In plain English — what this agreement does
This is the contract between you (the Customer) and Howspace Oy (the Supplier) for the use of the Howspace platform. The commercial details — what you are paying for, for how long, and at what price — live in the Order Form. The rules that govern the relationship live here, in this Master Subscription Agreement, and in two appendices: the Data Processing Agreement (Appendix 2), which covers personal data, and the Trust & Security Annex (Appendix 3), which covers security, service levels and AI.
If you only read one page, read this one. The full terms apply, but the key commitments are:
- Howspace provides the platform on a Software-as-a-Service basis. Customer Data is stored in the EU/EEA by default. A small number of ancillary functions use named sub-processors that may process limited technical or routing data outside the EU/EEA under the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. The full list and safeguards are in the DPA, Schedules B and C. You and your users own the content you put in.
- You pay annually in advance unless your Order Form says otherwise. Prices may rise at renewal, but only within a transparent, capped formula.
- Either party can choose not to renew with two months' notice. During a fixed term, you remain committed for the term you signed up for.
- Howspace is certified to ISO/IEC 27001:2022 and encrypts data at rest and in transit. AI features in the platform are powered by an EU-hosted enterprise LLM service, classified as low-risk under the EU AI Act, and used transparently. We do not train AI models on your data, and our LLM sub-processor is contractually prohibited from doing so either.
- Liability is capped, with a higher cap for security and confidentiality matters. Personal data is handled under the Data Processing Agreement.
The full terms follow. If anything in the Order Form conflicts with these terms, the Order Form wins. If anything in these terms conflicts with the Data Processing Agreement on personal data, the Data Processing Agreement wins.
Parties
The parties to this Master Subscription Agreement (the "MSA") are:
Howspace Oy (business ID 2153753-6), Salomonkatu 17 A 43, 00100 Helsinki, Finland (the "Supplier"); and
the Customer named in the Order Form (the "Customer").
Agreement structure and order of priority
This MSA, together with the Order Form signed by the Customer and the appendices listed below, forms the agreement between the Supplier and the Customer (the "Agreement"). Only the Order Form is signed. This MSA and each appendix are published online at versioned URLs and are incorporated into the Agreement at the specific versions identified in the Order Form.
The Agreement consists of, in descending order of priority:
the Order Form;
this MSA;
Appendix 2 — Data Processing Agreement (the "DPA"); and
Appendix 3 — Trust & Security Annex.
All appendices form an integral part of the Agreement. In the event of conflict, the document higher in the list above prevails, except that the DPA prevails over all other documents with respect to the processing of personal data.
Howspace Marketplace Terms. The Supplier operates an online directory at https://howspace.com/marketplace/ (the "Marketplace"), governed by the Howspace Marketplace Terms of Service, which the Customer accepts separately by clicking through on the Marketplace (the "Marketplace Terms"). The Marketplace Terms govern the Customer's use of the Marketplace itself (browsing, inquiry and the relationship with third-party partners listed on the Marketplace). They do not govern the Customer's use of the Service. Where a Customer purchases a Howspace Offering through the Marketplace, the resulting Order Form is governed by this Agreement. In the event of a conflict between the Marketplace Terms and this Agreement, (i) the Marketplace Terms prevail with respect to Marketplace-specific subjects (the directory experience, inquiries, third-party partner disclaimers, and Marketplace-platform intellectual property), and (ii) this Agreement (including the DPA) prevails on all other matters, including the Customer's use of the Service, Customer Data, and any matter governed by the DPA.
Subscriptions, Seats and Modules
Subscriptions. Under this Agreement the Customer subscribes to: (a) a subscription to the Howspace platform (the "Core Subscription"), priced on a per-Seat basis; (b) optionally, one or more modules (each a "Module"); and (c) optionally, one or more add-ons (each an "Add-on"). The Customer's Core Subscription, Modules, Add-ons and any one-time fees are specified in the Order Form.
Number of Seats. The Number of Seats is the maximum total number of unique users registered across all open workspaces at any point in time. The Number of Seats committed by the Customer for the Initial Term is set out in the Order Form.
Seat Bands. Supplier pricing is structured into seat bands (each a "Seat Band"). The Customer's committed Seat Band, the unit price per Seat applicable to that Seat Band, and the next applicable Seat Band in the event of an automatic move under section 3.4 are set out in the Order Form.
Automatic move to a higher Seat Band. If the Number of Seats exceeds the maximum of the Customer's committed Seat Band, the Customer is automatically moved to the next applicable Seat Band as set out in the Order Form and is committed to that higher Seat Band for the remainder of the then-current Term. The unit price per Seat applied on an automatic move shall not exceed the unit price per Seat applicable to the Customer at the start of the then-current Term.
Renewal Seat Band. By default, the Customer's Seat Band at the start of each renewal Term is the Seat Band applicable at the end of the immediately preceding Term.
Modules. Each Module is provided as a separate subscription running concurrently with the Core Subscription. The subscription fee, any one-time Implementation Fee, the functional scope and the term of each Module are set out in the Order Form. Where a Module subscription fee is set in the Order Form to scale with the Customer's Seat Band, any automatic move to a higher Seat Band under section 3.4 shall also trigger the corresponding adjustment to the Module subscription fee. Termination or expiry of the Core Subscription terminates each Module on the same date, without prejudice to the early-termination provisions in section 10.
Implementation Services. A Module or an Add-on (including an integration provided by the Supplier) may include a mandatory one-time implementation service (an "Implementation Service") and a corresponding one-time fee (an "Implementation Fee"), each as set out in the Order Form. Implementation Services are delivered once at the start of the Initial Term of the relevant Module or Add-on.
Acceptance of Implementation Services. On completion of an Implementation Service, the Supplier shall notify the Customer in writing. The Customer has ten (10) business days from that notice to accept the Implementation Service or to reject it in writing with specific reasons. If the Customer does not respond within that period, the Implementation Service is deemed accepted. If the Customer rejects the Implementation Service on reasonable grounds, the Supplier shall use commercially reasonable efforts to remedy the defects identified and re-deliver within thirty (30) days. Once accepted (or deemed accepted), the Implementation Fee is non-refundable and is not subject to the renewal increase in section 13.3.
Add-ons. The functional scope, pricing structure (which may be flat-fee, usage-based or one-time), metering, billing cycle, term and any specific termination conditions of each Add-on are set out in the Order Form, and may differ from those applicable to the Core Subscription and to Modules. Unless otherwise stated in the Order Form, termination or expiry of the Core Subscription terminates each Add-on on the same date. An Add-on is part of the Service and is provided by the Supplier under this Agreement.
Marketplace Offerings and Third-Party Offerings. Where the Customer purchases a Howspace Offering through the Marketplace (an "Add-on, Module, Implementation Service or Additional Service provided by the Supplier"), the resulting Order Form incorporates this Agreement and the Offering is part of the Service. A Third-Party Offering (an integration, service, template, or other offering provided by an independent third party listed on the Marketplace) is not part of the Service, is not an Add-on or Module under this Agreement, and is not provided by the Supplier. Each Third-Party Offering is governed by a separate agreement between the Customer and the relevant third party. The Supplier's role in respect of Third-Party Offerings is limited to operating the Marketplace directory, as set out in the Marketplace Terms.
Integrations provided by the Supplier. An integration provided by the Supplier as an Add-on (a "Supplier Integration") may carry both a one-time implementation fee and a recurring maintenance and operation fee, each set out as a separate line item in the Order Form. Unless otherwise stated in the Order Form, the recurring fee covers continued operation of the Supplier Integration with the Application, upkeep for compatibility with the underlying third-party API or service to the extent within the Supplier's reasonable control, and bug fixes. The recurring fee does not cover any fees, licences or subscriptions for the underlying third-party service, which remain the Customer's responsibility. Where the Supplier needs to modify, suspend or discontinue a Supplier Integration because the underlying third-party API or service is altered, deprecated or restricted by the third party, the Supplier shall notify the Customer and the consequences set out in section 7 of the Marketplace Terms shall apply by analogy.
Validity and term
Start date. The start date of the Agreement is the date the Customer signs the Order Form (the "Effective Date"). The start date of the Service is the Subscription Start Date set out in the Order Form or, if no such date is set out, the Effective Date. This Agreement supersedes any prior service agreement between the parties relating to the same subject matter. The duration of the initial term is twelve (12) months unless agreed otherwise in the Order Form (the "Initial Term"; together with any renewal periods, the "Term").
Renewal. Unless agreed otherwise in the Order Form, after the Initial Term the Agreement shall be silently renewed for successive periods of twelve (12) months each, unless either party gives the other written notice of non-renewal (which may be given by email) at least two (2) months before the end of the then-current Term. Where the Supplier has issued a renewal Order Form in accordance with section 15.2(b), the versions of the MSA and appendices stated in that renewal Order Form shall apply for the renewal Term.
Service description
Howspace Subscription. The Supplier shall provide Howspace (the "Service" or "Application") to the Customer on a Software-as-a-Service basis. The Supplier shall deliver the Service as a standard version over the Internet.
Onboarding. The Supplier shall provide basic training for the Customer's administrator(s).
Support, service hours and backups. The Supplier shall provide support via email and phone during office hours (excluding Finnish and Swedish public holidays). Support is offered in Finnish and English. Emails received outside office hours are collected and followed up on a 24/7 basis; however, no action is guaranteed until the next working day. The Supplier's support system automatically monitors servers, the network and the Service 24/7. Incidents are handled during support and service hours. A backup of all data in the Service is created at least once per day. Backups are stored in a different location than the production servers and are retained for a minimum of seven (7) days.
Service levels. Target service levels for the technical availability of the Application, the corresponding service credits, and the chronic-failure termination right are set out in Appendix 3 (Trust & Security Annex).
Modules. Each Module provides additional functionality, content, templates and/or workflows for a specific use case, ordered by the Customer in the Order Form on top of the Core Subscription. The functional scope and any limits of each Module are described on the Supplier's website at the time the relevant Order Form is issued. The Supplier may update the scope of a Module from time to time, subject to retaining the Module's core functionality.
Add-ons. Each Add-on is a discrete capability or feature that extends the Application or the Service, ordered by the Customer in the Order Form. The functional scope and any limits of each Add-on are described on the Supplier's website at the time the relevant Order Form is issued. The Supplier may update the scope of an Add-on from time to time, subject to retaining the Add-on's core functionality.
Additional Services. The Supplier shall provide the consultancy or other additional services described in the Order Form ("Additional Services"). All Additional Services must be ordered by the Customer and confirmed by the Supplier in writing.
User licence and intellectual property
Licence. The Supplier grants the Customer a limited, non-exclusive and non-transferable licence to use the Application, including the Service, subject to any limitations in the Order Form and this MSA, solely for the Customer's internal business operations. The Customer may allow third parties to access the Application or Service for occasional use. The Supplier may, on reasonable grounds related to licence-payment evasion or to the security or stability of the Service, prohibit access by specific third parties. The Customer may give user rights to its end customers ("End Customers") and their personnel. The Customer is liable to the Supplier for its End Customers' and their users' use of the Application and the Service.
Number of Seats. The number of authorised users is specified in the Order Form.
Supplier ownership. All right, title and interest in and to all copyright, patent, trademark, design right, database protection right and any other form of statutory protection (whether registered or unregistered), as well as any know-how, inventions and trade secrets in or related to the Application, the Service and related documentation (including modifications) remain exclusively vested with, and the sole and exclusive property of, the Supplier and/or its licensors or subcontractors.
Reservation of rights. Except as expressly stated in the Agreement, the Agreement does not grant the Customer any intellectual property rights in the Application or the Service. All rights not expressly granted are reserved by the Supplier and its subcontractors or licensors.
Duration. The licence granted under this section 6 is valid only during the Term of the Agreement.
Customer Data and AI
Customer Data. In connection with the use of the Service and the Application, the Customer, End Customers and users may enter data into the Application ("Customer Data"). The intellectual property rights in and the title to Customer Data belong to the Customer or its End Customer. The Customer is solely responsible for the legality, reliability, integrity, accuracy and quality of Customer Data.
No AI training on Customer Data. The Supplier shall not use Customer Data to train any Howspace, Supplier-controlled or third-party foundation model, large language model or other artificial intelligence model. This commitment applies to the Supplier and to its sub-processors. The Supplier may use de-identified and aggregated usage data (data that cannot be reasonably re-identified to the Customer or to any data subject) to operate, secure, improve and develop the Service.
AI within the Application. The Supplier's commitments in respect of artificial intelligence within the Application — including the Supplier's role under the EU AI Act (Regulation (EU) 2024/1689), the risk classification, the no-training commitment, and how new AI capabilities are introduced — are set out in section 5 of Appendix 3 (Trust & Security Annex). The current list of AI capabilities available within the Application is published on the Supplier's Trust Center and may be updated by the Supplier from time to time, subject to the commitments in section 5 of Appendix 3.
Account Data. In addition to processing Customer Data, the Supplier and its sub-processors may process contact-detail and identification data on the Customer and its employees ("Account Data"). Where the Supplier processes Customer Data, Account Data or any other personal data on behalf of the Customer, the DPA applies.
Use restrictions
The Customer shall not, directly or indirectly: reverse engineer, decompile, disassemble or otherwise attempt to discover the source code or underlying ideas or algorithms of the Application; copy, modify, translate or create derivative works based on the Application; rent, lease, distribute, sell, resell, assign or otherwise transfer rights to the Application; use the Application for time-sharing or service-bureau purposes or for the benefit of a third party; circumvent or attempt to circumvent any usage-control features of the Application; or remove any proprietary notices or labels on the Application.
The above restrictions also apply to the Customer having a third party perform any of the above on its behalf or under its instructions.
In accordance with the EU Data Act, the Customer (including any third party receiving data at the Customer's request) shall not use any data obtained through the Application or the Service to develop a service or product that competes with the Application or the Service, nor shall the Customer use such data to derive insights about the economic situation, assets or production methods of the Supplier.
Service warranty and IPR indemnification
Conformance warranty. The Supplier warrants that the Service will materially conform to the Service description (set out in section 5 and in the documentation available on the Supplier's website at the time the Order Form is issued) during the Term. The Customer's sole remedy for a breach of this warranty is that the Supplier shall use commercially reasonable efforts to correct the non-conformance. If the Supplier fails to correct the non-conformance within thirty (30) days of the Customer's written notice, the Customer may terminate the affected Service and receive a pro-rated refund of pre-paid Service Fees for the unused portion of the then-current Term in respect of that Service. Except for the warranty in this section 9.1, and to the extent permitted by mandatory law, the Service is provided with the functionalities available from time to time, without further warranty of any kind, express or implied, including warranties of merchantability and fitness for a particular purpose.
IPR indemnification. The Supplier shall defend any action brought against the Customer alleging that the Service infringes any third-party copyright, trademark, trade secret or other intellectual property right, and shall settle any such action and pay any damages that: (i) a court of competent jurisdiction finally orders the Customer to pay without right of appeal; or (ii) the Customer has paid to a third party as part of a settlement, in each case to the extent the order or settlement results from the Service breaching a third-party intellectual property right.
Indemnity conditions. As a condition to the Supplier's obligations under section 9.2, the Customer shall: (i) notify the Supplier promptly in writing of any event known to the Customer that would give rise to an indemnity obligation; (ii) provide reasonable cooperation and assistance to the Supplier; and (iii) grant the Supplier full authority to manage the defence or settlement of the claim. The Supplier shall maintain control and direction of the defence at its expense, provided that the Customer, at its own expense, has the right to participate in the defence.
Indemnity exclusions. The indemnification obligation in this section 9 does not apply to any claim resulting from: (i) the combination, operation or use of the Application or Service with code or programs not developed or supplied by the Supplier, if such claim would have been avoided without that combination, operation or use; (ii) the use of the Application or Service as modified or enhanced by the Customer, if such modification or enhancement results in the infringement and use of the unmodified Application or Service would have avoided the infringement; or (iii) the use of the Application or Service in violation of the Agreement.
Exclusive remedy. The remedy set out in this section 9, taken together with the limitations in section 12 (Liability), is the Customer's sole and exclusive remedy in respect of third-party claims relating to intellectual property right infringement, to the extent permitted by mandatory applicable law.
Termination
Termination of fixed-term commitments. The Customer may terminate a fixed-term Agreement only at the end of the then-current Term, observing the notice period in section 4.2. If the Customer initiates a request to switch data processing services or terminates the Agreement for convenience before the end of the then-current Term, the Customer remains liable for the full Service Fees for the remainder of that Term.
Supplier termination for cause. The Supplier may terminate the Agreement and/or close Customer accounts immediately and without liability for damages if the Customer: (i) is declared bankrupt or becomes subject to insolvency proceedings; (ii) uses the Service for illegal purposes; or (iii) is in material breach of the Agreement or any other agreement between the parties and fails to remedy the breach within thirty (30) days of written notice. Failure by the Customer to pay Service Fees when due shall always constitute a material breach.
Non-refundability and switching. Service Fees paid in advance for a fixed Term are non-refundable except (a) under the conformance-warranty remedy in section 9.1, (b) where termination is caused by the Supplier's wilful misconduct or gross negligence, or (c) where this Agreement expressly provides for a refund (including the sub-processor objection refund in DPA section 3.2 and the materially-diminished change of terms in section 15.2(a)). For the purposes of Chapter VI of the EU Data Act, Service Fees payable for the remainder of a fixed Term are standard fees for the provision of the Service contracted by the Customer and do not constitute 'switching charges'.
Switching support. On termination or expiry of the Agreement, the Supplier shall provide the switching assistance set out in section 14 below at no additional charge for the activities mandated under Chapter VI of the EU Data Act.
Payment
All Service Fees are exclusive of VAT. VAT and any other applicable taxes or levies shall be added to the Service Fees in accordance with applicable tax law.
Separation of non-recurring and recurring charges. The Order Form shall set out non-recurring charges (including Implementation Fees, one-time integration set-up fees and one-time Additional Services) and recurring charges (including the Core Subscription fee, Module subscription fees, Add-on subscription fees, recurring integration maintenance and operation fees, and any recurring usage-based fees) as separate line items, in a manner that makes clear, for each line item, the amount, the billing cycle, and whether the line item is one-time or recurring.
Unless agreed otherwise in the Order Form, recurring Service Fees — including the Core Subscription fee and any Module subscription fees — are invoiced once, in advance, for the then-current Term.
In the case of an automatic Seat Band move under section 3.4, the Supplier may invoice the pro-rated difference between the previous Seat Band fee and the new Seat Band fee (and any corresponding adjustment to a Module subscription fee under section 3.6) immediately for the remainder of the then-current Term.
Fees for Additional Services are invoiced on a time-and-materials basis unless otherwise agreed in writing.
Implementation Fees, where applicable, are invoiced once at the start of the Initial Term of the relevant Module or Add-on and become non-refundable on acceptance under section 3.8.
Add-on fees (including recurring maintenance and operation fees for Supplier Integrations under section 3.11) are invoiced in accordance with the billing arrangements set out in the Order Form.
Unless agreed otherwise in the Order Form, payment is due fourteen (14) days from the invoice date. Late payment interest accrues in accordance with the Finnish Interest Act (633/1982).
Taxes and withholding. If any taxes are required by law to be withheld on payments by the Customer to the Supplier, the Customer shall (i) deduct such taxes from the amount payable to the Supplier, (ii) pay the taxes to the relevant taxing authority, and (iii) gross up the payment to the Supplier so that the Supplier receives the amount it would have received absent such withholding. The Customer shall promptly furnish the Supplier with tax receipts evidencing the payment of such taxes.
Liability
Exclusion of indirect damages. Subject to section 12.4, neither party shall be liable to the other for any indirect, incidental, consequential, special or punitive damages, or for any loss of profit, loss of revenue, loss of business opportunity, loss of goodwill or loss of anticipated savings, in each case whether arising in contract, tort (including negligence), under statute or otherwise, and whether or not the party was advised of the possibility of such damages.
General liability cap. Subject to sections 12.3 and 12.4, each party's total aggregate liability to the other arising out of or in connection with the Agreement shall be limited, in the aggregate, to the Service Fees paid or payable by the Customer under the Agreement during the twelve (12) months immediately preceding the first event giving rise to the liability.
Enhanced cap for security, confidentiality and Customer Data. For (i) breach by the Supplier of its confidentiality obligations under section 17, (ii) breach by the Supplier of its security obligations under Appendix 3 (Trust & Security Annex), or (iii) loss, unauthorised access to or unauthorised disclosure of Customer Data caused by the Supplier in breach of the Agreement, the Supplier's total aggregate liability under this Agreement shall be limited, in the aggregate, to two (2) times the cap set out in section 12.2.
Carve-outs. The limitations in sections 12.1, 12.2 and 12.3 do not apply to: (a) the Customer's obligation to pay undisputed Service Fees and any applicable taxes; (b) either party's liability for death or personal injury caused by its negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be limited or excluded under applicable mandatory law; (c) either party's liability for wilful misconduct or gross negligence; (d) the Customer's material breach of the use restrictions in section 8, or of the Supplier's intellectual property rights, that results in IP infringement or unauthorised distribution of the Application; or (e) the Supplier's indemnification obligation under section 9, provided that the Supplier's total aggregate liability under section 9 shall not exceed two (2) times the cap set out in section 12.2.
Acknowledgement. The parties acknowledge that the limitations and exclusions in this section 12 reflect the allocation of risk between them, the Service Fees agreed and the availability of insurance, and shall apply regardless of the failure of essential purpose of any limited remedy.
Pricing changes
Automatic invoicing changes triggered by the Customer exceeding the committed Number of Seats take effect immediately and do not require a new signature or additional written approval from the Customer.
Downgrading to a lower Seat Band requires ninety (90) days' prior notice and takes effect at the start of the next Term.
Renewal price indexation. Unless agreed otherwise in the Order Form, the recurring Service Fees (the unit price per Seat for the Core Subscription and each Module subscription fee) are adjusted at the start of each renewal Term by the lower of: (a) five per cent (5%); or (b) the percentage change in the all-items Eurozone Harmonised Index of Consumer Prices (HICP), as published by Eurostat, for the twelve (12) months ending three (3) months before the start of the renewal Term, plus two per cent (2%). The adjustment shall not be less than zero per cent (0%). The aggregate increase over any rolling three-year period shall not exceed fifteen per cent (15%). Implementation Fees are one-time and are not subject to renewal indexation. Pricing arrangements for Add-ons (including any indexation, usage-rate changes or renewal behaviour) are as set out in the Order Form.
Switching and data portability
Right to switch. In accordance with Chapter VI of the EU Data Act, the Customer has the right to switch to another provider of data processing services or to an on-premises ICT infrastructure. The Customer may initiate the process by giving written notice of switching, with a notice period not exceeding two (2) months.
Transitional period. Following the notice period, the Supplier shall provide a transitional period of thirty (30) calendar days to complete the switching process. During this period, the Supplier shall act with due care to maintain business continuity and the functions of the Service, provide reasonable assistance to the Customer to facilitate an effective switch, and ensure a high level of security during data transfer.
Exportable data. The Supplier shall make available for porting all Exportable Data, meaning input and output data generated by the Customer's use of the Service. Exportable Data excludes any data protected by intellectual property rights of the Supplier or constituting a trade secret of the Supplier.
Data retrieval and erasure. After the transitional period, the Customer has thirty (30) calendar days to retrieve its Exportable Data. On expiry of that period or upon successful completion of the switch, the Supplier shall ensure the full erasure of all Customer Exportable Data and digital assets.
No switching charges. The Supplier shall not charge the Customer any fee for the switching activities mandated under Chapter VI of the EU Data Act. The standard Service Fees for the provision of the Service remain fully payable by the Customer for the remainder of the then-current Term in accordance with section 10.1.
Changes to the Agreement
Subject to the automatic invoicing changes described in section 13, any change to the Agreement must be made in writing and accepted in advance by both parties. Changes to the Order Form require execution of a new Order Form.
Generic changes to terms. Notwithstanding section 15.1, the Supplier is entitled to modify this MSA and the appendices as part of a generic change of terms by publishing a new version at the relevant versioned URL, as follows:
Mid-term application. If the Supplier gives the Customer at least ninety (90) days' prior notice of the change (by email to the Customer's billing or primary contact), the new version takes effect at the end of that notice period and applies for the remainder of the then-current Term and for each subsequent Term. Until the new version takes effect, the version of the document identified in the Customer's Order Form (or the most recent version accepted under this section) continues to apply. The Supplier shall not, by way of generic change of terms, materially diminish the security, confidentiality or data-protection commitments of the Supplier without the Customer's prior written consent. If the Customer does not agree to a change and the parties cannot find an amicable solution, the Customer may terminate the Agreement with at least sixty (60) days' notice, and the Supplier shall refund the pro-rated portion of any pre-paid Service Fees for the period after termination takes effect.
Renewal-time application. If the Supplier does not give the notice described in paragraph (a), the version of each document applicable to the Customer remains the version identified in the Customer's Order Form (or the most recent version accepted under this section) for the remainder of the then-current Term. At least sixty (60) days before the end of the then-current Term, the Supplier may issue to the Customer a renewal Order Form referencing the then-current versions of this MSA and the appendices (and any updated pricing). The versions stated in such a renewal Order Form shall apply automatically from the start of the renewal Term, in accordance with section 4.2, unless the Customer gives notice of non-renewal under section 4.2.
Versioning. Each version of this MSA and each appendix is permanently archived at a unique versioned URL. The Supplier shall not retire a versioned URL while any active Agreement references it.
Customer reference
The Supplier may refer to the Customer as a customer of the Supplier in sales and marketing presentations, other materials, and activities.
Confidentiality
Definition. "Confidential Information" means any material or information received by one party from the other party that is marked as confidential or that should reasonably be understood to be confidential, given its nature or the circumstances of disclosure.
Obligations. Neither party shall disclose Confidential Information to any third party, nor use such material or information for purposes other than those stated in the Agreement, except as permitted by section 17.4.
Exclusions. The confidentiality obligation does not apply to material or information that: (i) is generally available or otherwise public; (ii) the party has received from a third party without any obligation of confidentiality; (iii) was in the possession of the receiving party prior to receipt from the other party without any obligation of confidentiality; or (iv) the party has independently developed without using material or information received from the other party.
Permitted disclosures. A receiving party may disclose Confidential Information: (i) where compelled by law, regulation or competent authority, provided that the receiving party gives the disclosing party prompt notice of the requirement where lawful and reasonably practicable, and cooperates with any reasonable effort by the disclosing party to seek confidential treatment or a protective order; (ii) to its professional advisers (including legal, financial, accounting and insurance advisers) that are bound by confidentiality obligations no less protective than those of this section 17; and (iii) to bona fide prospective acquirers, investors or financing parties in connection with a due diligence process, under a written non-disclosure agreement no less protective than those of this section 17.
Survival. The confidentiality obligations in this section 17 survive termination or expiry of the Agreement for a period of three (3) years, except for Confidential Information that constitutes a trade secret under applicable law, in respect of which the obligations survive for so long as the information continues to qualify as a trade secret.
Force majeure
Neither party shall be liable for any failure or delay in the performance of its obligations (other than payment obligations) to the extent that the failure or delay is caused by an event beyond its reasonable control, including acts of God, war, terrorism, civil disturbance, pandemic, epidemic, governmental or regulatory action, failure of the public Internet, failure of third-party cloud or telecommunications providers, or industrial action not involving the affected party's own workforce (each, a "Force Majeure Event").
Notice and mitigation. The affected party shall promptly notify the other party of the Force Majeure Event and use commercially reasonable efforts to mitigate its effects and resume performance.
Long-stop termination. If a Force Majeure Event prevents substantial performance for more than sixty (60) continuous days, either party may terminate the affected Service or, where the Force Majeure Event affects the Service as a whole, the Agreement, by written notice, and the Supplier shall refund the pro-rated portion of any pre-paid Service Fees for the period after termination takes effect.
Insurance
The Supplier shall maintain throughout the Term insurance coverage that is reasonable and appropriate for a SaaS provider of comparable size and scope of operations, including cyber liability insurance, professional indemnity insurance, and commercial general liability insurance, in each case with limits adequate to cover the Supplier's reasonably foreseeable liabilities under this Agreement. On the Customer's written request (not more than once per calendar year, unless following a material incident affecting the Customer), the Supplier shall provide certificates of insurance evidencing the insurance maintained.
Anti-bribery, sanctions and export controls
Anti-bribery. Each party warrants that it has not, and shall not, directly or indirectly, offer, promise, give, request, receive or accept any undue financial or other advantage, or any other thing of value, in connection with the Agreement, that would breach any applicable anti-bribery or anti-corruption laws, including the Finnish Criminal Code, the UK Bribery Act 2010, the US Foreign Corrupt Practices Act, and equivalent legislation in any jurisdiction where the party operates.
Sanctions and export controls. Each party warrants that it shall comply with all applicable economic sanctions and trade restrictions (including those administered by the European Union, the United Nations, the United Kingdom and the United States), and with all applicable export-control laws and regulations, in connection with the performance of the Agreement. Neither party shall, in the performance of the Agreement, deal with any person, entity or country that is the target of comprehensive sanctions.
ICC reference. The parties acknowledge that this section 20 is modelled on the International Chamber of Commerce Anti-Corruption Clause 2022 and shall be interpreted consistently with its purpose.
NIS2 and supply-chain security
Information-security programme. The Supplier shall maintain throughout the Term a documented information-security programme aligned with ISO/IEC 27001:2022 and the controls set out in Appendix 3 (Trust & Security Annex).
Upstream incident notification. The Supplier shall notify the Customer, without undue delay, of any material security incident affecting an upstream sub-processor that the Supplier reasonably assesses could materially affect the security, confidentiality, integrity or availability of the Service provided to the Customer.
Cooperation with NIS2 risk assessments. Where the Customer is, or the Customer's group includes, an entity subject to Directive (EU) 2022/2555 ("NIS2") or to corresponding national implementing legislation, the Supplier shall, on reasonable request and not more than once per calendar year (except in case of a material incident affecting the Customer), provide reasonable cooperation in the Customer's NIS2 supplier risk assessments, including answering reasonable security questionnaires and confirming the Supplier's compliance with the commitments set out in this Agreement.
Assignment
Neither party may assign or otherwise transfer the Agreement, in whole or in part, without the prior written consent of the other party, such consent not to be unreasonably withheld, conditioned or delayed. Notwithstanding the foregoing, either party may, on prior written notice to the other party but without the other party's consent, assign the Agreement: (i) to an Affiliate of the assigning party; or (ii) in connection with a merger, acquisition, reorganisation, or sale of all or substantially all of the assets of the assigning party to which the Agreement relates, provided that the assignee assumes the assignor's obligations under the Agreement. For the purposes of this section 22, "Affiliate" means an entity that controls, is controlled by, or is under common control with the relevant party, where "control" means the direct or indirect ownership of more than fifty per cent (50%) of the voting interests of the entity.
Entire agreement and no reliance
The Agreement constitutes the entire agreement between the parties in respect of its subject matter and supersedes all prior agreements, understandings, representations and warranties, whether written or oral, in respect of that subject matter. Each party acknowledges that, in entering into the Agreement, it has not relied on any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in the Agreement. Nothing in this section 23 limits or excludes liability for fraud or fraudulent misrepresentation.
Survival
The following provisions survive termination or expiry of the Agreement to the extent necessary to give effect to their purpose: section 6 (so far as it preserves the Supplier's intellectual property rights), section 7 (Customer Data and AI training), section 9 (Service warranty and IPR indemnification, in respect of claims arising before termination), section 10 (Termination, including section 10.3 on non-refundability), section 11 (Payment, in respect of accrued fees), section 12 (Liability), section 14 (Switching and data portability, for the duration of the transitional and retrieval periods), section 17 (Confidentiality), section 20 (Anti-bribery, sanctions and export controls), this section 24, and section 25 (Governing law and dispute resolution). The DPA survives in accordance with its own terms.
Governing law and dispute resolution
Governing law. The Agreement is exclusively governed by and construed in accordance with the laws of Finland, without regard to its choice-of-law rules.
Dispute resolution. Any dispute, controversy or claim arising out of or relating to the Agreement, including its breach, termination or validity, shall be finally settled by arbitration in accordance with the Arbitration Rules of the Finland Chamber of Commerce. The number of arbitrators shall be one (1). The seat of arbitration shall be Helsinki, Finland. The language of the arbitration shall be English. The arbitral proceedings and award shall be confidential. Nothing in the Agreement limits either party's right to seek interim injunctive relief or to enforce an arbitration award in any court of law. With respect to any violation by the Customer of any of the Supplier's intellectual property rights, confidential information or payment obligations, the Supplier may, at its sole discretion, seek remedies in public courts within any applicable territory.
Miscellaneous
Severability. If any part of the Agreement is held to be invalid or unenforceable by a court, tribunal or other authority having jurisdiction, the validity and enforceability of the remainder of the Agreement shall not be affected. The Agreement shall be construed and interpreted so that its effect remains as close as legally possible to the effect it would have had without that invalidity or unenforceability.
No waiver. A failure or delay by either party in exercising any right under the Agreement shall not constitute a waiver of that right.
No third-party beneficiaries. Except as expressly stated in the Agreement, nothing in the Agreement is intended to confer any rights or remedies on any person other than the parties.