Services Terms (PSA)

• These Services Terms (the "Terms") apply when a Statement of Work, Service Order or Change Order (each a "SOW") references them, or when the parties have signed a Master Service Agreement that incorporates them.
• The Terms cover both direct customers and channel partners who resell or white-label Xcelocloud services. Partner-specific provisions are in section 10 and apply only where a Partner Operating Agreement is in effect.
• The version in effect is the one published here on the Effective Date of the SOW. We keep prior versions available on request; a SOW is not affected by later changes to these Terms unless the parties agree in a Change Order.

• "Xcelocloud," "XC," "we" — Xcelocloud, Inc., a Georgia corporation, 5331 East Mockingbird Lane, Suite 411, Dallas, Texas 75206.
• "Customer," "you" — the entity that signs a SOW. Where that entity resells or delivers the Services to third parties under a Partner Operating Agreement, it is also a "Partner," and the third parties are "End Customers."
• "Services" — the managed, engineering, project, field, service-desk, security or other services described in a SOW.
• "Platform" — XceloHub, the Partner Portal and related Xcelocloud software, tooling, workflows, documentation and know-how used to deliver the Services.
• "Customer Data" — data submitted to the Platform or collected and processed on your behalf in the course of the Services.
• "Deliverables" — reports, documents, configurations, code or other work product expressly identified as a deliverable in a SOW.
• "Security Incident" — unauthorized access to, or use, disclosure, alteration or destruction of, Customer Data in Xcelocloud's possession or control.
• "Service Levels" — the measurable response, resolution or availability commitments stated in a SOW, including any credit mechanism in that SOW.

Each SOW, together with these Terms, forms a separate contract. If a SOW conflicts with these Terms, the SOW controls for scope, schedule, deliverables, Service Levels, fees, invoicing, term and termination of that engagement. A SOW may not reduce any limitation of liability, expand or narrow any indemnity, or alter the governing-law and dispute-resolution provisions of these Terms unless it says so expressly, identifies the section being changed, and is signed by an officer of each party.

Where a Partner Operating Agreement or other program addendum exists, the order of precedence is: (1) these Terms and any signed Master Service Agreement; (2) the SOW, for matters it expressly addresses; (3) the Partner Operating Agreement; (4) program collateral and enablement materials, which are informational and not binding. Terms printed on or referenced by a purchase order have no effect.

Performance

Xcelocloud will perform the Services described in each SOW with the skill and care of a recognized professional firm providing similar services, in accordance with the specifications in the SOW, the manufacturer's documentation for in-scope products, and generally accepted industry practice, in that order of priority. Xcelocloud assigns a named engagement or project manager for each SOW who is the primary point of contact.

Change control

Changes to scope, schedule, deliverables, Service Levels, price or term require a written Change Order signed by authorized representatives of both parties. Operational changes within the agreed scope follow the change-management procedure in the SOW. Delays caused by Customer or its agents may lead to a Change Order adjusting schedule and fees to reflect Xcelocloud's direct costs.

Platform license

For the term of each SOW, Xcelocloud grants Customer a revocable, non-exclusive, non-transferable right to access and use the Platform solely for business purposes directly related to the Services. Use is subject to the Acceptable Use Policy in our Terms & Conditions. Customer is responsible for the confidentiality of its credentials and for all activity under accounts it controls.

Third-party products

Hardware, software and cloud subscriptions supplied through the Services remain subject to their manufacturers' or publishers' license terms, which Customer agrees to comply with. Xcelocloud passes through manufacturer warranties to the extent it is permitted to. Xcelocloud represents that it has the right to provide the Services and Platform without infringing third-party rights.

Acceptance

Where a SOW defines acceptance criteria, deliverables are accepted when they meet those criteria or, if Customer has not rejected them in writing with specific reasons within the review period stated in the SOW (ten business days if none is stated), on expiry of that period. Managed and recurring Services are governed by Service Levels rather than acceptance.

• Fees, billing frequency and any non-recurring charges are stated in the SOW. All amounts are in US dollars and exclude taxes; Customer pays applicable sales, use and similar taxes other than taxes on Xcelocloud's income.
• Invoices are issued electronically and due 30 days after receipt. Customer must notify Xcelocloud in writing of any disputed amount within 30 days of the invoice and pay the undisputed balance on time.
• Pre-approved expenses (direct materials, reasonable travel) are billed at cost with substantiation.
• Amounts more than 30 days past due and not subject to a good-faith dispute accrue interest at 1.5% per month or the maximum lawful rate, whichever is lower. Xcelocloud may suspend affected Services on 15 days' written notice and terminate them on 30 days' written notice if the amount remains unpaid; Xcelocloud will not suspend Services over an amount under good-faith dispute.
• Unless the SOW says otherwise, committed recurring fees are non-cancellable for the SOW term, and Service Level credits are applied against future invoices and are not redeemable for cash.

• Each SOW runs for the term stated in it and, unless it says otherwise, renews automatically for successive 12-month periods unless either party gives written notice of non-renewal at least 60 days before the end of the current term.
• Either party may terminate a SOW for the other's material breach that remains uncured 30 days after written notice. Xcelocloud may terminate without a cure period for Customer's material breach of the confidentiality, intellectual-property or data-protection sections.
• Where a SOW permits termination for convenience, it will state the notice period and any early-termination amounts, which may include fees for the remaining committed term, unamortized onboarding charges, and non-cancellable third-party commitments made for Customer.
• On termination Xcelocloud will invoice for Services performed and approved expenses incurred through the termination date; Customer will pay undisputed amounts; each party will return or destroy the other's Confidential Information on request; and Xcelocloud will provide reasonable transition assistance under a Change Order.
• Expiry of a Master Service Agreement does not terminate SOWs then in effect; they continue under these Terms through their stated term.

Xcelocloud warrants that for 90 days after completion of project Services, or on an ongoing basis for recurring Services, the Services will conform to the SOW and be performed with professional skill and care. As Customer's exclusive remedy for breach of this warranty, Xcelocloud will re-perform the non-conforming Services at its expense or, if it cannot make them conform within a reasonable time, refund the fees paid for the non-conforming Services. Each party warrants that it is not a sanctioned person and will comply with applicable export-control and sanctions laws; either party may remove personnel or terminate a SOW to the extent required to stay in compliance.

EXCEPT AS EXPRESSLY STATED IN THESE TERMS OR A SOW, XCELOCLOUD MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT, AND DOES NOT WARRANT THAT THE SERVICES WILL PREVENT EVERY SECURITY INCIDENT OR THAT THE PLATFORM WILL BE UNINTERRUPTED OR ERROR-FREE.

• Customer retains all rights in Customer Data and in intellectual property it owned before, or acquires independently of, the Services. Customer grants Xcelocloud a non-exclusive, royalty-free right to process Customer Data solely to perform the Services and related obligations.
• Xcelocloud retains all rights in the Platform and in its pre-existing or independently developed tools, methodologies, playbooks, templates, runbooks, detection content and know-how, including any configuration, integration, modification or improvement made to the Platform while performing the Services.
• Deliverables expressly identified in a SOW as Customer-owned become Customer's property on payment. All other deliverables are licensed to Customer, non-exclusively and for its internal business purposes, for the term of the SOW or perpetually if the SOW so states.
• Third-party intellectual property remains with its owner and is subject to its own license.
• Nothing in these Terms prevents Xcelocloud from providing similar services or developing similar deliverables for others, provided it does not use Customer's Confidential Information, Customer Data or Customer-owned deliverables.
• Feedback about the Services or Platform may be used by Xcelocloud without restriction or compensation.

Each party will protect the other's Confidential Information with at least reasonable care, use it only to perform or receive the Services, and disclose it only to employees, contractors and advisers who need to know it and are bound by equivalent obligations. Confidential Information includes the terms and pricing of any SOW, security telemetry and incident details, Platform contents, and non-public business and technical information. It excludes information that is public through no fault of the recipient, already rightfully known to the recipient, independently developed, or rightfully received from a third party without restriction. Disclosure compelled by law is permitted with prompt notice where lawful. These obligations last for five years after the last SOW ends and, for trade secrets, as long as the information remains a trade secret. Breach may be restrained by injunction without a bond.

• Xcelocloud processes Customer Data only on Customer's documented instructions as set out in the SOW and these Terms, and in compliance with applicable data-protection law.
• The Xcelocloud Data Processing Addendum (DPA), published alongside these Terms, forms part of every SOW under which Xcelocloud processes personal data on Customer's behalf, and prevails over these Terms for personal data.
• Xcelocloud maintains administrative, technical and physical safeguards appropriate to the sensitivity of Customer Data and the risk of the Services, as further described in the SOW and DPA.
• Xcelocloud will notify Customer of a confirmed Security Incident affecting Customer Data without undue delay and within the period stated in the DPA, and will cooperate in investigation and remediation.
• Customer is responsible for the lawfulness of Customer Data, for obtaining any consents required to share it, for its own security controls outside Xcelocloud's scope, and for not submitting regulated data outside the scope agreed in a SOW.
• Services are delivered from the United States and, where the SOW permits, from Xcelocloud delivery centers in other countries. Cross-border transfers of personal data are governed by the DPA.

• Resale and branding. Subject to the Partner Operating Agreement, Partner may market, sell and deliver the Services to End Customers under its elected brand posture (partner-branded, co-branded or Xcelocloud-branded), invoice End Customers directly at prices Partner sets, and use Xcelocloud's trademarks and approved materials under the Brand Use Guidelines then in effect. Xcelocloud retains all rights in the Services, Platform and its marks; no ownership transfers to Partner or any End Customer.
• Flow-down. Partner will ensure its agreement with each End Customer contains terms at least as protective of Xcelocloud as these Terms regarding acceptable use, intellectual property, confidentiality, data protection, limitation of liability and third-party license compliance, and will not make commitments on Xcelocloud's behalf beyond the SOW.
• Microsoft CSP. Where Services include Microsoft cloud subscriptions under Xcelocloud's Cloud Solution Provider authorization, Partner's End Customer agreements must be consistent with the Microsoft Customer Agreement and CSP program requirements, and Partner will provide the End Customer information Xcelocloud reasonably needs for CSP compliance. Xcelocloud may suspend or terminate CSP-based Services to the extent required to maintain its authorization.
• Partner-fronted SOWs. Where Partner is the contracting party to the End Customer, Partner remains responsible to Xcelocloud for payment and for End Customer compliance, and Xcelocloud's obligations run to Partner unless the SOW states otherwise.
• Brand license termination. On expiry or termination of the Partner Operating Agreement, Partner will cease using Xcelocloud marks and withdraw co-branded or white-labeled materials, subject to any transition period agreed in writing.

• Provide timely access to sites, systems, cloud tenants, software, credentials and personnel reasonably required for the Services; consent to access will not be unreasonably withheld.
• Ensure any physical site where Services are performed is safe and free of hazardous materials; Xcelocloud may decline work at an unsafe site.
• Maintain the licenses, support contracts and backups for its own environment except where a SOW assigns them to Xcelocloud.
• Cooperate in inspection and acceptance procedures and respond to requests for decisions within the periods stated in the SOW.
• Use the Services only for its own internal business or, as a Partner, for End Customers under the Partner Operating Agreement.

Xcelocloud will defend and indemnify Customer and its affiliates, officers, directors and employees against third-party claims, and resulting damages, costs and reasonable attorneys’ fees finally awarded or agreed in settlement, arising from (a) an allegation that the Services or Platform, as provided by Xcelocloud, infringe a United States patent, copyright, trademark or trade secret, except to the extent caused by Customer's modifications or by combination with items not provided or authorized by Xcelocloud; (b) claims by Xcelocloud personnel relating to their employment or engagement; or (c) Xcelocloud's failure to comply with laws, permits or regulatory approvals applicable to its performance. For infringement claims Xcelocloud may, at its option, procure the right to continue, modify the Services to be non-infringing, replace them with a substantially equivalent service, or, if none is commercially reasonable, terminate the affected Services and refund prepaid fees for the unused period.

Customer will defend and indemnify Xcelocloud and its affiliates, officers, directors and employees against third-party claims arising from (a) Customer Data or Customer's instructions; (b) Customer's or its End Customers' use of the Services in breach of these Terms or applicable law; (c) taxes and related penalties that are Customer's obligation; or (d) Customer's failure to comply with laws, permits or regulatory approvals applicable to its business.

Each party will indemnify the other for personal injury, death or damage to tangible property caused by its gross negligence or willful misconduct. The indemnified party must give prompt notice, allow the indemnifying party to control the defense and settlement (no settlement may impose obligations on the indemnified party without its consent), and reasonably cooperate. Indemnification is the exclusive remedy for the claims it covers, without limiting either party's right to terminate for cause.

NEITHER PARTY IS LIABLE TO THE OTHER FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOSS OF DATA OR BUSINESS INTERRUPTION, HOWEVER CAUSED AND EVEN IF ADVISED OF THEIR POSSIBILITY. EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO A SOW WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER UNDER THAT SOW IN THE TWELVE MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

These limitations do not apply to a party's indemnification obligations, to breach of the confidentiality section, to Customer's payment obligations, or to a party's gross negligence, willful misconduct or fraud. Liability for breach of the data-protection section is subject to the cap stated in the DPA or, if none, to the cap above. Service Level credits are the exclusive financial remedy for failure to meet Service Levels, unless the failure also constitutes a material breach permitting termination.

During the term of any SOW Xcelocloud will maintain commercial general liability, workers’ compensation and employer's liability as required by law, technology errors-and-omissions and cyber liability, and, where field Services are performed, automobile liability, each with commercially reasonable limits appropriate to the Services. Certificates of insurance are available on request.

• Independent contractors. The parties are independent contractors. Xcelocloud personnel remain Xcelocloud's employees or contractors; nothing creates an employment, agency, partnership or joint-venture relationship, and neither party may bind the other.
• Subcontractors. Xcelocloud may use subcontractors and affiliates, remains responsible for their performance, and will bind them to confidentiality and data-protection obligations consistent with these Terms. The DPA governs subprocessors of personal data.
• Non-solicitation. During a SOW and for 12 months after, neither party will directly solicit for employment the other's personnel who performed or received the Services, except through general advertising not targeted at those individuals.
• Assignment. Neither party may assign a SOW without the other's written consent, except to an affiliate or a successor in a merger, acquisition or sale of substantially all assets, on notice. Any other attempted assignment is void.
• Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, excluding payment obligations; the affected party will notify the other and resume performance as soon as practicable.
• Notices. Legal notices must be in writing, delivered by courier or certified mail to the addresses in the SOW, with a copy by email to legal@xcelocloud.com (for Xcelocloud) and the email in the SOW (for Customer).
• Publicity. Neither party will use the other's name or marks in publicity without consent, except that Xcelocloud may identify Customer as a customer in lists unless Customer opts out in the SOW, and Partners may use Xcelocloud marks under section 10.
• Compliance. Each party will comply with laws applicable to it, including anti-corruption, export-control, sanctions and employment laws.
• Survival. Sections on fees, intellectual property, confidentiality, data protection, indemnification, limitation of liability, governing law and any other provision that by its nature should survive, survive termination.
• Entire agreement; amendments; waiver; severability. These Terms, the DPA and each SOW are the entire agreement for that engagement and supersede prior proposals. Amendments must be in a signed writing. Failure to enforce a provision is not a waiver. If a provision is unenforceable the remainder stays in effect.

These Terms and every SOW are governed by the laws of the State of Texas, without regard to conflict-of-law rules; the UN Convention on Contracts for the International Sale of Goods and UCITA do not apply. Before formal proceedings, either party may give written notice of a dispute, after which executives with authority to settle will meet within 15 days and negotiate in good faith for at least 30 days from the notice. Xcelocloud will continue performing, and Customer will continue paying undisputed amounts, during the dispute. Disputes not resolved informally will be settled by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules before a single arbitrator in Dallas, Texas, in English; the award is confidential and may be entered in any court of competent jurisdiction. Either party may seek injunctive relief in the state or federal courts in Dallas County, Texas, for breach of confidentiality, intellectual-property or acceptable-use obligations, and those courts have exclusive jurisdiction for any claim not subject to arbitration. Claims must be brought within two years of arising.

Contract questions and legal notices: legal@xcelocloud.com. Xcelocloud, Inc., 5331 East Mockingbird Lane, Suite 411, Dallas, TX 75206, United States.