Mutual Non-Disclosure Agreement

Mutual Non-Disclosure Agreement

IndustryUX Platform — Annex: mutual confidentiality (NDA)

This Mutual Non-Disclosure Agreement (the "Agreement" or the "NDA") is entered into between DEVIBRAIN S.R.L., the Provider (DevIBrain), and the Counterparty identified in the Identification Record, each of which may disclose and receive confidential information in connection with the evaluation, demonstration, scoping, quotation and possible supply of the IndustryUX platform and of the related services. The Parties wish to define, on reciprocal and balanced terms, how such information is protected before and outside any supply agreement. IndustryUX is a registered trademark of DEVIBRAIN S.r.l.

Art. 1 — Parties, identification and scope of application

1.1 The Provider

DEVIBRAIN S.R.L., a company incorporated under the laws of Italy, with registered office at Via Coghetti 6, 24128 Bergamo (BG), Italy, VAT and tax identification number IT04507220160, certified electronic mail address devibrain@pec.it (the "Provider"), owner of the IndustryUX platform and of the registered trademark INDUSTRYUX.

1.2 The Counterparty and the Identification Record

The other party to this Agreement (the "Counterparty") is the undertaking, professional or public body whose identification data are set out in the Identification Record. The "Identification Record" is the set of data comprising legal name, legal form, registered office, VAT or tax identification number, entry in the register of companies where applicable, certified electronic mail address where available, electronic mail address for notices, and the name and role of the authorised signatory. Where this Agreement is generated by the IndustryUX platform, those data are pre-filled from the account record and may be verified and corrected by the Counterparty before execution. The Identification Record is stored together with the executed copy of this Agreement and forms an integral and substantial part of it.

1.3 Business-to-business scope

This Agreement is entered into exclusively between parties acting in the course of their trade, business, craft or profession. It is not offered to, and is not to be executed by, consumers. Confidentiality in the self-service shop channel, where consumers may contract, is governed by the confidentiality provisions of the shop terms and not by this Agreement. Where a natural person executes this Agreement, that person acts as a professional or as the authorised representative of the Counterparty.

1.4 Parties defined

The Provider and the Counterparty are referred to individually as a "Party" and jointly as the "Parties".

Art. 2 — Purpose and permitted use

2.1 The Purpose

The Parties will exchange Confidential Information solely for the following purposes (jointly, the "Purpose"):

• evaluation of the IndustryUX platform and of its applications, including product demonstrations and the Guided Trial;

• technical and functional scoping of a possible supply, including the assessment of machines, assets, plants, interfaces and integration requirements;

• preparation of quotations and commercial proposals, including the quotation of the AI Training service on the basis of the documents supplied by the Counterparty;

• proof-of-concept activities and pilot projects agreed in writing between the Parties;

• negotiation of a possible supply agreement and of its annexes;

• any pre-contractual activity strictly instrumental to the above.

2.2 The Guided Trial

The "Guided Trial" means the pre-contractual guided evaluation made available by the Provider, whose content and duration are those set out in Article 3.5 of the Master Terms (IUX-EN-01), to which this Agreement refers without altering them. All information exchanged, displayed or generated during the Guided Trial, in either direction, is Confidential Information and is covered by this Agreement.

2.3 Limitation of use

Each Party will use the Confidential Information of the other Party solely for the Purpose, and for no other purpose, whether its own or that of any third party. No Party is required to disclose any particular information, and any disclosure is made voluntarily.

2.4 Prior disclosures

This Agreement also covers Confidential Information disclosed in contemplation of the Purpose during the six months preceding the Effective Date, which is deemed to have been disclosed under this Agreement.

Art. 3 — Definitions

3.1 Defined terms

In this Agreement:

• "Affiliate" means any entity that controls, is controlled by, or is under common control with a Party, control meaning the direct or indirect holding of more than fifty per cent of the voting rights or the power to direct the management of that entity.

• "Confidential Information" has the meaning given in Article 5.

• "Customer Materials" means the documents, files, models, data and other materials of any nature supplied, uploaded or otherwise made accessible by the Counterparty, including AI Training Documents. "Customer Materials" is used in this Agreement as an express synonym of "Customer Data" as defined in the Master Terms (IUX-EN-01): the two expressions designate the same content of the Counterparty and are interchangeable throughout the contractual package.

• "AI Training Documents" means the documents supplied or uploaded by the Counterparty so that the Provider may quote and, where instructed, perform the AI Training service and produce the local AI chatbot associated with the Counterparty's designated asset.

• "Disclosing Party" means the Party disclosing Confidential Information, including through its Affiliates and Permitted Recipients.

• "Receiving Party" means the Party receiving or accessing Confidential Information, including through its Affiliates and Permitted Recipients.

• "Effective Date" has the meaning given in Article 21.

• "Master Terms" means the IndustryUX Master Subscription and Licence Terms (document IUX-EN-01) and the schedules and annexes applicable to the relevant channel.

• "Permitted Recipient" has the meaning given in Article 8.

• "Platform" means the IndustryUX platform and its applications, in any deployment mode, together with the related documentation, interfaces, tools and services.

• "Trade Secret" means information qualifying as a trade secret under Directive (EU) 2016/943, as implemented in Italy by Legislative Decree 63/2018 and by Articles 98 and 99 of the Italian Industrial Property Code, or under any equivalent law applicable to the Disclosing Party.

3.2 Interpretation

Headings are for convenience only. References to a statute, regulation or directive include its amendments and implementing measures in force from time to time. The words "including" and "in particular" are not limiting.

Art. 4 — Mutual application and parity of protection

4.1 Reciprocity

This Agreement applies symmetrically. Each Party may act as Disclosing Party and as Receiving Party, and every obligation, restriction and remedy set out in this Agreement applies to each Party in the same terms and to the same extent when it acts in that capacity.

4.2 Equal standard of protection

The Confidential Information of the Counterparty, and in particular the Customer Materials, the AI Training Documents and any industrial, process, machine, plant or production information, is protected to the same standard, for the same duration and with the same remedies as the Confidential Information of the Provider. No provision of this Agreement confers on the Confidential Information of one Party a degree of protection, a priority or a prevalence over the Confidential Information of the other Party, and any doubt as to interpretation is resolved in favour of equal treatment of the Parties.

4.3 Reservation of intellectual property is not a limitation

The reservation of the Provider's intellectual property rights under Article 10, and any other provision protecting the Platform, is a reservation of ownership and of licence rights only. It does not reduce, qualify or subordinate the Provider's own confidentiality obligations towards the Counterparty's Confidential Information, which stand on the same footing as those of the Counterparty.

4.4 Supersession of asymmetric wording

Any earlier confidentiality wording exchanged between the Parties in relation to the Purpose that made the protection of one Party's information subordinate to that of the other Party is superseded by this Article and has no effect between the Parties.

Art. 5 — Confidential Information

5.1 General definition

"Confidential Information" means any information of any nature, in any form, whether oral, written, electronic, visual or embodied in samples, prototypes, environments or demonstrations, disclosed by or on behalf of a Disclosing Party, or to which a Receiving Party gains access, in connection with the Purpose, which is designated as confidential or whose confidential nature is reasonably apparent from its content, its context or the circumstances of its disclosure.

5.2 Confidential Information of the Provider

Without limitation, the Confidential Information of the Provider includes: the software of the Platform, its source and object code, architecture, data models, algorithms, operating logic and methods; know-how, technical documentation, interfaces, application programming interfaces, design and user experience; security measures, licensing and entitlement mechanisms, cryptographic material and telemetry design; product roadmaps and release plans; commercial, financial, pricing, discount, margin and customer information; quotations, proposals and price lists not publicly published; and any information relating to the registered trademark INDUSTRYUX and to the Provider's intellectual property.

5.3 Confidential Information of the Counterparty

Without limitation, the Confidential Information of the Counterparty includes: technical drawings, computer-aided design and neutral exchange files, three-dimensional models, piping and instrumentation diagrams, electrical schematics, plant and line layouts; tag lists, control logic, recipes, alarm lists, set-points and process parameters; machine, production, quality, maintenance and energy data; operating procedures, manuals and internal instructions; the AI Training Documents and any material uploaded to the Platform for evaluation, quotation or training purposes; supplier, customer, pricing, cost and commercial information; organisational, personnel and security information; and the results of the Guided Trial and of any proof of concept.

5.4 Information not marked

Information is Confidential Information even if not marked, labelled or otherwise designated as confidential, provided its confidential nature is reasonably apparent under Article 5.1. Neither Party is required to confirm in writing the confidential nature of information disclosed orally or visually, and the absence of such confirmation does not deprive that information of protection.

5.5 Aggregate and derived information

Information derived from, or analyses, summaries, notes and models based on, Confidential Information are themselves Confidential Information of the Disclosing Party. Statistical or aggregated information generated by a Party from Confidential Information of the other Party is Confidential Information of the other Party unless it is irreversibly aggregated and anonymised so that neither the other Party, nor its plants, machines, products, customers or personnel can be identified, directly or indirectly, and provided its use is otherwise permitted by the agreement in force between the Parties.

Art. 6 — Exclusions and compelled disclosure

6.1 Exclusions

The obligations of this Agreement do not apply to information which the Receiving Party demonstrates:

1. is or becomes publicly available without any breach of this Agreement or of any other duty of confidentiality;

2. was lawfully in its possession, without any duty of confidentiality, before the disclosure by the Disclosing Party;

3. was lawfully obtained from a third party entitled to disclose it and not bound by any duty of confidentiality;

4. was independently developed by it without any use of, or reference to, the Confidential Information of the Disclosing Party.

6.2 Burden of proof

The Receiving Party bears the burden of proving that an exclusion applies, and must do so by contemporaneous written or electronic records. A partial exclusion does not exclude the combination of features or of information which as a whole, or in its precise configuration, is not publicly available or lawfully in the Receiving Party's possession.

6.3 Compelled disclosure

Disclosure required by mandatory law, by a binding order of a court or of a public authority, or by the rules of a regulated market is not a breach of this Agreement, provided that the Receiving Party, to the extent legally permitted: notifies the Disclosing Party in advance and without delay, so that the Disclosing Party may seek protective measures; discloses only the minimum necessary to comply; requests confidential treatment of the disclosed information; and informs the Disclosing Party of the disclosure actually made. Information so disclosed remains Confidential Information for all other purposes.

6.4 Reporting to authorities

Nothing in this Agreement prevents or discourages a Party or any individual from reporting suspected unlawful conduct to a competent authority, including reports protected by Legislative Decree 24/2023 implementing Directive (EU) 2019/1937, or from cooperating with an investigation.

Art. 7 — Obligations of the Receiving Party

7.1 Core obligations

The Receiving Party will:

1. keep the Confidential Information strictly confidential and not disclose it to any third party without the prior written consent of the Disclosing Party, except to Permitted Recipients under Article 8;

2. use the Confidential Information solely for the Purpose;

3. protect the Confidential Information with technical and organisational measures no less protective than those it applies to its own confidential information of equivalent importance, and in any event with measures that are appropriate to the risk;

4. limit access to those individuals who need to know the information for the Purpose;

5. keep the Confidential Information logically and, where reasonable, physically separated from its own materials, and clearly identifiable as belonging to the Disclosing Party;

6. make only the copies strictly necessary for the Purpose, reproducing all proprietary and confidentiality notices;

7. immediately cease any use and access upon the expiry of the retention rights under Article 15.

7.2 No use with third-party artificial intelligence services

The Receiving Party will not input, upload or otherwise make the Confidential Information of the other Party available to any third-party artificial intelligence service, model or tool whose terms permit the provider to use inputs to train, fine-tune, evaluate or improve models made available to other users, or to retain inputs beyond what is necessary to return the output. Use of such services is permitted only where the applicable terms exclude any such use and retention, and where the Receiving Party remains fully liable for the service under Article 8.

7.3 No residual-use licence

Neither Party acquires any right to use the Confidential Information of the other Party on the ground that it is retained in the unaided memory of its personnel. The Parties expressly exclude any so-called residuals clause, in either direction.

7.4 Responsibility of the Receiving Party

The Receiving Party is liable for any breach of this Agreement by its Affiliates and by its Permitted Recipients as if it were its own breach.

Art. 8 — Permitted Recipients

8.1 Categories

"Permitted Recipients" are, in respect of each Party: its employees, directors, officers and contractors engaged on the Purpose; its Affiliates and their personnel; its professional advisers bound by a statutory duty of professional secrecy; and its subcontractors and service providers engaged for the Purpose.

8.2 Conditions

Disclosure to a Permitted Recipient is permitted only where the recipient needs to know the information for the Purpose and is bound by written obligations of confidentiality and of limited use at least as protective as those of this Agreement, or by an equivalent statutory duty of professional secrecy. On the reasoned written request of the Disclosing Party, the Receiving Party will provide the list of the categories of Permitted Recipients to which the Confidential Information has been disclosed and confirm that the conditions of this Article have been met.

8.3 Sub-processing of hosted content

Where Confidential Information is hosted or processed on the Platform, the Provider will engage subcontractors only in accordance with the data processing agreement in force between the Parties or, before that agreement is in force, only for infrastructure and support services necessary for the Purpose and under written obligations complying with Article 8.2.

Art. 9 — Restrictions on analysis, reverse engineering and demonstrations

9.1 No reverse engineering

The Receiving Party will not copy, reproduce, disassemble, decompile, decrypt, translate or otherwise reverse engineer the Confidential Information or, in the case of the Provider's Confidential Information, the Platform, nor attempt to derive its source code, architecture or internal logic, nor circumvent or test its technical protection, licensing or security measures.

9.2 Mandatory interoperability

Article 9.1 does not restrict acts which cannot lawfully be prohibited, and in particular the acts permitted by Article 6 of Directive 2009/24/EC and, in Italy, by Article 64-quater of Law 633/1941, provided that the Counterparty first requests in writing the interoperability information from the Provider and the Provider fails to supply it within thirty days on reasonable terms.

9.3 No development based on Confidential Information

The Receiving Party will not use the Confidential Information of the other Party to design, develop, have developed, market or supply any product, service or functionality that is competing with, or substitutable for, the Platform or the Counterparty's own products, as applicable. This Article restricts the use of Confidential Information only. It is not a non-competition covenant: each Party remains free to develop, acquire and market any product or service that is developed independently and without any use of, or reference to, the Confidential Information of the other Party.

9.4 Demonstrations, trials and benchmarking

Neither Party will record, film, photograph, screen-capture, stream, transmit or publish any demonstration, Guided Trial session, environment or interface of the other Party, in whole or in part, without prior written consent. Neither Party will publish or disclose to third parties the results of any benchmarking, performance test or technical evaluation of the other Party's products, technology or environment carried out in connection with the Purpose.

9.5 Notices

The Receiving Party will not remove, alter or obscure any proprietary, trademark, copyright or confidentiality notice appearing on or in the Confidential Information.

Art. 10 — No licence, intellectual property and feedback

10.1 Ownership retained

All Confidential Information, and all intellectual and industrial property rights in it, remain the exclusive property of the Disclosing Party. Disclosure under this Agreement transfers no title.

10.2 No implied licence

This Agreement grants the Receiving Party no right, licence, option, sublicence or authorisation, whether express or implied, by estoppel or otherwise, in respect of the Confidential Information, the Platform, any software, any patent, copyright, database right, design, know-how or trade secret, or the trademark INDUSTRYUX or any other distinctive sign of the Disclosing Party, save the strictly limited right to use the Confidential Information for the Purpose for the term of this Agreement. No licence to use the Platform arises from this Agreement; any such licence arises only under the Master Terms and the applicable order.

10.3 Reciprocity of Article 10.1 and 10.2

Articles 10.1 and 10.2 apply in the same terms to the intellectual and industrial property rights of the Counterparty in the Customer Materials, in the AI Training Documents and in any industrial know-how disclosed to the Provider, which remain the exclusive property of the Counterparty and are not licensed to the Provider beyond what is strictly necessary for the Purpose and, thereafter, for the performance of any agreement subsequently entered into.

10.4 Feedback

Where the Counterparty voluntarily provides suggestions, comments, feature requests or evaluations regarding the Platform ("Feedback"), the Provider may use and implement the Feedback without restriction, obligation of confidentiality towards the Counterparty in respect of the Feedback itself, attribution or payment. This Article applies only to Feedback that concerns the Platform and does not extend to, and does not permit the use or disclosure of, any Customer Material, any industrial, process or machine information, any personal data or any other Confidential Information of the Counterparty, which remain fully protected by this Agreement even where they form the context in which the Feedback was given.

Art. 11 — Customer Materials, AI Training Documents and hosted content

11.1 Ownership and control

The Customer Materials and the AI Training Documents are and remain the property of the Counterparty or of its licensors. The Provider acquires no right in them other than the right to use them strictly for the Purpose and in accordance with the Counterparty's written instructions.

11.2 Permitted use

The Provider may use the AI Training Documents solely to prepare the quotation of the AI Training service and, where the Counterparty so instructs, to perform the AI Training and to produce and operate the local AI chatbot associated with the Counterparty's own designated asset or instance.

11.3 No cross-customer reuse

The Provider will not use the Customer Materials, the AI Training Documents or any Confidential Information of the Counterparty to train, fine-tune, evaluate, benchmark or improve any model, index, knowledge base or service made available to other customers or to third parties, and will not reuse them for any customer other than the Counterparty. Any exception requires the separate, express and specific written consent of the Counterparty, given in a distinct document and revocable at any time for the future. That distinct document is the sole instrument by which such consent may be given: no order, order form, schedule or other instrument of the contractual package has that effect, and the same instrument is the one referred to by Article 16.4 of the Master Terms (IUX-EN-01) and by Article 29.5 of the Enterprise Schedule (Schedule B, IUX-EN-20).

11.4 Deletion

The Provider will delete the Customer Materials and the AI Training Documents, and any derived index or embedding, within thirty days of the earlier of: the written request of the Counterparty; the conclusion of the evaluation without the Parties entering into a supply agreement; and twelve months of inactivity of the evaluation environment. Deletion is confirmed in writing on request. Copies contained in secure backups are deleted according to the ordinary backup cycle and remain subject to this Agreement until deletion.

11.5 Content hosted after a supply agreement

Where the Parties enter into a supply agreement, the retrieval, portability and deletion of content hosted on the Platform are governed by that agreement and by the applicable switching and data retrieval provisions, which grant a retrieval period of thirty days, without prejudice to the confidentiality obligations of this Agreement for information disclosed outside that agreement.

11.6 No output for third parties

The Provider will not generate, for any other customer or third party, any output, model, template or documentation that incorporates or reveals the Counterparty's Confidential Information.

Art. 12 — Personal data

12.1 Minimisation

Each Party will avoid including personal data in the information exchanged for the Purpose, save where strictly necessary, and will inform the other Party where personal data are unavoidably included.

12.2 Processing on behalf

Where the Provider processes personal data on behalf of the Counterparty in connection with the Purpose, the Parties will enter into a data processing agreement complying with Article 28 of Regulation (EU) 2016/679. Until that agreement is in force, the Provider will process such personal data only to the extent strictly necessary for the Purpose, on the documented instructions of the Counterparty, will not transfer them outside the European Economic Area without an appropriate transfer mechanism, and will apply the confidentiality and security obligations of this Agreement, which apply cumulatively with, and are not replaced by, the data processing agreement once in force.

12.3 Independent controllers

Each Party acts as an independent controller in respect of the business contact data of the other Party's representatives, which it processes for the management of the relationship on the basis of its legitimate interest under Article 6(1)(f) of Regulation (EU) 2016/679, and in respect of the evidence of execution of this Agreement, which is retained for ten years for the establishment, exercise and defence of legal claims.

12.4 No conflict

Nothing in this Agreement limits either Party's obligations under applicable data protection law, and no confidentiality obligation prevents a Party from complying with a data subject request or with an instruction of a supervisory authority.

Art. 13 — Security and notification of unauthorised disclosure

13.1 Security measures

Each Party will apply technical and organisational measures appropriate to the risk to protect the Confidential Information of the other Party, including access control on a need-to-know basis, authentication, encryption of transmission and, where appropriate, of storage, logging of access, secure disposal and personnel confidentiality undertakings.

13.2 Notification

Each Party will notify the other Party of any loss, unauthorised access, use or disclosure of that Party's Confidential Information without undue delay and in any event within seventy-two hours of becoming aware of it, will provide the information reasonably necessary to assess the event, will cooperate in good faith to mitigate its effects and to prevent recurrence, and will not make any public statement identifying the other Party in relation to the event without its prior written consent, save where required by mandatory law.

13.3 Dedicated environment

Where the Counterparty purchases a plan with a dedicated environment (Business or Enterprise Online) or an On-Premise or VPS supply, the Provider undertakes to host the Counterparty's workspace in a dedicated container environment, technically more isolated than the shared environment used by the self-service plans. This undertaking is an obligation of means: it operates within the limits of the infrastructure of the hosting provider used from time to time and of the cybersecurity measures applied pursuant to the supply agreement, and it does not amount to a guarantee of absolute segregation or of the impossibility of unauthorised access. The measures applied and their limits are described in the security documentation of the supply agreement (Article 28 of the Enterprise Schedule and Annex 2 of the Data Processing Agreement).

Art. 14 — Term, survival and trade secrets

14.1 Term

This Agreement takes effect on the Effective Date and remains in force for twenty-four months, during which either Party may disclose Confidential Information under it. Where the Parties enter into an agreement concerning the Platform, this term is automatically extended for the duration of that agreement in respect of disclosures falling outside its scope.

14.2 Termination for convenience

Either Party may terminate this Agreement for convenience on thirty days' written notice. Termination does not affect the obligations relating to Confidential Information already disclosed, which continue for the survival period set out in Article 14.3.

14.3 Survival

The confidentiality and limited-use obligations of this Agreement survive for five years from the later of the expiry or termination of this Agreement and the date of the last disclosure of Confidential Information.

14.4 Trade secrets

In respect of Trade Secrets, the obligations of this Agreement continue without limitation of time for as long as the relevant information continues to qualify as a Trade Secret. Each Party acknowledges that this Agreement, together with the measures described in Article 13, constitutes reasonable steps by the Disclosing Party to keep such information secret for the purposes of Directive (EU) 2016/943, of Legislative Decree 63/2018 and of Articles 98 and 99 of the Italian Industrial Property Code, and of any equivalent applicable law.

Art. 15 — Return and destruction

15.1 Obligation

Within thirty days of the written request of the Disclosing Party, and in any event within thirty days of the expiry or termination of this Agreement, the Receiving Party will return or irreversibly destroy the Confidential Information of the Disclosing Party and all copies, extracts and derived materials, and will cease all use of them.

15.2 Written confirmation

The Receiving Party will confirm compliance in writing, signed by an authorised representative, within fifteen days of completing the return or destruction.

15.3 Permitted retention

The Receiving Party may retain: one copy required to be retained by mandatory law or by professional rules, held by its legal or compliance function or by its external counsel; and copies contained in automated backup or archiving systems that cannot reasonably be selectively deleted. Retained copies may be used only to demonstrate compliance with this Agreement or to comply with the applicable legal obligation, and remain subject to this Agreement, without any time limit for Trade Secrets, until they are deleted.

15.4 Content on the Platform

The deletion of Customer Materials and AI Training Documents hosted on the Platform is governed by Article 11.4 and, after a supply agreement is entered into, by Article 11.5.

Art. 16 — Remedies

16.1 Irreparable harm and interim relief

Each Party acknowledges that a breach of this Agreement may cause the other Party serious and irreparable harm which damages alone may not adequately remedy. Accordingly, each Party is entitled to seek injunctive, precautionary and protective measures before any competent court, including the measures available under Italian law in urgent proceedings and the measures available for the protection of industrial property and trade secrets, such as description, seizure and inhibitory orders, without prejudice to any other remedy and without any requirement to prove actual loss for that purpose.

16.2 Damages and profits

Each Party is entitled to compensation for the loss suffered as a result of a breach and, to the extent permitted by the applicable law, to the restitution of the profits made by the party in breach, in particular under Article 125 of the Italian Industrial Property Code, and to the remedies available for unlawful acquisition, use or disclosure of trade secrets and for unfair competition under Article 2598 of the Italian Civil Code.

16.3 No liquidated damages

The Parties have deliberately not agreed any liquidated sum, penalty or pre-estimated amount payable on breach. Compensation is determined according to the loss actually suffered and proved. No provision of this Agreement is to be construed as a penalty in any jurisdiction where penalty clauses are unenforceable.

16.4 Cumulative remedies

The remedies under this Agreement are cumulative and additional to any remedy available at law. The failure to exercise a remedy is not a waiver of it.

16.5 Liability

Neither Party excludes or limits its liability for wilful misconduct or gross negligence, in accordance with Article 1229 of the Italian Civil Code, or any other liability that cannot be excluded or limited under mandatory law. Save in those cases, neither Party is liable to the other for loss of profit, loss of opportunity or other indirect loss arising from a breach of this Agreement.

Art. 17 — Notice under the United States Defend Trade Secrets Act

17.1 Scope

This Article applies where the Receiving Party, or any of its Permitted Recipients, is a natural person or an entity established in the United States of America, or where the trade secret laws of the United States would otherwise apply.

17.2 Immunity notice

In accordance with the United States Defend Trade Secrets Act of 2016 (18 U.S.C. section 1833(b)), an individual is not held criminally or civilly liable under any federal or state trade secret law for the disclosure of a trade secret that is made in confidence to a federal, state or local government official, directly or indirectly, or to an attorney, and solely for the purpose of reporting or investigating a suspected violation of law, or that is made in a complaint or other document filed in a legal proceeding, provided that such filing is made under seal. An individual who brings proceedings against an employer for retaliation for reporting a suspected violation of law may disclose the trade secret to that individual's attorney and use the trade secret information in the proceedings, provided that any document containing the trade secret is filed under seal and the trade secret is not otherwise disclosed except pursuant to a court order.

17.3 Effect

This notice is given so that the remedies available under the Defend Trade Secrets Act, including exemplary damages and attorneys' fees, remain available to the Disclosing Party. Nothing in this Article is to be read as restricting the protection of Trade Secrets under Article 14.4.

Art. 18 — Export control and sanctions

18.1 Controlled information

The Confidential Information may include technology or software subject to export control, in particular under Regulation (EU) 2021/821 and under the national implementing measures, and may include cryptographic functionality. Each Party will comply with the applicable export control laws when disclosing, transferring or making available Confidential Information, including in electronic form and by remote access.

18.2 Restrictive measures

Neither Party will disclose or make available the Confidential Information, directly or indirectly, to any person, entity or body subject to restrictive measures adopted by the European Union, the United Nations or the competent national authorities, nor to any destination in respect of which such disclosure is prohibited. The Counterparty will not make the Confidential Information available, directly or indirectly, for use in the Russian Federation or in the Republic of Belarus, or for re-export to those destinations.

18.3 Screening and cooperation

Each Party will carry out reasonable screening of its Permitted Recipients against applicable restrictive measures lists and will inform the other Party without delay if it becomes aware of any circumstance that would make a disclosure unlawful. A Party may suspend disclosure where compliance would otherwise be breached, without liability.

Art. 19 — No obligation to contract, non-exclusivity and freedom of employment

19.1 No obligation to contract

This Agreement does not oblige either Party to enter into any further agreement, to make any purchase or supply, or to continue any negotiation, which each Party may discontinue at any time without liability, without prejudice to the duty to negotiate in good faith under Articles 1337 and 1338 of the Italian Civil Code.

19.2 Non-exclusivity

This Agreement is not exclusive. Each Party remains free to develop, acquire, market and purchase products and services, including from or with competitors of the other Party, subject only to the restrictions on the use of Confidential Information set out in this Agreement.

19.3 Freedom of employment

The Parties have deliberately not agreed any non-solicitation or no-poaching commitment in respect of each other's personnel, in view of the restrictions applicable to such commitments under European Union and national competition law. Each Party remains free to recruit. The use of the other Party's Confidential Information, such as confidential organisational or personnel information, in order to target or approach that Party's personnel is nevertheless a breach of Article 7.

Art. 20 — Relationship with the Master Terms and other agreements

20.1 Relationship with the Master Terms

Where the Parties enter into the Master Terms and the applicable schedules, the confidentiality provisions of the Master Terms govern the relationship between the Parties from their effective date. In case of conflict between this Agreement and the Master Terms on a matter of confidentiality, the provision offering the higher standard of protection to the Disclosing Party prevails, consistently with Article 14.5 of the Master Terms (IUX-EN-01) and Article 21.6 of the Enterprise Schedule (Schedule B, IUX-EN-20). For every other matter the order of precedence is the single one set out in Article 2.3 of the Master Terms (IUX-EN-01), which this Agreement adopts by reference and does not restate. No provision of this Agreement gives the Confidential Information of either Party priority over that of the other Party, and this Agreement does not claim precedence over the agreement governing the supply. For the Business and Enterprise Online plans and for the On-Premise and VPS supplies, this Agreement is a mandatory annex to the per-customer supply agreement and is executed together with it, in a single act, through the channels set out in Article 21.1.

20.2 Continuing scope of this Agreement

This Agreement continues to govern: the Confidential Information disclosed before the effective date of the Master Terms; the Confidential Information disclosed in relation to activities that fall outside the scope of the Master Terms; and the relationship between the Parties if no supply agreement is entered into.

20.3 Counterparty templates

Where the Parties also execute a confidentiality agreement on the Counterparty's own template, the two instruments apply cumulatively and the provision offering the higher standard of protection to the Disclosing Party prevails for each specific matter, save that Articles 4, 20.1 and 24 of this Agreement prevail in any event.

Art. 21 — Formation, electronic signature and evidence

21.1 Execution channels

This Agreement is executed through the channel corresponding to the establishment of the Counterparty and to the supply concerned, as follows. Where this Agreement accompanies a Business or Enterprise Online plan as a mandatory annex under Article 20.1, it is executed together with the per-customer supply agreement and execution is completed before the platform checkout: payment is enabled only after the execution of both instruments has been verified. For On-Premise and VPS supplies, which are not concluded through the platform checkout, execution takes place through the administrative channel described in the table below.

21.2 Effective Date

The "Effective Date" is the date of the later of the two signatures in the download-and-upload channel and in the administrative channel for On-Premise and VPS supplies, or the date and time recorded for the confirmation of the one-time password in the acceptance channel.

21.3 Legal effect

The Parties acknowledge that an electronic signature may not be denied legal effect or admissibility as evidence solely because it is in electronic form, in accordance with Article 25 of Regulation (EU) 910/2014 as amended by Regulation (EU) 2024/1183, and agree that the qualified electronic time stamp applied to the execution event benefits from the presumption of accuracy of its date and time and of the integrity of the data.

21.4 Specific approval of clauses

Where this Agreement is executed in the acceptance channel, the clauses listed in Article 25 are submitted for specific approval in a separate step, distinct from the general acceptance, confirmed by a dedicated one-time password and separately logged. Where this Agreement is executed in the download-and-upload channel, the specific approval is given by the second signature affixed to the corresponding block of this document.

21.5 Retention of evidence

The Provider retains the evidence of execution described in this Article for ten years from the Effective Date, on tamper-evident storage, for the establishment, exercise and defence of legal claims. The Counterparty may obtain a copy of the evidence relating to its own execution on written request.

Art. 22 — Notices

22.1 Form

Notices under this Agreement are given in writing and are valid if sent to the Provider by certified electronic mail to devibrain@pec.it or by registered letter with return receipt to Via Coghetti 6, 24128 Bergamo (BG), Italy, and to the Counterparty at the certified electronic mail address or, in its absence, at the electronic mail address and registered office set out in the Identification Record.

22.2 Operational communications

Communications that do not constitute notices under Articles 14, 15 and 16 may be exchanged by ordinary electronic mail, at the addresses used for the Purpose and, for the Provider, at support@devibrain.com.

22.3 Receipt

A notice is deemed received on the date of the delivery receipt for certified electronic mail, on the date of delivery or of attempted delivery for registered letter, and on the date of dispatch for ordinary electronic mail where receipt is acknowledged.

22.4 Changes

Each Party will notify the other Party of any change to its notice addresses. Until such notice is given, notices sent to the last communicated address are validly given.

Art. 23 — General provisions

23.1 Amendments

Any amendment to this Agreement is valid only if made in writing and executed with the same formalities as this Agreement.

23.2 Severability

If a provision of this Agreement is held invalid or unenforceable, it is deemed replaced by a valid provision reflecting as closely as possible the original intention of the Parties, and the remaining provisions continue in full force.

23.3 No waiver

Tolerance of a breach or delay in exercising a right does not constitute a waiver of that right or of any other right.

23.4 Assignment

Neither Party may assign this Agreement or any right under it without the prior written consent of the other Party, except to an Affiliate or to a successor by merger, demerger or transfer of the business to which this Agreement relates, subject to written notice to the other Party and provided the assignee is not a competitor of that Party.

23.5 Entire agreement

This Agreement contains the entire agreement between the Parties in respect of confidentiality for the Purpose and supersedes any previous understanding on that subject, subject to Article 20.

23.6 Counterparts and copies

This Agreement may be executed in counterparts and in electronic form. An electronic copy stored by the Platform has the same evidential value as the original between the Parties.

23.7 Language

The English text of this Agreement is the authoritative text. Any translation, including any Italian courtesy translation supplied by the Provider, is provided for convenience only. In case of discrepancy, the English text prevails.

Art. 24 — Governing law, jurisdiction and optional arbitration

24.1 Governing law

This Agreement is governed by and construed in accordance with the substantive laws of Italy, excluding its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods of 11 April 1980 is expressly excluded.

24.2 Exclusive jurisdiction

The courts of Bergamo, Italy, have exclusive jurisdiction over any dispute arising out of or in connection with this Agreement, including its validity, interpretation, performance and termination, in accordance with Article 25 of Regulation (EU) No 1215/2012.

24.3 Optional arbitration

Where the Counterparty is domiciled or established outside the European Union, outside the European Economic Area and outside the States bound by the Lugano Convention of 30 October 2007, the Provider may elect, at its sole option, to submit the dispute to arbitration instead of the courts identified in Article 24.2. The election is made in writing before commencing proceedings or, where the Counterparty has commenced court proceedings, within thirty days of service. Where the election is made, the dispute is finally settled under the Rules of the Milan Chamber of Arbitration by a sole arbitrator, with seat in Milan, Italy, and in the English language; where the amount in dispute exceeds one hundred and fifty thousand euro, the dispute is instead finally settled under the Rules of Arbitration of the International Chamber of Commerce by three arbitrators, with seat in Milan, Italy, and in the English language. The award is final and enforceable in accordance with the New York Convention of 10 June 1958. This option is available to the Provider only and cannot be exercised by the Counterparty.

24.4 Reservation of urgent and monitory proceedings

Notwithstanding Articles 24.2 and 24.3, each Party may apply to any competent court for interim, precautionary, protective or injunctive measures, including measures to protect trade secrets and industrial property, and the Provider may in any event apply for orders for payment and other monitory proceedings for the recovery of sums due. Such applications are not a waiver of the jurisdiction clause or of the arbitration option.

24.5 Mandatory protections

Where, notwithstanding Article 1.3, a mandatory rule of the law of the Counterparty's country of establishment confers on it a protection that cannot be derogated from by agreement, that rule prevails to the extent of the conflict and the remainder of this Article continues to apply.

Art. 25 — Specific approval of clauses under Articles 1341 and 1342 of the Italian Civil Code

25.1 Clauses submitted for specific approval

The Counterparty declares that it has read and specifically approves the following clauses of this Agreement, which are submitted for its specific approval in accordance with Articles 1341 and 1342 of the Italian Civil Code and, where execution takes place in the acceptance channel, in a separate step under Article 21.4:

• Article 7 (Obligations of the Receiving Party), Article 8 (Permitted Recipients) and Article 9 (Restrictions on analysis, reverse engineering and demonstrations), which impose limitations on the Counterparty's freedom of action;

• Article 10 (No licence, intellectual property and feedback), which excludes any implied licence;

• Article 14 (Term, survival and trade secrets), which extends the obligations beyond the term of this Agreement and, for trade secrets, without limitation of time;

• Article 15 (Return and destruction), which imposes time limits and formalities;

• Article 16 (Remedies), and in particular Articles 16.1, 16.2 and 16.5, concerning interim relief, restitution of profits and the limitation of liability for indirect loss;

• Article 18 (Export control and sanctions), which imposes restrictions on disclosure and permits suspension;

• Article 20 (Relationship with the Master Terms and other agreements), concerning the order of precedence of the instruments;

• Article 21 (Formation, electronic signature and evidence), concerning the execution mechanisms and the retention of evidence;

• Article 23.4 (Assignment) and Article 23.7 (Language), concerning the restriction on assignment and the prevalence of the English text;

• Article 24 (Governing law, jurisdiction and optional arbitration), and in particular Articles 24.2, 24.3 and 24.4, concerning the exclusive jurisdiction of the courts of Bergamo, the arbitration option reserved to the Provider and the reservation of urgent and monitory proceedings.

25.2 Reciprocity of approval

The Provider likewise declares that it accepts the same clauses in their reciprocal application to itself under Article 4, so that the obligations, limitations and remedies apply to the Provider in the same terms when it acts as Receiving Party.

Luogo e data: ______________________________

The clauses specifically approved in accordance with Articles 1341 and 1342 of the Italian Civil Code are those listed in Article 25.1 of this Agreement.

Ai sensi e per gli effetti degli artt. 1341 e 1342 c.c., il Cliente dichiara di avere letto e di approvare specificamente le clausole richiamate nel presente blocco.

Luogo e data: ______________________________

Validation note. This document is a version 1.1 release candidate of the IndustryUX legal corpus, prepared on 10 August 2026 and updated on 11 August 2026 on the basis of the law in force at those dates. Its adoption with real counterparties requires prior validation by a qualified lawyer and, for the data protection aspects referred to in Article 12, by a data protection officer or equivalent qualified adviser; the clauses relating to jurisdictions outside the European Union, and in particular Article 17, should also be verified with local counsel. This document does not constitute legal advice.

Changelog

IUX-EN-32 · v1.1 · 2026-08-11 · IndustryUX® è un marchio registrato di DEVIBRAIN S.r.l.