MASTER SERVICES AGREEMENT (MSA)

This Master Services Agreement ("Agreement") is entered into by and between IMPACT Technology Group, Inc., a Maryland corporation ("IMPACT"), and <<&DH_SoldToCompany>> ("Client"). This Agreement governs all Services provided by IMPACT to Client. By executing any Order referencing this Agreement, Client agrees to be bound by all terms herein.

 

IMPACT Technology Group | Version 2026.08.03 | Effective August 3, 2026 | Supersedes Version 2026.01.26

1. DEFINITIONS

For purposes of this Master Services Agreement ("Agreement"), the following capitalized terms shall have the meanings set forth below. Any capitalized term used but not defined herein shall have the meaning assigned to it elsewhere in this Agreement, an Order, Addendum, or Schedule. IMPACT's complete list of Definitions is located at https://impact.huducloud.com/shared_article/ekDruNsvNheKkXFQVvYwXu5L.

1.1 "Access Control Systems"

means electronic or mechanical systems used to control entry to or exit from physical spaces, including door controllers, readers, keypads, badges, biometric devices, access management software, and related components.

1.2 "Addendum"

means any written addendum, supplement, or rider to this Agreement that modifies or applies additional terms to specific Services, including but not limited to the Managed IT Services Addendum, Cybersecurity Addendum, AI & Automation Addendum, VoIP / UCaaS Addendum, Hardware-as-a-Service (HaaS / TaaS) Addendum, Surveillance & Access Control Systems Addendum, and Cabling & Low-Voltage Addendum.

1.3 "Administrative Credentials"

means usernames, passwords, keys, certificates, tokens, API credentials, privileged accounts, or other authentication mechanisms that provide administrative or elevated access to systems, platforms, applications, devices, networks, or data.

1.4 "Affiliated Entities"

means the "Client", which includes the legal entity executing this Agreement, and any entity that directly or indirectly controls, is controlled by, or is under common control with such entity (each, an "Affiliate"), to the extent Services are provided for the benefit of such Affiliate. All such Affiliates are deemed bound by this Agreement and any applicable Orders as if each were a signatory hereto.

1.5 "Agreement"

means this Master Services Agreement, together with all Orders, Addendums, Schedules, exhibits, URL-based policies, and documents incorporated herein by reference, as the same may be amended from time to time in accordance with this Agreement.

1.6 "Authorized User"

means any employee, contractor, agent, or representative of Client who is authorized by Client to access Services, systems, or deliverables provided by IMPACT.

1.7 "Business Email Compromise" or "BEC"

means a type of cybercrime involving unauthorized access to, impersonation of, or fraudulent use of email accounts or messaging systems for purposes including but not limited to financial fraud, wire transfer fraud, invoice manipulation, credential harvesting, or social engineering.

1.8 "Camera & Surveillance Systems"

means video cameras, recording devices (including NVRs and DVRs), storage devices, video management software, and related components used for video monitoring or recording purposes.

1.9 "Client Data"

means any data, information, content, files, records, or materials provided by or on behalf of Client, or accessed, processed, transmitted, or stored by IMPACT in connection with the Services, excluding IMPACT Confidential Information and IMPACT intellectual property.

1.10 "Confidential Information"

has the meaning set forth in Section 12 of this Agreement and includes, without limitation, all non-public, proprietary, or confidential information disclosed by one Party to the other, whether oral, written, electronic, or otherwise.

1.11 "Device"

means any physical or virtual hardware unit within or connected to the Client environment, including without limitation workstations, laptops, desktops, servers, mobile devices, tablets, firewalls, switches, routers, access points, and other endpoints or network equipment. The Devices covered under any Service, and the basis on which Devices are counted for billing, are determined by the applicable Order and Addendum.

1.12 "Documentation"

means technical documentation, diagrams, configurations, inventories, credentials (to the extent releasable), runbooks, or other records created or maintained by IMPACT in the ordinary course of providing Services. Documentation excludes IMPACT proprietary methodologies, templates, scripts, automations, and internal operational materials.

1.13 "Effective Date"

means the date on which this Agreement becomes legally binding, which shall be the earliest of (a) the date of last signature by the Parties, (b) the date Services are first provided or access is granted, or (c) the date Client accepts an Order or otherwise authorizes performance, including by electronic acceptance or conduct.

1.14 "End-of-Life" or "EOL"

means the date after which a manufacturer or vendor no longer sells, supports, patches, or provides security updates for a product, operating system, platform, or service.

1.15 "End-of-Support" or "EOS"

means the date after which a manufacturer or vendor no longer provides technical support, updates, or remediation for a product, operating system, platform, or service.

1.16 "Force Majeure Event"

means any event beyond the reasonable control of a Party, including but not limited to acts of God, natural disasters, acts of terrorism, war, labor disputes, government actions, utility failures, internet or telecommunications outages, third-party provider failures, or widespread cybersecurity events.

1.17 "Hardware-as-a-Service" or "HaaS"

means hardware, equipment, or devices provided by IMPACT to Client on a subscription or leasing basis, owned by IMPACT, and subject to return upon termination. It can also be known as "Technology-as-a-Service" or "TaaS".

1.18 "Order"

means any proposal, quote, statement of work ("SOW"), service order, subscription agreement, or similar document executed by the Parties that references this Agreement and describes the Services, pricing, and term.

1.19 "Projects"

(also referred to as "Professional Services") mean any non-recurring, finite-scope engagement requiring IMPACT to design, plan, implement, migrate, deploy, configure, remediate, optimize, or materially modify Client systems, infrastructure, applications, security controls, automations, or processes, where the work exceeds routine operational oversight and is performed pursuant to a separately defined scope, timeline, and fee. Projects are not included in recurring service fees unless expressly stated in an Order or Statement of Work.

1.20 "Recurring Services"

mean ongoing monitoring, oversight, administration, governance, maintenance, and advisory services provided on a continuous basis, excluding Projects / Professional Services unless expressly included in an Order. Service-specific Addendums may further define recurring service categories applicable to particular service lines.

1.21 "Service Catalog"

means IMPACT's then-current catalog of available services, inclusions, exclusions, service descriptions, and limitations, as published at https://impact.huducloud.com/shared_article/YKGnqEqER6RCVFXg21CgVgxs/impact-services-catalog. The Service Catalog may be updated by IMPACT from time to time, and the version in effect as of the execution of an applicable Order shall control for such Order. Only services expressly listed in the Service Catalog and expressly included in an executed Order are covered under this Agreement. Services not listed in the Service Catalog, or not expressly included in an Order, are excluded.

1.22 "Services"

means the specific services expressly described in one or more executed Orders, and not any service category referenced elsewhere unless expressly included therein. These could include managed services, cybersecurity services, AI & automation services, VoIP services, hardware-as-a-service, surveillance and access control services, cabling and low-voltage services, professional services, projects, subscriptions, or other offerings expressly described in an executed Order and governed by this Agreement. The classification of services as Recurring Services or Projects shall be determined by IMPACT in its reasonable discretion based on scope, complexity, risk, and effort required.

1.23 "Service Level Targets" or "SLTs"

means the internal operational performance objectives expressly set forth in Schedule B, provided for transparency and operational guidance only. Service Level Targets do not constitute contractual commitments, performance warranties, or guaranteed outcomes, and are subject to all conditions, exclusions, and dependencies described in Schedule B.

1.24 "Third-Party Provider"

means any vendor, carrier, manufacturer, software provider, cloud platform, telecommunications provider, or other third party whose products or services are resold, integrated, or relied upon in connection with the Services. The current list of Third-Party Providers, together with links to their applicable terms and conditions, is published at https://impacttg.com/legal/third-party-providers/. Such terms are incorporated herein by reference and may be updated from time to time.

1.25 "User"

means an individual person who uses, accesses, or is provisioned to access Client systems, applications, Services, or Devices under an Order, whether an employee, contractor, agent, or other individual. User is a unit of measure for scope and billing; the basis on which Users are counted is determined by the applicable Order and Addendum. User is distinct from Authorized User as defined in Section 1.6.

1.26 "Work Product"

means deliverables created specifically for Client under an Order, excluding IMPACT intellectual property, tools, scripts, templates, methodologies, and pre-existing materials.

1.27 “IMPACT Systems”

means the platforms, tools, consoles, portals, instances, and systems owned, licensed, hosted, or operated by IMPACT and used by IMPACT to deliver the Services, including without limitation IMPACT's remote monitoring and management platform, endpoint detection and response and managed detection and response consoles, backup and recovery platforms, network and firewall management consoles, ticketing and service management system, documentation portal, client portal, automation and orchestration platforms, and automation monitoring and reporting interfaces. IMPACT Systems constitute IMPACT Intellectual Property within the meaning of Section 13.2. IMPACT Systems does not include any system, tenant, subscription, application, instance, or environment owned by Client, including any such system administered by IMPACT on Client's behalf.

2. AGREEMENT STRUCTURE, INCORPORATION & PRECEDENCE

2.1 Master Agreement Structure

This Agreement establishes the general terms and conditions governing the relationship between IMPACT and Client. Specific Services, pricing, scope, and service-level commitments shall be set forth in one or more Orders executed by the Parties from time to time. Each executed Order is hereby incorporated into and governed by this Agreement.

No Order shall be binding unless executed by authorized representatives of both Parties. In the event an Order expires or terminates, this Agreement shall remain in effect with respect to all remaining active Orders.

2.2 Incorporation by Reference

The following documents are incorporated into this Agreement by reference and form a part hereof, as if fully set forth herein:

• all executed Orders;
• all Addendums;
• all Schedules, including any URL-based schedules;
• IMPACT's Service Catalog;
• policies, standards, and requirements referenced herein and maintained at URLs designated by IMPACT; and
• any Non-Disclosure Agreement ("NDA") executed by the Parties.

Client acknowledges and agrees that documents incorporated by reference are binding even if not physically attached to this Agreement.

2.3 Service-Specific Addendums

This Agreement contemplates the following service-specific Addendums, each of which governs a distinct category of Services and applies only to the extent such Services are expressly described in, and provided pursuant to, an executed Order:

• Managed IT Services Addendum — governs traditional managed IT services, including endpoint management, network operations, co-managed engagements, and basic cabling work as defined therein;
• Cybersecurity Addendum — governs cybersecurity services, including managed detection and response, security operations, vCISO advisory, and incident response services;
• AI & Automation Addendum — governs artificial intelligence and automation services;
• VoIP / UCaaS Addendum — governs Voice over IP, hosted telephony, and unified communications services;
• Hardware-as-a-Service (HaaS / TaaS) Addendum — governs hardware subscription and leasing programs;
• Surveillance & Access Control Systems Addendum — governs camera, video surveillance, and physical access control services;
• Cabling & Low-Voltage Addendum — governs new cabling, replacement cabling, relocation of existing cabling, and any cabling Project exceeding the basic-work scope defined in the Managed IT Services Addendum.

Any Addendum applicable to a specific Service shall be deemed incorporated into the applicable Order and this Agreement by reference, whether or not expressly referenced in such Order. Client and IMPACT may stack multiple Addendums under this Agreement; each Addendum applies only to its respective Service category.

2.4 URL-Based Documents and Updates

(a) Documents Maintained at URLs. Client expressly agrees that certain Schedules, standards, policies, catalogs, and lists referenced in this Agreement may be maintained at publicly accessible or Client-accessible URLs designated by IMPACT, including but not limited to:

• Required Technical Standards (governed by the Managed IT Services Addendum);
• Third-Party Providers and downstream terms;
• Service Catalog;
• Approved Alternatives;
• Security requirements and policies;
• Schedules published at the Schedules index designated by IMPACT.

(b) Documents Not Subject to Unilateral Update. Notwithstanding Section 2.2 and Section 2.4(a), this Agreement and each Addendum may be amended only in a writing signed by authorized representatives of both Parties in accordance with Section 2.6. Publication of a revised version of this Agreement or of any Addendum at a URL designated by IMPACT shall not amend, modify, or supersede any version of this Agreement or of any Addendum previously executed by the Parties, and shall have no effect on any Order executed prior to such publication. A revised version of this Agreement or of an Addendum becomes binding on Client only upon execution by both Parties, or upon Client's execution of an Order that expressly identifies that revised version. For the avoidance of doubt, the update mechanics of Sections 2.4(d) and 2.4(e) apply only to the categories of documents described in Section 2.4(a) and do not apply to this Agreement or to any Addendum.

(c) Version Control; Governing Version. Each document described in Section 2.4(a) applies to an Order in the version in effect as of the Effective Date of that Order, subject to the update mechanics set forth in Sections 2.4(d) and 2.4(e). IMPACT shall assign a version identifier and effective date to each such document and shall maintain an archive of superseded versions. Upon Client's written request at any time during the Term and for two (2) years following termination or expiration, IMPACT shall furnish Client, at no charge, a complete copy of any document incorporated by reference into this Agreement or any Order, in the version in effect as of the Effective Date of the applicable Order. Where a dispute arises concerning the content of a document described in Section 2.4(a) or of any document incorporated by reference, the archived version bearing the applicable version identifier and effective date shall be controlling evidence of that content.

(d) Material Updates. IMPACT will provide written notice of material updates to documents described in Section 2.4(a) from time to time to reflect changes in technology, vendor requirements, security threats, operational practices, or industry standards. For purposes of this Section, a "material update" means a change that, taken as a whole, materially reduces the scope of a Service purchased under an active Order, materially shifts risk allocation between the Parties, or materially increases Client's substantive obligations under this Agreement. Minor clarifications, formatting changes, vendor list refreshes, and routine standard updates shall not be deemed material.

Material updates shall apply at the next renewal of the affected Order, or thirty (30) days following IMPACT's notice, whichever is earlier. If a material update is unacceptable to Client, Client may, within thirty (30) days following IMPACT's notice, terminate the affected Service without early-termination penalty by providing written notice to IMPACT. In such event, Client shall remain responsible for fees and charges accrued through the effective date of termination and any reasonable transition assistance fees pursuant to Section 4.7. No material update to a document described in Section 2.4(a) shall increase the recurring fees payable under an active Order. This Section 2.4(d) does not limit IMPACT's rights under Section 6.7 (Rate Adjustments), or IMPACT's right to update ancillary, variable, and pass-through fee schedules in accordance with Sections 6.10 and 6.11.

(e) Non-Material Updates. Non-material updates apply prospectively and shall not materially reduce Services purchased under an existing Order. Client's continued use of the Services following publication of an update constitutes acceptance of the updated document, subject to Client's termination right under Section 2.4(d) for material updates.

(f) Notice Mechanics for This Section. Notwithstanding Section 23.9, notice of a material update under Section 2.4(d) shall be deemed given, and the thirty (30) day periods described in Section 2.4(d) shall begin to run, on the date IMPACT both (i) publishes the updated document at the applicable URL with a revised version identifier and effective date, and (ii) sends notice by electronic mail to the notice contact or billing contact then designated by Client in IMPACT's records. Confirmation of receipt is not required for notice under this Section. Client is solely responsible for maintaining a current and monitored notice contact with IMPACT, and Client's failure to do so shall not extend or suspend any period under Section 2.4(d).

(g) Acceptance of Revised Versions. From time to time IMPACT may publish a revised version of this Agreement. A revised version becomes binding on Client only upon (i) Client's execution of an Order that expressly identifies that version, (ii) Client's execution of a written version acceptance instrument in IMPACT's then-current form, or (iii) Client's affirmative electronic acceptance of that version through an authentication-gated interface designated by IMPACT, by an individual authorized to bind Client. Absent one of the foregoing, the version of this Agreement most recently accepted by Client in accordance with this Section continues to govern all Orders. Client's continued receipt or payment for Services shall not constitute acceptance of a revised version of this Agreement or of any Addendum.

2.5 Order of Precedence

This MSA governs except as expressly modified by an applicable Addendum and/or an applicable Order. In the event of any conflict or inconsistency among the documents governing the Parties' relationship, the following order of precedence shall apply, unless expressly stated otherwise in writing:

• any applicable Service-specific or Order Addendum;
• the applicable Order;
• this Master Services Agreement (MSA);
• Schedules (including URL-based schedules and policies);
• the Service Catalog (descriptive only);
• operational documentation, policies, or procedures.

For clarity, no sales proposal, marketing material, email, verbal statement, or other informal communication shall modify this Agreement unless expressly incorporated into an executed Order or Addendum.

Where multiple Addendums are stacked under a single relationship and an apparent conflict arises between two Addendums, the Addendum most directly governing the affected Service shall control with respect to that Service.

2.6 No Implied Modification

This Agreement may not be modified by course of dealing, course of performance, industry custom, or oral agreement. Any modification must be in writing and signed by authorized representatives of both Parties.

The failure of either Party to enforce any provision of this Agreement shall not be deemed a waiver of future enforcement of that or any other provision.

2.7 Relationship to Service Catalog

The Service Catalog defines the scope, inclusions, exclusions, and limitations of IMPACT's Services. The Service Catalog is descriptive only and does not create an obligation to provide any service unless expressly included in an applicable Order. Only those services expressly listed in the Service Catalog and included in an executed Order are covered under this Agreement.

Client acknowledges that the Service Catalog may change over time and that such changes may reflect improvements, replacements, or discontinuation of services, provided that such changes do not materially diminish the Services purchased under an active Order.

2.8 Conflicts with Third-Party Terms

Where Services involve Third-Party Providers, Client agrees that the applicable Third-Party Provider terms and conditions shall apply in addition to this Agreement. In the event of a conflict between this Agreement and a Third-Party Provider's terms, the Third-Party Provider's terms shall govern solely with respect to the Third-Party Provider's products or services.

IMPACT shall not be deemed to assume any additional obligations or liabilities beyond those expressly stated in this Agreement.

2.9 Independent Agreements

If Client and IMPACT enter into a separate written agreement expressly identified as superseding this Agreement with respect to a specific service or relationship, such agreement shall control only to the extent expressly stated therein. All other Services and Orders shall remain governed by this Agreement.

2.10 Survival of Structure

The provisions of this Section 2 shall survive termination or expiration of this Agreement to the extent necessary to enforce rights, obligations, and remedies arising from Services provided during the term.

3. SERVICES, SCOPE, SERVICE CATALOG & NO IMPLIED SERVICES

3.1 Services Provided

IMPACT shall provide to Client only those services that are expressly identified in an executed Order and governed by this Agreement and the applicable Addendum (collectively, the "Services"). The Services shall be performed in a commercially reasonable manner for the specific Services purchased, consistent with generally accepted industry standards applicable to the type of Services purchased, subject to the terms and limitations set forth herein and in the applicable Addendum. IMPACT shall have no obligation to provide any services that are not expressly described in an executed Order.

Each category of Services is governed by its corresponding Addendum, which is incorporated into this Agreement by reference and shall apply in addition to these Terms:

• Managed IT Services are governed by the Managed IT Services Addendum.
• Cybersecurity Services are governed by the Cybersecurity Addendum.
• AI & Automation Services are governed by the AI & Automation Addendum.
• VoIP / UCaaS Services are governed by the VoIP / UCaaS Addendum.
• Hardware-as-a-Service (HaaS / TaaS) is governed by the Hardware-as-a-Service (HaaS / TaaS) Addendum.
• Surveillance & Access Control Services are governed by the Surveillance & Access Control Systems Addendum.
• Cabling & Low-Voltage Project work is governed by the Cabling & Low-Voltage Addendum. Basic cabling work, as defined in the Managed IT Services Addendum, may be performed under that Addendum without execution of the Cabling & Low-Voltage Addendum.

3.2 Service Catalog Controls Scope

Client acknowledges and agrees that IMPACT maintains a Service Catalog, which defines the available Services, service descriptions, inclusions, exclusions, dependencies, limitations, and service boundaries. The Service Catalog is maintained at a URL designated by IMPACT and is incorporated herein by reference.

Only Services expressly listed in the Service Catalog and included in an executed Order are covered under this Agreement. Any service, task, activity, deliverable, or outcome not expressly included in the Service Catalog and the applicable Order is excluded from the scope of Services.

3.3 No Implied Services

Client acknowledges and agrees that:

• IMPACT provides only those services expressly identified in an executed Order. The existence of this Agreement does not obligate IMPACT to provide any particular category of services unless expressly stated in an Order;
• no Services are implied by course of dealing, prior performance, industry custom, marketing materials, proposals, emails, or verbal statements;
• any assistance provided by IMPACT outside the scope of an Order is discretionary and does not create an obligation to continue providing such assistance; and
• the absence of a service, feature, control, or deliverable from an Order or the Service Catalog means that such item is not included.

IMPACT expressly disclaims any obligation to provide services beyond those expressly stated in writing.

3.4 Out-of-Scope Services

Any work requested or required that falls outside the scope of the Services set forth in the applicable Order, applicable Addendum, or Service Catalog shall be deemed Out-of-Scope Services. Out-of-Scope Services may include, without limitation:

• services related to systems, devices, or environments not covered by an executed Order;
• vendor, regulatory, or security requirements not contemplated in the Order;
• emergency or after-hours work not expressly included.

Service-specific Addendums may identify additional categories of Out-of-Scope Services applicable to that service line.

Out-of-Scope Services shall be billable at IMPACT's then-current rates unless otherwise agreed in writing.

3.5 Service Dependencies and Preconditions

Client acknowledges that the provision of Services is dependent upon certain technical, operational, and administrative prerequisites, including but not limited to:

• compliance with any applicable Service-specific standards set forth in an applicable Addendum;
• use of supported hardware, software, and configurations;
• cooperation by Client and its Authorized Users;
• timely approvals, access, and information;
• availability and performance of Third-Party Providers.

IMPACT shall not be responsible for delays, failures, or degraded performance resulting from Client's failure to satisfy such dependencies.

3.6 Client Cooperation and Access

Client shall provide IMPACT with timely access to Client's personnel, facilities, systems, credentials, documentation, and information reasonably necessary to perform the Services. Client represents that all information provided is accurate and complete. IMPACT shall not be responsible for delays, service degradation, or additional costs caused by Client's failure to provide such access, information, licenses, or approvals, and Client agrees to reimburse IMPACT for reasonable costs incurred as a result.

3.7 Changes to Services

IMPACT reserves the right to modify, enhance, replace, or discontinue Services or components of the Service Catalog from time to time in response to changes in technology, vendor availability, security risks, or operational considerations, provided that such changes do not materially reduce the Services purchased under an active Order.

Where a modification materially affects the Services, IMPACT shall use commercially reasonable efforts to provide functionally equivalent alternatives.

3.8 Third-Party and Regulatory Scope Exclusions

Unless expressly stated in an Order or applicable Addendum, IMPACT does not provide legal, regulatory, accounting, insurance, compliance, or risk management advice. Client is solely responsible for determining its regulatory obligations and compliance requirements, as further described in Section 8.

3.9 No Guaranteed Outcomes

Client acknowledges that the Services are designed to support Client's business operations and reduce risk where applicable; however, IMPACT does not guarantee any specific business outcome, financial result, security posture, uptime level, or regulatory compliance outcome unless expressly stated in an Order.

3.10 Survival

The provisions of this Section 3 shall survive termination or expiration of this Agreement to the extent necessary to enforce rights, obligations, and remedies related to Services provided during the term.

4. TERM, TERMINATION, SUSPENSION & EFFECT OF TERMINATION

4.1 Term of Agreement

This Agreement shall commence on the Effective Date set forth in the first executed Order and shall continue in effect until terminated in accordance with this Section 4 (the "Term").

Unless otherwise expressly stated, the termination or expiration of any individual Order shall not terminate this Agreement, which shall remain in effect with respect to all remaining active Orders.

4.2 Term of Orders

Each Order shall have an initial term as specified therein. An Order may include renewal terms, which may provide for automatic renewal or manual renewal, as expressly stated in the applicable Order. No Order shall automatically renew unless the applicable Order expressly provides for automatic renewal. Except as set forth in an applicable Order, the expiration or termination of an Order shall not affect the continued validity of this Agreement.

4.3 Termination for Convenience

(a) By Client. Except as expressly stated otherwise in an Order, Client may terminate an Order for convenience only upon written notice and payment of all fees due through the end of the then-current term of the Order. For clarity, Orders run for their stated term and termination for cause under Section 4.4 is Client's exclusive convenience-equivalent remedy.

(b) By IMPACT. IMPACT may terminate any Order for convenience upon thirty (30) days' written notice to Client. Upon such termination, Client shall be released from all further fee obligations under the affected Order from and after the effective date of termination, except that Client shall remain responsible for: (i) all fees and charges accrued through the effective date of termination; (ii) any reasonable out-of-pocket costs incurred by IMPACT in connection with the affected Order and not yet recovered; and (iii) reasonable transition assistance fees pursuant to Section 4.7 if Client requests transition assistance.

For the avoidance of doubt, termination by Client for convenience does not relieve Client of its payment obligations for the full term of the Order, and termination by IMPACT for convenience does not entitle Client to any refund of fees properly paid through the effective date of termination.

4.4 Termination for Cause

Either Party may terminate this Agreement or any Order upon written notice if the other Party materially breaches this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice specifying the breach in reasonable detail.

Notwithstanding the foregoing, IMPACT may terminate this Agreement or any Order immediately upon written notice if Client:

• fails to pay undisputed amounts when due and does not cure within ten (10) days of notice;
• materially violates security requirements applicable to the Services and refuses to remediate;
• interferes with IMPACT's ability to provide the Services;
• engages in unauthorized access, credential sharing, or misuse of systems;
• breaches confidentiality or non-solicitation obligations; or
• becomes insolvent, files for bankruptcy, or ceases business operations.

4.5 Suspension of Services

IMPACT reserves the right, upon written or electronic notice to Client, to suspend all or part of the Services without liability if:

• Client fails to pay undisputed amounts when due;
• Client's systems present a material security risk to IMPACT, Client, or third parties;
• Client fails to cooperate with cybersecurity investigations or incident response;
• continued provision of Services would violate applicable law; or
• Client materially breaches this Agreement.

Suspension of Services shall not excuse Client's payment obligations.

4.6 Effect of Termination or Expiration

Upon termination or expiration of this Agreement or any Order:

• all outstanding invoices shall become immediately due and payable;
• Client's right to receive Services shall cease;
• IMPACT may revoke access to systems, tools, and platforms provided under the Services;
• Client shall cease using any IMPACT-owned hardware, software, or intellectual property;
• all licenses or rights granted to Client shall terminate unless expressly stated otherwise.

4.7 Offboarding and Transition Assistance

Upon termination or expiration, IMPACT shall, upon Client's written request and subject to payment of applicable fees, provide reasonable transition assistance services, which may include:

• transfer of administrative credentials;
• export of Client Data;
• reasonable cooperation with a successor service provider.

Transition assistance is not included in the Services and shall be billed at IMPACT's then-current rates pursuant to Schedule C or as otherwise agreed in writing.

IMPACT shall have no obligation to provide transition assistance until all outstanding balances are paid in full.

4.8 Administrative Credentials and Documentation

Subject to full payment of all outstanding fees, IMPACT shall release Administrative Credentials and Client-specific Documentation reasonably necessary for Client to operate its systems following termination.

IMPACT shall not be required to release proprietary methodologies, templates, scripts, automations, internal runbooks, or operational documentation.

4.9 Data Retention and Deletion

Unless otherwise required by law or agreed in writing:

• IMPACT shall retain Client Data in its possession or control for a minimum of thirty (30) days following termination or expiration, after which IMPACT may delete such data without further notice;
• Upon Client's written request received prior to deletion, IMPACT may extend the retention period by up to an additional sixty (60) days (for a total retention period not to exceed ninety (90) days from termination), at Client's expense at IMPACT's then-current rates;
• Client is solely responsible for retrieving Client Data prior to termination or during the applicable retention period;
• IMPACT shall not be liable for loss of Client Data following expiration of the applicable retention period.

4.10 Post-Termination Forensic Cooperation

For a period of twelve (12) months following termination or expiration of this Agreement (the "Forensic Cooperation Period"), IMPACT shall, upon Client's written request and subject to the terms of this Section, provide reasonable forensic cooperation in connection with security incidents alleged or reasonably suspected to have occurred during the Term.

(a) Scope of cooperation. Reasonable forensic cooperation may include: (i) reasonable access to logs, records, and configurations retained by IMPACT in the ordinary course of business or pursuant to its records retention policies; (ii) reasonable engineer and consultant time to answer factual questions, produce records, and provide context regarding the Client's environment during the Term; (iii) reasonable cooperation with Client's incident response team, retained forensic firm, cyber insurer, regulator, or legal counsel; and (iv) provision of declarations, affidavits, or fact-witness testimony as reasonably required.

(b) To the extent retained. IMPACT's cooperation obligation extends only to records, logs, and information actually retained by IMPACT as of the date of Client's request. IMPACT has no obligation to retain records beyond its standard retention practices, to recreate records that have been deleted, or to maintain records for the benefit of Client beyond the Forensic Cooperation Period unless Client has separately purchased an extended retention service.

(c) Billable; minimum retainer. Forensic cooperation under this Section is not included in the Services and shall be billed at IMPACT's then-current incident-response or professional-services rates. IMPACT may require a minimum retainer prior to commencing work, in an amount commensurate with the anticipated scope of cooperation. Outstanding balances under this Agreement must be paid in full before IMPACT is obligated to provide forensic cooperation.

(d) Confidentiality, IP, and privilege protections. Forensic cooperation is subject to the confidentiality, intellectual property, and other protective provisions of this Agreement. IMPACT shall not be required to disclose proprietary methodologies, scripts, automations, internal operational materials, information about other clients, or information subject to a legal hold or contractual confidentiality obligation owed to a third party. Where cooperation is requested in connection with anticipated or pending litigation or regulatory action, the Parties shall reasonably coordinate to preserve applicable privileges, including by working under the direction of Client's legal counsel where appropriate.

(e) Outside the Forensic Cooperation Period. After expiration of the Forensic Cooperation Period, IMPACT's only obligation to cooperate shall be in response to subpoena or other valid legal process, at Client's expense and subject to IMPACT's reasonable confidentiality and IP protections.

4.11 Survival

Termination or expiration of this Agreement shall not affect any rights, obligations, or remedies that by their nature or express terms are intended to survive, including but not limited to provisions relating to:

• fees and payment obligations;
• confidentiality and data protection;
• limitation of liability;
• indemnification and subrogation;
• non-solicitation;
• post-termination forensic cooperation;
• governing law and dispute resolution.

4.12 No Liability for Termination

Except as expressly provided in this Agreement, neither Party shall be liable to the other for any damages arising solely from the termination or expiration of this Agreement or any Order in accordance with its terms.

5. CLIENT RESPONSIBILITIES, COOPERATION & ENVIRONMENT CONTROL

5.1 General Client Responsibilities

Client shall be responsible for complying with all obligations set forth in this Agreement and shall cooperate fully with IMPACT in the performance of the Services. Client acknowledges that IMPACT's ability to provide the Services in a timely, secure, and effective manner is dependent upon Client's cooperation, accuracy of information, and compliance with this Agreement.

Client shall designate at least one authorized point of contact with decision-making authority to act on Client's behalf with respect to the Services.

5.2 Access, Information, and Authority

Client shall provide IMPACT with timely, accurate, and complete access to systems, environments, personnel, documentation, credentials, and information reasonably necessary for IMPACT to perform the Services, including administrative access where required.

Client represents and warrants that it has full authority to grant such access and that doing so does not violate any agreement with third parties. IMPACT shall have no liability arising from reliance on access or authority provided by Client.

5.3 Service-Specific Standards and Obligations

Where an applicable Addendum imposes Service-specific technical, security, operational, or configuration standards on Client, Client shall comply with such standards as a condition of receiving the affected Services. Failure to comply with such Service-specific standards may result in:

• suspension of Service Level Targets applicable to the affected Services;
• requirement to execute a Waiver of Standards or analogous risk-acceptance instrument as defined in the applicable Addendum;
• classification of resulting work as Out-of-Scope Services;
• limitation or termination of Services pursuant to Section 4.

Service-specific standards apply only with respect to the Services and Addendums to which they relate. The absence of such standards in this Agreement shall not be construed as a waiver of any standards imposed by an applicable Addendum.

5.4 Client Data and Security Responsibility

Client retains sole responsibility for the content, accuracy, security, and backup of Client Data unless expressly included as a Service in an applicable Order. Client acknowledges that no system is immune from security incidents and that IMPACT does not guarantee uninterrupted service, data integrity, or security outcomes. IMPACT shall not be responsible for third-party access authorized by Client or factors outside IMPACT's reasonable control.

5.5 Security Responsibilities

Client shall implement and enforce appropriate internal security practices, including but not limited to:

• user access controls and acceptable use policies;
• password and credential management;
• employee security awareness and training;
• prompt reporting of suspected security incidents or compromises.

Client shall promptly notify IMPACT of any known or suspected security incident, breach, or unauthorized access involving systems related to the Services.

5.6 Cybersecurity Cooperation

In the event of a cybersecurity incident, investigation, or response effort, Client shall fully cooperate with IMPACT, including:

• providing reasonable access to systems, logs, backups, credentials, and personnel relevant to the incident;
• preserving evidence and refraining from altering affected systems without IMPACT's direction where IMPACT is engaged in incident response;
• following IMPACT's reasonable instructions related to containment, remediation, and recovery to the extent IMPACT is engaged in such activities.

IMPACT shall not be liable for damages, delays, or failures caused by Client's lack of cooperation or interference. Additional cooperation obligations applicable to specific Services may be set forth in the applicable Addendum.

5.7 Licensing and Legal Compliance

Client is solely responsible for obtaining and maintaining all licenses, consents, and permissions required for its use of software, data, and systems, unless expressly included in an Order.

IMPACT shall not be responsible for Client's compliance with laws, regulations, or contractual obligations applicable to Client's business, including but not limited to privacy, data protection, or industry-specific regulatory requirements.

5.8 Identification of Regulatory Frameworks; No Default BAA Relationship

Client is solely responsible for identifying any regulatory framework, industry standard, or contractual obligation applicable to its business or to the data, systems, or services provided by IMPACT, including but not limited to HIPAA, GDPR, UK-GDPR, CCPA/CPRA, PCI-DSS, GLBA, FINRA, SEC, FedRAMP, CMMC and DFARS, CJIS, IRS Pub. 1075, NY DFS Part 500, state privacy laws, and similar frameworks. Client is responsible for notifying IMPACT in writing of any such applicable framework prior to disclosing relevant data to IMPACT or engaging IMPACT in services subject to such framework.

Where a framework requires execution of a Business Associate Agreement ("BAA"), Data Processing Agreement ("DPA"), CMMC Addendum, or other supplemental agreement, the Parties shall execute IMPACT's then-current form of such agreement (or a mutually agreed-upon form) prior to commencement of services subject to the framework. IMPACT will execute a reasonable and customary BAA, DPA, or other supplemental agreement upon Client's written request.

In the absence of an executed BAA, DPA, or other applicable supplemental agreement, IMPACT does not act as a Business Associate, Data Processor, or covered service provider under any such framework, and Client assumes all risks associated with disclosing regulated data or engaging IMPACT in services subject to such framework without first executing the appropriate supplemental agreement.

5.9 Accuracy of Information

Client represents and warrants that all information provided to IMPACT is accurate and complete. IMPACT shall not be responsible for errors, delays, or damages arising from inaccurate or incomplete information provided by Client.

5.10 Access to IMPACT Systems; Revocation

(a) Nature of the grant. Where IMPACT grants Client, or any employee, contractor, agent, or internal resource of Client, access to any IMPACT System, whether privileged, administrative, elevated, script-execution, or read-only (an "Access Grant"), such Access Grant is a discretionary accommodation extended by IMPACT to support the engagement. An Access Grant is not a Service, is not an entitlement, and is subject to Sections 13.2 and 13.5. The scope of each Access Grant is as set forth in the applicable Order, Addendum, Variance Sheet, or other writing executed under this Agreement.

(b) Standing right of revocation. IMPACT may suspend, revoke, reduce, or modify any Access Grant at any time, in whole or in part, with or without cause, upon commercially reasonable notice to Client. Where practicable, IMPACT shall provide not less than five (5) business days' notice of a revocation made without cause.

(c) Immediate revocation. IMPACT may suspend or revoke an Access Grant immediately and without prior notice where IMPACT reasonably determines that any of the following has occurred or may occur:

(i) a security incident, breach, compromise, or suspected compromise involving the credentials, account, or device through which the access is exercised;

(ii) use of the access outside its authorized scope, including use of an IMPACT System to make any change without IMPACT's prior written approval where such approval is required;

(iii) sharing, delegation, or transfer of credentials, or use of the access by any individual other than the individual to whom it was granted;

(iv) use of an IMPACT System for any purpose other than performance of the functions allocated to Client under this Agreement, an Addendum, an Order, or a Variance Sheet, including any attempt to access data, configurations, or records of any other IMPACT client;

(v) any use inconsistent with Section 13.5;

(vi) departure, reassignment, role change, or change in employment or engagement status of the individual holding the access, or Client's failure to notify IMPACT of the same;

(vii) failure of the account through which the access is exercised to satisfy applicable security requirements, including multi-factor authentication enforcement;

(viii) suspension of Services under Section 4.5, or termination or expiration of the applicable Order;

(ix) a requirement imposed by a Third-Party Provider, vendor, insurer, or regulator, or a requirement of applicable law or legal process;

(x) conduct that, in IMPACT's reasonable determination, places IMPACT Systems, IMPACT's other clients, or IMPACT's security posture at risk; or

(xi) an ongoing investigation into any of the foregoing, in which case access may be suspended for the duration of the investigation.

(d) No expansion of IMPACT's scope; no fee adjustment. Suspension or revocation of an Access Grant does not expand IMPACT's Services, obligations, or allocation of responsibility. Where a function was allocated to Client under this Agreement, an Addendum, an Order, or a Variance Sheet, that allocation is unaffected by the revocation, and Client remains responsible for the function. Where Client requests that IMPACT perform work Client can no longer perform as a result of a revocation, such work is chargeable as out-of-scope work or as a Project as applicable under the governing Addendum, or is drawn against any applicable prepaid retainer. Suspension or revocation does not entitle Client to any fee reduction, credit, refund, or rebate.

(e) No liability. IMPACT shall have no liability arising from or relating to the suspension, revocation, reduction, or modification of an Access Grant, including any resulting delay, downtime, loss of productivity, inability of Client to perform a function allocated to it, or cost incurred by Client. Client's exclusive recourse is to request reinstatement under subsection (f) or to purchase the affected function from IMPACT.

(f) Reinstatement. IMPACT may reinstate an Access Grant at its discretion, and may condition reinstatement on remediation of the circumstance giving rise to the revocation, completion of training, execution or re-execution of an applicable Risk Acknowledgment, reduction in access scope, or amendment of the applicable Order or Variance Sheet.

(g) Scope of this Section. This Section applies solely to access to IMPACT Systems. Nothing in this Section authorizes IMPACT to deny Client access to Client Data, to revoke Client's access to or administrative authority over any system, tenant, subscription, application, or environment owned by Client, or to withhold anything IMPACT is obligated to provide under Section 4.8. Client's ownership of and access to its own systems and data is unaffected by this Section.

(h) Client obligations. Client shall notify IMPACT promptly, and in no event later than one (1) business day, of any departure, reassignment, or role change affecting an individual holding an Access Grant, and of any known or suspected compromise of the credentials through which such access is exercised. Client shall maintain multi-factor authentication on all accounts holding an Access Grant and shall not permit credential sharing.

(i) Risk Acknowledgments unaffected. Suspension or revocation of an Access Grant does not release, limit, or discharge Client's obligations or assumed liability under any executed Risk Acknowledgment with respect to any period during which the access was held.

(j) Survival. Subsections (d), (e), (g), and (i) survive termination or expiration of this Agreement.

5.11 Survival

The provisions of this Section 5 shall survive termination or expiration of this Agreement to the extent necessary to enforce rights, obligations, and remedies arising during the Term.

6. FEES, BILLING, RATE ADJUSTMENTS & TAXES

6.1 Fees and Pricing Structure

Client shall pay all fees for the Services as set forth in the applicable Order, Addendum, Schedule, or Service Catalog, as applicable. Fees may include, without limitation, recurring subscription fees, usage-based fees, professional services fees, project fees, hardware fees, and pass-through costs from Third-Party Providers. All fees are stated in U.S. dollars unless otherwise specified and are exclusive of applicable taxes. Fees are variable based on quantities and services in use, and Client acknowledges that monthly charges may increase or decrease during the term based on changes to Users, Devices, Services, or applicable billing cycles.

6.2 Invoicing

IMPACT shall invoice Client in accordance with the billing frequency specified in the applicable Order. Unless otherwise stated:

• recurring fees shall be billed in advance;
• usage-based, project-based, and Out-of-Scope Services shall be billed in arrears;
• Third-Party Provider charges may be billed in advance or as incurred.

Invoices may be delivered electronically. Client agrees that electronic delivery constitutes proper delivery of invoices.

6.3 Payment Terms

Unless otherwise stated in an Order, payment of all undisputed invoices is due upon receipt. Client shall remit payment in accordance with Section 6.4 (Payment Method).

6.4 Payment Method (ACH Required)

(a) ACH Requirement. Client agrees that all recurring and non-recurring fees and other amounts due under this Agreement shall be paid by Automated Clearing House (ACH) debit or electronic funds transfer from a U.S. financial institution account designated by Client, in accordance with applicable law.

(b) ACH Authorization; Push or Pull. Client may satisfy the ACH payment requirement either by (i) authorizing IMPACT to initiate ACH debits ("pull") or (ii) initiating ACH payments directly ("push") from Client's designated financial institution account. Where Client elects to initiate ACH payments, Client remains solely responsible for ensuring that payment is received by IMPACT on or before the applicable due date. Failure to timely remit payment shall constitute non-payment under this Agreement, regardless of the payment method selected.

(c) Non-ACH Administrative and Processing Fee. If IMPACT, in its sole discretion, permits Client to remit payment using any method other than ACH (including, without limitation, check, credit card, wire, or manual payment), Client agrees that such payment shall be subject to an administrative and processing fee of three percent (3%) of the invoice amount; provided, however, that IMPACT may charge an administrative and processing fee of up to three and one-half percent (3.5%) of the invoice amount where the actual processor or handling cost incurred by IMPACT exceeds 3%. In no event shall the administrative and processing fee exceed three and one-half percent (3.5%) of the invoice amount.

(d) Applicability to All Charges. The payment method requirements and non-ACH fees set forth in this Section apply to all invoices, including one-time, project-based, pass-through, usage-based, or other non-recurring charges.

(e) No Waiver. Acceptance of any non-ACH payment shall not constitute a waiver of IMPACT's right to require ACH payment for future invoices.

(f) Condition of Service. IMPACT may require compliance with the payment method requirements set forth in this Section 6.4 as a condition of providing or continuing Services. Failure to maintain compliant payment authorization or to remit payment in accordance with this Section shall constitute non-payment under this Agreement.

6.5 Late Payments

Any undisputed amount not paid when due may, at IMPACT's option:

• accrue interest at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by law;
• result in suspension of Services pursuant to Section 4;
• require Client to prepay future fees;
• result in Client being responsible for all reasonable costs of collection, including attorneys' fees and collection agency fees.

6.6 Disputed Charges

Client shall notify IMPACT in writing of any good-faith dispute regarding an invoice within ten (10) days of receipt, specifying the basis for the dispute in reasonable detail. Failure to timely dispute an invoice shall be deemed acceptance of the charges.

Client shall timely pay all undisputed portions of an invoice while a dispute is being resolved.

6.7 Rate Adjustments

IMPACT may adjust recurring fees on an annual basis upon at least thirty (30) days' written notice to Client to account for:

(a) Standard Annual Adjustment. IMPACT may adjust recurring fees annually by up to five percent (5%) upon not less than thirty (30) days' written notice to Client. Such adjustment may be applied to reflect increased costs of labor, technology, security, compliance, operations, or service delivery.

(b) Inflation-Indexed Adjustment. Notwithstanding Section 6.7(a), if the annual percentage increase in the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average (or any successor index) for the applicable period exceeds five percent (5%), IMPACT may increase recurring fees by an amount not to exceed the applicable CPI-U increase, in lieu of the standard annual adjustment. Any such increase shall be applied uniformly and shall not exceed the measured inflation rate for the applicable period.

(c) Vendor and Third-Party Cost Pass-Through. IMPACT may adjust fees to reflect increases imposed by third-party vendors, licensors, carriers, or service providers upon which the Services rely. Such adjustments may be applied as incurred and are independent of the adjustments permitted under Sections 6.7(a) and 6.7(b). IMPACT is not required to disclose underlying vendor pricing, contract terms, or calculation methodology in connection with pass-through adjustments. However, where the cumulative pass-through increase to a recurring fee line item exceeds fifteen percent (15%) in any rolling twelve (12) month period, IMPACT shall provide Client with at least thirty (30) days' prior written notice identifying the line item and the magnitude of the increase, and Client may, within thirty (30) days of such notice, terminate the affected Service without early-termination penalty by providing written notice to IMPACT. In such event, Client shall remain responsible for fees and charges accrued through the effective date of termination and any reasonable transition assistance fees pursuant to Section 4.7. Cumulative pass-through increases of fifteen percent (15%) or less in any rolling twelve (12) month period may be implemented with the standard thirty (30) days' notice required under this Section 6.7 and do not trigger a termination right.

(d) Enterprise Clients. For Clients designated as Enterprise Clients in an applicable Order, pricing, adjustment methodology, notice periods, and any caps on annual increases may be customized and supersede Sections 6.7(a)–(c) solely as expressly stated in such Order. Absent an express Enterprise pricing provision in an Order, this Section 6.7 shall apply in full.

(e) No Waiver. Failure by IMPACT to exercise any rate adjustment right in a given year shall not constitute a waiver of its right to do so in any subsequent period.

6.8 Prorated Fees

Fees for Services may be prorated for partial billing periods, including upon service commencement, modification, or termination, in accordance with IMPACT's billing practices. Client acknowledges that charges for a billing period may reflect partial-month or partial-period adjustments.

6.9 Minimum Fees / Base Fees

Certain Services may be subject to a minimum recurring fee or base fee as specified in the applicable Order ("Base Fee"). Client acknowledges that the Base Fee represents a minimum charge for availability of Services and applies regardless of actual usage, consumption, or quantities during the applicable billing period. Reductions in Users, Devices, or Services shall not reduce the Base Fee unless expressly stated in a written amendment to the applicable Order.

6.10 Additional Fees and Charges

In addition to the fees set forth in an applicable Order, Client may incur additional fees for services, activities, or costs not included in the base Services or triggered by Client requests, lifecycle events, or third-party requirements, including without limitation: hardware disposal or recycling fees, special handling fees, expedited or after-hours services, travel or onsite charges, vendor or carrier pass-through charges, regulatory or compliance-related fees, and other ancillary or conditional charges. Such fees may be billed as incurred in accordance with IMPACT's then-current billing policies or applicable fee schedules, which may be maintained by IMPACT from time to time. Client acknowledges that such fees are not included in base recurring fees unless expressly stated in an applicable Order.

Increases to ancillary or variable fee schedules maintained by IMPACT shall take effect not less than thirty (30) days following publication or written notice, whichever is earlier, and shall apply only to Services, activities, or costs performed or incurred on or after the effective date of the increase. No such increase shall be applied retroactively.

6.11 Pass-Through and Third-Party Costs

Client shall be responsible for all fees, charges, and cost increases imposed by Third-Party Providers in connection with the Services, whether billed directly by such providers or passed through by IMPACT. IMPACT shall have no obligation to absorb increases in Third-Party Provider costs.

6.12 Non-Refundable Fees

Unless expressly stated otherwise in writing:

• all setup fees, onboarding fees, project fees, and professional services fees are non-refundable;
• prepaid fees, including block hours and subscription fees, are non-refundable;
• fees paid for partially used service periods are not subject to proration or refund.

6.13 Taxes

Client shall be responsible for all sales, use, value-added, excise, or similar taxes imposed on the Services, excluding taxes based on IMPACT's net income.

If IMPACT is required to collect or remit taxes on Client's behalf, such amounts shall be invoiced to Client and paid in accordance with this Section.

6.14 Credits and Setoff

Client may not withhold payment, assert setoff, or deduct amounts from invoices except as expressly authorized in writing by IMPACT.

6.15 Financial Condition and Creditworthiness

IMPACT reserves the right to evaluate Client's creditworthiness at any time. If IMPACT reasonably determines that Client's financial condition poses a risk of non-payment, IMPACT may require modified payment terms, advance payment, or additional security as a condition of continuing Services.

6.16 Survival

The provisions of this Section 6 shall survive termination or expiration of this Agreement to the extent necessary to enforce payment obligations and related remedies.

7. SECURITY OBLIGATIONS & CYBER INSURANCE

7.1 Shared Responsibility Model

Client acknowledges and agrees that cybersecurity is a shared responsibility between IMPACT and Client. While IMPACT implements technical, administrative, and operational safeguards within the scope of the Services purchased, Client retains responsibility for its business operations, users, internal policies, data governance, and compliance obligations.

Nothing in this Agreement shall be construed as a guarantee that security incidents, data breaches, cyberattacks, or unauthorized access will not occur.

7.2 Cybersecurity Incident Notification

Client shall promptly notify IMPACT upon discovery of any actual or suspected:

• cybersecurity incident;
• data breach;
• unauthorized access;
• credential compromise;
• Business Email Compromise ("BEC");
• ransomware or malware infection.

Failure to provide timely notice may materially impair IMPACT's ability to respond and shall relieve IMPACT of responsibility for resulting damages to the extent caused by such delay.

Service-specific incident response, cooperation, and remediation obligations may be further set forth in an applicable Addendum, including the Managed IT Services Addendum and the Cybersecurity Addendum. The notification obligation set forth in this Section 7.2 applies regardless of which Services Client has purchased.

7.3 No Guarantee of Security

Client expressly acknowledges and agrees that:

• no system, network, or service is completely secure;
• IMPACT does not warrant or guarantee that security incidents will not occur;
• the Services are not a substitute for Client-maintained cybersecurity insurance, internal controls, or risk management programs.

7.4 Client Cyber Insurance Requirements

Client shall maintain, at its own expense, a cyber liability insurance policy throughout the Term with coverage appropriate to its risk profile and business operations. Such policy shall include coverage for, at a minimum:

• data breaches and privacy events;
• ransomware and cyber extortion;
• incident response and forensic investigation;
• business interruption due to cyber events;
• regulatory fines and penalties (to the extent insurable);
• Business Email Compromise (BEC) and social engineering fraud.

Unless otherwise specified in an applicable Order, the minimum coverage limits required under this Section shall be One Million U.S. Dollars (US $1,000,000) per occurrence and One Million U.S. Dollars (US $1,000,000) in the aggregate. An applicable Order may require higher minimum coverage limits, in which case the Order shall control. Coverage limits stated in this Section are minimums only; Client is solely responsible for evaluating its risk profile and obtaining coverage adequate to its actual exposure.

Upon reasonable request, Client shall provide IMPACT with evidence of such coverage in the form of a certificate of insurance.

7.5 Subrogation and Insurance Coordination

Client acknowledges that IMPACT's limitation of liability is based in part on Client maintaining appropriate insurance coverage. Subrogation and insurance coordination are addressed in Sections 16.5 and 19.5.

7.6 Security Recommendations Are Advisory

Security recommendations provided by IMPACT are advisory in nature and based on industry standards, available information, and the scope of Services purchased. Client retains ultimate responsibility for accepting or rejecting such recommendations.

7.7 Regulatory and Legal Disclaimer

IMPACT does not provide legal, regulatory, or compliance advice. Client is solely responsible for determining and complying with applicable data protection, privacy, and cybersecurity laws and regulations, as further described in Section 8.

7.8 Survival

The provisions of this Section 7 shall survive termination or expiration of this Agreement to the extent necessary to enforce rights, obligations, and remedies relating to security events occurring during the Term.

8. REGULATORY COMPLIANCE FRAMEWORKS

8.1 Client Responsibility for Identification of Frameworks

Client is solely responsible for identifying and complying with all laws, regulations, industry standards, and contractual obligations applicable to its business, its data, its users, and the Services it engages from IMPACT. Such frameworks may include, without limitation:

• Health Insurance Portability and Accountability Act ("HIPAA") and HITECH;
• General Data Protection Regulation ("GDPR"), UK-GDPR, and similar foreign privacy laws;
• California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA") and other U.S. state privacy laws;
• Payment Card Industry Data Security Standard ("PCI-DSS");
• Gramm-Leach-Bliley Act ("GLBA") and related financial-services frameworks;
• Financial Industry Regulatory Authority ("FINRA") and Securities and Exchange Commission ("SEC") cybersecurity rules;
• New York Department of Financial Services Part 500 ("NY DFS Part 500");
• Federal Risk and Authorization Management Program ("FedRAMP");
• Cybersecurity Maturity Model Certification ("CMMC") and Defense Federal Acquisition Regulation Supplement ("DFARS") clauses including 252.204-7012, 7019, 7020, and 7021;
• Criminal Justice Information Services ("CJIS") Security Policy;
• Internal Revenue Service Publication 1075 ("IRS Pub. 1075");
• North American Electric Reliability Corporation Critical Infrastructure Protection ("NERC CIP");
• Family Educational Rights and Privacy Act ("FERPA");
• and any other federal, state, local, or international law, regulation, or standard applicable to Client.

8.2 Client Notification Obligation

Client shall notify IMPACT in writing, prior to commencement of Services or as soon as reasonably practicable thereafter, of any regulatory framework, industry standard, or contractual flow-down obligation that applies to (a) Client's business, (b) the data Client will disclose to IMPACT or that IMPACT will process in connection with the Services, or (c) the systems or environments IMPACT will administer.

Client acknowledges that IMPACT cannot make commitments, implement controls, or operate as a regulated service provider in connection with frameworks IMPACT has not been notified of, and that Client's failure to provide such notification relieves IMPACT of responsibility for framework-specific obligations.

8.3 Framework-Specific Supplemental Agreements

Where a regulatory framework requires execution of a supplemental agreement between Client and IMPACT (such as a Business Associate Agreement under HIPAA, a Data Processing Agreement under GDPR or CCPA/CPRA, a CMMC Addendum for DoD supply-chain engagements, or a similar instrument), the Parties shall execute IMPACT's then-current form of such supplemental agreement (or a mutually agreed-upon form) prior to the commencement of services subject to the framework. IMPACT will execute reasonable and customary supplemental agreements upon Client's written request.

In the absence of an executed supplemental agreement applicable to a given framework, IMPACT does not act as a Business Associate, Data Processor, External Service Provider, or other regulated service provider under that framework, and Client shall not disclose data or engage IMPACT in services subject to that framework until the supplemental agreement is executed.

8.4 No Compliance Certification or Advice

IMPACT does not provide legal, regulatory, accounting, audit, or compliance advice, and IMPACT does not certify Client's compliance with any framework unless expressly stated in an executed Order or supplemental agreement. Client should consult its own legal, compliance, and audit advisors regarding the application of any framework to its business and the adequacy of any Services in connection with such framework.

Where IMPACT provides services framed in terms of a particular framework (such as "HIPAA-aligned managed services" or "CMMC Level 2 ESP services"), such framing describes IMPACT's operational alignment with framework requirements applicable to the services IMPACT performs and does not constitute a certification of Client's overall compliance, an audit opinion, or a guarantee of regulatory outcome.

8.5 Survival

The provisions of this Section 8 shall survive termination or expiration of this Agreement.

9. PROJECTS & PROFESSIONAL SERVICES

9.1 Definition of Projects

For purposes of this Agreement, a "Project" means any service, task, engagement, or body of work that is not included within the recurring Services described in an Order or the Service Catalog and that involves a defined scope, deliverables, timeline, or objective. Projects may include, without limitation:

• onboarding and environment configuration;
• migrations, upgrades, or platform changes;
• remediation, optimization, or configuration work;
• consulting, assessments, or architecture design;
• AI agent design, automation workflow build-outs, and integration projects;
• VoIP / UCaaS implementation, cutovers, and number porting projects;
• hardware deployment, decommissioning, and refresh projects;
• surveillance and access control system installation projects;
• cabling Projects governed by the Cabling & Low-Voltage Addendum;
• security remediation or incident response work.

Service-specific Addendums may further define categories of Projects applicable to particular service lines, including triggers that automatically convert in-scope work into Project work.

9.2 Project Authorization

Projects shall be performed only pursuant to a written authorization, which may take the form of:

• a standalone Statement of Work ("SOW");
• an Order identifying the Project scope; or
• written approval of a time-and-materials engagement.

No Project shall be deemed authorized unless approved by Client in writing.

9.3 Scope Control and Assumptions

Each Project shall be performed in accordance with the scope, assumptions, exclusions, and dependencies set forth in the applicable SOW or Order. Client acknowledges that Project timelines, costs, and outcomes are dependent upon:

• timely Client cooperation and approvals;
• availability of required resources;
• accuracy of Client-provided information;
• performance of Third-Party Providers.

Any material change to the scope, assumptions, or dependencies shall constitute a change order and may result in additional fees and timeline adjustments.

9.4 Billing and Payment for Projects

Unless otherwise stated in writing:

• Projects may be billed on a fixed-fee or time-and-materials basis;
• Project fees may be invoiced in advance, in milestones, or upon completion;
• Project fees are non-refundable once work has commenced;
• delays caused by Client may result in additional fees.

IMPACT shall have no obligation to commence or continue Project work if Client is delinquent on payment.

9.5 Out-of-Scope Project Work

Any work requested or required that falls outside the approved Project scope shall be deemed out-of-scope and shall not be performed unless authorized in writing. Out-of-scope Project work shall be billable at IMPACT's then-current rates.

9.6 Client Responsibilities for Projects

Client shall:

• provide timely access, information, and approvals;
• ensure availability of decision-makers;
• perform any Client-assigned tasks identified in the Project scope;
• refrain from making changes that interfere with Project execution.

IMPACT shall not be responsible for Project delays or failures caused by Client's failure to meet these obligations.

9.7 No Guarantee of Project Outcomes

Projects are provided on a commercially reasonable, best-efforts basis. IMPACT does not guarantee that a Project will achieve any specific business outcome, regulatory compliance status, or performance result unless expressly stated in writing.

9.8 Project Suspension or Termination

IMPACT may suspend or terminate a Project upon written notice if:

• Client fails to make required payments;
• Client materially interferes with Project execution;
• Client fails to provide required cooperation or access;
• continued execution would pose a security or legal risk.

Client shall remain responsible for all fees incurred through the effective date of suspension or termination.

9.9 Transition from Project to Recurring Services

Completion of a Project does not automatically result in inclusion of the Project deliverables within ongoing Services unless expressly stated in an Order. Ongoing support, maintenance, monitoring, or administration of Project deliverables must be separately purchased.

9.10 Survival

The provisions of this Section 9 shall survive termination or expiration of this Agreement to the extent necessary to enforce rights, obligations, and remedies relating to Projects performed during the Term.

10. HARDWARE-AS-A-SERVICE & EQUIPMENT

10.1 Hardware-as-a-Service ("HaaS")

Where expressly stated in an Order, IMPACT may provide hardware, equipment, peripherals, or devices to Client under a subscription or leasing model ("Hardware-as-a-Service" or "HaaS"). HaaS Services are governed by the Hardware-as-a-Service (HaaS / TaaS) Addendum, which is incorporated into this Agreement by reference and shall apply in addition to these Terms.

In the absence of an executed HaaS / TaaS Addendum and corresponding Order, IMPACT shall have no obligation to provide HaaS Services.

10.2 Hardware Procurement (Non-HaaS)

Where Client purchases hardware, software, or related components from IMPACT outright (i.e., on a non-subscription, non-leased basis), the procurement shall be governed by this Agreement and the applicable Order. Such procurement does not constitute HaaS and is not subject to the HaaS / TaaS Addendum.

Client acknowledges that delivery timelines, availability, and pricing for procured hardware and software are dependent on Third-Party Providers and supply-chain conditions beyond IMPACT's control. IMPACT does not guarantee the availability, pricing, or continued manufacture of any specific hardware or software product and reserves the right to substitute functionally equivalent alternatives.

10.3 Manufacturer Warranties

Hardware and software procured by or through IMPACT, whether under HaaS or outright purchase, may be subject to manufacturer warranties and support terms. IMPACT does not guarantee manufacturer response times, replacement timelines, or availability of parts. IMPACT makes no independent warranty regarding hardware performance beyond any express warranties provided by the manufacturer.

10.4 Shipping, Handling, and Fees

Client shall be responsible for all shipping, handling, freight, insurance, customs, restocking, and related fees unless otherwise stated in writing. Such fees may be invoiced separately and are non-refundable.

10.5 Survival

The provisions of this Section 10 shall survive termination or expiration of this Agreement to the extent necessary to enforce ownership rights, payment obligations, and remedies relating to hardware and procurement.

11. THIRD-PARTY PROVIDERS

11.1 Use of Third-Party Providers

Client acknowledges and agrees that the Services may rely upon, integrate with, resell, or otherwise involve products or services provided by third parties ("Third-Party Providers"), including but not limited to cloud service providers, telecommunications carriers, software vendors, hardware manufacturers, licensors, internet service providers, hosting providers, AI platform providers, and model providers.

IMPACT does not control and is not responsible for the acts or omissions of Third-Party Providers.

11.2 Third-Party Provider Terms and Conditions

Client agrees to be bound by the applicable terms and conditions, acceptable use policies, privacy policies, service level agreements, and other contractual requirements imposed by Third-Party Providers.

The current list of Third-Party Providers, together with links to their applicable terms and conditions, is maintained at https://impacttg.com/thirdpartyproviders. Such list and terms are incorporated herein by reference and may be updated from time to time.

11.3 No Warranty or Guarantee of Third-Party Services

IMPACT makes no representations or warranties regarding the availability, performance, reliability, security, or suitability of any Third-Party Provider's products or services.

Any warranties, service credits, or remedies offered by Third-Party Providers are provided solely by such providers and not by IMPACT.

11.4 Third-Party Provider SLAs

Any service level agreements ("SLAs") or uptime commitments provided by Third-Party Providers are separate from and independent of any Service Level Targets provided by IMPACT.

Client acknowledges that a Third-Party Provider's SLA does not extend to or bind IMPACT, and IMPACT shall not be liable for any failure of a Third-Party Provider to meet its SLA.

11.5 Pass-Through Costs and Changes

Client shall be responsible for all fees, charges, surcharges, taxes, and cost increases imposed by Third-Party Providers in connection with the Services, subject to Section 6.7(c).

IMPACT reserves the right to modify, replace, or substitute Third-Party Providers in its discretion to maintain service quality, security, or availability, provided that such substitution does not materially reduce the Services purchased under an active Order.

11.6 Third-Party Outages and Failures

IMPACT shall not be liable for service interruptions, delays, data loss, security incidents, or other damages caused by:

• outages or failures of Third-Party Providers;
• acts or omissions of Third-Party Providers;
• maintenance or upgrades performed by Third-Party Providers;
• failures of internet connectivity, power, or telecommunications services.

Such events shall not constitute a breach of this Agreement.

11.7 Client Responsibility for Third-Party Accounts

Client is solely responsible for:

• maintaining accurate account information with Third-Party Providers;
• complying with Third-Party Provider policies;
• paying Third-Party Provider invoices when billed directly;
• managing licenses, subscriptions, and entitlements not expressly included in an Order.

IMPACT shall not be liable for service disruptions resulting from Client's failure to satisfy these obligations.

11.8 Limitation of IMPACT Responsibility

IMPACT's role with respect to Third-Party Providers may be limited to procurement, configuration, integration, or administrative assistance. IMPACT does not assume responsibility for the underlying performance or security of Third-Party Provider services.

Nothing in this Agreement shall be construed as creating a partnership, agency, or joint venture between IMPACT and any Third-Party Provider.

11.9 Survival

The provisions of this Section 11 shall survive termination or expiration of this Agreement to the extent necessary to enforce rights, obligations, and remedies relating to Third-Party Provider services.

12. CONFIDENTIALITY & NON-DISCLOSURE

12.1 Definition of Confidential Information

For purposes of this Agreement, "Confidential Information" means all non-public, proprietary, or confidential information disclosed by one Party ("Disclosing Party") to the other Party ("Receiving Party"), whether disclosed orally, visually, electronically, or in writing, and whether marked as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure.

Confidential Information includes, without limitation:

• business plans, financial information, pricing, and strategies;
• technical data, systems, architectures, configurations, and documentation;
• security information, vulnerabilities, incident details, and remediation efforts;
• trade secrets, know-how, processes, and methodologies;
• Client Data;
• the terms and conditions of this Agreement, all Orders, Addendums, and Schedules.

12.2 Client Confidential Information

Client Confidential Information includes any Client Data and any personally identifiable information ("PII"), protected health information ("PHI"), or other sensitive information relating to Client, its employees, customers, or vendors.

Client acknowledges and agrees that this Agreement, standing alone, does not constitute a Business Associate Agreement under HIPAA, a Data Processing Agreement under GDPR or CCPA/CPRA, a CMMC ESP agreement, or any similar framework-specific instrument. As described in Section 5.8 and Section 8.3, where Client is subject to a regulatory framework that requires execution of a supplemental agreement, Client is responsible for identifying the applicable framework, notifying IMPACT in writing, and requesting execution of the appropriate supplemental agreement, and IMPACT will execute a reasonable and customary supplemental agreement upon Client's written request.

Client shall defend, indemnify, and hold harmless IMPACT from and against any claims arising from Client's failure to identify an applicable regulatory framework or to request execution of a required supplemental agreement prior to disclosing regulated data to IMPACT or engaging IMPACT in services subject to such framework, except to the extent such claims arise from IMPACT's gross negligence or willful misconduct. Confidentiality obligations under this Agreement do not create or imply regulatory compliance obligations under any framework absent execution of the applicable supplemental agreement.

12.3 IMPACT Confidential Information

IMPACT Confidential Information includes, without limitation, IMPACT's:

• service methodologies;
• security frameworks;
• scripts, automations, templates, and tools;
• internal documentation and processes;
• pricing models and business practices.

Client acknowledges that IMPACT Confidential Information constitutes valuable trade secrets and proprietary information.

12.4 Exclusions from Confidential Information

Confidential Information does not include information that the Receiving Party can demonstrate:

• is or becomes publicly available without breach of this Agreement;
• was lawfully known to the Receiving Party prior to disclosure;
• is lawfully received from a third party without breach of confidentiality;
• is independently developed without use of the Disclosing Party's Confidential Information.

12.5 Confidentiality Obligations

The Receiving Party shall:

• protect Confidential Information using at least the same degree of care it uses to protect its own confidential information, but no less than a commercially reasonable degree of care;
• use Confidential Information solely for purposes of performing under this Agreement;
• restrict disclosure of Confidential Information to employees, contractors, and agents with a legitimate need to know and who are bound by confidentiality obligations no less protective than those herein.

12.6 Prohibited Disclosure

Except as expressly permitted herein, neither Party shall disclose the other Party's Confidential Information to any third party without prior written consent, except to legal counsel, accountants, insurers, or auditors subject to confidentiality obligations.

12.7 Compelled Disclosure

The Receiving Party may disclose Confidential Information if required by law, court order, or governmental authority, provided that the Receiving Party gives prompt notice (to the extent legally permitted) and reasonably cooperates with the Disclosing Party's efforts to seek protective treatment.

12.8 Data Security

IMPACT shall implement commercially reasonable administrative, technical, and physical safeguards to protect Client Confidential Information within the scope of the Services purchased, subject to the limitations and exclusions set forth in this Agreement.

Client acknowledges that no security measures are infallible and that IMPACT does not guarantee absolute security.

12.9 Return or Destruction of Confidential Information

Upon termination of this Agreement or upon written request, each Party shall return or destroy the other Party's Confidential Information, except where retention is required by law or where destruction is impracticable. Any retained Confidential Information shall remain subject to confidentiality obligations.

12.10 Survival

Confidentiality obligations shall survive termination or expiration of this Agreement for a period of five (5) years, except for trade secrets, which shall be protected for so long as they remain trade secrets under applicable law.

12.11 Relationship to Separate NDA

The Parties acknowledge that they may have executed a separate Non-Disclosure Agreement ("NDA") prior to or in connection with the evaluation of the business relationship contemplated by this Agreement. Upon the Effective Date of this Agreement:

(a) this Section 12 shall govern all matters of confidentiality and non-disclosure between the Parties and shall supersede any such NDA with respect to Confidential Information disclosed on or after the Effective Date;

(b) Confidential Information disclosed under an NDA before the Effective Date shall remain subject to that NDA's terms, including its survival provisions, and shall additionally receive the protections of this Section 12; and

(c) notwithstanding anything in any NDA to the contrary, no NDA shall modify, expand, or supersede the limitations of liability, disclaimers, indemnities, or other risk-allocation provisions of this Agreement, including Section 15, and to the extent any NDA conflicts with those provisions, this Agreement shall control.

12.12 Remedies

Each Party acknowledges that unauthorized disclosure or misuse of Confidential Information may cause irreparable harm for which monetary damages may be inadequate. Accordingly, the Disclosing Party shall be entitled to seek injunctive relief, in addition to any other remedies available at law or equity, without the necessity of posting bond.

13. INTELLECTUAL PROPERTY & OWNERSHIP

13.1 Background Intellectual Property

Each Party retains all right, title, and interest in and to its respective intellectual property, inventions, works of authorship, trade secrets, know-how, processes, methodologies, software, tools, templates, and materials that were developed or owned by such Party prior to, or independently of, this Agreement ("Background IP").

Nothing in this Agreement shall be construed as transferring ownership of a Party's Background IP to the other Party.

13.2 IMPACT Intellectual Property

IMPACT expressly retains all right, title, and interest in and to all intellectual property created, developed, or used by IMPACT in connection with the Services, including but not limited to:

• scripts, automations, code, and software tools;
• system architectures, configurations, and designs;
• templates, playbooks, runbooks, and documentation frameworks;
• methodologies, processes, workflows, and standards;
• monitoring, security, and management platforms;
• aggregated, anonymized, or derived operational data.

Such materials constitute IMPACT's proprietary intellectual property and trade secrets, regardless of whether they are created specifically for Client or used in connection with Client's environment.

13.3 Client Data Ownership

Client retains all right, title, and interest in and to Client Data. Nothing in this Agreement transfers ownership of Client Data to IMPACT.

Client grants IMPACT a limited, non-exclusive, royalty-free license to access, process, transmit, store, and use Client Data solely as necessary to perform the Services, comply with legal obligations, and enforce this Agreement.

13.4 Work Product

Unless otherwise expressly stated in an Order, any deliverables created specifically for Client as part of the Services ("Work Product") shall be deemed Client-owned upon full payment of all applicable fees.

Notwithstanding the foregoing, Work Product shall exclude IMPACT Background IP and IMPACT Intellectual Property. To the extent any IMPACT Intellectual Property is embedded in or necessary to use the Work Product, IMPACT grants Client a limited, non-exclusive, non-transferable license to use such intellectual property solely for Client's internal business purposes.

For the avoidance of doubt, automations, workflows, scripts, code, software tools, and configurations are IMPACT Intellectual Property under Section 13.2 and are not Work Product, regardless of whether they were created specifically for Client; Client's use of them is licensed under this Section and, for AI and automation deliverables, under the AI & Automation Addendum, and does not transfer ownership. Work Product owned by Client upon payment is limited to deliverables that are not IMPACT Intellectual Property, such as reports, written analyses, and documentation prepared for Client.

13.5 License Restrictions

Client shall not, and shall not permit any third party to:

• copy, modify, reverse engineer, decompile, or disassemble IMPACT Intellectual Property;
• use IMPACT Intellectual Property to develop competing products or services;
• sublicense, resell, or distribute IMPACT Intellectual Property;
• remove or alter proprietary notices.

Any unauthorized use shall constitute a material breach of this Agreement.

13.6 Feedback

Client may provide suggestions, feedback, or recommendations regarding the Services ("Feedback"). Client grants IMPACT a perpetual, irrevocable, royalty-free license to use, incorporate, and commercialize such Feedback without obligation or compensation.

13.7 Open Source and Third-Party Software

Certain components of the Services may include open-source or third-party software subject to separate license terms. Client agrees to comply with all applicable license requirements. Nothing in this Agreement shall restrict IMPACT's rights under such licenses.

13.8 No Assignment of IP Rights

Except as expressly stated herein, no intellectual property rights are granted by either Party to the other, whether by implication, estoppel, or otherwise.

13.9 Protection of Intellectual Property

Client acknowledges that unauthorized use or disclosure of IMPACT Intellectual Property may cause irreparable harm for which monetary damages may be inadequate. IMPACT shall be entitled to seek injunctive relief in addition to any other remedies available at law or equity.

13.10 Survival

The provisions of this Section 13 shall survive termination or expiration of this Agreement.

14. WARRANTIES & DISCLAIMERS

14.1 Mutual Authority Warranty

Each Party represents and warrants that:

• it is duly organized, validly existing, and in good standing under the laws of its jurisdiction of formation;
• it has full power and authority to enter into and perform this Agreement;
• the execution and performance of this Agreement do not violate any other agreement to which it is a party.

14.2 IMPACT Limited Services Warranty

IMPACT warrants that it shall perform the Services in a commercially reasonable manner, consistent with generally accepted industry standards applicable to the type of Services purchased. This warranty is limited to the Services expressly purchased under an executed Order.

14.3 Disclaimer of Guarantees

EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT OR AN APPLICABLE ORDER, IMPACT DOES NOT WARRANT OR GUARANTEE THAT:

• THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR AVAILABLE AT ALL TIMES;
• SECURITY INCIDENTS, DATA BREACHES, OR CYBERATTACKS WILL NOT OCCUR;
• CLIENT'S SYSTEMS WILL BE IMMUNE FROM FAILURE, MALWARE, OR UNAUTHORIZED ACCESS;
• THE SERVICES WILL ACHIEVE ANY PARTICULAR BUSINESS, FINANCIAL, OR OPERATIONAL RESULT;
• CLIENT WILL MEET ANY REGULATORY OR COMPLIANCE REQUIREMENT.

14.4 Disclaimer of Implied Warranties

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IMPACT DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

14.5 No Warranty for Third-Party Providers

IMPACT MAKES NO REPRESENTATIONS OR WARRANTIES WITH RESPECT TO THE PRODUCTS OR SERVICES OF THIRD-PARTY PROVIDERS.

ALL THIRD-PARTY PRODUCTS AND SERVICES ARE PROVIDED "AS IS" AND SUBJECT SOLELY TO THE WARRANTIES, IF ANY, PROVIDED BY THE APPLICABLE THIRD-PARTY PROVIDER.

14.6 No Warranty for Client-Controlled Systems

IMPACT DISCLAIMS ALL WARRANTIES WITH RESPECT TO:

• SYSTEMS, DEVICES, OR SERVICES CONTROLLED BY CLIENT OR THIRD PARTIES;
• CLIENT-SUPPLIED HARDWARE OR SOFTWARE;
• SYSTEMS OUTSIDE THE SCOPE OF THE SERVICES PURCHASED.

ANY ASSISTANCE PROVIDED WITH RESPECT TO SUCH SYSTEMS IS PROVIDED WITHOUT WARRANTY.

14.7 No Legal, Regulatory, or Insurance Advice

IMPACT DOES NOT PROVIDE LEGAL, REGULATORY, ACCOUNTING, OR INSURANCE ADVICE. CLIENT IS SOLELY RESPONSIBLE FOR DETERMINING ITS OBLIGATIONS UNDER APPLICABLE LAWS, REGULATIONS, AND INDUSTRY STANDARDS.

14.8 Security Disclaimer

CLIENT ACKNOWLEDGES THAT NO SECURITY MEASURES CAN GUARANTEE ABSOLUTE PROTECTION AGAINST ALL THREATS. IMPACT DOES NOT WARRANT THAT ITS SERVICES WILL PREVENT ALL SECURITY INCIDENTS OR DATA LOSS.

14.9 Client Reliance

CLIENT ACKNOWLEDGES THAT IT HAS NOT RELIED ON ANY REPRESENTATION, WARRANTY, OR STATEMENT NOT EXPRESSLY SET FORTH IN THIS AGREEMENT OR AN EXECUTED ORDER.

14.10 Exclusive Remedies

CLIENT'S SOLE AND EXCLUSIVE REMEDY FOR ANY BREACH OF THE WARRANTIES SET FORTH IN THIS SECTION SHALL BE, AT IMPACT'S OPTION:

• RE-PERFORMANCE OF THE AFFECTED SERVICES; OR
• TERMINATION OF THE AFFECTED SERVICES AND REFUND OF FEES PAID FOR THE NON-CONFORMING SERVICES DURING THE APPLICABLE PERIOD.

14.11 Survival

The provisions of this Section 14 shall survive termination or expiration of this Agreement.

15. LIMITATION OF LIABILITY

15.1 Exclusion of Certain Damages

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND EXCEPT AS EXPRESSLY PROVIDED IN SECTION 15.2(c) BELOW, IN NO EVENT SHALL IMPACT BE LIABLE FOR ANY:

• INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES;
• LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF BUSINESS, LOSS OF USE, OR LOSS OF GOODWILL;
• LOSS, CORRUPTION, OR INACCURACY OF DATA;
• BUSINESS INTERRUPTION OR DOWNTIME COSTS;
• COST OF COVER, PROCUREMENT OF SUBSTITUTE SERVICES, OR SYSTEM RESTORATION COSTS;
• CLAIMS ARISING FROM UNAUTHORIZED ACCESS, CYBERATTACKS, RANSOMWARE, MALWARE, OR DATA BREACHES.

THE FOREGOING EXCLUSIONS APPLY REGARDLESS OF THE THEORY OF LIABILITY (CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE), EVEN IF IMPACT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. The exclusions of this Section 15.1 shall not apply to damages arising from IMPACT's gross negligence, willful misconduct, or fraud, or to liability that, under applicable law, may not be excluded.

15.2 Aggregate Liability Cap

(a) Default Cap. Subject to Sections 15.2(b) and 15.2(c), IMPACT's total, aggregate liability arising out of or relating to this Agreement, any Order, or the Services, shall not exceed the total fees paid by Client to IMPACT for the Services giving rise to the claim during the twelve (12) month period immediately preceding the event giving rise to the claim (or, if Services have been provided for less than twelve (12) months, the total fees paid by Client to IMPACT through the date of such event) (the "Default Cap"). The Default Cap shall apply collectively to all claims, actions, and causes of action, whether arising in contract, tort, or otherwise.

(b) Super-Cap for Specified Categories. Notwithstanding the Default Cap, IMPACT's aggregate liability for claims arising out of or relating to (i) IMPACT's gross negligence or willful misconduct, (ii) IMPACT's material breach of its confidentiality obligations under Section 12, or (iii) IMPACT's intellectual property indemnification obligations under Section 16.3, shall not exceed two (2) times the Default Cap, or the limits of IMPACT's applicable insurance coverage actually available to respond to the claim, whichever is lower (the "Super-Cap"). The Super-Cap shall apply collectively to all claims falling within categories (i)–(iii) above.

(c) Uncapped Liability. Notwithstanding the Default Cap and the Super-Cap, the limitations of Sections 15.1, 15.2(a), and 15.2(b) shall not apply to: (i) liability arising from IMPACT's fraud or fraudulent misrepresentation; (ii) liability for third-party bodily injury or tangible property damage caused by IMPACT's negligent or willful acts or omissions; (iii) IMPACT's payment obligations under this Agreement; or (iv) liability that, under applicable law, may not be limited or excluded.

(d) Liquidated Damages Under Section 17.4. For clarity, the recruitment and training fee payable by Client under Section 17.4 is a Client liability and is not subject to the limitations of this Section 15, which limit only IMPACT's liability.

15.3 Allocation of Risk

Client acknowledges and agrees that:

• the fees charged by IMPACT reflect the allocation of risk set forth in this Agreement;
• IMPACT would not enter into this Agreement without the limitations of liability set forth herein;
• Client is in the best position to insure against risks associated with its business operations, data, and users;
• the Default Cap, Super-Cap, and uncapped categories set forth in Section 15.2 reflect a deliberate, negotiated allocation of risk between the Parties.

15.4 Acknowledgement of Reasonableness

Client acknowledges that the limitations, exclusions, and allocations of liability set forth in this Agreement are commercially reasonable, reflect an agreed-upon allocation of risk between the Parties, and were a material inducement for IMPACT to enter into this Agreement. Client further acknowledges that it has had the opportunity to obtain insurance coverage to mitigate such risks.

15.5 Client Data and Security Responsibility

Without limiting the foregoing, Client acknowledges the data and security responsibilities set forth in Section 5.4.

15.6 Service-Specific Limitations

Service-specific Addendums may identify additional categories of claims, damages, or losses for which IMPACT shall have no liability, including but not limited to claims arising from unsupported systems, Client-declined service-specific standards, executed waivers or risk-acceptance instruments, or other Addendum-specific risk allocations.

15.7 Statutory and Other Non-Excludable Liability

Nothing in this Section 15 shall exclude or limit liability to the extent such liability cannot be excluded or limited under applicable law.

15.8 Service Level Targets — No Remedy

Service Level Targets set forth in Schedule B represent IMPACT's internal operational performance objectives and are provided for transparency and operational guidance only. Service Level Targets do not constitute contractual commitments, performance warranties, or guaranteed outcomes. Failure to meet any Service Level Target shall not constitute a breach of this Agreement, shall not give rise to service credits, refunds, damages, termination rights, or any other remedy, and shall not be asserted as a basis for any claim against IMPACT. Client's sole recourse in the event of persistent or material performance concerns shall be to engage IMPACT through the escalation procedures set forth in Schedule B or to exercise its termination rights as expressly provided in Section 4.

The Parties expressly agree that Service Level Targets are not intended to function as, and shall not be construed as, service level agreements, performance warranties, contractual commitments, or guarantees of any kind. No course of dealing, performance history, marketing communication, or informal discussion shall operate to convert a Service Level Target into a contractual commitment. Any change in the nature of Service Level Targets must be made by written amendment to this Agreement or an applicable Order executed by authorized representatives of both Parties.

15.9 No Liability for Certain Causes

Without limiting the foregoing and subject to Section 15.2(c), IMPACT shall have no liability for claims, damages, or losses arising from or related to:

• actions or omissions of Client personnel, contractors, or third parties;
• systems, devices, or services outside the scope of the Services purchased;
• Third-Party Provider outages, failures, or security incidents;
• Client's failure to maintain required cyber insurance;
• delayed notification or lack of cooperation by Client during a security incident;
• additional categories identified in an applicable Addendum.

15.10 Time Limitation on Claims

Any claim or cause of action arising out of or relating to this Agreement must be commenced within two (2) years after the event giving rise to such claim, or such claim shall be permanently barred, to the extent permitted by applicable law.

15.11 Independent Basis of Bargain

The limitations of liability set forth in this Section 15 apply independently of any failure of essential purpose of any limited remedy.

15.12 Survival

This Section 15 shall survive termination or expiration of this Agreement.

16. INDEMNIFICATION & SUBROGATION

16.1 Client Indemnification

Client shall defend, indemnify, and hold harmless IMPACT and its affiliates, and each of their respective officers, directors, employees, agents, insurers, successors, and assigns (collectively, the "IMPACT Indemnitees") from and against any and all claims, demands, causes of action, damages, losses, liabilities, penalties, fines, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to:

• Client's breach of this Agreement, any Order, Addendum, or Schedule;
• Client's failure to comply with security recommendations or Service-specific obligations identified in an applicable Addendum;
• execution of a Waiver of Standards or analogous risk-acceptance instrument by Client;
• acts or omissions of Client's employees, contractors, agents, or third-party providers;
• Client Data, including its content, accuracy, legality, or use;
• Business Email Compromise (BEC), wire fraud, social engineering, or payment diversion events involving Client;
• Client's failure to maintain required cyber insurance;
• Client's violation of applicable laws, regulations, or contractual obligations;
• Client's failure to identify an applicable regulatory framework or to request execution of a required supplemental agreement, as described in Sections 5.8, 8.3, and 12.2.

This indemnification obligation shall apply regardless of whether such claims arise from alleged negligence, except to the extent caused by IMPACT's gross negligence or willful misconduct. Service-specific Addendums may set forth additional Client indemnification obligations applicable to particular service lines.

16.2 Third-Party Provider Indemnity Allocation

Client acknowledges that Third-Party Providers are independent entities and that IMPACT does not control their acts or omissions. Client shall indemnify IMPACT for any claims arising from Third-Party Provider failures, outages, security incidents, or contractual disputes, except to the extent expressly assumed by IMPACT in writing.

16.3 Intellectual Property Indemnification by IMPACT

IMPACT shall indemnify Client from and against any third-party claim alleging that the Services, as provided by IMPACT and used in accordance with this Agreement, infringe a valid U.S. patent, copyright, or trademark, provided that Client:

• promptly notifies IMPACT in writing of the claim;
• grants IMPACT sole control over the defense and settlement;
• provides reasonable cooperation at IMPACT's expense.

IMPACT shall have no obligation under this Section to the extent the claim arises from:

• Client modifications or misuse;
• Client-supplied hardware, software, or data;
• Third-Party Provider products or services;
• combinations not authorized by IMPACT.

IMPACT's liability under this Section 16.3 is subject to the Super-Cap set forth in Section 15.2(b).

16.4 Indemnification Procedures

The indemnified Party shall:

• promptly notify the indemnifying Party of any claim;
• allow the indemnifying Party sole control of the defense and settlement;
• provide reasonable assistance at the indemnifying Party's expense.

Failure to provide prompt notice shall not relieve the indemnifying Party of its obligations except to the extent materially prejudiced.

16.5 Subrogation; Insurance Offset

(a) Property and HaaS Subrogation Waiver. Each Party waives, to the maximum extent permitted by applicable law, any right of subrogation against the other Party for losses to physical property and equipment (including Hardware-as-a-Service equipment) covered by such Party's commercial property insurance. Each Party shall ensure that its commercial property insurance policies include a corresponding waiver of subrogation in favor of the other Party to the extent permitted by law.

(b) Cyber Insurance — Insurance Offset; No Subrogation Waiver. With respect to Client's cyber liability insurance, the Parties agree as follows in lieu of a waiver of subrogation:

• Client's cyber liability insurance shall be primary with respect to losses arising out of or relating to Client's business operations, data, users, and security posture;
• to the extent any loss giving rise to a claim against IMPACT is paid or payable to Client by Client's cyber liability insurer, the amount of such loss recoverable by Client from IMPACT shall be reduced dollar-for-dollar by the amount paid or payable by Client's insurer (the "Insurance Offset");
• the Insurance Offset shall apply regardless of whether Client actually pursues recovery from its insurer, provided that Client may, in its sole discretion, elect to seek payment from its insurer prior to or in lieu of pursuing IMPACT;
• nothing in this Section 16.5(b) requires Client to waive subrogation rights under its cyber liability insurance policy, and Client and Client's cyber insurer retain any subrogation rights they would otherwise possess at law, subject to the Default Cap and Super-Cap set forth in Section 15.2.

(c) Coordination. The Parties acknowledge that the limitation of liability provisions of Section 15 and the Insurance Offset of Section 16.5(b) operate together to allocate risk between the Parties and their respective insurers.

16.6 Coordination with Insurance

Client acknowledges that the indemnification, limitation of liability, and Insurance Offset provisions of this Agreement are intended to operate in conjunction with Client's insurance coverage. Client's insurance shall be primary with respect to claims arising from Client's business operations, data, and users.

16.7 No Expansion of Liability

Nothing in this Section 16 shall be construed to expand IMPACT's liability beyond the limitations set forth in Section 15. All indemnification obligations are subject to the limitations, exclusions, and caps set forth therein to the maximum extent permitted by law.

16.8 Survival

The provisions of this Section 16 shall survive termination or expiration of this Agreement.

17. NON-SOLICITATION, NON-HIRE & TALENT PROTECTION

17.1 Acknowledgement of Legitimate Business Interest

Client acknowledges and agrees that IMPACT invests substantial time, expense, and proprietary resources in recruiting, hiring, training, certifying, and retaining skilled technical, engineering, and professional personnel. Client further acknowledges that IMPACT's personnel constitute a valuable business asset and that unauthorized solicitation or hiring would cause material harm to IMPACT.

17.2 Non-Solicitation of Personnel

During the Term of this Agreement and for a period of twelve (12) months following the termination or expiration of this Agreement or any Order, Client shall not, directly or indirectly:

• solicit, recruit, induce, or encourage any employee, contractor, or consultant of IMPACT to terminate or alter their relationship with IMPACT;
• assist or participate in any solicitation or recruitment of IMPACT personnel;
• engage any IMPACT personnel through a third party or affiliate for the purpose of circumventing this restriction.

General employment advertisements not specifically targeted at IMPACT personnel shall not, by themselves, constitute solicitation.

17.3 Non-Hire of Personnel

During the same period described in Section 17.2, Client shall not directly or indirectly hire, engage, or contract with any IMPACT employee, contractor, or consultant who:

• provided Services to Client;
• had access to Client's systems or data; or
• became known to Client through the provision of Services.

This restriction applies regardless of whether the individual responds to a solicitation initiated by Client or independently seeks employment with Client.

17.4 Liquidated Damages / Recruitment Fee

Client acknowledges that IMPACT's damages arising from a breach of this Section would be difficult or impracticable to calculate at the time of contracting, including costs associated with recruitment, onboarding, training, lost productivity, client impact, and replacement risk. Accordingly, Client agrees that if Client breaches this Section by hiring or engaging IMPACT personnel, Client shall pay IMPACT a recruitment and training fee equal to forty percent (40%) of the individual's first-year total compensation, including base salary, bonuses, and guaranteed incentives.

The Parties expressly agree that the recruitment and training fee represents a reasonable pre-estimate of actual damages and is not intended as a penalty.

17.5 No Offset or Mitigation Required

Payment of the recruitment and training fee shall be due within thirty (30) days of written notice from IMPACT and shall not be subject to offset, reduction, or mitigation.

Payment of such fee shall not be deemed consent to the hiring or waive any other remedies available to IMPACT.

17.6 Injunctive Relief

Client acknowledges that a breach of this Section would cause irreparable harm for which monetary damages may be insufficient. IMPACT shall be entitled to seek injunctive relief, in addition to any other remedies available at law or equity, without the necessity of posting bond.

17.7 Independent Covenant

The obligations set forth in this Section are independent of all other provisions of this Agreement and shall survive termination or expiration of this Agreement regardless of the reason for termination.

17.8 Enforcement and Severability

If any portion of this Section is determined by a court of competent jurisdiction to be unenforceable, such provision shall be modified to the minimum extent necessary to render it enforceable while preserving the intent of the Parties.

17.9 Survival

This Section 17 shall survive termination or expiration of this Agreement.

18. FORCE MAJEURE

18.1 Force Majeure Events

Neither Party shall be liable for failure or delay in the performance of its obligations under this Agreement (other than payment obligations) if such failure or delay is caused by events beyond its reasonable control ("Force Majeure Event"), including but not limited to:

• acts of God, natural disasters, fires, floods, earthquakes, or severe weather;
• acts of terrorism, war, civil unrest, riots, or sabotage;
• labor disputes, strikes, or work stoppages not involving the affected Party's workforce;
• governmental orders, laws, regulations, or actions;
• failures or interruptions of utilities, internet services, telecommunications networks, or cloud infrastructure;
• widespread cybersecurity incidents, malware outbreaks, ransomware campaigns, or denial-of-service attacks;
• failures, outages, or acts of Third-Party Providers.

18.2 Notice of Force Majeure

The affected Party shall use commercially reasonable efforts to notify the other Party of the Force Majeure Event as soon as practicable, describing the nature of the event and the anticipated impact on performance.

Failure to provide prompt notice shall not relieve the affected Party of protection under this Section except to the extent the other Party is materially prejudiced.

18.3 Suspension of Obligations

During the continuance of a Force Majeure Event, the affected Party's obligations under this Agreement shall be suspended to the extent impacted by the Force Majeure Event.

The affected Party shall use commercially reasonable efforts to resume performance as soon as practicable.

18.4 No Excuse for Payment Obligations

Force Majeure Events shall not excuse or delay Client's obligation to pay fees and charges due under this Agreement.

18.5 Extended Force Majeure

If a Force Majeure Event continues for a period of more than sixty (60) consecutive days and materially prevents performance of the affected Services, either Party may terminate the affected Order upon written notice, without further liability, except for fees accrued prior to termination.

18.6 No Liability for Force Majeure

Neither Party shall be liable for damages arising from a Force Majeure Event, provided that the affected Party complies with the requirements of this Section.

18.7 Survival

The provisions of this Section 18 shall survive termination or expiration of this Agreement.

19. INSURANCE REQUIREMENTS

19.1 Client Insurance Obligations

Client shall, at its own expense, maintain insurance coverage appropriate to the nature, size, and risk profile of its business throughout the Term of this Agreement and for any applicable survival period.

Such insurance shall be issued by insurers licensed to do business in the United States and having an A.M. Best rating of A- or better, unless otherwise approved by IMPACT in writing.

19.2 Required Cyber Liability Insurance

Client shall maintain a Cyber Liability / Network Security and Privacy Insurance policy with coverage limits sufficient to cover reasonably foreseeable losses arising from cybersecurity incidents.

At a minimum, such policy shall include coverage for:

• data breaches and privacy events;
• ransomware and cyber extortion;
• forensic investigation and incident response costs;
• data restoration and system recovery;
• business interruption and extra expense arising from cyber events;
• regulatory investigations, fines, and penalties (to the extent insurable);
• Business Email Compromise (BEC), social engineering fraud, and wire transfer fraud.

Unless otherwise specified in an applicable Order, the minimum coverage limits required under this Section shall be One Million U.S. Dollars (US $1,000,000) per occurrence and One Million U.S. Dollars (US $1,000,000) in the aggregate. An applicable Order may require higher minimum coverage limits, in which case the Order shall control. Coverage limits stated in this Section are minimums only; Client is solely responsible for evaluating its risk profile and obtaining coverage adequate to its actual exposure.

Client acknowledges that failure to maintain such coverage materially increases risk and may result in suspension of Services, execution of a Waiver of Standards or analogous risk-acceptance instrument, or termination of this Agreement.

19.3 General Commercial Insurance

Client shall also maintain commercially reasonable insurance coverage applicable to its operations, which may include, as appropriate:

• Commercial General Liability insurance;
• Errors and Omissions / Professional Liability insurance;
• Property insurance covering Client-owned assets;
• Crime or Fidelity insurance, including employee dishonesty coverage.

19.4 Evidence of Coverage

Upon reasonable request, Client shall provide IMPACT with certificates of insurance evidencing compliance with this Section. Such certificates shall not materially amend or limit the coverage required herein.

Failure to provide evidence of coverage upon request may result in suspension of Services.

19.5 Subrogation

Subrogation and insurance offset are addressed in Section 16.5. Each Party shall cause its commercial property insurance policies to include a waiver of subrogation in favor of the other Party with respect to physical property and equipment, to the maximum extent permitted by applicable law. With respect to cyber liability insurance, the Insurance Offset set forth in Section 16.5(b) shall apply in lieu of a subrogation waiver.

19.6 No Limitation of Client Obligations

Client's insurance coverage shall not limit or reduce Client's obligations, indemnification duties, or liabilities under this Agreement.

19.7 IMPACT Insurance

IMPACT shall maintain, throughout the Term, insurance coverage consistent with industry standards for managed service providers, which shall include, at a minimum:

• Commercial General Liability insurance;
• Errors and Omissions / Professional Liability insurance (Technology E&O);
• Cyber Liability / Network Security and Privacy insurance.

Coverage limits and carrier information shall be made available to Client upon written request, subject to confidentiality obligations and customary insurance disclosure practices. Client acknowledges that IMPACT's insurance coverage is not intended to insure Client's business risks, and that IMPACT's coverage limits may be reduced or impaired by claims unrelated to Client.

19.8 No Representation as to Adequacy

IMPACT makes no representation or warranty regarding the adequacy, availability, or sufficiency of Client's insurance coverage. Client is solely responsible for determining appropriate coverage limits and policy terms.

19.9 Survival

The provisions of this Section 19 shall survive termination or expiration of this Agreement to the extent necessary to enforce rights and obligations relating to insurance coverage.

20. AUDIT, VERIFICATION & COMPLIANCE RIGHTS

20.1 Audit Rights Limited to Verification

Client acknowledges that IMPACT's systems, tools, methodologies, and internal operations constitute proprietary and confidential information. Accordingly, any audit or verification rights granted to Client under this Agreement are limited strictly to verifying compliance with this Agreement and applicable Orders and shall not extend to IMPACT's internal systems, trade secrets, or third-party confidential information.

20.2 Client Audit Requests

Upon reasonable written request and not more than once in any twelve (12) month period, Client may request verification that IMPACT is performing the Services in material compliance with this Agreement and the applicable Order.

Such verification may be satisfied, at IMPACT's discretion, by one or more of the following:

• written certification of compliance;
• summary reports or attestations;
• third-party audit reports or attestation summaries, where available, in accordance with Section 20.3;
• reasonable responses to written inquiries.

20.3 Third-Party Attestation

Where IMPACT then maintains a current third-party security or operational attestation, IMPACT shall, upon Client's reasonable written request and not more than once in any twelve (12) month period, provide Client with a copy or executive summary of the most recent such attestation, subject to (a) execution of a non-disclosure agreement reasonably acceptable to IMPACT (or, if an NDA is already in place between the Parties, subject to such NDA), and (b) IMPACT's reasonable confidentiality, redaction, and distribution restrictions. Examples of qualifying attestations include SOC 2 Type II reports, ISO/IEC 27001 certificates, and substantially equivalent third-party security or operational attestations.

For the avoidance of doubt, IMPACT does not represent that it maintains any specific attestation at any specific time, and IMPACT may, in its discretion, transition between attestation frameworks or temporarily lack a current attestation due to renewal cycles, framework changes, or business considerations. IMPACT is not required to obtain or maintain any particular attestation for the benefit of Client unless expressly stated in an applicable Order.

20.4 Exclusions from Audit Scope

Under no circumstances shall Client be entitled to:

• access IMPACT's internal systems, security tools, or monitoring platforms;
• inspect source code, scripts, automations, or methodologies;
• audit Third-Party Providers directly;
• perform on-site inspections of IMPACT facilities;
• obtain confidential information relating to other clients.

20.5 Regulatory or Legal Audits

If Client is subject to a regulatory or legal audit that requires information related to the Services, IMPACT shall provide reasonable assistance, subject to:

• advance written notice;
• scope limitations to protect IMPACT's confidential information;
• reimbursement of IMPACT's reasonable time and expenses;
• compliance with applicable law and confidentiality obligations.

IMPACT shall have no obligation to respond to audits not directly applicable to the Services provided.

20.6 Cost Allocation

All costs associated with audits, verification requests, or regulatory inquiries initiated by Client shall be borne by Client, unless otherwise required by law.

20.7 No SLT or Liability Expansion

Nothing in this Section 20 shall be construed to expand IMPACT's obligations, create new service commitments, modify Service Level Targets, or increase liability beyond the express terms of this Agreement.

20.8 Survival

The provisions of this Section 20 shall survive termination or expiration of this Agreement.

21. GOVERNING LAW, VENUE & DISPUTE RESOLUTION

21.1 Governing Law

This Agreement, all Orders, Addendums, Schedules, and any disputes arising out of or relating thereto shall be governed by and construed in accordance with the laws of the State of Maryland, without regard to its conflict of laws principles.

21.2 Exclusive Venue

Any legal action or proceeding arising out of or relating to this Agreement, any Order, any Addendum, or any Schedule shall be brought exclusively in the Circuit Court for Wicomico County, Maryland, the District Court of Maryland for Wicomico County, or the United States District Court for the District of Maryland. Each Party irrevocably submits to the personal jurisdiction and venue of such courts and waives any objection to such venue, including any objection based on inconvenient forum, improper venue, or lack of personal jurisdiction.

Notwithstanding the foregoing, either Party may seek injunctive or other equitable relief under Section 21.4 in any court of competent jurisdiction where such relief is necessary to prevent immediate and irreparable harm, and either Party may bring an action to enforce or domesticate a judgment in any court of competent jurisdiction.

21.3 Informal Dispute Resolution

Before initiating any formal legal proceeding, the Parties shall first attempt in good faith to resolve any dispute through informal discussions between executive-level representatives with authority to resolve the dispute.

If the dispute is not resolved within thirty (30) days after written notice of the dispute, either Party may pursue formal remedies as set forth herein.

21.4 Injunctive Relief

Notwithstanding Section 21.3, either Party may seek immediate injunctive or equitable relief in a court of competent jurisdiction without first engaging in informal dispute resolution where necessary to prevent irreparable harm, including but not limited to breaches of confidentiality, intellectual property, or non-solicitation obligations.

21.5 Waiver of Jury Trial

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY HEREBY KNOWINGLY, VOLUNTARILY, AND IRREVOCABLY WAIVES ANY RIGHT TO A TRIAL BY JURY IN ANY ACTION OR PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT.

EACH PARTY ACKNOWLEDGES THAT IT HAS BEEN REPRESENTED BY COUNSEL OR HAS HAD THE OPPORTUNITY TO CONSULT WITH COUNSEL REGARDING THIS WAIVER.

21.6 Attorneys' Fees

In any action or proceeding arising out of or relating to this Agreement, the prevailing Party shall be entitled to recover its reasonable attorneys' fees, court costs, and expenses incurred in connection therewith, in addition to any other relief to which such Party may be entitled.

21.7 Limitation on Claims

No claim, action, or proceeding arising out of or relating to this Agreement may be commenced more than two (2) years after the event giving rise to such claim, to the extent permitted by applicable law. This Section 21.7 is intended to align with the time limitation set forth in Section 15.10.

21.8 Class Action Waiver

To the maximum extent permitted by applicable law, Client waives any right to bring claims against IMPACT on a class, collective, representative, or consolidated basis.

21.9 Survival

This Section 21 shall survive termination or expiration of this Agreement.

22. ASSIGNMENT, SUCCESSORS & CHANGE OF CONTROL

22.1 Binding Effect

This Agreement shall be binding upon and inure to the benefit of the Parties and their respective permitted successors and assigns.

22.2 Assignment by Client

Client may not assign, transfer, delegate, or otherwise convey this Agreement or any Order, in whole or in part, whether by operation of law, merger, consolidation, asset sale, stock sale, or otherwise, without the prior written consent of IMPACT, which shall not be unreasonably withheld.

Any attempted assignment in violation of this Section shall be null and void.

22.3 Change of Control

For purposes of this Agreement, a "Change of Control" means:

• a merger or consolidation involving Client;
• the sale of all or substantially all of Client's assets;
• the transfer of more than fifty percent (50%) of Client's equity or voting power;
• any transaction resulting in a new entity or person obtaining control of Client.

A Change of Control shall be deemed an assignment requiring IMPACT's prior written consent.

22.4 Effect of Change of Control

Upon a Change of Control, IMPACT may, in its discretion:

• require confirmation or modification of the Services and pricing;
• require updated credit or insurance information;
• require execution of updated Orders or Addendums;
• terminate the affected Orders upon written notice if the acquiring entity materially differs in size, risk profile, or business operations.

22.5 Assignment by IMPACT

IMPACT may assign this Agreement and any Orders without Client's consent in connection with:

• a merger, consolidation, or reorganization;
• sale of assets or business line;
• assignment to an affiliate;
• financing or security arrangements.

Client consents in advance to such assignments.

22.6 No Release of Obligations

Any assignment or Change of Control shall not relieve Client of any obligations accrued prior to the effective date of such assignment.

22.7 Survival

The provisions of this Section 22 shall survive termination or expiration of this Agreement.

23. GENERAL PROVISIONS

23.1 Entire Agreement

This Agreement, together with all executed Orders, Addendums, Schedules, and documents incorporated by reference, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous agreements, negotiations, representations, or understandings, whether written or oral.

No purchase order, invoice, email, proposal, or other document issued by Client shall modify this Agreement unless expressly agreed in writing by IMPACT.

23.2 Amendments

This Agreement may be amended only by a written document executed by authorized representatives of both Parties. No oral modification or course of conduct shall constitute an amendment.

23.3 Correction of Errors

IMPACT reserves the right to correct any clerical, typographical, or administrative errors in this Agreement or any Order upon written notice to Client, provided that such correction does not materially alter the scope of Services or pricing without Client's written consent.

23.4 Waiver

The failure of either Party to enforce any provision of this Agreement shall not be deemed a waiver of future enforcement of that or any other provision. Any waiver must be in writing and signed by the waiving Party.

23.5 Severability

If any provision of this Agreement is held by a court of competent jurisdiction to be invalid, illegal, or unenforceable, such provision shall be enforced to the maximum extent permitted by law, and the remaining provisions shall remain in full force and effect.

23.6 Interpretation

This Agreement shall be interpreted as having been drafted jointly by the Parties. No presumption or rule of construction shall apply against either Party as the drafter of this Agreement.

Headings are for convenience only and shall not affect interpretation.

23.7 Independent Contractors

The Parties are independent contractors. Nothing in this Agreement shall be deemed to create any partnership, joint venture, fiduciary relationship, or agency relationship between the Parties.

Neither Party has authority to bind the other.

23.8 No Third-Party Beneficiaries

Except as expressly stated herein, this Agreement is for the benefit of the Parties only and does not create any rights in favor of any third party.

23.9 Notices

All notices under this Agreement shall be in writing and shall be deemed given when:

• delivered personally;
• sent by a nationally recognized courier; or
• sent by electronic mail to the notice address designated by the receiving Party, provided that electronic notice shall be deemed effective only upon confirmation of receipt. Confirmation methods include but are not limited to reply email, read receipt, e-sign platform log, ticketing portal notification, or similar mechanisms.

Each Party is responsible for maintaining current contact information.

23.10 Counterparts; Electronic Signatures

This Agreement may be executed in counterparts, each of which shall be deemed an original. Signatures transmitted electronically (including PDF, DocuSign, Adobe EchoSign, PandaDoc, Microsoft eSignature, or similar platforms) shall be deemed valid and binding.

23.11 Survival

All provisions which by their nature should survive termination or expiration of this Agreement shall survive, including but not limited to provisions relating to:

• fees and payment obligations;
• confidentiality and data protection;
• intellectual property;
• limitation of liability;
• indemnification and subrogation;
• non-solicitation and non-hire;
• post-termination forensic cooperation;
• governing law and dispute resolution.

23.12 Authority

Each Party represents that the individual executing this Agreement on its behalf has full authority to bind such Party.

23.13 Execution and Effective Date

This Agreement is effective as of the date of the last signature below or, if earlier, the effective date of the first executed Order referencing this Agreement.