END USER LICENSE AGREEMENT ("EULA")

Last Update Date: 08/07/2026

This EULA between the User and RedCarbon S.r.l. sets forth the terms and conditions regulating Your use of RedCarbon services as specified below. By installing, using or accessing RedCarbon Services or any materials included in or with the RedCarbon Services, you hereby accept the terms of this EULA.

If you do not accept the terms of this EULA, do not install, use or access RedCarbon Services.

1. Definitions

1.1 Except to the extent expressly provided otherwise, in this EULA:

"EULA" means this End User License Agreement, including any amendments to it from time to time;
"RedCarbon" means RedCarbon S.r.l., with registered office in Torino (TO), Corso Castelfidardo 22 – 10145 – Italy;
"User" or "End-User" means the legal person to which RedCarbon grants a right to use RedCarbon Services under this EULA, as identified in the Order Form. User/End-User and RedCarbon are indicated separately as "Party" and jointly as "Parties";
"Authorized Users" means the user authorized by the User to use the Services, including, but not limited to, employees, collaborators;
"Software" or "Platform" means the SaaS cloud application and all software programs, data and documents distributed, published or otherwise made available by RedCarbon or its affiliates through which the Services are delivered, including, but not limited to, software, data, updates and upgrades as well as accompanying manual(s), packaging and other written files, electronic or on-line materials or documentations, and any and all copies of such software and its materials;
"Services" means the software services offered to the End-User via the Platform, consisting of AI Agents (i.e. artificial intelligence software agents that collaborate with security teams to perform repetitive tasks and automate various aspects of cyber security such as incident response, auditing, etc.) or APIs (Application Programming Interfaces) for using the aforementioned AI Agents, as described in the Order Form;
"RedCarbon Services" means Software and Services provided by RedCarbon;
"Confidential Information" means: (i) any and all information and data, in whatever form or medium (including paper, electronic, verbal, visual or any other format), relating to the past, present or future business, activities, technology or operations of RedCarbon, including without limitation its research and development, software (including the Platform and its underlying source code, object code, algorithms, models, architecture and AI/ML components), know-how, trade secrets, technical and IT knowledge, pricing, business plans, marketing strategies, customer and supplier data, financial information, and any other information disclosed or made available by RedCarbon to the User in connection with this EULA — all of which shall be deemed Confidential Information of RedCarbon without the need for any marking or further designation; (ii) any information disclosed or developed by either Party for the purposes of this EULA, the unauthorised disclosure, loss, tampering or misuse of which involves or could result in serious risk and/or damage — including financial, operational, reputational or competitive damage — to the disclosing Party; and/or (iii) information identified in writing as "confidential", "reserved", and/or "secret" or which can reasonably be identified or considered as such;
"Intellectual Property rights" means all intellectual property rights including but not limited to copyright and related rights, database rights, confidential information, trade secrets, know-how, business names, trade names, trademarks, service marks, passing off rights, unfair competition rights, patents;
"Force Majeure Events" means an event, or a series of related events, that is outside the reasonable control of the Party affected, including but not limited to failures of the internet or any public telecommunications network, hacker attacks, denial of service attacks, virus or other malicious software attacks or infections, power failures, industrial disputes affecting any third party, changes to the law, disasters, explosions, fires, floods, riots, terrorist attacks and/or wars;
"Partner" means the legal entity that, pursuant to separate agreements with RedCarbon ("MSA") and the End-User, distributes or resells the Platform and the Services to End-User;
"Order Form" means the document completed by the Partner on behalf of the User for the activation of RedCarbon Services in favor of the User, specifying configurations, active modules, duration, fees and any other applicable parameters, that the End-User declares to be fully aware of;
"Beta Services" means Services or features of the Platform which, at the time of their release and activation, RedCarbon still considers to be in a development and testing phase.

2. License and Scope of Use

2.1 RedCarbon hereby grants to the User, who subscribes to and accepts this EULA, a non-exclusive, non-transferable license to use the RedCarbon Services provided in Cloud Software as a Service (SaaS) mode, according to the Order Form and this EULA.

2.2 RedCarbon provides licensing of its Software according to User's subscription ("Subscription") for a defined time period ("Subscription Period"); the Subscription Period, and any other Subscription parameters, are specified in the Order Form.

2.3 The User hereby acknowledges that no title or ownership in the Software is being transferred or assigned and this EULA is not to be construed as a sale of any rights in the Software. The rights granted herein are subject to User's compliance with this EULA.

2.4 Unless applicable law gives the User more rights despite this limitation, User may use RedCarbon Services only as expressly permitted by this EULA; in doing so, User must comply with any technical limitations in the Software that only allow User to use it in certain ways, as stated in this EULA.

2.5 In any case, User shall not, and shall not permit others under its control to: (1) copy, modify, reproduce, distribute or create a derivative work of the RedCarbon Services or any component thereof, including the Platform, or make the same available to third parties; (2) carry out reverse engineering, disassembly, decompilation, translation or any other operation aimed at obtaining the source code, algorithms, technical details or any component of the Platform or the Services; (3) translate, alter or create utilities based on parts of the Platform or the Services, or modify the visual or functional structure of the Platform, nor request third parties to carry out such modifications; (4) remove or alter any proprietary notices, trademarks or legends contained in the Platform, the Services or any related manuals or documentation; (5) assign, sublicense, transfer, lease, rent, sell or otherwise distribute or make available the RedCarbon Services, any copy of the software, related manuals or documentation to any third party; (6) use the RedCarbon Services for High Risk Activities or in any other way contrary to this EULA; (7) use the RedCarbon Services to create, deliver training on, improve (directly or indirectly) or offer a substantially similar product or service.

3. RedCarbon Obligations and Warranties

3.1 RedCarbon undertakes to provide access to the Services and the Software in accordance with the terms and conditions set forth in the Order Form and this EULA, as well as in compliance with the service and support levels specified in Annex A.

3.2 RedCarbon shall provide the Services and access to the Software by implementing security technologies that are reasonably available.

3.3 To the maximum extent permitted by applicable mandatory law, RedCarbon expressly disclaims and excludes all representations, conditions and warranties of any kind, whether express, implied, statutory or otherwise, including without limitation any implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, title, non-infringement, accuracy or completeness of results. The User acknowledges that it has evaluated the RedCarbon Services independently or with the Partner and that it is solely responsible for determining whether the RedCarbon Services meet its requirements and that it accepts them "as is". Without limiting the foregoing, RedCarbon specifically does not represent or warrant that:

the RedCarbon Services will meet the User's expectations, requirements or objectives, or be fit for any particular purpose intended by the User. The User expressly acknowledges and accepts that the sole purpose of the RedCarbon Services is to seek to reduce — and not to eliminate — the risk of potential cybersecurity incidents, and that RedCarbon provides no guarantee that such incidents will not occur;
the Service and the Software will operate uninterruptedly, in a timely manner, or be error-free, including in the event of disruptions and/or unauthorized access by third parties; any temporary unavailability or degradation of the RedCarbon Services shall not constitute a breach of this EULA by RedCarbon;
any errors in the Software related to the provision of the Services and/or in the Services themselves will be corrected and/or remedied within the period of time requested by the User; provided that, where an error is identified and verified by RedCarbon as falling within its reasonable control, RedCarbon shall use commercially reasonable efforts to address such error within a reasonable period of time, as determined at RedCarbon's sole discretion and in accordance with the scope of priorities and procedures set out in Annex A. RedCarbon shall have no obligation to correct and/or provide corrections or updates beyond those set out in the applicable Service Level Agreement.

3.4 The warranties set out in this EULA shall not apply where the User has used the Software and/or the Services improperly, unlawfully, or otherwise in breach of this EULA and/or any additional instructions provided by RedCarbon.

3.5 The User acknowledges and accepts that the Platform and the Services are based on artificial intelligence, machine learning algorithms and automated analysis systems which, by their very nature, produce outputs that are inherently probabilistic and may contain inaccuracies, errors, false positives or false negatives. The performance and accuracy of such AI-driven outputs depend, inter alia, on the quality, completeness and timeliness of the data transmitted via the integrations ("Integration"), i.e. through technical connection between RedCarbon and an external system belonging to the Partner or End-User, among those indicated as supported on www.redcarbon.ai (e.g. SIEM, EDR, XDR, security appliances or cloud services) ("Admitted Systems"), designed to receive events, alerts or data relevant to security analysis, and on the evolving nature of the cyber threat landscape and on factors beyond RedCarbon's reasonable control. Accordingly, RedCarbon shall not be liable for any decision, action or omission taken or made by the User on the basis of, or in reliance upon, any output, report, analysis or recommendation generated by the Platform and the Services.

3.6 Where the RedCarbon Services are offered to the User as part of a bundle, package or integrated solution that includes services, software, hardware or other products provided by the Partner ("Bundled Offering") or by a third party, the User acknowledges and accepts that: (i) RedCarbon's obligations and liabilities under this EULA extend exclusively to the RedCarbon Services as independently delivered by RedCarbon, and do not extend to any services, components or products forming part of the Bundled Offering that are provided by the Partner or any third party; (ii) RedCarbon shall not be liable for any defect, malfunction, interruption, non-conformity or failure of the Bundled Offering to the extent that such defect, malfunction, interruption, non-conformity or failure is caused or contributed to, directly or indirectly, by any service, software, hardware or product provided by the Partner or any third party, or by the Integration, configuration or combination of the RedCarbon Services with any such Partner or third-party components; (iii) the User's sole recourse in respect of any such defect, malfunction or failure attributable to the Partner's components or to the Bundled Offering as a whole shall be against the Partner pursuant to the terms of any separate agreement between the User and the Partner; and (iv) RedCarbon makes no representation or warranty, express or implied, as to the compatibility, interoperability, fitness or performance of the RedCarbon Services when combined with any Partner or third-party services or products, except to the extent expressly set out in the applicable Order Form.

3.7 The User acknowledges and accepts that: (i) the fees and any other amounts due in consideration of the RedCarbon Services are payable by the User exclusively to the Partner, pursuant to the terms and conditions agreed between the User and the Partner in a separate agreement; RedCarbon is not a party to such payment obligation and no amount is due by the User directly to RedCarbon under this EULA in respect of fees; (ii) RedCarbon shall have no liability whatsoever towards the User arising out of or in connection with: (a) any failure by the Partner to invoice, collect or remit fees; (b) any dispute between the User and the Partner regarding the amounts due, the billing terms or the scope of the fees; (c) any suspension or termination of the RedCarbon Services resulting from the User's failure to pay the Partner in accordance with the terms agreed between them; and (iii) in the event that the Partner fails to remit to RedCarbon any amounts due under the agreement between RedCarbon and the Partner, RedCarbon reserves the right to suspend or terminate the RedCarbon Services, without any liability towards the User and without prejudice to any other rights available to RedCarbon. The User's sole recourse in respect of any payment dispute or failure attributable to the Partner shall be against the Partner.

3.8 The User acknowledges and accepts that Partner (and not directly RedCarbon) shall provide End Users with first-level support relating to the Platform, including onboarding, basic troubleshooting and initial request management.

4. User Obligations

4.1 By accepting this EULA, the User agrees to:

Acknowledge the technical specifications of the Software and Services, possessing the technical and professional skills necessary to ensure the correct use of the RedCarbon Services. It is understood that assessment of the Software's and Services' compliance with the User's requirements is the sole responsibility of the latter;
Use the RedCarbon Services for themselves and their users in accordance with the applicable laws and regulations in force from time to time, and in compliance with the rights of RedCarbon and third parties, as well as in compliance with this EULA, the Order Form and any technical instructions provided by RedCarbon;
Acknowledge that complex software is never wholly free from security vulnerabilities, such as, by way of example, defects, errors and bugs; subject to the other provisions of this EULA, RedCarbon gives no warranty or representation that the RedCarbon Services will be wholly free from potential security vulnerabilities;
Ensure that the RedCarbon Services are used only by Authorized Users and, in any event, by personnel under its direct control, assuming full and exclusive responsibility in this regard;
Not disclose, including through User's personnel, credentials relating to the RedCarbon Services, in order to prevent any misuse thereof;
Notify the Partner of any changes to the data/information specified in the Order Form and relevant to the performance of the contract;
Notify RedCarbon and the Partner or the distributor immediately of any changes to User's technical infrastructure that could affect the proper provision of the RedCarbon Services; it is understood that RedCarbon reserves the right to suspend, in whole or in part, the provision of the RedCarbon Services in the event of such changes;
Acknowledge that the Software is only designed to be compatible with the technical configuration requested by RedCarbon; RedCarbon does not warrant or represent that the Software will be compatible with any other technical configuration;
Acknowledge that the proper functioning of the Software and Services requires an internet connection, and that the functioning of the internet connection is sole and exclusive responsibility of the User;
Acknowledge that RedCarbon will not provide any legal, financial, accountancy or taxation advice under this EULA or in relation to the RedCarbon Services; and, except to the extent expressly provided otherwise in this EULA, RedCarbon does not warrant or represent that the RedCarbon Services or the use of the same by the User will not give rise to any legal liability on the part of the User or any other person.

4.2 Subject to the provisions of this EULA, the User shall indemnify and shall keep indemnified RedCarbon against any and all liabilities, damages, losses, costs and expenses (including legal expenses and amounts reasonably paid in settlement of legal claims) suffered or incurred by RedCarbon and arising directly or indirectly as a result of any breach by the User (or its Authorised Users) of this EULA.

4.3 Moreover, User undertakes to indemnify and hold RedCarbon harmless from any legal or extrajudicial claims that may be brought by third parties in relation to any alleged breach of national and/or international laws attributable to the User in the use of the RedCarbon Services. In such cases, the User shall notify RedCarbon without undue delay, where appropriate also through the Partner.

5. License Term and Termination

5.1 Subject to the payment of any applicable fees by the Partner, the term of User's Subscription licenses under this EULA shall commence on the date indicated in the Order Form, and will continue for the Subscription Period, unless terminated earlier as set forth in this EULA or in the MSA between RedCarbon and the Partner.

5.2 Any license terminates immediately if User attempts to circumvent any technical protection measures used in connection with the Software and/or Services or otherwise use the Software and/or Services in breach of the terms of this EULA.

5.3 The termination of this EULA shall not affect the accrued rights of either Party.

5.4 For the avoidance of doubt, the license in this EULA shall terminate within the term indicated in the Order Form; and, accordingly, the User must immediately cease to use RedCarbon Services upon the termination of it.

5.5 In any event, RedCarbon retains the right to terminate this EULA with immediate effect, by simple written notice in accordance with Article 1456 of the Italian Civil Code, in the case that RedCarbon should be unable to provide the RedCarbon Services due to circumstances attributable to the User.

6. Intellectual Property Rights

6.1 RedCarbon retains all right, title and interest in and to the RedCarbon Services, including, but not limited to, all copyrights, trademarks, trade secrets, trade names, proprietary rights, patents, titles, computer codes, audiovisual effects, themes, characters, character names, stories, dialog, settings, artwork, sound effects, musical works, and moral rights whether registered or not and all applications thereof.

6.2 Unless expressly authorized by mandatory legislation, RedCarbon Services and relevant Intellectual Property Rights may not be copied, reproduced, disclosed, used or distributed by the End-User in any manner or medium, in whole or in part, without prior written consent from RedCarbon, except for the performance of this EULA. All rights not expressly granted herein are reserved by RedCarbon.

6.3 The User expressly acknowledges and accepts that all Intellectual Property Rights relating, but not limited to, to the Software, Services, consulting services, reports produced, as well as any other element delivered by RedCarbon and/or the Partner under the EULA are and remain exclusive property of RedCarbon, and the User may only use them within the limits set out in the EULA.

6.4 The User further acknowledges that no rights to the source code, technical data, algorithms or any component of the Platform or the Services are transferred under this EULA, and that any modification, improvement or customisation of the Platform or the Services, even if carried out at the User's request or suggestion, remains the exclusive property of RedCarbon.

6.5 User agrees that RedCarbon may collect and use the aggregated anonymized statistical data that may be derived from the analysis of the actual functioning of the Platform and the Services, including for the purposes of training, fine-tuning and improving RedCarbon's artificial intelligence and machine learning models, as well as disclose them for the purposes of scientific publications.

7. Third Party Software

7.1 The Software includes integrated third-party software, sublicensed inside RedCarbon Software and supported only for the uses described in the software documentation.

7.2 Any third-party software is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall RedCarbon be liable for any damages or other liability, whether in contract, tort or otherwise, arising from, out of or in connection with the third-party software and/or the use or other dealings in the third-party software.

8. Increased Volume of Use

8.1 User may increase RedCarbon Services' volume of use during the Subscription Period beyond the scope specified in the Order Form, provided that User promptly notifies RedCarbon – through the Partner – of the additional use; in such cases, a new Order Form shall be issued. Possible increase of the volume without previous agreement shall cause termination of the EULA according to article 1456 of the Civil Code, without prejudice of RedCarbon's right to the refund of the suffered damages.

9. Limitation of Use of the Software

9.1 In the event of faults, defects or malfunctions affecting all or part of the RedCarbon Services, including those due to Force Majeure Events, or in the event of security threats relating to the RedCarbon Services, RedCarbon reserves the right to restrict access to the RedCarbon Services, in whole or in part, for the time necessary to carry out repairs, even without prior notice to the User. In any case, where possible, RedCarbon will provide the User with reasonable notice, communicated via the contact details provided by the User.

9.2 RedCarbon reserves the right to temporarily suspend, in whole or in part, the End-User's use of the RedCarbon Services when this is necessary for reasons related to routine maintenance or emergency maintenance. Such suspension shall not constitute a breach of this EULA and shall not be taken into account for the purposes of calculating the service uptime referred to in the Service Level Agreement.

9.3 Where the User has requested, or has been granted access to, Beta Services, the User accepts and acknowledges that such Beta Services are intended solely for the purposes of testing and evaluating functionality, with the express exclusion of use in production environments. Beta Services are provided without any warranty whatsoever and may be discontinued at any time at RedCarbon's sole discretion, without any liability of any kind except in cases of RedCarbon's wilful misconduct or gross negligence. RedCarbon may never make Beta Services available in a final version. RedCarbon accepts no liability for any type of damage or injury arising from or in connection with the use of a Beta Service.

10. Confidentiality

10.1 Each Party shall maintain complete confidentiality and secrecy of any news, information, data or documents of which it becomes aware, or in any case that the Party has collected or processed, during the execution of Services, which by law, nature or other circumstances, are to be considered as covered by confidentiality obligations.

10.2 Each Party undertakes during the term of the EULA and for a period of five (5) years after expiry or termination of the EULA however arising, to keep secret and confidential all Confidential Information pursuant to this EULA and to use such Confidential Information exclusively for the purposes of this EULA, and to disclose the Confidential Information only to third parties that strictly need to know them for the execution of this EULA, provided that before any such disclosure at least the same confidentiality obligations as set out in this paragraph shall be imposed on that third parties by way of a written agreement. With respect to any Confidential Information that constitutes a trade secret under applicable law, the obligations of confidentiality shall continue for as long as such information retains its status as a trade secret.

10.3 The confidentiality obligations shall not apply to Confidential Information or other information (i) which becomes public knowledge otherwise than through a breach of any obligation of confidentiality by a Party, or (ii) the Party is required to disclose pursuant to an obligation under statute or to a statutory or governmental body, but then only to the extent of such disclosure, provided that the disclosing Party has previously informed the other Party of such request or of the compliance with legal obligations with sufficient advance.

10.4 The Party receiving Confidential Information undertakes to keep with the utmost diligence, for itself and for its assignees, all Confidential Information, whether on computer or paper, in any way acquired or produced, for the entire duration of the EULA and to irreversibly destroy any Confidential Information within and no later than 90 (ninety) days from the termination of the EULA howsoever arising or, if previous, upon the request of the disclosing Party, providing written proof of the elimination. The Party receiving Confidential Information also ensures that any assignee and/or third parties who have come into possession of any Confidential Information through the Party receiving Confidential Information shall proceed in the same manner, also providing written proof of the elimination to the other party.

10.5 It is also forbidden, for each Party and its employees and/or consultants and/or any authorized suppliers, or for any third party who has a contractual or de facto relationship with the Party, to copy, duplicate, reproduce and/or remove any Confidential Information, both in electronic and paper format, with the sole exception of those that are objectively necessary to carry out the activities agreed between the Parties.

11. Data Protection

11.1 Each Party confirms the adoption of and compliance with the applicable data protection legislation, with particular reference to EU Regulation No. 2016/679 ("GDPR") and any applicable national implementing legislation, including the Legislative Decree No. 196/2003 ("Privacy Code").

11.2 The Data Processing Agreement ("DPA") set out in Annex B governs the processing of personal data by RedCarbon exclusively within the direct, bilateral service relationship between RedCarbon and the User under this EULA. The DPA applies only insofar as RedCarbon processes personal data directly on behalf of the User in the performance of the Services. For the avoidance of doubt: (a) RedCarbon shall not be liable for any processing of personal data carried out by the Reseller, including in connection with the distribution or resale of the Services, nor for any failure by the Reseller to comply with applicable data protection obligations; (b) the involvement of a Reseller in the commercial distribution of the Services does not affect or modify the direct and bilateral nature of the data processing relationship between RedCarbon and the User established under this Article 11 and Annex B.

11.3 As Data Controller, the User is responsible for: (a) ensuring that a valid legal basis exists under the GDPR for each processing operation carried out through the Services, including in respect of personal data contained in log files and security event data transmitted to RedCarbon; (b) providing RedCarbon with clear, documented instructions regarding the processing of personal data; (c) ensuring that data subjects whose personal data are transmitted through the use of the Services have been duly informed in accordance with Articles 13 and/or 14 of the GDPR, including in respect of processing carried out by RedCarbon as Data Processor. RedCarbon shall bear no liability for any breach of applicable data protection law resulting from processing carried out in accordance with the User's instructions.

11.4 At the same time, for the purposes of performing this EULA, RedCarbon may process personal data relating to the other User's employees, collaborators and contact persons for purposes connected with the management and performance of the contractual relationship and the fulfilment of the resulting legal obligations in accordance with the RedCarbon's privacy notice.

11.5 Without prejudice to any other provision of this EULA, the User undertakes to indemnify and hold RedCarbon harmless from any claims, liabilities, fines, administrative penalties, costs or expenses (including reasonable legal fees) arising from: (a) any failure by the User to comply with its obligations as Data Controller under this Article 11 or applicable data protection legislation; (b) processing instructions given by the User to RedCarbon that are unlawful, incomplete or otherwise infringe applicable data protection law; (c) any personal data breach or violation of applicable data protection law attributable to the User's actions or omissions, including the submission of personal data to the Services without an adequate legal basis or without having duly informed the relevant data subjects.

12. Publicity

12.1 User may state publicly that it is a user of RedCarbon Services, and RedCarbon may identify User as a user of RedCarbon Services, provided that any such statements shall conform with the trademark usage guidelines provided by one party to the other.

12.2 User must obtain the other party's advance consent to any press release relating to use of RedCarbon Services.

13. Audit

13.1 RedCarbon shall be entitled, at any time, to carry out — directly or through duly appointed third-party auditors bound by appropriate confidentiality obligations — audits and inspections of the User's systems, records, processes and documentation, to the extent strictly necessary and proportionate to verify the User's compliance with its obligations under this EULA, including, without limitation, the correct use of the Platform and the Services. The User shall provide RedCarbon and its appointed auditors with reasonable cooperation and access to the relevant information and systems, limited to what is strictly necessary and proportionate for the purposes of the audit, subject to applicable confidentiality obligations and data protection requirements, and, where strictly necessary, premises. In the event that an audit reveals any material non-compliance by the User, the User shall promptly remedy such non-compliance at its own cost and expense and shall reimburse RedCarbon for all reasonable costs incurred in connection with such audit. The exercise of audit rights under this paragraph shall not relieve the User of any of its obligations or liabilities under this EULA.

14. Limitation of Liability

14.1 To the maximum extent permitted by applicable mandatory law, RedCarbon shall not in any event be liable for indirect or consequential damages, loss of profit, loss of data, loss of business, loss of goodwill or reputational damage, regardless of the legal basis of the claim, suffered by the User or any third party in connection with, or arising out of, the use of or inability to use the RedCarbon Services and/or this EULA; should liability of RedCarbon be established, claim for compensation shall not exceed the fees paid by the Partner to RedCarbon in the twelve (12) calendar months preceding the event giving rise to the claim, in relation to the affected Order Form.

14.2 The User acknowledges and accepts that RedCarbon shall not be liable for, and shall have no obligation to indemnify or hold harmless the End-User or third party in respect of, any claim, damage, cost or expense arising from or in connection with:

(a) defects, malfunctions, errors or non-conformities of the Platform or the Services, except to the extent that such defects, malfunctions, errors or non-conformities are directly and exclusively attributable to RedCarbon's wilful misconduct or gross negligence;
(b) any infringement or alleged infringement of third-party intellectual property rights, except where such infringement is directly caused by the Platform or the Services as provided by RedCarbon in their unmodified form;
(c) any use of the Platform or the Services by the End-User in a manner not expressly authorised by this Agreement or the applicable documentation;
(d) possible damages caused by Integrations;
(e) any modification of and/or intervention on the RedCarbon Services carried out by the User or the Partner without RedCarbon's prior written authorisation;
(f) any malfunction of hardware or software used by the User other than those covered by this EULA and not directly managed and/or maintained by RedCarbon;
(g) any total or partial interruption of local access services, call termination services provided by telecommunications operators, and/or internet network failures;
(h) any failure, breach, or violation of applicable laws attributable to the User;
(i) any breach of this EULA by the User or its Authorised Users.

14.3 In addition, RedCarbon shall not be liable for any damages arising in any way from the fulfilment of the obligations undertaken, and in particular for damages resulting from the failure to activate or use the Platform, or from the unavailability or malfunctioning of the RedCarbon Services, or from delays in their provision, or from the destruction, loss, theft, damage or deterioration, whether total or partial, of data provided by the End-User or third parties, where such damage is attributable to:

a) defective or incorrect use of the Platform and the Services by the Partner or the End-User;
b) malfunction of the network infrastructure, electrical system or terminals used by the Partner or the End-User;
c) the Partner, End-User or Third Parties carrying out work on the RedCarbon Services not expressly authorised by RedCarbon;
d) total or partial interruption of access services or termination of the connection, if due to acts of third parties, the Partner or the End-User, and interruption or unavailability of connections between the Platform and RedCarbon's Services and the Partner or between the Platform and RedCarbon's Services and the End-User;
e) Force Majeure;
f) failure by the Partner or the End-User to comply with applicable laws and regulations, in particular regarding fire prevention, safety and accident prevention;
g) failure to install updates to their devices;
h) malfunction of the Partner's, the End-User's or a Third Party's software or hardware.

14.4 RedCarbon accepts no liability whatsoever for the transmission or receipt of illegal information of any nature or kind, the Parties mutually acknowledging that the internet is not controlled by RedCarbon and that, due to the specific structure of the said network, no public or private entity, not even RedCarbon itself, is able to fully guarantee and monitor the performance and functionality of the network's branches or to carry out adequate checks regarding the content of the information transmitted via its network.

14.5 Whilst the Parties mutually acknowledge that RedCarbon adopts state-of-the-art measures to protect the End-User and their data of which it may become aware, RedCarbon, like any operator, cannot guarantee that the solutions it adopts will succeed in detecting or preventing harmful or dangerous events caused by malicious conduct on the part of Third Parties (for example: viruses, malware, intrusion attempts, unsolicited messages, phishing attacks) and, should this occur, RedCarbon shall therefore not be liable to the End-User for any direct and/or indirect damages arising therefrom, including, without limitation, loss of data, business interruption, costs of remediation or any other loss or expense, except in cases of RedCarbon's willful misconduct or gross negligence.

14.6 RedCarbon has no obligation to monitor any documents or data that may be stored and shall therefore have no obligation to monitor or examine such documents or data, nor to actively investigate facts or circumstances indicating the presence of unlawful activities. Consequently, RedCarbon shall under no circumstances be held liable by the End-User or any third party in relation to the fact that they have acted in breach of applicable regulatory or contractual provisions.

14.7 Any claim by the User against RedCarbon for damages or any other remedy under or in connection with this EULA must be notified to RedCarbon in writing within ten (10) calendar days from the date on which the User became aware, or ought reasonably to have become aware, of the event or circumstance giving rise to such claim. Any such claim notification shall be accompanied by comprehensive supporting documentation, including, without limitation: (a) a detailed description of the alleged event giving rise to the claim; (b) the date and time of occurrence of the alleged event; (c) all available technical evidence, including system logs, error reports, screenshots and any other data reasonably necessary to substantiate the claim; (d) a detailed quantification of the damages claimed, together with all supporting evidence and calculations; (e) evidence of the causal link between the alleged breach or event and the damages claimed; and (f) evidence of the measures taken by the End-User to mitigate the loss or damage suffered. Failure to give notice within such period shall constitute an irrevocable waiver of the User's right to bring that specific claim. RedCarbon shall have no obligation to process or respond to any claim that is not accompanied by the documentation required under this paragraph. This provision does not affect any mandatory statutory limitation period applicable under Italian law.

15. Amendments to EULA

15.1 RedCarbon reserves the right, at any time, to amend, update, or otherwise modify the provisions of this EULA and/or any Annexes.

15.2 Where such changes materially adversely affect the RedCarbon Services from a technical standpoint, or result in increased costs for the User, or otherwise constitute amendments to this EULA and/or any Annexes, RedCarbon shall notify the User at least thirty (30) days in advance. Such changes shall become effective thirty (30) days after receipt of such notice. Within the same thirty (30) day period, if the User does not wish to accept the adverse changes referred to above, it may terminate the EULA by giving written notice to RedCarbon by registered mail with return receipt or certified email (PEC).

15.3 In such case, the User shall be entitled to a refund exclusively from the Partner of any fees paid in respect of Services and use of the Software not yet provided. RedCarbon shall have no obligation or liability to the User in this regard on any grounds whatsoever, including by way of damages.

15.4 Failing such termination within the above period, the changes shall be deemed to have been fully accepted by the User.

16. Termination for Breach

16.1 Either Party may terminate the Agreement in the event of a material breach by the other Party of its obligations under this EULA, provided that such breach remains uncured for thirty (30) days following receipt of written notice specifying the breach.

16.2 RedCarbon reserves the right to terminate this EULA with immediate effect, pursuant to Article 1456 of the Civil Code, by written notice to the User in the event that the User breaches any of the obligations set out in Articles 2.5 (Prohibited actions), 4.1 (User's commitments), 5.2 (Attempt to circumvent technical protection measures), 5.5 (Impossibility due to User's behavior), 6.7 (Intellectual Property), 8 (Volumes), 10 (Confidentiality), 11 (Data Protection), 12 (Publicity). In these cases, RedCarbon, in addition or alternatively to termination, reserves the right to seek any further remedy provided for by law.

17. Termination Rights

17.1 Except as expressly provided in this EULA, the User shall not be entitled to terminate this EULA prior to the expiry of the Subscription Period.

17.2 RedCarbon may terminate this EULA and the execution of the Software and the Services at any time, without prior notice, without obligation to provide reasons, and without incurring any costs, penalties, or liability in connection with the exercise of such right, by written notice to the User, where:

the provision of the RedCarbon Services is prevented by Force Majeure Events for more than ninety (90) consecutive days;
the User operates in breach of applicable laws or third-party rights or otherwise involves RedCarbon in legal proceedings of any nature.

18. Subcontracting

18.1 RedCarbon may subcontract part of the Services to third parties, who shall operate solely for the purpose of providing the services entrusted to them by RedCarbon.

18.2 A list of subcontractors shall be made available upon the User's request at any time. RedCarbon shall remain fully liable to the User for the performance of the Services.

19. Severability

19.1 If any provision of these General Terms and Conditions is held to be invalid or unenforceable, in whole or in part, such invalidity or unenforceability shall not affect the remaining provisions, which shall remain in full force and effect.

19.2 Any invalid or unenforceable provision shall be replaced by a valid provision that most closely reflects the original intent of the Parties.

20. Notices

20.1 All notices under this EULA shall be made in writing by registered mail with return receipt or certified mail (PEC) and shall be deemed duly given upon receipt.

20.2 Any notice to RedCarbon shall be sent to: redcarbonsrl@legalmail.it, or such other address as RedCarbon may notify to the User in writing from time to time.

20.3 Any notice to End-User shall be sent to the address indicated in the Order Form.

21. Governing Law and Jurisdiction

21.1 This EULA shall be governed by and construed in accordance with the substantive laws of Italy.

21.2 All disputes arising in connection with this EULA shall be adjudicated solely in the Court of Turin, Italy, which shall have exclusive jurisdiction.

22. Miscellaneous

22.1 If any part of this EULA is found void and unenforceable, it will not affect the validity of the balance of the EULA, which shall remain valid and enforceable according to its terms.

22.2 This is the entire agreement relating to RedCarbon Services and it supersedes any prior representations, discussions, undertakings, communications or advertising relating to RedCarbon Services.

22.3 This EULA will not be construed as creating an agency, partnership, joint venture or any other form of association, for tax purposes or otherwise, between the Parties; the Parties will at all times be and remain independent contractors.

22.4 This EULA does not confer any benefits to any third party unless it expressly states that it does.

The annexes attached to this EULA, in the version in force at any given time, form an integral and essential part thereof.

Specific Approval of Clauses

The User declares that it has carefully read all the clauses of this EULA and, having specifically examined and understood each of the following clauses, hereby expressly approves them pursuant to Articles 1341 and 1342 of the Italian Civil Code:

Article 2 (License and Scope of Use — restrictions on use, prohibitions and consequences of violation, including immediate termination); Article 3 (RedCarbon Obligations and Warranties — exclusion and limitation of warranties, including exclusion of implied warranties and of fitness for purpose); Article 4.2 and 4.3 (User Obligations — Indemnification); Article 5 (License Term and Termination — termination with immediate effect by RedCarbon); Article 6.4 (Intellectual Property); Article 9 (Limitation of Use of the Software — right of RedCarbon to restrict or suspend access to the RedCarbon Services without prior notice); Article 14 (Limitation of Liability); Article 15 (Amendments to EULA); Article 16 (Termination for Breach); Article 17 (Termination Rights); Article 21 (Governing Law and Jurisdiction).

Annex B – Data Processing Agreement

Section I

Clause 1 – Purpose and scope

(a) The purpose of this Data Processing Agreement ("DPA" or the "Clauses") is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 (hereinafter defined as "GDPR") of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

(b) The User, as data controller (or "controller") and RedCarbon, as data processor (or "processor"), have agreed to this DPA in order to ensure compliance with Article 28(3) and (4) of GDPR.

(d) Annexes I to IV are an integral part of this DPA.

(e) This DPA is without prejudice to obligations to which the controller is subject by virtue of GDPR.

(f) This DPA does not by itself ensure compliance with obligations related to international transfers in accordance with Chapter V of GDPR.

(g) This DPA applies exclusively to the direct, bilateral data processing relationship between the controller and RedCarbon as processor under the EULA.

Clause 2 – Individual Negotiation

(a) The Parties acknowledge that this DPA has been the subject of specific individual negotiations between them, with each Party having the right to discuss, amend and supplement its content. Consequently, the Parties agree that Articles 1341 and 1342 of the Civil Code do not apply to this DPA, as its clauses do not constitute general terms and conditions of contract drawn up unilaterally.

Clause 3 – Interpretation

(a) Where the DPA uses the terms defined in GDPR, those terms shall have the same meaning as in that Regulation.

(b) This DPA shall be read and interpreted in the light of the provisions of GDPR.

(c) This DPA shall not be interpreted in a way that runs counter to the rights and obligations provided for in GDPR or in a way that prejudices the fundamental rights or freedoms of the data subjects.

Clause 4 – Hierarchy

In the event of a contradiction between this DPA and the provisions of the EULA, this DPA shall prevail with respect to data protection obligations.

Clause 5 – Docking clause

(a) Any entity that is not a Party to these Clauses may, with the agreement of all the Parties, accede to these Clauses at any time as a controller or a processor by completing the Annexes and signing Annex I.

(b) Once the Annexes under (a) are completed and signed, the acceding entity shall be treated as a Party to these Clauses and have the rights and obligations of a controller or a processor, in accordance with its designation in Annex I.

(c) The acceding entity shall have no rights or obligations resulting from these Clauses from the period prior to becoming a Party.

(d) Notwithstanding sub-clauses (a) to (c) above, the Reseller (as defined in the EULA) may not accede to these Clauses in its capacity as an intermediary involved in the distribution or resale of the Services. Any accession by the Reseller requires the prior express written consent of RedCarbon.

Section II – Obligations of the Parties

Clause 6 – Description of processing

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

Clause 7 – Obligations of the Parties

7.1. Instructions

(a) The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of personal data. These instructions shall always be documented.

(b) The processor shall immediately inform the controller if, in the processor's opinion, instructions given by the controller infringe GDPR or the applicable Union or Member State data protection provisions.

(c) Where the processor notifies the controller pursuant to paragraph (b) above and the controller fails to provide adequate written clarification or does not withdraw or modify the disputed instruction within ten (10) business days of such notification, RedCarbon shall be entitled to suspend performance of the contested instruction without such suspension constituting a breach of these Clauses or the EULA, and without prejudice to the processor's right to terminate in accordance with Clause 10(c).

7.2. Purpose limitation

The processor shall process the personal data only for the specific purposes of the processing, as set out in Annex II, unless it receives further instructions from the controller.

7.3. Duration of the processing of personal data

Processing by the processor shall only take place for the duration specified in Annex II.

7.4. Security of processing

(a) The processor shall at least implement the technical and organisational measures specified in Annex III to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (personal data breach). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects.

(b) The measures may evolve during the term of this EULA in line with technological developments, architectures, providers, risks, applicable legislation and the scope of the Services, provided that the overall level of protection is not substantially reduced. Should the planned changes entail a significant alteration to the security measures adopted – meaning those that affect the areas described in Annex III or that could reduce the level of protection afforded to data subjects – the processor shall give prior written notice to the controller. The latter shall be entitled to raise a reasoned objection within 10 (ten) working days of receiving the notification. In the absence of an objection within that period, the changes shall be deemed to have been accepted. In the event of urgent measures necessitated by security reasons, critical vulnerabilities or new regulatory obligations, the processor may proceed immediately, notifying the controller at the same time or without undue delay.

(c) The processor shall grant access to the personal data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of the contract. The processor shall ensure that persons authorised to process the personal data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(d) RedCarbon, in accordance with Article 82(3) of GDPR shall not be liable for personal data breaches or security incidents that arise from or are directly attributable to: (i) the controller's failure to provide accurate, timely or sufficient configuration instructions; (ii) the introduction into the Services of malicious content, misconfigured log sources, unsanitised data or malware by or on behalf of the controller; (iii) vulnerabilities or failures in systems, networks or software not managed or operated by RedCarbon; or (iv) the controller's failure to implement adequate security measures within its own infrastructure that are necessary to protect the integrity of the data submitted to the Services.

7.5. Processing of special categories of personal data (Sensitive data)

The controller warrants that it shall not submit, upload or otherwise transmit data belonging to special categories of personal data within the meaning of Article 9 of the GDPR to the Services without prior written agreement with RedCarbon specifying the applicable additional technical and organisational safeguards to be implemented. RedCarbon shall bear no liability for the processing of such "sensitive" data submitted to the Services without such prior written agreement, and the controller shall indemnify and hold RedCarbon harmless from any claims, fines or damages arising therefrom.

7.6. Documentation and compliance

(a) The Parties shall be able to demonstrate compliance with these Clauses.

(b) The processor shall deal promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses.

(c) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from GDPR. At the controller's request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.

(d) The controller may choose to conduct the audit by itself or mandate an independent auditor, subject to the following conditions: (i) audits shall be requested by written notice at least thirty (30) calendar days in advance; (ii) audits shall be conducted during normal business hours in a manner that does not unreasonably interfere with RedCarbon's operations or services provided to other clients; (iii) independent auditors shall execute a confidentiality agreement with RedCarbon prior to commencing any audit; (iv) the scope of audits shall not extend to RedCarbon's source code, proprietary algorithms or models, cryptographic keys, trade secrets, or data of other clients; (v) the costs of any audit beyond one (1) per calendar year, or of any audit not triggered by a confirmed breach of these Clauses, shall be borne by the controller.

(e) The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authorities on request.

7.7. Use of sub-processors

(a) The processor has the controller's general authorisation for the engagement of sub-processors from an agreed list. The processor shall specifically inform the controller of any intended changes of that list through the addition or replacement of sub-processors at least thirty (30) days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The processor shall provide the controller with the information necessary to enable the controller to exercise the right to object.

(b) Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the data processor in accordance with these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to GDPR.

(c) At the controller's request, the processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secret or other confidential information, including personal data, the processor may redact the text of the agreement prior to sharing the copy.

(d) The processor shall remain fully responsible to the controller for the performance of the sub-processor's obligations in accordance with its contract with the processor. The processor shall notify the controller of any failure by the sub-processor to fulfil its contractual obligations.

(e) The processor shall agree a third party beneficiary clause with the sub-processor whereby - in the event the processor has factually disappeared, ceased to exist in law or has become insolvent - the controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

(f) The controller's right to object pursuant to sub-clause (a) must be exercised in writing within the specified notice period and must be based on specific, documented, and objectively justified data protection grounds. Where a valid objection cannot be resolved and no technically or economically reasonable alternative is available to deliver the affected component of the Services, RedCarbon shall be entitled to suspend or discontinue that component without such action constituting a breach of these Clauses or the EULA.

7.8. International transfers

(a) Any transfer of data to a third country or an international organisation by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject and shall take place in compliance with Chapter V of Regulation (EU) 2016/679. The controller acknowledges that certain technical components of the Services, including infrastructure or sub-processor services, may involve processing or access from outside the European Economic Area; in such cases, RedCarbon shall implement appropriate transfer safeguards in accordance with Chapter V GDPR, including where applicable Standard Contractual Clauses adopted pursuant to Article 46(2) GDPR, adequacy decisions, or other recognised transfer mechanisms.

(b) The controller agrees that where the processor engages a sub-processor in accordance with Clause 7.7. for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of GDPR, the processor and the sub-processor can ensure compliance with Chapter V of GDPR by using standard contractual clauses adopted by the Commission in accordance with Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.

Clause 8 – Assistance to the controller

(a) The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller.

(b) The processor shall assist the controller in fulfilling its obligations to respond to data subjects' requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor shall comply with the controller's instructions.

(c) In addition to the processor's obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:

the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a 'data protection impact assessment') where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;
the obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk;
the obligations in Article 32 of GDPR.

(d) The Parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required.

(e) Assistance activities under Clauses 8(b) to 8(d) that require extraordinary manual effort, forensic analysis, specialist development work, or dedicated resources outside the ordinary scope of the Services shall be subject to prior written agreement between the Parties and may be invoiced by RedCarbon at its applicable professional services rates.

Clause 9 – Notification of personal data breach

In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 of Regulation (EU) 2016/679, where applicable, taking into account the nature of processing and the information available to the processor.

9.1. Data breach concerning data processed by the controller

In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:

(a) in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, where relevant;

(b) in obtaining the following information which, pursuant to Article 33(3) of GDPR, shall be stated in the controller's notification, and must at least include:

the nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
the likely consequences of the personal data breach;
the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(c) in complying, pursuant to Article 34 of GDPR, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

9.2. Data breach concerning data processed by the processor

In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay and, where reasonably practicable, within forty-eight (48) hours of the processor's internal classification of the event as a relevant personal data breach affecting data processed on behalf of the controller. Such notification shall contain, at least:

(a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);

(b) the details of a contact point where more information concerning the personal data breach can be obtained;

(c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.

The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller's obligations under Articles 33 and 34 of Regulation (EU) 2016/679.

Section III – Final Provisions

Clause 10 – Non-compliance with the Clauses and termination

(a) Without prejudice to any provisions of GDPR, in the event that the processor is in breach of its substantive obligations under these Clauses, the controller shall first provide RedCarbon with written notice specifying the alleged breach in reasonable detail and allow a remediation period of thirty (30) calendar days from receipt of such notice. Only if the breach remains uncured following such period may the controller instruct the processor to suspend the processing of personal data until compliance is restored or the contract is terminated. The right of suspension shall not apply to minor, technical or incidental non-conformities that do not result in material harm to data subjects. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.

(b) The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if:

the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;
the processor is in substantial or persistent breach of these Clauses or its obligations under GDPR;
the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to GDPR.

(c) The processor shall be entitled to terminate the contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1(b), the controller insists on compliance with the instructions.

(d) Following termination of the contract, the processor shall, at the written request of the controller and at the controller's choice, delete all personal data processed on behalf of the controller and provide written confirmation to the controller that it has done so, or return all personal data to the controller and delete existing copies, unless Union or Member State law requires storage of the personal data. Deletion or return shall be completed within thirty (30) days of the controller's written request, subject to technical feasibility. Backup copies subject to ordinary rotation and disaster recovery cycles may be retained for the technically necessary period, during which they shall remain subject to these Clauses. Operations involving large data volumes, complex datasets, or bespoke formats may require additional time and professional services to be agreed in writing between the Parties. Until all personal data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

The Parties acknowledge that this Data Processing Agreement ("DPA") has been the subject of specific individual negotiations between them, with each Party having the right to discuss, amend and supplement its content. Consequently, the Parties agree that Articles 1341 and 1342 of the Civil Code do not apply to this DPA, as its clauses do not constitute general terms and conditions of contract drawn up unilaterally.

Annex I – List of parties

Controller:

Name: see the Purchase Order
Address: see the Purchase Order
Contact details: see the Purchase Order

Processor:

Name: RedCarbon S.r.l.
Address: Torino (TO), Corso Lecce 51 – 10145 – Italy
Contact details: privacy@redcarbon.ai

Annex II – Description of the processing

Categories of data subjects whose personal data is processed

(a) Authorized Users of the RedCarbon platform: employees and collaborators of the User who are granted access to the platform by the User. (b) Individuals whose personal data appear incidentally in security data streams: employees, contractors, customers and other individuals of the User or of third parties whose personal data may be contained in log files and security events (SIEM, XDR, EDR, network logs and related telemetry) transmitted by the User to RedCarbon.

Categories of personal data processed

(a) Platform user data: name, surname, business email address; professional role and assigned permissions; user ID, access logs, activity history and audit trail; technical identifiers (IP address, agent ID, user agent, session data). (b) Data contained in security streams (SIEM, XDR, EDR, logs and events): user and operator identifiers (username, email address, employee ID, application ID); IP addresses, hostnames, MAC addresses; authentication events, access events and application usage events; anomalous behaviours detected by security systems; textual content contained in log files, which may incidentally include personal data not deliberately submitted by the User.

Sensitive data processed (if applicable) and applied restrictions or safeguards

Sensitive data processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

RedCarbon does not intentionally collect or process special categories of personal data within the meaning of Article 9 GDPR. The User, acting as Data Controller, is solely responsible for ensuring that such data do not appear in log files and security events submitted to the Services without prior written agreement with RedCarbon on additional safeguards.

Nature of the processing

Collection, recording, organization, structuring, storage, retrieval, consultation, use, disclosure by transmission.

Purpose(s) for which the personal data is processed on behalf of the controller

Management of IT security services.

Duration of the processing

Corresponds to the duration of the EULA.

For processing by (sub-) processors, also specify subject matter, nature and duration of the processing

The full and up-to-date list of sub-processors, including their names, addresses, contact details and descriptions of processing activities, is set out in the Technical Services Annex to the EULA. Sub-processors engaged by RedCarbon process personal data exclusively to assist RedCarbon in the provision of the Services under this EULA, for the duration of their respective agreements with RedCarbon, and subject to data protection obligations equivalent to those set out in this DPA.

Annex III – Technical and organisational measures including technical and organisational measures to ensure the security of the data

RedCarbon S.r.l., in its capacity as Data Processor, implements the following technical and organisational security measures to ensure an appropriate level of security for the processing of personal data under this DPA, having regard to the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of natural persons:

Encryption: end-to-end encryption of personal data both in transit and at rest; prohibition on unencrypted transmission or storage of personal data.
Confidentiality, integrity and availability: zero-trust access architecture; immutable and tamper-evident audit logs; continuous system monitoring to ensure ongoing confidentiality, integrity, availability and resilience of processing systems.
Availability and recovery: encrypted backup systems; regularly tested disaster recovery and business continuity procedures enabling timely restoration of availability and access to personal data following a physical or technical incident.
Testing and assessment: periodic vulnerability assessments, penetration tests and security audits to evaluate the effectiveness of technical and organisational measures; continuous improvement of detection accuracy and reduction of false positives in security monitoring.
User identification and authorisation: multi-factor authentication (MFA); role-based access control (RBAC); Identity and Access Management (IAM) platform; timely provisioning and revocation of access rights; principle of least privilege applied to all personnel with access to personal data.
Data transmission protection: all data transmitted between the User and RedCarbon systems is protected using HTTPS; encrypted communications; prohibition of unencrypted data channels.
Data storage protection: encryption at rest using industry-standard algorithms; tenant segregation to prevent cross-customer data access; secure credential management through IAM; protection of stored authentication data.
Physical access controls: enforced at the data centre level by the infrastructure provider.
Event logging: comprehensive security event logging; immutable audit trails recording all access to and operations on personal data; intrusion detection systems (IDS/IPS) monitoring platform activity; log integrity verification.
System configuration: security-hardened system and network configurations; zero-trust network segmentation; continuous vulnerability monitoring and patch management; prohibition of unauthorised configuration changes.
Internal IT governance and personnel measures: documented internal information security policies; mandatory confidentiality agreements binding all personnel with access to personal data; regular security awareness training; formal incident response procedures.
Certification and assurance: ongoing review of compliance against applicable security standards; RedCarbon makes available, upon written request, audit reports, certifications or equivalent evidence demonstrating compliance with the security measures set out in this Annex.
Data minimisation: platform designed in accordance with the principle of data minimisation (privacy by design); processing limited to personal data strictly necessary for the provision of the Services as described in Annex II.
Incident response and change management: documented security incident response procedure aligned with the SLA in Annex A; formal change management process for production systems; User notified without undue delay in the event of a personal data breach affecting data processed under this DPA, in accordance with Clause 9 of this DPA.
Data retention: platform user data retained for the duration of the EULA and deleted within thirty (30) days of EULA termination.
Accountability: records of processing activities maintained in accordance with Article 30 GDPR; designated privacy contact: privacy@redcarbon.ai; RedCarbon cooperates with the competent supervisory authority on request in relation to processing activities covered by this DPA.
Data portability and erasure: upon the controller's written request, and in any event upon contract termination, all personal data processed on behalf of the controller shall be deleted or, at the controller's choice, returned within thirty (30) days, with written certification of deletion or return provided to the controller.
Sub-processor controls and international transfers: all sub-processors are contractually bound to data protection obligations equivalent to those set out in this DPA; where sub-processors are located or process data outside the European Economic Area, appropriate safeguards are implemented, including Standard Contractual Clauses adopted pursuant to Article 46(2) GDPR or other recognised transfer mechanisms, as applicable.
Assistance to the controller: upon written request from the controller, RedCarbon shall provide such information, documentation and cooperation as may be reasonably required to assist the controller in complying with its obligations under Articles 32 to 36 GDPR, including in respect of data protection impact assessments and prior consultation with the supervisory authority.

Annex IV – List of sub-processors

The list of sub-processors is made available upon the User's request at privacy@redcarbon.ai.

RedCarbon S.r.l.

Office: Torino (TO), OGR - Corso Castelfidardo, 22 - 10128 - Italy

Tax Code and VAT Number: 13235700013

REA Number: TO-1348837

Registered share Capital: €322.447,06