Master Services Agreement

KLARI TECHNOLOGIES LIMITED

Effective Date: The date stated in the applicable Order Form

This Master Services Agreement (the “Agreement”) is entered into between Klari Technologies Limited, a private company incorporated in Nigeria with its registered office in Lagos, Nigeria (“Klari”), and the organisation identified in an applicable Order Form (“Customer”). Klari and Customer are each a “Party” and together the “Parties”. This Agreement governs the Parties’ commercial and legal relationship in respect of the Services purchased by Customer from Klari under one or more Order Forms.

1. Definitions and Interpretation

“Authorised User” means an individual whom Customer authorises to access and use the Services under Customer’s account, including its employees, officers, consultants, compliance personnel, Data Protection Officer or other designated personnel.

“Confidential Information” means information disclosed by or on behalf of one Party to the other Party which is identified as confidential or which, by its nature or the circumstances of disclosure, reasonably ought to be understood to be confidential.

“Customer Data” means all information, records, documents, files, personal data and other data submitted, uploaded, transmitted or otherwise made available by or on behalf of Customer or its Authorised Users through the Services.

“DPA” means the data processing and data protection terms agreed between the Parties and incorporated into this Agreement, as amended from time to time by written agreement of the Parties.

“Effective Date” means the date stated in the applicable Order Form or, if no date is stated, the date on which the first Order Form is executed by both Parties.

“Initial Term” means the initial subscription or service period stated in an Order Form.

“Order Form” means an order form, quotation accepted in writing, statement of work or other written commercial document executed or otherwise expressly accepted by both Parties which references this Agreement and specifies the applicable Services, fees, term, scope or other engagement-specific terms.

“Services” means the SaaS, compliance technology, data processing, hosting, software, implementation, integration, training, support or other services expressly identified in an Order Form.

“Klari Materials” means the Services, software, platform, documentation, templates, methodologies, workflows, configurations, know-how, designs, interfaces, tools and other materials owned, developed or licensed by Klari, excluding Customer Data.

“SLA” means a written service level agreement expressly incorporated into an Order Form or this Agreement.

“Tenant” means Customer’s logical environment or account within the Klari platform.

“Fees” means the fees payable by Customer for the Services as specified in an applicable Order Form.

Headings are for convenience only and do not affect interpretation. References to writing include electronic communications capable of being retained and reproduced. References to applicable law include amendments and replacement legislation.

2. Structure of the Relationship and Order Forms

2.1 Each Order Form forms part of this Agreement once accepted by both Parties and shall be governed by this Agreement.

2.2 Each Order Form shall, where applicable, specify the Services, service tier, scope, Fees, billing arrangements, Initial Term, renewal terms, Authorised Users, implementation requirements and any agreed deviations from this Agreement.

2.3 If an Order Form expressly conflicts with this Agreement, the Order Form shall prevail only in respect of the specific commercial or engagement-specific matter it expressly addresses. The DPA shall prevail over this Agreement in respect of data protection matters, and an agreed SLA shall prevail in respect of service-level matters.

2.4 Customer purchase orders, procurement portals or standard purchasing terms shall not amend this Agreement unless expressly accepted in writing by an authorised representative of Klari.

3. Services and Permitted Use

3.1 Klari shall provide the Services described in each applicable Order Form with reasonable skill and care and in accordance with the agreed scope.

3.2 Subject to Customer’s payment obligations and compliance with this Agreement, Klari grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the applicable term to permit its Authorised Users to access and use the Services for Customer’s internal business, compliance, governance and operational purposes.

3.3 Customer shall ensure that its Authorised Users use the Services only for lawful purposes and in accordance with this Agreement.

3.4 Customer remains responsible for the accuracy, completeness and legality of Customer Data and for decisions made by Customer based on information, reports, workflows or outputs generated through the Services.

4. Scope and Professional/Regulatory Boundaries

4.1 The Services are technology and related support services. Klari does not provide legal, tax, accounting, audit, employment, investment or other regulated professional advice, and no Order Form may extend the Services to include it.

4.2 Klari’s platform may assist Customer to organise information, prepare records, generate compliance materials, manage workflows and support regulatory processes. Such functionality does not, by itself, constitute a representation that Customer is compliant with applicable law.

4.3 Unless expressly agreed in writing and lawfully permitted, Klari does not assume Customer’s statutory responsibilities, make regulatory filings on Customer’s behalf, act as Customer’s statutory Data Protection Officer, or represent Customer before a regulator.

4.4 Where the Services include preparation of compliance documents or regulatory returns, Customer remains responsible for reviewing, approving, adopting and, where applicable, filing or submitting them. Customer shall obtain independent professional advice where the circumstances require it.

4.5 Without limiting clauses 4.1 to 4.4, Klari is not:

(a) a licensed Data Protection Compliance Organisation ("DPCO") under section 33 of the Nigeria Data Protection Act 2023, and does not hold itself out as one;

(b) the party that files Customer's Compliance Audit Return or any other submission with the Nigeria Data Protection Commission. Klari prepares records and exportable materials; Customer, or Customer's own licensed DPCO, files where the applicable rules require it;

(c) Customer's Data Protection Officer under section 32 of that Act, and does not perform that function, unless an Order Form expressly provides for a named appointment and applicable law permits it; or

(d) a law firm. Nothing Klari or its personnel supplies is a legal opinion given in the capacity of a legal practitioner.

4.6 Klari does not verify, certify, attest to or otherwise vouch for Customer's compliance with the Nigeria Data Protection Act 2023 or any other law. Documents the Services generate are Customer's records, compiled from information Customer supplied, for Customer to review, approve and rely on at its own discretion. Where the Services print a classification, tier, licence number, sector or figure supplied by Customer, they print it as supplied and Klari does not independently verify it.

4.7 Nothing in the Services, this Agreement or an Order Form appoints Klari or any Klari personnel, by implication, as Customer's Data Protection Officer, DPCO, auditor, statutory compliance officer or legal adviser.

4.8 Customer remains responsible for appointing and maintaining its own Data Protection Officer; determining its own obligations under the Nigeria Data Protection Act 2023 and any sector regulation; its own regulatory classification; the accuracy and completeness of information it submits; reviewing and approving its own Data Protection Impact Assessments and Records of Processing Activities; submitting its own regulatory returns; and appointing a licensed DPCO where one is required.

5. Customer Responsibilities

Customer shall: (a) provide accurate and timely information reasonably required for delivery of the Services; (b) maintain the confidentiality of account credentials; (c) promptly notify Klari of suspected unauthorised access; (d) ensure Authorised Users comply with this Agreement; (e) obtain and maintain all rights, notices, consents and lawful bases necessary for Customer Data supplied to Klari; and (f) use the Services in compliance with applicable law.

Customer shall not circumvent access controls, reverse engineer or attempt to derive source code from the Services except to the extent such restriction is prohibited by applicable law; interfere with the security or operation of the platform; introduce malicious code; or use the Services to infringe the rights of another person.

6. Fees, Invoicing and Taxes

6.1 Fees shall be stated in the applicable Order Form. Unless otherwise stated, invoices are payable within thirty (30) days of invoice date.

6.2 Unless an Order Form states otherwise, subscription Fees are payable annually in advance. Payment shall be made to the bank account designated by Klari.

6.3 Overdue undisputed amounts may accrue interest at one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law, whichever is lower.

6.4 Fees are exclusive of applicable taxes, duties, levies and statutory charges, including VAT, except where expressly stated otherwise. Customer shall make legally required withholding deductions and provide appropriate evidence of remittance.

6.5 Customer shall notify Klari promptly of any disputed invoice and shall pay all undisputed portions when due.

7. Service Changes, Support and Availability

7.1 Klari may improve, modify or update the Services from time to time, provided that Klari does not materially reduce the core functionality purchased by Customer during the applicable subscription term.

7.2 Unless an SLA is expressly agreed, Klari does not provide a contractual uptime percentage, service-credit regime or guaranteed support response time. Klari will nevertheless use commercially reasonable efforts to maintain the availability and security of the Services.

7.3 If an SLA is agreed, it shall be incorporated into the applicable Order Form or this Agreement and shall govern service-level matters to the extent of any conflict.

8. Data Protection and Data Governance

8.1 The Parties acknowledge that Klari may process personal data in more than one capacity depending on the processing activity.

8.2 In relation to personal data that Klari processes on Customer’s behalf in providing the Services, Klari shall act as a Data Processor to the extent prescribed by applicable data protection law and the DPA.

8.3 In relation to personal data processed by Klari for its own legitimate business purposes, including account administration, billing, security, fraud prevention, service communications, legal compliance and management of its business relationship with Customer, Klari may act as an independent Data Controller where applicable law so recognises.

8.4 The DPA forms part of this Agreement. The DPA governs the Parties’ respective data protection obligations to the extent it addresses a particular processing activity.

8.5 Klari shall maintain appropriate technical and organisational measures proportionate to the risks associated with the Services and shall maintain procedures for responding to security incidents and personal data breaches.

8.6 The Services are a compliance-documentation system. They are designed to hold records about processing activities, not the operational data those activities concern. For example, "the organisation processes customer payment transactions through its mobile banking application" is appropriate content; a transaction reference, account number and amount paid by a named individual is not.

8.7 Customer shall not submit to the Services, whether in a free-text field, an uploaded evidence file or otherwise: (a) payment transaction records, payment references, settlement or routing data; (b) payment card numbers, card verification values, PINs or one-time passcodes; (c) authentication credentials, tokens or secrets for any system; (d) full bank account details beyond what is strictly necessary to describe a processing activity; or (e) special category or other sensitive personal data not necessary for the compliance record being created, unless the applicable Service is designed and contracted to support such information and the Parties have agreed any additional safeguards required.

8.8 Where Klari becomes aware that data prohibited by clause 8.7 has been submitted, Klari may, where technically practicable and proportionate, quarantine, restrict access to, redact or delete it, and will notify Customer where reasonably practicable. Klari does not systematically monitor Customer Data, gives no undertaking to detect every instance, and gives no undertaking that any particular item embedded in an uploaded file can be reliably redacted.

8.9 Clause 8.7 does not undo processing that has occurred: if prohibited data is submitted and stored, Klari is processing it. The clause exists so that both Parties are clear the Services are not the place for operational payment data, and so that Customer's own sector-specific localisation, security and retention obligations are not inadvertently engaged. Customer remains responsible for removing prohibited data from its records and for any consequence of its submission.

9. Sub-processors

9.1 Customer authorises Klari to engage third-party service providers and Sub-Processors reasonably required to provide, maintain, secure and support the Services, subject to the DPA and the Sub-Processor Schedule incorporated into this Agreement.

9.2 The Sub-Processor Schedule identifies the Sub-Processors authorised as at the relevant date and describes their principal functions, processing locations and relevant categories of Personal Data.

9.3 Klari shall conduct reasonable due diligence before engaging a Sub-Processor that will process Customer Data and shall impose appropriate contractual obligations concerning confidentiality, security and data protection.

9.4 Klari shall remain responsible for its obligations under this Agreement and the DPA notwithstanding its engagement of a Sub-Processor.

9.5 Klari shall provide Customer with at least fourteen (14) days’ prior written notice of any proposed new or replacement Sub-Processor that materially changes the location or category of processing of Customer Data. Customer may object within that period on reasonable and documented data protection, security or compliance grounds.

9.6 Following an objection, the Parties shall work in good faith to resolve the concern. Klari shall use commercially reasonable efforts to provide additional safeguards or an alternative Sub-Processor where reasonably feasible.

9.7 Where the Parties cannot reasonably resolve a material objection, Customer’s rights shall be determined in accordance with the applicable DPA and Order Form, including any applicable right to terminate the affected Services.

9.8 Where the DPA imposes more specific requirements concerning Sub-Processors, those requirements shall prevail over this clause to the extent of any inconsistency.

9.9 A Sub-Processor shall not acquire any direct contractual rights against Customer merely because it processes Customer Data on Klari’s behalf, unless the Parties expressly agree otherwise in writing.

10. Confidentiality

10.1 Each Party may receive Confidential Information of the other in connection with this Agreement. The receiving Party shall use at least reasonable care to protect it and shall use it only for purposes connected with this Agreement.

10.2 Confidential Information may be disclosed to employees, officers, professional advisers, contractors and service providers who need to know it and are bound by confidentiality obligations no less protective than those in this Agreement.

10.3 Confidential Information excludes information that is or becomes public without breach; was lawfully known without confidentiality restriction; is independently developed without reference to the disclosing Party’s Confidential Information; or is lawfully received from a third party without restriction.

10.4 Where disclosure is required by law or a competent authority, the receiving Party may make the required disclosure and, where lawful and reasonably practicable, shall provide prior notice to the disclosing Party.

10.5 These obligations survive for three (3) years after termination, except that Customer Data and information required to remain protected by applicable data protection law shall remain protected for so long as Klari retains or is required to protect it.

11. Intellectual Property Rights

11.1 Klari and its licensors retain all right, title and interest in the Services and Klari Materials, including software, source code, object code, interfaces, documentation, designs, templates, methodologies, know-how, trademarks, workflows, improvements and derivative works.

11.2 Customer retains all right, title and interest in Customer Data. Customer grants Klari a limited, worldwide, royalty-free licence to host, copy, transmit, process and display Customer Data solely to provide, secure, maintain and improve the Services in accordance with the DPA and this Agreement.

11.3 Unless otherwise stated in an Order Form, bespoke configurations, workflows, templates and deliverables developed by Klari shall remain Klari Materials to the extent they incorporate or are based upon Klari’s pre-existing technology, methodologies, tools or reusable components.

11.4 Customer grants Klari a perpetual, irrevocable, royalty-free right to use suggestions, recommendations and feedback concerning the Services, provided that Klari shall not disclose Customer’s Confidential Information in doing so.

11.5 Except for the rights expressly granted under this Agreement, neither Party grants the other any licence or other right in its intellectual property.

12. Third-Party Services and Open-Source Components

The Services may interoperate with or depend upon third-party services. Customer’s use of third-party services may be subject to separate terms. Klari shall not be responsible for failures caused solely by a third-party service outside Klari’s reasonable control. Nothing in this clause limits obligations expressly undertaken by Klari in an applicable SLA or DPA.

13. Warranties and Disclaimers

13.1 Each Party warrants that it has authority to enter into and perform this Agreement.

13.2 Klari warrants that it will provide the Services with reasonable skill and care and that, during the applicable term, the core Services will materially conform to their applicable documentation.

13.3 If the Services materially fail to conform, Klari shall use reasonable efforts to correct the non-conformity. If Klari cannot reasonably correct a material non-conformity, Customer may terminate the affected Service and receive a pro-rated refund of prepaid Fees for the unused portion of the affected term, subject to the Agreement.

13.4 Except as expressly stated, the Services are provided on an ‘as available’ and ‘as is’ basis to the maximum extent permitted by law. Klari does not warrant uninterrupted or error-free operation unless expressly provided in an SLA.

13.5 Customer acknowledges that software outputs, compliance workflows and generated materials are tools to support Customer’s operations and do not replace Customer’s own professional, managerial or regulatory judgment.

14. Indemnification

14.1 Klari shall defend Customer against a third-party claim alleging that Customer’s authorised use of the Services infringes that third party’s intellectual property rights, and shall pay damages finally awarded or settlement amounts approved by Klari, subject to the exclusions below.

14.2 Klari shall have no obligation to the extent the claim results from Customer’s modification of the Services, combination with materials not supplied by Klari, use contrary to this Agreement, or continued use after Klari has provided a commercially reasonable non-infringing alternative.

14.3 Customer shall defend and indemnify Klari against third-party claims arising from Customer’s unlawful provision or use of Customer Data, misuse of the Services, or breach of applicable law in connection with Customer’s use of the Services.

14.4 The indemnified Party shall promptly notify the indemnifying Party of a claim, provide reasonable cooperation, and allow the indemnifying Party control of the defence and settlement, provided no settlement may impose an admission, obligation or liability on the indemnified Party without its consent.

15. Limitation of Liability

15.1 To the maximum extent permitted by law, neither Party shall be liable for indirect, incidental, special, consequential or punitive loss, or loss of anticipated profits, revenue, business opportunity or goodwill, arising out of this Agreement.

15.2 Subject to clause 15.3, each Party’s aggregate liability arising from or relating to an Order Form shall not exceed the total Fees paid or payable by Customer under that Order Form during the twelve (12) months preceding the event giving rise to the claim.

15.3 The liability cap shall not apply to Customer’s payment obligations, fraud, or liability which cannot lawfully be limited or excluded. The Parties may agree a different cap or specific uncapped liabilities in an Order Form.

15.4 Nothing in this Agreement excludes or limits liability to the extent such exclusion or limitation is prohibited by applicable law.

16. Insurance

Each Party shall maintain insurance reasonably appropriate to its business and obligations under this Agreement where commercially and legally appropriate. Where an Order Form expressly requires specified insurance cover, the applicable Party shall maintain that cover for the period stated there and provide reasonable evidence of cover upon written request. No insurance coverage is deemed to exist merely because this Agreement refers to it.

17. Term, Renewal, Suspension and Termination

17.1 This Agreement commences on the Effective Date and continues until terminated in accordance with this clause. Each Order Form has the term stated in it.

17.2 Unless an Order Form provides otherwise, an annual subscription renews for successive twelve (12) month periods unless either Party gives at least thirty (30) days’ written notice of non-renewal.

17.3 Either Party may terminate an affected Order Form for material breach if the breach is not remedied within thirty (30) days after written notice describing the breach.

17.4 Klari may suspend access where reasonably necessary to address a material security threat, unlawful use, or serious risk to the Services or other customers. Where reasonably practicable, Klari shall provide notice and an opportunity to remedy the issue.

17.5 Termination does not affect accrued rights or payment obligations. Clauses intended by their nature to survive termination shall survive, including confidentiality, intellectual property, liability, indemnity, dispute resolution and data-retention obligations.

18. Data Export and Exit

18.1 Following expiry or termination of an Order Form, Klari shall, subject to payment of outstanding undisputed Fees, make Customer Data reasonably available for export for thirty (30) days, unless the DPA or applicable law requires a different period.

18.2 After the applicable export period, Klari may delete Customer Data in accordance with the DPA, its retention schedule and applicable law, subject to legally required archival or backup retention.

18.3 Customer is responsible for downloading or otherwise preserving Customer Data during the export period.

19. Compliance with Law

Each Party shall comply with applicable law in connection with its performance of this Agreement. Customer remains responsible for laws and regulatory requirements applicable specifically to its business, industry and operations. Klari shall comply with laws applicable to Klari’s provision of the Services, including applicable data protection requirements.

20. Security and Incident Management

Klari shall maintain reasonable administrative, technical and organisational safeguards appropriate to the nature of the Services and risks involved. Klari shall maintain procedures for detecting, assessing, containing and responding to security incidents and personal data breaches. Where an incident affects Customer Data, Klari shall act in accordance with the DPA and its applicable incident-response procedures.

21. Force Majeure

Neither Party shall be liable for delay or failure to perform caused by circumstances beyond its reasonable control, including natural disasters, epidemic or pandemic events, war, terrorism, civil unrest, government action, telecommunications or internet failures, power infrastructure failure, or material failure of a third-party infrastructure provider, provided the affected Party gives reasonably prompt notice and uses reasonable efforts to mitigate the effects and resume performance. Force majeure does not excuse payment for Services already provided.

22. Notices

Notices under this Agreement shall be in writing and delivered by email to the addresses stated in the applicable Order Form or, for Klari, to hello@klari.ng, unless Klari designates another notice address in writing. A notice is deemed received on the next business day after successful transmission, unless the sender receives a delivery failure notification.

23. Governing Law and Dispute Resolution

23.1 This Agreement is governed by the laws of the Federal Republic of Nigeria.

23.2 The Parties shall first attempt in good faith to resolve any dispute through discussion between senior representatives. If the dispute is not resolved within thirty (30) days after written escalation, either Party may commence proceedings in the courts having competent jurisdiction in Nigeria.

23.3 The Parties may agree in an Order Form that a particular engagement will instead be subject to arbitration. Any such agreement shall specify the applicable arbitral rules, seat, language and number of arbitrators.

24. Assignment and Subcontracting

24.1 Neither Party may assign this Agreement without the prior written consent of the other Party, except that either Party may assign it to an affiliate or successor in connection with a merger, corporate reorganisation or sale of substantially all relevant assets, provided the assignee assumes the assigning Party’s obligations.

24.2 Klari may use affiliates, contractors and service providers to perform the Services, subject to its obligations under this Agreement and the DPA.

25. Publicity and Use of Name

Neither Party may use the other Party’s name, logo or trademarks in public marketing materials, case studies or announcements without prior written consent, except where disclosure is required by law. The Parties may agree specific publicity rights in an Order Form.

26. General

26.1 Entire Agreement. This Agreement, each Order Form, the DPA, and any expressly incorporated SLA constitute the entire agreement concerning the Services and supersede prior understandings on that subject.

26.2 Order of Precedence. In the event of conflict: (a) the applicable Order Form governs its expressly stated commercial terms; (b) the DPA governs data protection matters; (c) an applicable SLA governs service-level matters; and (d) this Agreement governs all other matters.

26.3 Amendments. Amendments to this Agreement must be in writing and signed by authorised representatives of both Parties, except for operational updates expressly permitted under the DPA or an applicable SLA.

26.4 Severability. If a provision is held invalid or unenforceable, the remaining provisions remain effective and the Parties shall seek a lawful provision that most closely reflects the original commercial intention.

26.5 Waiver. Failure or delay in exercising a right does not constitute a waiver.

26.6 Independent Contractors. The Parties are independent contractors. Nothing creates a partnership, joint venture, employment, agency or fiduciary relationship.

26.7 No Third-Party Rights. Except where expressly stated, no person other than the Parties has rights under this Agreement.

26.8 Counterparts and Electronic Execution. This Agreement and Order Forms may be executed in counterparts and by electronic signature, each of which shall be treated as an original and together constitute one instrument.

26.9 Survival. Provisions which by their nature should survive termination shall survive, including confidentiality, intellectual property, payment obligations, indemnities, limitations of liability, dispute resolution and data protection obligations.

27. Signatures

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their duly authorised representatives.

For Klari Technologies Limited	For Customer
Signature: ..............................	Signature: ..............................
Name: ..............................	Name: ..............................
Title: ..............................	Title: ..............................
Date: ..............................	Date: ..............................

Schedule 1 — Order Form (minimum content)

• Customer legal name and registered address;

• Effective Date and Order Form number;

• Services and service tier;

• Implementation scope and deliverables, where applicable;

• Authorised Users and user limits, where applicable;

• Fees, currency, billing frequency and payment terms;

• Initial Term, renewal and non-renewal arrangements;

• Applicable SLA, if any;

• Any agreed data-location, security, sub-processor or sector-specific requirements;

• Any agreed liability-cap deviation or special indemnity;

• Any agreed arbitration provision;

• Customer and Klari authorised signatories.

Schedule 2 — Sub-processor schedule

1. Purpose and Status

This Sub-Processor Schedule (“Schedule”) forms part of the Master Services Agreement (“MSA”) and the applicable Data Processing Agreement (“DPA”) between Klari Technologies Limited (“Klari”) and the Customer.

Klari may engage third-party service providers (“Sub-Processors”) to process Personal Data on Klari’s behalf where such engagement is reasonably necessary for Klari to provide, secure, maintain, support or improve the Services.

Each Sub-Processor engaged by Klari shall be subject to written contractual obligations relating to data protection and confidentiality appropriate to the nature of the processing, whether through a data processing agreement, data processing addendum, standard contractual terms, or other legally binding terms that impose materially equivalent obligations.

2. Current Sub-Processors

The Sub-Processors currently authorised for the Services are:

Sub-Processor	Service Provided	Processing Region	Categories of Personal Data
Supabase Inc.	Postgres database, authentication and object storage	eu-central-1, Frankfurt, Germany	Tenant Data, including organisation records, RoPA, DPIAs, evidence files, audit logs, dossiers and user identifiers
Vercel Inc.	Application hosting and Next.js functions	fra1, Frankfurt, Germany	Transient request data, including request paths, IP addresses, response codes and user-agent strings; no persistent Tenant Data
Resend, Inc.	Transactional email delivery	eu-west-1, Ireland	Recipient email addresses and email body content, including magic-link tokens and invitation acceptance URLs
Upstash, Inc.	Rate-limit cache (Redis)	eu-west-1, Ireland	User account identifiers and IP addresses, stored unhashed as sliding-window rate-limit keys that expire within one hour
Cloudflare, Inc.	Authoritative DNS for klari.ng	Global edge network	DNS lookup information only; no Tenant Data and no email content
Google Cloud EMEA Limited (Google Workspace)	Email for Klari addresses, including support requests and service-credit claims	No fixed location — the Business Starter plan offers no data-region setting	Content of emails sent to Klari addresses, which may include Customer Data where a Customer includes it in a support request
Functional Software, Inc. (Sentry)	Error monitoring	Germany/Frankfurt ingest	Stack traces, request metadata and appropriately scrubbed user identifiers

The above list constitutes the Sub-Processors authorised as at the effective date of this Schedule. Klari may maintain the current operational version of the list through its Trust Centre or other designated customer-facing documentation.

3. Customer Authorisation

Customer provides Klari with general authorisation to engage the Sub-Processors identified in this Schedule and any replacement or additional Sub-Processor subsequently notified in accordance with this Schedule and the DPA.

Klari shall remain responsible for the performance of its obligations under the MSA and DPA notwithstanding its engagement of a Sub-Processor.

The engagement of a Sub-Processor shall not relieve Klari of its obligations concerning the protection, confidentiality or security of Customer Data.

4. Sub-Processor Due Diligence

Before engaging a Sub-Processor to process Customer Data, Klari shall undertake reasonable due diligence having regard to the nature, scope and risks of the proposed processing.

Such assessment may include consideration of:

(a) the technical and organisational security measures maintained by the proposed Sub-Processor;

(b) the nature and purpose of the proposed processing;

(c) the categories of Personal Data involved;

(d) the location or locations from which the Personal Data may be processed or accessed;

(e) the Sub-Processor’s contractual data protection commitments; and

(f) any material regulatory, security or operational risks reasonably identifiable from the proposed engagement.

5. Contractual Obligations

Klari shall impose on each Sub-Processor appropriate contractual obligations concerning confidentiality, security, data protection and processing of Customer Data.

To the extent required by applicable data protection law, the relevant contractual arrangements shall require the Sub-Processor to:

(a) process Personal Data only for authorised purposes;

(b) maintain appropriate technical and organisational security measures;

(c) maintain confidentiality of Personal Data;

(d) provide reasonable assistance in responding to data protection obligations and incidents;

(e) notify Klari of relevant Personal Data Breaches without undue delay;

(f) delete or return Personal Data following termination of the relevant processing relationship, subject to applicable legal retention requirements; and

(g) cooperate with Klari as reasonably necessary for Klari to fulfil its obligations to Customer.

6. Notification of New or Replacement Sub-Processors

Klari shall provide Customer with at least fourteen (14) days’ prior written notice before authorising a new Sub-Processor where the proposed engagement materially changes:

(a) the location from which Customer Data is stored or processed; or

(b) the category or material nature of access that the Sub-Processor has to Customer Data.

Notice may be provided by email, through the Klari Trust Centre, or through another reasonable written customer communication mechanism.

The notice shall identify the proposed Sub-Processor and, where reasonably available, describe its role, processing location and relevant categories of Personal Data.

7. Customer Objection

Customer may object in writing to a proposed Sub-Processor within the applicable fourteen (14) day notice period where Customer has reasonable and documented data protection, security or compliance grounds for doing so.

An objection shall identify the material grounds for the objection and shall not be based solely on the fact that Klari has engaged a third-party service provider.

Upon receiving a valid objection, Klari shall use commercially reasonable efforts to address the concern, including, where reasonably practicable, by:

(a) providing additional information concerning the proposed Sub-Processor;

(b) implementing reasonable additional safeguards;

(c) using an alternative Sub-Processor where commercially and technically feasible; or

(d) otherwise modifying the relevant processing arrangement to address the material concern.

If the Parties are unable to resolve a material and reasonable objection within a reasonable period, either Party may exercise any termination rights expressly available under the DPA or applicable Order Form in respect of the affected Services.

8. Activation of New Sub-Processors

Subject to the objection procedure above, a proposed Sub-Processor may be authorised and engaged following expiry of the applicable notice period.

Klari shall maintain an updated version of this Schedule identifying active Sub-Processors.

9. International Processing and Data Location

Klari shall maintain appropriate safeguards for any international transfer or cross-border processing of Customer Data in accordance with the DPA and applicable data protection law.

The current Sub-Processor configuration is intended to use the processing locations identified in this Schedule. Where a material change in processing location occurs, Klari shall notify affected Customers in accordance with this Schedule and the DPA where required.

10. Current Service Architecture

Based on Klari’s current Service architecture:

(a) no US-hosted content delivery network is intended to hold persistent Tenant Data;

(b) Klari does not engage an analytics or advertising technology Sub-Processor for the Services;

(c) Klari does not currently engage a customer-support platform with access to persistent Tenant Data; and

(d) Klari’s current group structure does not involve an affiliated company accessing Tenant Data on Klari’s behalf.

These statements describe Klari’s current Service architecture and shall not prevent Klari from making future changes in accordance with the notification and objection mechanisms contained in this Schedule and the DPA.

11. Klari Group Structure

Klari Technologies Limited, Nigeria, is the customer-facing contracting entity and, where applicable, the Data Processor of record in respect of Customer Data processed on Customer’s behalf.

No Klari affiliate is authorised to access Customer Data merely by virtue of being an affiliate. Any affiliate that is subsequently engaged to process Customer Data on Klari’s behalf shall be treated as a Sub-Processor for purposes of the DPA and this Schedule where required by applicable law.

12. No Direct Customer Agreement

Unless expressly agreed otherwise in writing, Customer’s contractual relationship concerning the processing of Customer Data remains with Klari. Customer is not required to enter into a separate agreement directly with a Sub-Processor merely because Klari has engaged that Sub-Processor.