Information Security Exhibit

Data Protection Exhibit · Information Security Exhibit

“LeapGreat Systems” means the LeapGreat Platform and Our Technology but excludes any system that the Customer owns or makes available to LeapGreat for the purposes of the Agreement or any third party systems.

Technology Maintenance. LeapGreat maintains security and back-up processes and procedures, hardware, software, information technology systems, facilities, and other information technology services (including applying bug fixes, patches, repairs, updates and problem corrections to any of the foregoing), that are, at all times during the Term, consistent with internationally recognized industry best practices. Such practices shall include, without limitation, the use of appropriate and up-to-date firewall and anti-virus software; maintaining said countermeasures, operating systems, and other applications with up-to-date current virus definitions and security patches; installing and operating security mechanisms in the manner in which they were intended that are designed to ensure that Customer will not be impacted and its operations will not be disrupted; and permitting only authorized users access to LeapGreat Systems and Customer Data.

Secure Authentication. Where the Subscription or Services require that Customer, or any other person, connect or interconnect with any LeapGreat Systems, LeapGreat will enforce with access controls through the Internet that are consistent with internationally recognized industry best practices.

User Access/Security. LeapGreat will protect all such Customer Data with security measures that: (i) are appropriate to the sensitivity of such Customer Data; and (ii) are compliant with applicable laws and regulations of the jurisdiction in which such Customer Data was created. Depending on the nature of such Customer Data, such security measures may include physical controls (for example, keeping Customer Data in locked cabinets), password protection of electronic files, encryption of data, firewalls and anti-virus software or other measures to protect the security of information technology systems or file storage areas.

Data Access and Segregation. LeapGreat will: (i) ensure that Customer has access to all Customer Data; (ii) ensure that Customer may extract and delete all Customer Data; and (iii) store all Customer Data in a manner where such Customer Data is segregated from the information or data of any other customer by means of a dedicated single-tenant instance per customer.

Encryption. LeapGreat will: (i) treat and handle all Customer Data as if it falls within the LeapGreat’s most sensitive category of data, whether or not the applicable Customer Data falls within such category of data; and (ii) encrypt all Customer Data in electronic format, whether in rest or in transit, which encryption will comply with internationally recognized industry best practices. Encryption in transit uses TLS 1.3; Customer Data at rest is encrypted with AES-256.

Backup and Recovery. LeapGreat’s back-up and recovery procedure will ensure that (i) all Customer Data is backed-up to an alternative site on a daily basis or at another frequency, as set out in an applicable Order; (ii) the Subscription can be restored to full functionality after a business interruption in accordance with the Subscription service levels.

Data Residency. If requested, LeapGreat will inform Customer where such Customer Data is stored and processed, including the name of any cloud provider. If the Customer desires that its Customer Data be stored and processed in a specific country, then upon entering into Order for such custom cloud services, LeapGreat will store and process the Customer Data in that location.

Data Retention. LeapGreat will only retain such Customer Data until the earlier of: (i) receipt of any request to return or destroy the Customer Data in accordance with the Agreement; (ii) as long as is reasonably necessary for LeapGreat to fulfill its obligations under this Agreement; or (iii) 60 days after termination of the Agreement.

Security Breaches: Upon the occurrence of any actual or suspected security breach, LeapGreat shall do the following: (i) contain, and mitigate the effects of the security breach; (ii) notify Customer by email without undue delay, such notice to include a detailed description of the security breach and the data affected; (iii) communicate on an ongoing, regular basis (at least weekly) with Customer with respect to the security breach and provide information relating thereto while the security breach is ongoing (including root cause, status, effects, and implementation of work around and final resolution activities); (iv) take all steps necessary to prevent the recurrence of such security breach; (v) on resolution of the security breach, provide information to Customer with respect to the security breach, its resolution, and the measures taken to ensure it does not re-occur.

Penetration Testing. LeapGreat has an independent service provider perform penetration testing on LeapGreat Systems at least once annually. LeapGreat will make available upon Customer request a report which includes: (i) the results of any such test; and (ii) LeapGreat’s plan to remediate any vulnerabilities uncovered during such test.

Independent Third Party Audit. If requested by Customer, LeapGreat will, at Customer’s expense, have an independent service provider perform an internal control audit on the Subscription, Services and any facilities from which the Subscription and Services are provided. Prior to any such audit, LeapGreat will submit the details of the audit plan and cost, including the scope, control objectives and internal controls, the tests to be performed and the reports to be prepared, to Customer for Customer’s prior approval, no later than 90 days prior to the commencement of such internal control audit. Following the completion of any internal control audit, LeapGreat will promptly deliver to Customer: (i) the auditor’s report; and (ii) LeapGreat’s plan to correct any deficiencies uncovered in any such audit (if any).

---

LeapGreat Inc. · Data protection contact: privacy@leapgreat.com

Prior versions are available in the version archive. This document is incorporated into the LeapGreat Terms & Conditions by reference.