Custom Software Development Contract Template

1.1 Governing SOW. The specific deliverables, features, technology stack, platforms, integrations, and milestones for this engagement are set forth in the Statement of Work attached hereto as Exhibit A (the "SOW"), which is incorporated by reference and made a part of this Agreement. In the event of a conflict between the body of this Agreement and any SOW, the SOW shall control solely with respect to the subject matter addressed therein. 1.2 Completeness of Deliverables. Provider shall deliver only those features, pages, screens, integrations, and functionalities expressly described in the SOW. Any feature, function, content element, third-party integration, platform, or deliverable not listed in the SOW is out of scope and shall not be provided under this Agreement without a fully executed Change Order as provided in Section 2. 1.3 Explicit Exclusions. Without limiting Section 1.2, the following are expressly excluded from the scope of this Agreement unless separately specified in the SOW or a Change Order: (a) SEO optimization, copywriting, or content creation beyond placeholder or seed content identified in the SOW; (b) third-party service fees, API subscription costs, domain registration, SSL certificates, or hosting fees; (c) training, documentation, or post-launch support beyond any maintenance period defined in the SOW; (d) data migration from legacy systems unless expressly itemized; (e) accessibility remediation beyond the WCAG compliance level specified in the SOW; and (f) compatibility with browsers, operating systems, or devices not identified in the SOW. 1.4 Technology Stack. Provider shall use the technology stack identified in the SOW. Material deviations from the specified stack require Client's prior written consent, which shall not be unreasonably withheld. 1.5 SOW Amendments. The SOW may only be amended through a signed Change Order executed by both parties. No verbal instruction, email direction, or other informal communication shall expand, modify, or supersede the SOW. 1.6 Client Responsibilities. Client shall furnish all materials, assets, credentials, and approvals identified as Client-supplied in the SOW by the dates specified therein. Provider's timeline obligations are tolled day-for-day for each day Client is in default of any material supply or approval obligation.

2.1 Scope Lock. The SOW constitutes the complete and exclusive description of the work to be performed under this Agreement. No addition, deletion, or modification of scope takes effect unless documented in a Change Order signed by authorized representatives of both parties. 2.2 Change Order Process. Either party may propose a scope change by delivering a written change request to the other party's project contact. Within 3 business days of receipt, Provider shall deliver a written Change Order proposal specifying: (a) a description of the requested change; (b) any additions to or deletions from the deliverable list; (c) the additional or reduced fee, calculated at the rates set forth in the SOW or, if not specified, at Hourly rate for out-of-scope / additional work (e.g., "$175") per hour; (d) the revised milestone or delivery schedule; and (e) any impacts on dependencies, third-party integrations, or previously accepted work. The Change Order is not binding until signed by both parties. 2.3 No Work Until Signed. Provider shall not commence out-of-scope work until a Change Order is signed by both parties. Client shall not direct Provider to perform out-of-scope work orally or by informal communication, and any such direction does not create an obligation for Provider to perform or Client to pay. This Section constitutes a no-oral-modification clause within the meaning of applicable contract law. 2.4 Revision vs. New Work. A "Revision" is a modification to content or design within the scope of an already-approved deliverable that does not add functionality, pages, screens, integrations, or platform targets. "New Work" is any addition, substitution, or expansion that falls outside the approved deliverable list or requires material additional development effort. The SOW specifies the number of Revision rounds included at no additional charge for each deliverable. Additional Revision rounds beyond the included number are billed at the rate in Section 2.2(c) above. 2.5 Effect on Timeline. Each executed Change Order may extend affected milestone dates by the number of days necessary to accommodate the change, as specified in the Change Order. Changes that are additive to scope do not accelerate remaining milestone dates. 2.6 Pending Change Orders. While a Change Order is pending and unsigned, Provider may, at its election: (a) continue in-scope work unaffected by the proposed change; or (b) pause work on deliverables that depend on resolution of the pending change, without being deemed in breach, provided Provider notifies Client of the pause in writing within one business day.

3.1 Relationship of the Parties. Provider is an independent contractor of Client. Nothing in this Agreement creates or shall be construed to create an employment, partnership, joint venture, franchise, agency, or fiduciary relationship between the parties. Neither party is authorized to bind the other to any obligation, contract, or liability without the other's prior written consent. 3.2 No Employment Benefits or Withholding. Client shall not withhold or pay any federal, state, or local income taxes, Social Security taxes, unemployment taxes, disability insurance premiums, or other payroll taxes on behalf of Provider or any of Provider's personnel. Provider is solely responsible for all such obligations with respect to Provider and Provider's personnel. Client shall not provide Provider with any employment benefits, including without limitation health insurance, retirement benefits, vacation pay, sick pay, workers' compensation coverage, or stock options. 3.3 Provider's Personnel. Provider may engage subcontractors or employees to assist in performing the services, subject to any limitations in the SOW. Provider is solely responsible for the compensation, withholding, benefits, and classification of its own personnel and subcontractors. Provider warrants that it has properly classified all individuals performing services under this Agreement in compliance with applicable law. 3.4 Method and Means. Provider retains sole discretion over the method, manner, and means by which the services are performed, subject to Client's right to specify deliverable requirements, acceptance criteria, and project milestones. Client shall not direct Provider's work schedule, working hours, or working location except to the extent necessary to meet mutually agreed deadlines or to conduct required meetings. 3.5 Right to Perform Other Work. Provider retains the right to perform services for other clients during the term of this Agreement, provided such services do not violate any confidentiality or intellectual-property obligations under this Agreement.

4.1 Fee. Client shall pay Provider the total fee set forth in the SOW (the "Project Fee") in accordance with the milestone schedule in Section 4.2. All amounts are in Invoice Currency (e.g., USD, CAD, GBP) and are exclusive of applicable taxes. 4.2 Milestone Payment Schedule. Unless the SOW specifies a different schedule, the Project Fee is due as follows: (a) Deposit: Deposit Percentage (%)% of the Project Fee is due upon execution of this Agreement. The deposit is non-refundable once Provider commences work and represents compensation for reserving Provider's capacity. (b) [Remaining milestones as specified in SOW.] 4.3 Late Payment. Invoices not paid within 30 days of invoice date will accrue interest at 1.5% per month (or the maximum rate permitted by applicable law, whichever is less) from the due date until paid in full. Provider may also suspend Services upon 5 business days' written notice if any invoice remains unpaid for more than 10 days after the due date. 4.4 Price Changes During Contract Term. Provider may not unilaterally increase fees for work covered by a signed SOW. For any renewal, extension, or new SOW entered into after the initial SOW term, Provider shall provide written notice of any fee change at least 30 days before the proposed effective date. If Client does not accept the new fees in writing and the parties do not agree on pricing within 15 days of notice, either party may decline to enter into a new SOW without penalty. 4.5 Price Cap for Maintenance and Retainer Engagements. For ongoing maintenance or retainer engagements that auto-renew under Section Auto-Renewal Section Reference: (a) the monthly fee for any Renewal Term shall not exceed the current-term fee by more than Annual Price Escalation Cap (%)% without Client's prior written consent; (b) if Provider's proposed renewal fee exceeds this cap, Client may terminate the maintenance engagement with 30 days' written notice without a kill fee, effective at the end of the current term; and (c) the CPI-based adjustment index used, if any, shall be the US CPI-U as published for the most recent 12-month period ending June of the renewal year. 4.6 Disputed Invoices. Client may withhold payment of a genuinely disputed invoice item by providing Provider with written notice of the dispute within 10 days of the invoice date, identifying the disputed amount and the basis for the dispute. Undisputed amounts must be paid by the original due date. The parties shall attempt to resolve the dispute within 14 days of the dispute notice.

INTELLECTUAL PROPERTY OWNERSHIP (a) Background IP. Each party retains all right, title, and interest in its Background IP. "Background IP" means all intellectual property owned or licensed by a party prior to the Effective Date or developed independently of this Agreement. Each party grants the other a limited, non-exclusive, royalty-free license to use its Background IP solely to the extent necessary to perform or receive the Services during the term of this Agreement. (b) Deliverables — Work-for-Hire Designation. To the extent that any Deliverable constitutes a "work made for hire" as defined in 17 U.S.C. § 101 (including as a contribution to a collective work, as a part of a motion picture or other audiovisual work, as a translation, as a supplementary work, as a compilation, as an instructional text, as a test, as answer material for a test, or as an atlas), such Deliverable is a work made for hire for Client name / business name, and Client name / business name will be the author and owner of the copyright therein from the moment of creation. (c) Assignment. To the extent that any Deliverable does not qualify as a work made for hire, Your name / business name hereby irrevocably assigns to Client name / business name, effective upon receipt of full payment for such Deliverable, all right, title, and interest in and to such Deliverable, including all copyrights, patents, trademarks, trade secrets, and other intellectual property rights worldwide, in perpetuity. (d) License for Partially-Paid Deliverables. If this Agreement terminates before Client name / business name has paid in full for a Deliverable, Your name / business name grants Client name / business name a non-exclusive, non-transferable, revocable license to use that Deliverable solely for Client name / business name's internal purposes until the outstanding balance is paid, at which point the assignment in Section (c) becomes effective. (e) Agency Portfolio License. Client name / business name grants Your name / business name a non-exclusive, royalty-free, perpetual license to display the Deliverables (excluding any Confidential Information) in Your name / business name's portfolio, case studies, and marketing materials, unless Client name / business name notifies Your name / business name in writing that a specific Deliverable is subject to confidentiality restrictions. (f) Third-Party Content. Your name / business name will obtain all necessary licenses for third-party content (stock images, fonts, music, software) incorporated into Deliverables, and will disclose to Client name / business name any third-party license restrictions that limit Client name / business name's use of the Deliverables. (g) Moral Rights. To the extent permitted by applicable law, Your name / business name waives all moral rights in the Deliverables in favor of Client name / business name. (h) Agency Tools & Methodologies. Notwithstanding the foregoing, Your name / business name retains all right, title, and interest in its proprietary tools, templates, methodologies, know-how, and general processes used to create the Deliverables. Client name / business name's rights are limited to the Deliverables themselves.

Pre-Existing / Background IP Retention and License-Back 1. Reservation of Background IP. Each party retains sole and exclusive ownership of all Intellectual Property Rights in works, inventions, methodologies, tools, frameworks, libraries, components, code bases, templates, and know-how that: (a) were created, developed, or acquired prior to the Effective Date; (b) are developed independently of this Agreement and the applicable SOW; or (c) are general-purpose tools or methodologies not created specifically for Client name / business name (collectively, "Background IP"). No assignment, transfer, or other conveyance of Background IP is intended or shall be implied by this Agreement. 2. Developer Background IP Schedule. Your name / business name's Background IP incorporated into or required to operate the Deliverables is described in Schedule A – Background IP attached to the applicable SOW ("Developer Background IP"). Your name / business name shall update Schedule A prior to delivery of each Deliverable to reflect any additional Background IP incorporated during the engagement. 3. License Grant to Client. Your name / business name hereby grants Client name / business name a non-exclusive, royalty-free, irrevocable, worldwide, perpetual license to use, execute, and reproduce the Developer Background IP solely to the extent incorporated in, or reasonably necessary to operate, the Deliverables for Client name / business name's internal business purposes (the "Background IP License"). The Background IP License does not include the right to: (a) sublicense, transfer, or assign the license except in connection with a permitted assignment of this Agreement; (b) use Developer Background IP in any product or service other than the Deliverables; (c) decompile, disassemble, or reverse-engineer any proprietary Developer Background IP beyond what is permitted by applicable law; or (d) use Developer Background IP to develop, train, or improve any competing product or service. 4. No Implied License. Except as expressly set out in Section 3, no license, right, or interest in Your name / business name's Background IP is granted to Client name / business name, whether by implication, estoppel, or otherwise. 5. Foreground IP. All Intellectual Property Rights in works specifically created for Client name / business name under an SOW that are not Background IP ("Foreground IP" or "Deliverables IP") are governed by the IP Ownership / Work-for-Hire & Assignment clause of this Agreement.

CONFIDENTIALITY (a) Definition. "Confidential Information" means all non-public information disclosed by one party ("Discloser") to the other ("Recipient") in connection with this Agreement that is designated as confidential at the time of disclosure, or that a reasonable person would understand to be confidential given the nature of the information and circumstances of disclosure. Without limiting the foregoing, Confidential Information includes: business plans, financial data, pricing, fee structures, customer and prospect lists, proprietary methodologies, software, technical specifications, and personnel information. (b) Exclusions. Confidential Information does not include information that: (i) is or becomes publicly available through no fault of Recipient; (ii) Recipient already knew before receiving it from Discloser, as shown by written records; (iii) Recipient independently develops without use of or reference to the Confidential Information; or (iv) Recipient rightfully receives from a third party without restriction. (c) Obligations. Recipient will: (i) use Discloser's Confidential Information solely to perform or receive the Services under this Agreement; (ii) disclose it only to its employees, contractors, and advisors who have a need to know and who are bound by confidentiality obligations no less protective than this clause; and (iii) protect it with at least the same degree of care it uses for its own confidential information of similar sensitivity, but in no event less than reasonable care. (d) Compelled Disclosure. Recipient may disclose Confidential Information if required by law, court order, or regulatory authority, provided that Recipient: (i) gives Discloser prompt prior written notice to the extent legally permitted; (ii) cooperates with Discloser in seeking a protective order or other appropriate relief; and (iii) discloses only what is legally required. (e) Trade Secrets. Obligations with respect to information that constitutes a trade secret under applicable law (including the Defend Trade Secrets Act, 18 U.S.C. § 1836) will continue for as long as such information remains a trade secret, notwithstanding any shorter survival period stated below. (f) Subcontractors. Your name / business name may share Client name / business name's Confidential Information with approved subcontractors solely to the extent necessary for them to perform work under this Agreement, provided each subcontractor is bound by written confidentiality obligations at least as protective as this clause. (g) Return or Destruction. Upon termination or expiration of this Agreement, or upon Discloser's written request, Recipient will promptly return or securely destroy all of Discloser's Confidential Information (including copies) and certify such return or destruction in writing, except as required by law or for legal-hold purposes. (h) Survival. This Section survives termination or expiration of this Agreement for a period of 3 years, except as provided in Section (e).

REPRESENTATIONS AND WARRANTIES (a) Mutual Representations. Each party represents and warrants to the other, as of the Effective Date and throughout the term of this Agreement, that: (i) Authority. It has the full legal right, power, and authority to enter into this Agreement and to perform its obligations hereunder; (ii) No Conflicts. Its execution, delivery, and performance of this Agreement do not and will not: (A) violate any applicable law, regulation, or court order; or (B) conflict with or result in a breach of any agreement to which it is a party; (iii) Binding Obligation. This Agreement constitutes its legal, valid, and binding obligation, enforceable against it in accordance with its terms; (iv) No Litigation. As of the Effective Date, there is no pending or, to its knowledge, threatened legal proceeding that would materially impair its ability to perform its obligations under this Agreement; and (v) Compliance with Law. It will comply with all applicable laws and regulations in performing its obligations or exercising its rights under this Agreement. (b) Agency Representations. Your name / business name additionally represents and warrants that: (i) Professional Standards. It will perform the Services in a professional and workmanlike manner consistent with industry standards; (ii) Non-Infringement. The materials, methodologies, and content created by Your name / business name (excluding Client-supplied content) will not, to Your name / business name's knowledge, infringe or misappropriate any third party's copyright, trademark, patent, trade secret, or other intellectual property right; (iii) Qualifications. It has the skills, experience, and qualifications necessary to perform the Services; and (iv) No Deceptive Practices. It will not engage in deceptive, unfair, or fraudulent practices in connection with the Services, including practices that violate the FTC Act or any analogous consumer-protection law. (c) Client Representations. Client name / business name additionally represents and warrants that: (i) Content Accuracy. All product descriptions, claims, pricing information, testimonials, and other materials supplied by Client name / business name to Your name / business name for publication or promotion are, to Client name / business name's knowledge, truthful, accurate, and not misleading, and are substantiated by competent and reliable evidence where required by applicable law; (ii) Ownership and Licenses. Client name / business name owns or has obtained all necessary rights, licenses, and permissions for all content, assets, images, trademarks, and data that Client name / business name provides to Your name / business name for use in the Services, and Client name / business name's provision of such materials to Your name / business name does not violate any third party's intellectual property rights; (iii) Regulatory Compliance. Client name / business name's products, services, and business practices comply with all applicable laws and regulations, and Client name / business name is not aware of any pending or threatened regulatory investigation or enforcement action that would affect the permissibility of the Services; (iv) Account Authority. Client name / business name has or will obtain all necessary rights, consents, and authorities to grant Your name / business name access to Client name / business name's systems, accounts, and platforms required to perform the Services; and (v) No Restricted Industry Violations. Client name / business name's products and services do not violate the applicable policies of the platforms on which the Services will be performed. (d) Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS SECTION, NEITHER PARTY MAKES ANY OTHER WARRANTY, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. Your name / business name DOES NOT WARRANT SPECIFIC BUSINESS OUTCOMES, REVENUE RESULTS, OR OTHER SPECIFIC RESULTS OR OUTCOMES FROM THE SERVICES.

Open-Source Software Disclosure, SBOM & Copyleft Compliance 1. Definitions. For purposes of this clause: - "Open-Source Software" ("OSS") means any software subject to a license that requires, as a condition of use, modification, or distribution, that the software or derivative works be made available in source code form, licensed to others on a royalty-free basis, or otherwise distributed subject to terms materially different from those of this Agreement. - "Copyleft License" means any license that conditions the right to use, modify, or distribute software on making the modified or combined work available under the same or similar terms, including without limitation the GNU General Public License v2 and v3 (GPL), the GNU Lesser General Public License (LGPL), the GNU Affero General Public License (AGPL), the European Union Public License (EUPL), the Open Software License (OSL), and the Mozilla Public License v2 (MPL). - "Permissive License" means an OSS license that does not impose copyleft obligations, including without limitation the MIT License, Apache License 2.0, BSD 2-Clause, BSD 3-Clause, and ISC License. - "SBOM" means a Software Bill of Materials listing each OSS component incorporated in or bundled with the Deliverables. 2. SBOM Delivery. Your name / business name shall deliver a complete and accurate SBOM concurrently with, or no later than SBOM delivery deadline after Deliverable (e.g. '5 business days') after, delivery of each Deliverable. The SBOM shall include, for each OSS component: (a) the component name and version; (b) the applicable license(s), including SPDX identifier where available; (c) the URL to the upstream repository or package registry; and (d) the manner of incorporation (e.g., linked, bundled, modified). 3. Copyleft Prohibition. Your name / business name shall not incorporate any Copyleft-Licensed software into the Deliverables without Client name / business name's prior written consent. Any request by Your name / business name to incorporate Copyleft-Licensed software shall be accompanied by: (a) the identity and license of the component; (b) a written technical isolation plan demonstrating that the copyleft obligation will not propagate to Client name / business name's proprietary code; and (c) a legal summary of the disclosure obligations triggered. 4. Compliance Obligations. Your name / business name shall ensure that all OSS incorporated in the Deliverables is used in compliance with the applicable license terms, including all attribution, notice, and copyright statement requirements. Your name / business name shall include all required OSS notices, license texts, and copyright attributions in the Deliverables in a form reasonably accessible to end users. 5. Representations and Warranties. Your name / business name represents and warrants that, as of each Delivery Date: (a) the SBOM is complete and accurate in all material respects; (b) no Copyleft-Licensed software has been incorporated into the Deliverables without Client name / business name's prior written consent; (c) no OSS component has been used in a manner that requires Client name / business name to: (i) disclose, license, or distribute any of Client name / business name's proprietary source code to any third party; (ii) license any of Client name / business name's proprietary software on a royalty-free basis; or (iii) grant any third party any rights in Client name / business name's proprietary software; and (d) all OSS license terms have been complied with. 6. Indemnification. Your name / business name shall indemnify, defend, and hold harmless Client name / business name and its officers, directors, employees, and successors from and against any and all claims, damages, losses, fines, penalties, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to any breach of the warranties in Section 5 or any failure by Your name / business name to comply with an OSS license incorporated in the Deliverables. 7. Survival. The representations, warranties, and indemnification obligations in this clause survive termination or expiration of this Agreement.

Malicious Code & Security Warranty 1. Malicious Code Warranty. Your name / business name warrants that, at the time of each Deliverable's delivery and acceptance, the Deliverables do not knowingly contain, and Your name / business name has not intentionally introduced, any: (a) virus, worm, Trojan horse, or other malicious code designed to damage, delete, disable, or gain unauthorized access to systems or data; (b) logic bomb, time bomb, kill switch, or other code designed to cause the Deliverable to cease functioning or to damage data upon the occurrence of any event or condition; (c) back door, undisclosed remote-access mechanism, or covert channel that would enable Your name / business name or any third party to access the Deliverable or any associated systems or data without Client name / business name's authorization; (d) spyware, adware, or undisclosed tracking mechanism designed to collect user data or behavior without disclosure in the applicable privacy policy; or (e) any code whose primary purpose is to benefit Your name / business name or any third party at the expense of Client name / business name or end users (collectively, "Malicious Code"). 2. Dependency Audit. Prior to each Deliverable delivery, Your name / business name shall conduct a dependency security audit of all third-party open-source packages and libraries incorporated in the Deliverable using industry-standard tooling (which may include npm audit, Snyk, OWASP Dependency-Check, or equivalent). Your name / business name shall deliver the dependency audit report as part of the SBOM or as a separate attachment. Your name / business name shall remediate or document its rationale for accepting any High or Critical severity vulnerability identified in the audit prior to delivery. 3. Scope Limitation on Third-Party Components. Your name / business name does not warrant the absence of security vulnerabilities in third-party open-source packages beyond the audit obligations in Section 2. Your name / business name's obligation is to perform reasonable due diligence, not to guarantee the security of third-party maintained software. 4. Zero-Day Patch Obligation. If, within Zero-day patch obligation window (calendar days after launch) calendar days after the Launch Date, a publicly disclosed zero-day or critical security vulnerability (CVSS score Minimum CVSS score triggering remediation obligation (e.g. 7.0) or higher) is discovered in a third-party component incorporated in the Deliverables, and that vulnerability was not identified in the pre-delivery dependency audit, Your name / business name shall provide a security patch or remediation plan at no additional charge, provided that: (a) Client name / business name has not modified the affected component; and (b) Your name / business name has an active warranty period or maintenance engagement in place at the time of discovery. 5. Indemnification. Your name / business name shall indemnify, defend, and hold harmless Client name / business name from and against any direct damages, regulatory fines, breach notification costs, and reasonable legal fees arising from: (a) Your name / business name's breach of the warranty in Section 1; or (b) Your name / business name's failure to remediate a High or Critical vulnerability identified in the dependency audit prior to delivery. 6. Exclusions. The warranty and obligations in this clause do not extend to: (a) vulnerabilities introduced by Client name / business name's own code, customizations, or third-party integrations installed after acceptance; (b) zero-day vulnerabilities that were not publicly known and could not have been identified through reasonable audit at the time of delivery; or (c) Deliverable components specifically designated as out-of-scope in the SOW.

Acceptance Testing, Deemed Acceptance & Cure 1. Acceptance Gates. The parties agree that the Deliverables will be reviewed and accepted in up to three (3) sequential stages (each, an "Acceptance Gate"), as identified in the applicable Statement of Work ("SOW") or project schedule: - Gate 1 – Design Comps: Static design mockups, wireframes, or visual prototypes submitted for approval prior to build. - Gate 2 – Staging Build: A fully functional version of the Deliverable deployed to a staging or test environment. - Gate 3 – Production Launch: The final Deliverable deployed to the production environment and ready for end-user access. Each Acceptance Gate corresponds to the payment milestone identified in the SOW. 2. Review Window. Upon Your name / business name's written notification that a Deliverable is ready for review at an Acceptance Gate, Client name / business name shall have 5 business days (the "Review Window") to review the Deliverable and either (a) provide written acceptance, or (b) deliver a written deficiency report as described in Section 3. 3. Deficiency Reports. To reject a Deliverable, Client name / business name must deliver a written deficiency report within the Review Window that: (i) identifies each defect with sufficient specificity to allow Your name / business name to reproduce it; (ii) classifies each defect by severity tier in accordance with Section 5; and (iii) identifies the specific specification, SOW requirement, or Acceptance Criteria the Deliverable fails to meet. Subjective design preferences not documented in the SOW, Acceptance Criteria, or a signed change order do not constitute grounds for rejection. 4. Cure Period. Upon receipt of a conforming deficiency report, Your name / business name shall have 10 business days (the "Cure Period") to correct all identified Critical and Major defects and re-submit the Deliverable. The Review Window restarts in full upon re-submission. If Your name / business name fails to cure all Critical and Major defects within a second Cure Period, Client name / business name's sole and exclusive remedy is, at Client name / business name's election: (a) a pro-rata reduction in the fees attributable to the non-conforming Acceptance Gate only; or (b) termination of the SOW with respect to the uncompleted phase and a pro-rata refund of fees paid for that phase, net of the reasonable value of work delivered to date. 5. Defect Severity Tiers. | Tier | Definition | Cure Target | |------|-----------|-------------| | Critical | Defect that completely blocks a core function described in the SOW and has no reasonable workaround. | 5 business days | | Major | Defect that materially impairs a function described in the SOW but a reasonable workaround exists. | 10 business days | | Minor | Cosmetic defect, typographic error, or non-material deviation; does not block or materially impair function. | Addressed in next scheduled release or maintenance cycle. | A Deliverable shall be deemed accepted once all Critical and Major defects have been resolved. Minor defects do not block acceptance or withhold payment. 6. Deemed Acceptance. If Client name / business name does not deliver a conforming written deficiency report before the expiry of the Review Window, the Deliverable shall be deemed accepted as of the last day of the Review Window, and the associated payment milestone shall become immediately due and payable. Production use of any Deliverable by Client name / business name or its end users prior to formal acceptance shall also constitute deemed acceptance of that Deliverable. 7. Acceptance Criteria. The parties shall agree on objective Acceptance Criteria for each Acceptance Gate no later than Deadline to agree on Acceptance Criteria (e.g. '10 business days') after the Effective Date. Where Acceptance Criteria are not specified, the applicable standard is conformity with the functional and technical specifications set out in the SOW.

Post-Launch Warranty / Bug-Fix Window 1. Warranty Period. Your name / business name warrants that the Deliverables will perform in material conformity with the specifications set out in the applicable SOW for a period of 90 calendar days commencing on the earlier of: (a) the Launch Date (defined as the date the Deliverable is deployed to the production environment and made accessible to end users); or (b) the date of deemed acceptance under the Acceptance Testing clause of this Agreement (the "Warranty Period"). 2. Scope of Warranty. During the Warranty Period, Your name / business name will, at its own cost, investigate and correct any reported defect that constitutes a failure of the Deliverables to conform to the specifications (a "Covered Defect"). Correction may be achieved by bug fix, patch, or reasonable workaround, at Your name / business name's reasonable discretion. 3. Warranty Exclusions. The warranty in Section 1 does not apply to, and Your name / business name has no obligation to correct at no charge, any defect or issue arising from: (a) Content or data changes — modifications to website text, images, media, or other content not performed by Your name / business name; (b) Design changes — requests for visual, layout, or user-experience modifications that differ from or expand the accepted specifications; (c) Client modifications — any alteration to the Deliverables made by Client name / business name, its employees, contractors, or agents after the Launch Date without Your name / business name's written approval; (d) Third-party software updates — changes in behavior caused by updates, patches, deprecations, or API changes in third-party software, plugins, platforms, or services not supplied by Your name / business name, including operating system updates, browser version changes released after the acceptance date, and social media or payment platform API changes; (e) Hosting and infrastructure — issues attributable to the hosting environment, CDN, DNS configuration, or server infrastructure not managed by Your name / business name under this Agreement; (f) Feature requests — functionality not described in the SOW or Acceptance Criteria; and (g) Force majeure and third-party attacks — data loss, corruption, or outages caused by cyberattacks, DDoS events, or force majeure events. 4. Warranty Remedy. Your name / business name's sole obligation under this warranty is to correct Covered Defects within a reasonable time after receiving written notice from Client name / business name that identifies the defect with sufficient specificity to reproduce it. Your name / business name's total liability for warranty claims shall not exceed the total fees paid under the applicable SOW. The warranty does not cover lost revenue, lost data, lost profits, or consequential damages. 5. Post-Warranty Support. After expiry of the Warranty Period, all support, bug fixes, security patches, plugin updates, and maintenance services are billable at Your name / business name's then-current rates or as set out in a separate Maintenance Agreement executed by the parties. 6. Warranty Disclaimer. EXCEPT AS EXPRESSLY SET OUT IN THIS CLAUSE, Your name / business name MAKES NO OTHER WARRANTY, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.

Third-Party Components; License Allocation; Dependency Risk 1. Identification of Third-Party Components. Prior to or concurrent with execution of the Statement of Work ("SOW"), Developer shall provide Client with a written schedule (the "Dependency Schedule") identifying all material third-party software, plugins, themes, libraries, APIs, SDKs, and other components (collectively, "Third-Party Components") that Developer reasonably anticipates incorporating into the Deliverables, together with the applicable license or subscription terms governing each component. The Dependency Schedule is incorporated into the SOW by reference. Developer shall promptly update the Dependency Schedule upon identifying any material new Third-Party Component during performance. 2. License Procurement — Client-Procures. (Client-Procures Model — insert if selected): For each Third-Party Component designated in the Dependency Schedule as requiring a paid license, Client shall procure, in its own name, all required licenses, subscriptions, and API keys before or promptly after execution of the SOW, and shall provide Developer with access credentials necessary to perform the Services. Developer is not responsible for the cost, procurement, renewal, or regulatory compliance of any Third-Party Component license. Developer shall use Third-Party Components only within the scope of the licenses provided by Client. (Agency-License Model — insert if selected): Developer may extend agency-tier or multi-site license access to Client for Third-Party Components held by Developer during the Engagement. Upon termination or expiration of this Agreement for any reason, such extended access shall automatically terminate, and Client shall procure its own licenses for any Third-Party Components it wishes to continue using within 30 calendar days following the effective date of termination. Developer shall have no liability for service interruptions, data loss, or functional degradation attributable to Client's failure to timely procure independent licenses. 3. Open-Source Components. The Dependency Schedule shall identify all open-source software incorporated into the Deliverables and the applicable open-source license (e.g., MIT, Apache 2.0, GPL v2/v3, LGPL) governing each component. Developer shall not incorporate any open-source component into the Deliverables in a manner that: (a) requires Client to release, license, or disclose Client's proprietary source code under an open-source license (including any GPL copyleft obligation) without Client's prior written consent; or (b) violates the terms of the applicable open-source license. Where a GPL-licensed theme or plugin is used, Developer shall disclose to Client any copyleft obligations that may apply to derivative works, including custom child themes or plugins, and obtain Client's written acknowledgment. 4. Post-Acceptance Dependency Changes. Developer does not warrant the continued availability, pricing, functionality, or terms of any Third-Party Component after the Acceptance Date. If, after the Acceptance Date, a Third-Party Component that is identified in the Dependency Schedule is deprecated, discontinued, materially modified, or made unavailable or economically impractical (including changes to API pricing, rate limits, or authentication requirements), and such change necessitates modifications to the Deliverables, such modifications shall be addressed through a Change Order and shall not constitute a warranty defect, provided that Developer's implementation of the affected component at the time of delivery was consistent with the component's then-current documentation and terms of use. 5. No Critical Single-Point-of-Failure Dependency. Without Client's prior written consent, Developer shall not architect the Deliverables such that a single Third-Party API, service, or component constitutes an unmitigated single point of failure for core functionality ("Critical Dependency"). Where a Critical Dependency is unavoidable or preferred by Client, Developer shall disclose such dependency in the Dependency Schedule, describe the associated risks in writing, and Client's written consent shall be documented in or attached to the SOW. 6. Developer's Compliance Obligation. Developer represents that, as of the Acceptance Date, Developer's use of each Third-Party Component in the Deliverables is consistent with the applicable license terms for such component. Developer's indemnification obligations under the Agreement with respect to third-party intellectual property claims shall not extend to claims arising from Third-Party Components themselves (as distinct from Developer's non-compliant use thereof), except to the extent such claims arise directly from Developer's material breach of a Third-Party Component's license terms.

Accessibility Standards; Scope of Warranty; Legal Compliance Allocation 1. Accessibility Scope. Developer shall design and build those components of the Deliverables expressly listed in the Accessibility Scope Exhibit attached to the SOW ("In-Scope Components") with the objective of conforming to the Web Content Accessibility Guidelines (WCAG) WCAG Version (e.g., 2.1 or 2.2) Level AA as published by the World Wide Web Consortium (W3C) at the time of delivery. The Accessibility Scope Exhibit shall identify each In-Scope Component with specificity (e.g., custom theme templates, primary navigation, contact and checkout forms, core page layouts) and shall identify Out-of-Scope Components as described in Section 3. 2. Testing and Documentation. Upon completion of In-Scope Components and prior to requesting formal acceptance, Developer shall conduct accessibility testing using Accessibility Testing Tool (e.g., axe-core, WAVE, Lighthouse) (or a substantially equivalent automated testing tool), document the results, and provide Client with a written Accessibility Conformance Report ("ACR") summarizing findings and any known residual issues. The ACR is not a legal compliance certification. 3. Out-of-Scope Components. Unless expressly listed as In-Scope in the Accessibility Scope Exhibit, the following are excluded from Developer's accessibility warranty: (a) third-party plugins, embeds, widgets, or iframes (including but not limited to payment processors, social media feeds, live chat widgets, mapping services, and marketing automation tools); (b) content, documents, images, video, audio, or other media uploaded or added by Client or Client's users after the Acceptance Date; (c) client-provided PDF, Word, or other document files and the platforms used to render them; (d) embedded video players and third-party streaming content (Client is solely responsible for providing captions and audio descriptions for such content); (e) components built or customized by Client or third parties after the Acceptance Date; and (f) any component the parties have agreed in writing to exclude. 4. No Statutory Compliance Warranty. Developer warrants only that In-Scope Components will conform to the WCAG WCAG Version (e.g., 2.1 or 2.2) Level AA technical standard as measured by the agreed testing methodology at the time of delivery. Developer makes no representation or warranty, express or implied, that WCAG conformance constitutes compliance with the Americans with Disabilities Act (ADA), Section 508 of the Rehabilitation Act, the Accessibility for Ontarians with Disabilities Act (AODA), or any other applicable accessibility statute, regulation, or legal standard. Responsibility for legal compliance with applicable accessibility laws rests solely and exclusively with Client as the website owner and operator. 5. Post-Delivery Content and Modifications. Client acknowledges that accessibility conformance of the Deliverables may be affected by content Client adds after the Acceptance Date, by Client's use of third-party components, or by modifications made by Client or third parties. Developer's accessibility warranty does not extend to any such content, components, or modifications. 6. Client Indemnification. Client shall indemnify, defend, and hold harmless Developer and its officers, directors, employees, and agents from and against any third-party claims, proceedings, fines, penalties, damages, and costs (including reasonable attorneys' fees) arising out of or relating to: (a) Client's content or specifications that affect accessibility of the Deliverables; (b) Out-of-Scope Components; (c) modifications to the Deliverables made by Client or at Client's direction after the Acceptance Date; or (d) Client's failure to comply with any applicable accessibility statute or regulation. This indemnification obligation is subject to Client receiving prompt written notice of any claim and having the right to participate in the defense thereof. 7. Warranty Remedy. If, within 90 days following the Acceptance Date, Client provides Developer with written notice and reproducible evidence that an In-Scope Component fails to conform to WCAG WCAG Version (e.g., 2.1 or 2.2) Level AA as measured by Accessibility Testing Tool (e.g., axe-core, WAVE, Lighthouse), Developer's sole obligation shall be to use commercially reasonable efforts to correct the non-conformity. This remedy is Client's exclusive remedy for Developer's accessibility warranty obligations.

SUBCONTRACTORS (a) Right to Subcontract. Your name / business name may engage subcontractors and independent contractors ("Subcontractors") to assist in performing the Services, provided that Your name / business name remains responsible for the quality and timely delivery of all work performed by its Subcontractors and for any breach of this Agreement caused by a Subcontractor. (b) Approval for Platform Access. Your name / business name will not permit any Subcontractor to access Client name / business name's software platforms, systems, accounts, or other third-party platform credentials without Client name / business name's prior written approval (which may be given by email and will not be unreasonably withheld or delayed). (c) Flow-Down Obligations. Your name / business name will, by written agreement with each Subcontractor, impose obligations on the Subcontractor that are at least as protective as those set forth in this Agreement with respect to: (i) Confidentiality — protecting Client name / business name's Confidential Information to the same standard as required of Your name / business name; (ii) Intellectual property — assigning to Your name / business name (for flow-through assignment to Client name / business name) all work product and intellectual property created by the Subcontractor as part of the Services; (iii) Data protection — handling personal data in accordance with applicable privacy laws and the data-protection obligations in this Agreement, to the extent the Subcontractor processes personal data; (iv) Non-disclosure — prohibiting the Subcontractor from using Client name / business name's Confidential Information or work product for any purpose other than performing the Services under this Agreement; and (v) Return of materials — returning or destroying Client name / business name's Confidential Information and credentials upon completion of the subcontracted work or upon request. (d) No Additional Cost. Unless otherwise agreed, Your name / business name's use of Subcontractors does not entitle it to charge additional fees beyond those stated in this Agreement. (e) Client Veto. If Client name / business name reasonably objects in writing to a specific Subcontractor (for example, due to a documented conflict of interest or security concern), Your name / business name will use commercially reasonable efforts to replace that Subcontractor within 15 business days without disrupting the Services. (f) Agency Liability. Your name / business name is liable to Client name / business name for the acts and omissions of its Subcontractors to the same extent as if Your name / business name had performed the relevant work itself.

LIMITATION OF LIABILITY (a) Exclusion of Consequential Damages. To the fullest extent permitted by applicable law, neither party will be liable to the other for any indirect, incidental, special, consequential, punitive, or exemplary damages — including lost profits, lost revenue, loss of business opportunity, loss of data, or harm to reputation — arising out of or related to this Agreement, even if the party has been advised of the possibility of such damages and even if a limited remedy fails of its essential purpose. (b) Aggregate Cap. Each party's total aggregate liability to the other arising out of or related to this Agreement — whether in contract, tort (including negligence), strict liability, or otherwise — will not exceed the total fees actually paid or payable by Client name / business name to Your name / business name during the Cap look-back period (months)-month period immediately preceding the event giving rise to the claim, or Minimum cap floor amount (e.g. $5,000), whichever is greater. (c) Exceptions. The limitations in Sections (a) and (b) do not apply to: (i) a party's obligation to indemnify the other for third-party claims of intellectual property infringement under the Mutual Indemnification clause; (ii) liability arising from a party's gross negligence or willful misconduct; (iii) a party's obligations under the Data Protection and Confidentiality clauses with respect to a data breach caused by that party's failure to maintain reasonable security; or (iv) a party's obligation to pay amounts owed under this Agreement. (d) Basis of the Bargain. Each party acknowledges that the limitations in this Section reflect a reasonable allocation of risk, are an essential element of the basis of the bargain between the parties, and that Your name / business name would not have entered into this Agreement without these limitations.

MUTUAL INDEMNIFICATION (a) Agency Indemnification. Your name / business name will defend, indemnify, and hold harmless Client name / business name and its officers, directors, employees, and agents ("Client Indemnitees") from and against any third-party claims, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) ("Losses") arising out of or related to: (i) any material breach by Your name / business name of its representations, warranties, or obligations under this Agreement; (ii) Your name / business name's infringement of a third party's intellectual property rights through materials created solely by Your name / business name and not based on Client-supplied content; (iii) Your name / business name's violation of applicable law in performing the Services; or (iv) Your name / business name's gross negligence or willful misconduct. (b) Client Indemnification. Client name / business name will defend, indemnify, and hold harmless Your name / business name and its officers, directors, employees, subcontractors, and agents ("Agency Indemnitees") from and against any Losses arising out of or related to: (i) any material breach by Client name / business name of its representations, warranties, or obligations under this Agreement; (ii) Client-supplied materials, content, product claims, pricing information, images, or data that infringe a third party's intellectual property rights or constitute false, misleading, or unsubstantiated claims under applicable law; (iii) Client name / business name's violation of applicable law; or (iv) Client name / business name's gross negligence or willful misconduct. (c) Indemnification Procedure. The indemnified party will: (i) promptly notify the indemnifying party in writing of any claim for which indemnification is sought (provided that delay in notice reduces the indemnification obligation only to the extent the indemnifying party is materially prejudiced by the delay); (ii) give the indemnifying party sole control of the defense and settlement of the claim, provided that no settlement that imposes any obligation, restriction, or liability on the indemnified party may be entered without the indemnified party's prior written consent, not to be unreasonably withheld; and (iii) provide reasonable cooperation and assistance at the indemnifying party's expense. (d) Interaction with Liability Cap. The indemnification obligations in this Section are subject to the aggregate liability cap set forth in the Limitation of Liability clause, except for claims arising from a party's gross negligence or willful misconduct, which are not subject to that cap.

GOVERNING LAW; JURISDICTION; VENUE (a) Governing Law. This Agreement and any dispute arising out of or related to it — including its formation, interpretation, performance, breach, or termination — will be governed by and construed in accordance with the laws of the State of Governing law state (e.g. New York), without regard to its conflict-of-law provisions. (b) Consent to Jurisdiction. Each party irrevocably submits to the exclusive personal jurisdiction of the state and federal courts located in Venue county (e.g. New York) County, Governing law state (e.g. New York) for any action or proceeding arising out of or relating to this Agreement that is not subject to arbitration under the Dispute Resolution clause (if any). (c) Venue. Each party waives any objection to the laying of venue in the courts identified in Section (b), and waives any claim that such courts are an inconvenient forum. (d) Service of Process. Service of process in any such action may be made by any method authorized by the applicable court rules or by mailing a copy of the summons and complaint by registered or certified mail, return receipt requested, to the party's address set forth in this Agreement. (e) Prevailing Party. In any dispute arising under this Agreement, the prevailing party is entitled to recover its reasonable attorneys' fees and costs from the non-prevailing party, unless the parties have agreed to a different allocation in the Dispute Resolution clause.

DISPUTE RESOLUTION (a) Good-Faith Negotiation. Before initiating any formal dispute proceeding, the parties will attempt to resolve any dispute, controversy, or claim arising out of or relating to this Agreement ("Dispute") through good-faith negotiation. Either party may initiate this step by delivering written notice to the other describing the Dispute in reasonable detail ("Dispute Notice"). Senior representatives of each party with authority to resolve the Dispute will meet (in person, by phone, or by videoconference) within 10 business days of the Dispute Notice and attempt to resolve the matter in good faith for a period of 30 business days from the date of the Dispute Notice (or longer, if agreed in writing). (b) Mediation. If the Dispute is not resolved through negotiation within the timeframe in Section (a), either party may submit it to non-binding mediation administered by Mediation provider (e.g. JAMS, AAA) (or, if the parties cannot agree on a provider, by the American Arbitration Association under its Commercial Mediation Procedures). The mediation will take place in Mediation city, Mediation state. The parties will share mediator fees equally. Each party will bear its own legal fees for the mediation. (c) Binding Arbitration. If the Dispute is not resolved through mediation within 60 days after the appointment of the mediator, either party may demand binding arbitration. Arbitration will be administered by Arbitration provider (e.g. JAMS, AAA) under its then-current Arbitration rules (e.g. Commercial Arbitration Rules), before a single arbitrator. The arbitration will take place in Arbitration city, Arbitration state. The arbitrator's decision will be final and binding and may be entered as a judgment in any court of competent jurisdiction. The parties agree that the arbitration — including its existence, proceedings, and any award — is confidential. (d) Exceptions to Arbitration. Either party may seek emergency injunctive or other equitable relief from a court of competent jurisdiction without first completing the negotiation or mediation steps, to prevent irreparable harm — including to protect Confidential Information or intellectual property — pending the outcome of arbitration. (e) Small Claims. Either party may bring a Dispute in small claims court if the amount in controversy falls within that court's jurisdictional limit. (f) Class Action Waiver. Each party waives any right to bring or participate in any class action, class arbitration, or representative proceeding relating to this Agreement. (g) Governing Law for Arbitration. The arbitration will be governed by the Federal Arbitration Act (9 U.S.C. §§ 1–16) and, where not preempted, by the laws of Governing law state (e.g. New York).

FORCE MAJEURE (a) Definition. A "Force Majeure Event" means any event beyond a party's reasonable control that prevents or materially impairs that party's ability to perform its obligations under this Agreement, including: acts of God; natural disasters; fire; flood; earthquake; epidemic or pandemic; war; terrorism; riots or civil unrest; actions or inactions of governmental authorities (including government-mandated service restrictions or platform-access bans); internet or telecommunications infrastructure failures (including widespread outages of major technology or infrastructure platforms affecting substantially all users); power outages; and cyber-attacks on the party's systems not caused by the party's own negligence (each, individually a "Force Majeure Event"). Economic downturns, changes in market conditions, and changes in third-party platform features or algorithms do not constitute Force Majeure Events. (b) Effect. The party affected by a Force Majeure Event ("Affected Party") will be excused from performance of the affected obligations during the continuance of the Force Majeure Event, provided that the Affected Party complies with the notice and mitigation obligations below. (c) Notice. The Affected Party will give the other party written notice of the Force Majeure Event as soon as reasonably practicable after the event begins, describing the nature of the event, the expected duration, and the obligations affected. (d) Mitigation. The Affected Party will use commercially reasonable efforts to mitigate the impact of and to overcome the Force Majeure Event, and will resume performance as soon as reasonably practicable after the event ends. (e) Suspension and Termination. If a Force Majeure Event prevents a party's material performance for more than 30 consecutive days, either party may terminate this Agreement on written notice without further liability, except for: (i) amounts already earned and owing; and (ii) obligations that survived the term of the Agreement (including confidentiality and IP assignments). (f) No Payment Excuse. A Force Majeure Event does not excuse Client name / business name from paying for Services already performed before the event or for Services Your name / business name is able to perform notwithstanding the event.

21.1 General Restriction. Neither Party may assign, delegate, or transfer any of its rights or obligations under this Agreement, in whole or in part, without the other Party's prior written consent, which will not be unreasonably withheld or delayed. 21.2 M&A Exception. Notwithstanding Section 21.1, either Party may assign this Agreement without consent in connection with a merger, acquisition, change of control, or sale of all or substantially all of the assets to which this Agreement relates, provided that: (a) the assignee assumes all obligations of the assigning Party under this Agreement; and (b) the assigning Party provides the other Party written notice within thirty (30) days of the assignment. 21.3 Void Assignment. Any purported assignment in violation of this Section is void. 21.4 Binding Effect. This Agreement is binding upon and inures to the benefit of the Parties and their permitted successors and assigns.

22.1 Form. All notices, requests, demands, consents, and other communications required or permitted under this Agreement ("Notices") must be in writing. 22.2 Delivery Methods. Notices may be delivered by: (a) personal delivery; (b) nationally recognized overnight courier (e.g., FedEx, UPS); (c) certified or registered mail, return receipt requested, postage prepaid; or (d) email to the address specified below, provided that the sender retains proof of transmission and does not receive an automated bounce or delivery-failure notification within twenty-four (24) hours. 22.3 Effectiveness. Notices are effective: (a) upon personal delivery; (b) one (1) business day after deposit with overnight courier; (c) three (3) business days after deposit in the mail; or (d) on the day of email transmission if sent by 5:00 PM recipient's local time on a business day, or on the next business day if sent after 5:00 PM or on a non-business day. 22.4 Addresses. To Provider: Your name / business name, Provider Notice Address, Email: Provider Legal/Notice Email To Customer: Client name / business name, Customer Notice Address, Email: Customer Legal/Notice Email Either Party may change its notice address by providing written notice to the other in accordance with this Section.

If any provision of this Agreement is held by a court of competent jurisdiction to be invalid, illegal, or unenforceable under applicable law, that provision will be: (a) modified to the minimum extent necessary to make it valid, legal, and enforceable while preserving the Parties' original intent; or (b) if modification is not possible, severed from this Agreement. The validity, legality, and enforceability of the remaining provisions will not in any way be affected or impaired. The Parties agree to negotiate in good faith a replacement provision that, to the greatest extent possible, achieves the intended commercial purpose of the severed provision.

24.1 Integration. This Agreement, together with all SOWs, Change Orders, and exhibits executed hereunder, constitutes the entire agreement between the Parties with respect to its subject matter and supersedes all prior and contemporaneous agreements, negotiations, representations, warranties, and understandings, whether written or oral, relating to the same subject matter. 24.2 No Oral Modifications. No oral statement, prior course of dealing, trade usage, or conduct will be used to supplement, interpret, or contradict the written terms of this Agreement. 24.3 Purchase Orders. Any terms set forth in Customer's purchase orders, vendor registration forms, or similar documents are of no force or effect and do not modify this Agreement unless expressly incorporated into a signed SOW or Change Order. 24.4 Results Representations. Customer acknowledges that no employee, agent, or representative of Provider has authority to guarantee specific results or outcomes, and that any such representation made outside this Agreement is not binding on Provider.

25.1 Amendments. This Agreement may not be amended, modified, or supplemented except by a written instrument signed by authorized representatives of both Parties. 25.2 No Waiver. No failure or delay by either Party in exercising any right, remedy, power, or privilege under this Agreement operates as a waiver thereof. No single or partial exercise of any right, remedy, power, or privilege precludes any other or further exercise thereof or the exercise of any other right, remedy, power, or privilege. 25.3 Written Waivers Only. Any waiver of a provision of this Agreement must be in writing and signed by the waiving Party to be effective. A written waiver of any particular breach or right is effective only for the specific instance and purpose for which it was given.

26.1 Electronic Signatures. This Agreement and any SOW or amendment may be signed by electronic signature, including signatures created through E-Signature Platform (e.g., DocuSign, HelloSign) or any other electronic signature service compliant with the Electronic Signatures in Global and National Commerce Act (E-SIGN Act), 15 U.S.C. § 7001 et seq., and the Uniform Electronic Transactions Act (UETA) as enacted in the applicable jurisdiction. Electronic signatures have the same legal effect as original handwritten signatures. 26.2 Counterparts. This Agreement may be executed in one or more counterparts, each of which will be deemed an original, and all of which together will constitute one and the same instrument. Delivery of an executed counterpart by electronic transmission (including PDF or electronic signature platform delivery) is equally effective as delivery of a manually executed counterpart.

Clause Number / Reference (e.g., 8, 12.3) Source Code / Repository Delivery Clause Number / Reference (e.g., 8, 12.3).1 Delivery Obligation. Within 5 business days after the Client issues a written final-acceptance notice under the Acceptance clause of this Agreement, Developer shall deliver (or cause to be delivered) to Client all of the following (collectively, the "Delivery Materials"): (a) the complete source code for all Deliverables, including all commits, branches, and tags constituting the full version-control history, transferred directly into a repository designated and controlled by Client; (b) all build scripts, Makefiles, Dockerfiles, container-orchestration manifests, CI/CD pipeline configuration files, and any other files required to compile, package, containerise, and deploy the software from source; (c) all infrastructure-as-code files (including Terraform, Pulumi, CloudFormation, Bicep, or equivalent) and environment-configuration files for each deployment environment (development, staging, and production); (d) all database schemas, entity-relationship diagrams, migration scripts, and seed-data scripts in executable form; (e) all API keys, service-account credentials, signing certificates, and environment secrets used in production, rotated by Developer at the time of delivery so that Client holds the sole active credentials; (f) technical documentation sufficient to allow a reasonably skilled software developer unfamiliar with the project to build, deploy, operate, and modify the software, including architecture diagrams, data-flow diagrams, API reference documentation, and a dependency inventory; and (g) the Open Source Register: a complete, accurate list of all open-source and third-party software components incorporated into the Deliverables, identifying for each component its name, version, licence identifier (SPDX format preferred), and any licence conditions that bind Client (including copyleft, notice, and attribution requirements). Clause Number / Reference (e.g., 8, 12.3).2 Format and Integrity. All source code shall be delivered in human-readable, unobfuscated form. Compiled binaries, bytecode-only deliveries, and container images delivered without accompanying source shall not satisfy this clause. Developer shall provide a written certification, signed by a duly authorised representative, that the Delivery Materials are complete and accurate as of the delivery date. Clause Number / Reference (e.g., 8, 12.3).3 Cooperation. For 30 days following delivery, Developer shall make its lead developer(s) reasonably available—at no additional charge—to answer Client's questions regarding the Delivery Materials and to assist Client in achieving a successful build and deployment from the delivered source code. Clause Number / Reference (e.g., 8, 12.3).4 Failure to Deliver. If Developer fails to deliver the Delivery Materials within the period specified in Section Clause Number / Reference (e.g., 8, 12.3).1, Client may, in addition to any other remedies available at law or equity: (a) withhold any unpaid amounts equal to 20% of the total project fees until delivery is complete; and (b) engage a third party to reconstruct, document, or replicate the missing materials at Developer's reasonable expense.

Usage Restrictions. Client shall use the Software solely for Client's internal business purposes in accordance with the Documentation and any applicable Order Form. Client shall not, and shall ensure that its Users do not: (a) Reverse Engineering. Reverse engineer, decompile, disassemble, or otherwise attempt to derive or reconstruct the source code, underlying algorithms, data structures, or trade secrets of the Software, except to the limited extent expressly permitted by applicable law notwithstanding this restriction; (b) Sublicensing and Distribution. Sell, sublicense, rent, lease, lend, transfer, assign, or otherwise make the Software available to any third party, except as expressly authorized in writing by Your name / business name; (c) High-Risk Activities. Use the Software in connection with any High-Risk Activity, including without limitation the design, development, operation, or maintenance of nuclear facilities, aircraft navigation or communication systems, air traffic control systems, medical life-support systems, weapons systems, or any other application in which a failure of the Software could reasonably be expected to cause death, personal injury, or severe physical or environmental damage; (d) Competitive Development. Use the Software, its output, or any proprietary methods, features, or know-how embodied therein to design, develop, or assist in the development of any product or service that competes with the Software or any other product or service offered by Your name / business name, or to benchmark or publicly compare the Software's performance against any competing product without Your name / business name's prior written consent; (e) Security Circumvention. Circumvent, disable, defeat, or interfere with any security feature, access control, license-enforcement mechanism, or technical protection measure incorporated in the Software; (f) Proprietary Notices. Remove, obscure, or alter any copyright notice, trademark, logo, legend, or other proprietary rights notice appearing in or on the Software or its Documentation; (g) Unauthorized Access. Use the Software to gain unauthorized access to any system, network, data, or account, or to conduct vulnerability testing, penetration testing, or denial-of-service attacks on any infrastructure without the prior written consent of the owner of that infrastructure; or (h) Unlawful Use. Use the Software in any manner that violates applicable law, infringes any third-party intellectual property right, or facilitates fraud, harassment, or distribution of malicious code. Client is responsible for all acts and omissions of its Users as if they were Client's own. Your name / business name may suspend Client's access to the Software upon reasonable notice if Your name / business name reasonably determines that Client or any User is violating this Section, and may terminate this Agreement for material breach in accordance with Section Termination-for-Convenience Section Reference if such violation is not cured within 3 days of written notice.

Key Personnel & Subcontractor Controls Clause Number / Reference (e.g., 8, 12.3). Key Personnel and Subcontractors. Clause Number / Reference (e.g., 8, 12.3).1 Designation of Key Personnel. The individuals identified in Exhibit Key Personnel Exhibit Letter (e.g., E, F) ("Key Personnel") are material to Client / Company Name's decision to enter into this Agreement. Developer shall ensure that each Key Personnel member devotes substantially all of the time allocated to such individual in Exhibit Key Personnel Exhibit Letter (e.g., E, F) to the performance of the Services and shall not, without Client / Company Name's prior written consent, (a) remove or reassign any Key Personnel from the Services, (b) reduce any Key Personnel member's allocated time by more than 20%, or (c) substitute any Key Personnel member with a different individual. Clause Number / Reference (e.g., 8, 12.3).2 Replacement of Key Personnel. If a Key Personnel member becomes unavailable due to voluntary resignation, termination, death, disability, or other circumstance beyond Developer's reasonable control, Developer shall: (a) notify Client / Company Name in writing within 10 business days of learning of or initiating such departure; (b) provide Client / Company Name with the resume, relevant experience, and professional background of each proposed replacement candidate; (c) afford Client / Company Name a reasonable opportunity, not less than 5 business days, to interview and approve the proposed replacement; and (d) not substitute the departing Key Personnel member until Client / Company Name has provided written approval of a replacement, such approval not to be unreasonably withheld or delayed. If Developer is unable to identify a qualified replacement acceptable to Client / Company Name within 60 days after the Key Personnel departure, Client / Company Name may, at its election, treat such failure as a material breach of this Agreement. Clause Number / Reference (e.g., 8, 12.3).3 Key Personnel Transition. Upon approval of a replacement, Developer shall ensure a structured handover period of not less than 2 weeks during which both the departing Key Personnel member (to the extent available) and the approved replacement work together on the Services so as to minimize disruption to the project schedule and continuity of institutional knowledge. Clause Number / Reference (e.g., 8, 12.3).4 Subcontractor Approval. Developer shall not engage any subcontractor, independent contractor, third-party vendor, or offshore development team (each, a "Subcontractor") to perform any portion of the Services without Client / Company Name's prior written approval, which may be granted or withheld in Client / Company Name's reasonable discretion. The initial list of approved Subcontractors, if any, is set forth in Schedule Approved Subcontractor Schedule Number/Letter to this Agreement ("Approved Subcontractor Schedule"). Developer may update the Approved Subcontractor Schedule only by submitting a written request to Client / Company Name and receiving Client / Company Name's written approval before the proposed Subcontractor commences any work. Clause Number / Reference (e.g., 8, 12.3).5 Subcontractor Obligations. Before any approved Subcontractor commences work, Developer shall: (a) enter into a written agreement with such Subcontractor that imposes confidentiality, intellectual property assignment, data protection, and security obligations at least as protective of Client / Company Name as those contained in this Agreement; (b) obtain from such Subcontractor an assignment (or, where assignment is not available under applicable law, an exclusive license) to Developer of all intellectual property rights in any work product or deliverables created by such Subcontractor in connection with the Services, sufficient to enable Developer to fulfill its IP assignment obligations to Client / Company Name under this Agreement; and (c) ensure that such Subcontractor is bound by the AI-generated code and training data restrictions set forth in Section AI-Generated Code Clause Number (cross-reference) of this Agreement, if applicable. Developer shall provide Client / Company Name with a copy of the executed Subcontractor agreement (or a redacted version sufficient to confirm compliance with this Section Clause Number / Reference (e.g., 8, 12.3).5) upon request. Clause Number / Reference (e.g., 8, 12.3).6 Developer Remains Liable. Notwithstanding any approved Subcontractor engagement, Developer remains solely and directly responsible to Client / Company Name for: (a) the performance, quality, and timely delivery of all Services and Deliverables, whether performed by Developer's employees or Subcontractors; (b) all acts, omissions, errors, and breaches of any Subcontractor to the same extent as if Developer had committed such act or omission directly; and (c) all payments owed to Subcontractors. Client / Company Name shall have no obligation to, and shall not be required to deal directly with, any Subcontractor. Clause Number / Reference (e.g., 8, 12.3).7 Removal of Subcontractor Personnel. Client / Company Name may, upon reasonable written notice to Developer, request that Developer remove a specific Subcontractor or individual Subcontractor personnel from the Services if Client / Company Name reasonably determines that such person poses a security risk, has breached applicable data protection or confidentiality obligations, or whose continued involvement is otherwise prejudicial to the interests of Client / Company Name. Developer shall use commercially reasonable efforts to comply with such a request within 5 business days. Clause Number / Reference (e.g., 8, 12.3).8 Relationship to Flow-Down Clause. This Section Clause Number / Reference (e.g., 8, 12.3) governs Developer's obligations regarding the approval, notification, and management of Key Personnel and Subcontractors. The flow-down of intellectual property, confidentiality, and data-protection obligations to Subcontractors is additionally governed by the Subcontractor Flow-Down clause of this Agreement. In the event of any conflict between the two sections with respect to flow-down obligations, the more protective provision shall control.