably believe that a breach is imminent, we may suspend part or all of the Services to the minimum extent necessary to ensure that the breach is resolved or contained, and Flare will reactive access to the Services as soon as reasonably practicable, except that Flare reserves the right to ban access or suspend permanently access to End Users who have breached this Section 3.

4. LICENSES

5. INTELLECTUAL PROPERTY

We shall remain the sole and exclusive owner of all rights, titles and interests, including all Intellectual Property, in and to the Services (including the Flare API, the Flare Platform, and the Risk Data), the Documentation, the Aggregated Data, and in and to our Confidential Information. The Services are licensed, not sold, to Customer. All rights not granted herein are reserved.

Notwithstanding anything to the contrary, Flare shall also be the sole owner of any suggestions, enhancement requests, recommendations or other feedback provided by Customer (or its End Users) to Flare, as long as they relate to the Services, and Customer hereby assigns to Flare, without limitation of any kind, all of its rights, titles and interests therein, and waives any non-assignable moral right therein, Flare accepting such assignment and waiver. Customer shall remain the sole and exclusive owner of all rights, titles, and interests into its Intellectual Property, including, without limitation, Anonymized Data and Customer Data.

Your use of the Services is subject to your compliance with the applicable Open-Source Software License Terms contained in the Services. You agree that you may not remove any attribution notices or proprietary notices set forth in the Services, or their underlying technologies.

6. SERVICE LEVEL AGREEMENT

The Services are available on a twenty-four (24) hours a day basis, from Monday to Sunday. Subject to this Agreement, Flare shall deploy commercially reasonable efforts to ensure an Uptime of 98.5% (the “Service Level”).

The Service Level excludes downtime that is caused by: (i) Customer’s fault, acts or omissions, or a breach of this Agreement , (ii) events that are not within the reasonable control of Flare, such as a case of Force Majeure, (iii) Customer’s third-party service providers (including Internet service providers’ downtime), (iv) Customer’s IT infrastructure and internal configurations, (v) suspension of the Services in accordance with this Agreement or (vi) a Urgent Security Issue (in which case, Flare may not be able to provide advance notice of such downtime).

The Service Level also excludes downtime that is caused by maintenance (“Scheduled Downtime”). We reserve up to eight (8) hours per month for Scheduled Downtime. Flare will provide a written notice to Customer prior to proceeding with a Scheduled Downtime either by e-mail or through the Flare Platform.

We may suspend the Services at our sole discretion in case of an Urgent Security Issue or as otherwise required to comply with Applicable Law, and such suspension shall be considered excluded from the Service Level calculation.

7. TECHNICAL SUPPORT

We provide technical support as set forth in the Documentation. Support requests are handled based on their criticality, as determined by the impacts on the Services. We do not provide technical support for previous versions of the Services. We deploy commercially reasonable efforts to respond to technical support requests within twenty-four (24) hours, from Monday through Friday, excluding on statutory holidays applicable to the activities of Flare.

8. FEES, TAXES

You agree to pay the fees set forth in the Order Form, including any costs and expenses which are set forth in such Order Form (the “Fees”). The Fees are subject to the payment terms set forth in the Order Form. If no payment terms are indicated, the Fees are payable within thirty (30) days of the invoice date, in Canadian dollars. After this delay, any unpaid portion of the Fees is subject to a monthly interest of 1%, for a total of 12% annually. If the payment is not received within sixty (60) days, Flare may suspend the Services for late payment at its sole discretion, and until any undisputed unpaid portion of the Fees are paid, and shall have no obligations to provide the Services until it receives full payment. Once the payment is received, Flare will reactivate the Services within twenty-four (24) hours. You will be liable for all costs incurred to recover the unpaid portion of the Fees, including attorney’s fees, if payment is not received within ninety (90) days of the invoice date and Flare may terminate this Agreement with cause pursuant to 17.

If a payment is processed through direct debit in your bank account or through a credit card, you hereby authorize us to debit the Fees from the bank account or the credit card. You also represent and warrant that you provide us with accurate and truthful banking and financial information as required for us to process the payments. It is your responsibility to inform us without undue delay of any changes to your banking and financial information. Notwithstanding the foregoing, we have no obligation to make such payment methods available to you. We may change our billing options at any time by advising you at least thirty (30) days in advance.

Subject to Applicable Law, and except if the Services are terminated by you for our breach of this Agreement, or otherwise by Flare for convenience, pursuant to Section 17, the Fees are non-reimbursable and non-cancellable, and we have no obligation to refund any Fees already paid by you to us for any reason whatsoever.

If we are required by Applicable Law, or by the administration thereof, to collect any applicable taxes from Customer, Customer shall pay such taxes to Flare concurrently with and in addition to the payment of the Fees.

9. CONFIDENTIAL INFORMATION

Confidential Information shall not include information which the Receiving Party can demonstrate: (i) is readily available to the public in the same form through no fault of the Receiving Party, (ii) did not originate from the Disclosing Party and was lawfully obtained by the Receiving Party in the same form from an independent third party without any restrictions on disclosure, or (iii) did not originate from the Disclosing Party and was in the possession of the Receiving Party in the same form prior to disclosure to the Receiving Party by the Disclosing Party. The foregoing shall not apply to Personal Data and Service Data.

The Receiving Party shall take all reasonable steps necessary to ensure that the Confidential Information of the Disclosing Party is not made available or disclosed by it or by any of its

Representatives to any third person except (i) as required by Applicable Law including a valid court order, (ii) with the prior written consent of the Disclosing Party, (iii) as authorized or reasonable inferred from this Agreement, or (iv) if the disclosure is made to the Receiving Party’s legal counsel, an auditor, or as reasonably required in the course of the administration of a legal entity. The Receiving Party will ensure that its Representatives are subject to an appropriate obligation of confidentiality.

The Receiving Party shall deploy commercially reasonable technical and organizational controls to protect the Disclosing Party’s Confidential Information against a Security Breach, taking into consideration the risks to such Confidential Information. Without limiting the generality of the foregoing, Flare shall ensure that Customer Data is encrypted in-transit and at-rest and enter into commercially reasonable terms with suppliers and service provider which shall be substantially as set forth herein. In case of a Security Breach, Flare will notify Customer without undue delays by providing information on the cause of the Security Breach, the types of Customer Data affected by the Security Breach and the likely consequences. If such information is not available at the time of the initial notice, Flare will follow up with additional information as such information becomes available.

Upon the termination of this Agreement for any reason, the Receiving Party shall promptly, at the request of the Disclosing Party, either return all Confidential Information in its possession to the Disclosing Party or securely destroy such Confidential Information. Notwithstanding the foregoing, the Receiving Party is authorized to keep copies as required to comply with Applicable Law, for its corporate records or as part of business continuity; in such case, the Receiving Party shall ensure the confidentiality and integrity of such Confidential Information as long as it is under the Receiving Party custody, and shall securely delete such Confidential Information as soon as reasonably possible.

9. CONFIDENTIAL INFORMATION

Each party agrees to comply with Data Protection Laws in the use and provision of the Services.

Without limiting the generality of the foregoing, Customer is solely responsible for (a) determining if it has a lawful basis for processing the Service Data, including through queries, and monitoring functionalities made available through the Services; (b) providing appropriate transparency notices based on its processing of such Service Data; (c) for determining appropriate retention periods for Service Data which are acquired by Customer through the use of the Services, such as query results; (d) for ensuring that it implements adequate technical and organizational measures to protect Service Data acquired through the Services against Security Breaches, and for notifying concerned individuals in case of a Security Breach.

Flare will process Personal Data as required to provide the Services or otherwise as set forth in its Privacy Policy. Flare will not sell or otherwise commercialize the Personal Data.

Flare shall ensure that any third party or personnel who process Personal Data on its behalf is subject to an appropriate confidentiality obligation with respect to such Personal Data.

The parties agree to collaborate in good faith to respond to End Users’ requests regarding their rights on their Personal Data. If Flare receives a request to this effect, Flare will inform Customer without undue delays and Customer will be responsible for responding to such requests. If a request is received by either party regarding Service Data, the parties will collaborate in good faith to respond to the requests, including by limiting further use of the Service Data thereafter if appropriate.

10. CUSTOMER INDEMNIFICATION

Each party agrees to comply with Data Protection Laws in the use and provision of the Services.

Without limiting the generality of the foregoing, Customer is solely responsible for (a) determining if it has a lawful basis for processing the Service Data, including through queries, and monitoring functionalities made available through the Services; (b) providing appropriate transparency notices based on its processing of such Service Data; (c) for determining appropriate retention periods for Service Data which are acquired by Customer through the use of the Services, such as query results; (d) for ensuring that it implements adequate technical and organizational measures to protect Service Data acquired through the Services against Security Breaches, and for notifying concerned individuals in case of a Security Breach.

Flare will process Personal Data as required to provide the Services or otherwise as set forth in its Privacy Policy. Flare will not sell or otherwise commercialize the Personal Data.

Flare shall ensure that any third party or personnel who process Personal Data on its behalf is subject to an appropriate confidentiality obligation with respect to such Personal Data.

The parties agree to collaborate in good faith to respond to End Users’ requests regarding their rights on their Personal Data. If Flare receives a request to this effect, Flare will inform Customer without undue delays and Customer will be responsible for responding to such requests. If a request is received by either party regarding Service Data, the parties will collaborate in good faith to respond to the requests, including by limiting further use of the Service Data thereafter if appropriate.

11. CUSTOMER INDEMNIFICATION

You hereby agree to indemnify us, defend us and hold us harmless (including our Representatives) from and against any and all claims, penalties, fines, costs, expenses (including reasonable attorney’s fees), actions, damages, losses or liabilities, directly or indirectly arising out of, related to, in connection with or resulting from: (i) a breach of Section 3 and (ii) your gross negligence, fraud and willful misconduct.

12. DISCLAIMER

Except as provided in this Agreement, and to the maximum extent permitted under Applicable Law, (i) we do not warrant that the Services will be uninterrupted or error free, (ii) we do not make any warranty as to the results that may be obtained from the use of the Services,

(iii) Flare is the sole authorized person to make any representations or warranties on its behalf, and (iv) the Services are provided on an “as is”, “where is” and “as available” basis. Flare does not guarantee that the Risk Data is accurate or reliable.

To the maximum extent permitted by Applicable Law, and except as otherwise set forth herein, we make no other representations, conditions, warranties or guarantees, express or implied, regarding the accuracy, quality, reliability or completeness of any outputs or information (including Outputs) provided as a by or as a result of using the Services, and we expressly disclaim any and all implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. Unless stated otherwise in this Agreement, you hereby waive your rights in any of the foregoing warranties, representations or conditions, whether express or implied.

Customer is solely responsible for the accuracy, truthfulness and quality of Customer Data and any content or information, directly or indirectly, delivered through or passed through the Services by Customer (or its End Users). We exercise no control over and accept no responsibility for the accuracy, truthfulness and quality of Customer Data, including, without limitation, violations of Intellectual Property, Applicable Law and privacy rights.

You acknowledge and agree that any Outputs produced by or obtained from the Services (or the use thereof) are for informational purposes only. We do not have any liability whatsoever for business decisions resulting from such Outputs. You must ensure the Outputs are accurate and consistent. For the avoidance of doubt, this includes any advices on mitigation and detection of information security vulnerabilities.

We do not operate the networks of, or have any control over the operations of, the wireless or other communications service providers through which you may access the Services. Accordingly, (a) we disclaim all responsibility and liability for, or relating to, your use of any such providers to access the Services, and (b) we cannot guarantee the privacy or security of wireless data transmissions.

No other oral advices, written or electronically delivered information given by us or our Representatives shall create any warranty.

13. LIMITATION OF LIABILITY

To the maximum extent permitted by Applicable Law, in no event will either party and its Representatives be liable for any consequential, indirect, punitive, special or incident damages, which shall include, without limitation, any loss of data, loss of opportunities, reputational damages or loss revenues resulting from a breach of this Agreement, or the provision of the Services, even if it has been made aware of such damages.

To the maximum extent permitted by Applicable Law, in no event will Flare’s liability to Customer or its Representatives in relation to this Agreement or the provision of the Services will exceed the Fees paid by Customer in the twelve (12) months preceding the claim.

For the avoidance of doubt, the foregoing limitation of liability shall not apply to bodily damages, moral damages, willful misconduct, gross negligence and fraud.

14. FORCE MAJEURE

Except as it relates to the payment of the Fees, neither party shall be liable for delays in or failure of performance hereunder due to causes beyond its reasonable control, including, but not limited to, acts of God or public enemy, acts of government in either its sovereign or contractual capacity, flood, earthquake, epidemic, pandemic (including any similar phenomenon arising from the outbreak of coronavirus COVID-19) or other natural disaster, strike or other labor disputes, acts of war, acts of civil disobedience, denial-of-services and distributed-denial-of-services, ransomware and other cyber-attacks that are not caused or facilitated by negligence (a “Force Majeure”). Any delay resulting from a Force Majeure will result in an extension of the corresponding obligation for a period equal to the time lost by reason of such cause. For instance, if the Services are unavailable for a period of two

(2) weeks as a result of a Force Majeure, then the Subscription Term shall automatically be extended by two (2) weeks. The parties shall advise each other as soon as possible in the event of a Force Majeure.

15. EXPORT CONTROL; ANTI-CORRUPTION

Each party shall comply with all applicable anti-bribery and anti-corruption laws, including, without limitation, the Canadian Corruption of Foreign Public Officials Act and the U.S. Foreign Corrupt Practices Act of 1977, as amended (“Anti-Corruption Laws”). Neither party nor any of their Representatives is or has been the subject of any investigation or inquiry by any authorities with respect to potential or actual violations of Anti-Corruption Law. If a party has been subject to such investigation or inquiry, it represents and warrants that it has not been found in breach of Applicable Law and that no charge has been retained against this party. Notwithstanding anything to the contrary, if either party takes any action that could constitute a violation of Anti-Corruption Laws, the other party may immediately terminate these Terms of Services.

Customer acknowledges that the provision of the Services, including the Flare API and Flare Platform is subject to export control laws. Customer hereby represents and warrants that

(i) neither it nor any of its Representatives will export, re-export, distribute or otherwise transfer the Services or Flare Platform, or any technical information related thereto, directly or indirectly, to any country for which the competent authorities (including the Canadian and United States government entities) require an export license, other governmental approval or letters of assurance without first obtaining such license, approval or letter, including, without limitation, any countries on Canada’s Area Control List or subject to the Canadian Economic Sanctions, and (ii) neither it nor any of its Representatives will export, re-export, distribute or otherwise transfer the Services or any technical information related thereto for an end use that is directly or indirectly related to the research, development or production of chemical, biological or nuclear weapons or any missile programs for such weapons, or that otherwise disrupt international peace or is contrary to any restriction on end users set for in applicable Law.

16. DISPUTE RESOLUTION PROCEDURE

In the event of a dispute between us in relation to this Agreement, such as a claim, a damage or allegations of claims and damages, the parties agree that they will deploy commercially reasonable efforts to resolve the conflict amicably. If the parties fail to resolve the dispute amicably, either party may send a notice of dispute to the other party, and the parties will

name a senior representative to solve the conflict for a period of at least thirty (30) days. Senior representatives must have decision-making authority. If the dispute has not been resolved through the honest efforts of both parties during this delay, either party may exercise its rights under this Agreement, or at law.

17. TERMINATION

Each party may terminate this Agreement for cause upon written notice (a) if the other party commits a material breach of the Agreement and has not cured the breach within thirty (30) days of receiving a notice of such material breach; (b) immediately upon written notice, if Customer becomes the subject of a petition in bankruptcy or any other proceeding related to insolvency, receivership, liquidation or assignment for the benefit of creditors, if such proceedings are not abandoned within sixty (60) days.

Each party may terminate this Agreement without cause subject to a ninety (90) days written notice to you.

17.1 Effects of Termination

If this Agreement is terminated for any reason or expire, then: (i) such termination or expiry shall not operate to limit, reduce, cancel or otherwise modify any obligations then accrued or unpaid in accordance with the Agreement; (ii) except as otherwise set forth in this Agreement, the rights granted by one party to the other shall terminate immediately; (iii) you shall have a limited access to the Services for a limited period of thirty (30) days during which you may extract Customer Data available for extraction through the Services, if any; (iv) if the termination of the Agreement is for any other reason than as a result of Flare’s material breach of this Agreement or as a result of Flare’s termination for convenience, you agree that all Fees shall become due upon the termination of this Agreement, and such Fees shall constitute adequate compensation for the early termination of the Agreement under Section 2129 of the Civil Code of Quebec and (v) if the termination of the Agreement is due to Flare’s material breach of this Agreement or as a result of Flare’s termination for convenience, then Flare will reimburse to Customer any Fees paid in advance for Services which have not been rendered as of the termination date, and Customer shall not be obliged to pay for any such Fees.

All obligations of the parties, whether in this Agreement, which by their terms are intended or are otherwise appropriate, to survive the cancellation, termination or expiration, including Section 1 – Definitions, Section 3 – Acceptable Use, Section 5 – Intellectual Property, Section 9 – Confidential Information, Section 10 – Personal Data, Section 11 – Customer Indemnification, Section 12 – Disclaimer, Section 13 – Limitation of Liability, and Section 17 – Termination, shall survive the cancellation, termination or expiration of the Agreement.

18. GOVERNING LAW

The laws of the Province of Québec and the applicable laws of Canada shall govern this Agreement. Venue for disputes arising under this Agreement shall lie exclusively in the courts located in the judicial district of Montreal, Quebec, and the parties attorn to the jurisdiction of such courts, without giving effect to any choice or conflict of law provision or rule (whether in Quebec or any other jurisdiction) that would cause the application of laws of any jurisdiction other than those of the Province of Quebec, Canada. The United Nations Convention on the International Sale of Goods is specifically excluded from application to the Terms of Services.

19. GENERAL PROVISIONS