Master Services Agreement

1. Aruga is in the business of providing cyber security managed services and any ancillary services.
2. The Customer wishes to obtain and Aruga wishes to provide the Services on the terms set out in this Agreement.

The parties agree the following terms and conditions.

The following definitions and rules of interpretation apply in this Agreement:

Agreement:

has the meaning set out in clause 2.1.

Affiliate:

in relation to a party, any entity that directly or indirectly controls, is controlled by, or is under common control with that party from time to time.

Applicable Data Protection Laws:

means:

1. To the extent the UK GDPR applies, the law of the United Kingdom or of a part of the United Kingdom which relates to the protection of personal data.
2. To the extent the EU GDPR applies, the law of the European Union or any member state of the European Union to which Aruga is subject, which relates to the protection of personal data.

Applicable Laws:

all applicable laws, statutes, regulation and codes from time to time in force.

Aruga’s Equipment:

any equipment, including tools, systems, cabling or facilities, provided by Aruga to the Customer and used directly or indirectly in the supply of the Services, including any such items specified in a SOW but excluding any such items which are the subject of a separate agreement between the parties under which title passes to the Customer.

Aruga Personal Data:

any personal data that Aruga processes in connection with this Agreement, in the capacity of a controller.

Authorised User/s:

means an individual who is authorised by the Customer to use any Third Party software and/or a services under this Agreement.

Business Day:

a day, other than a Saturday, Sunday or public holiday in England, when banks in London are open for business.

Business Hours:

the period from 9.00 am to 5.00 pm on any Business Day.

Change Order:

has the meaning given in clause 10.1.

Control:

has the meaning given to section 1124 of the Corporation Tax Act 2010, and controls, controlled and the expression change of control shall be construed accordingly.

Commencement Date:

the date when the Order Form has been signed by both parties.

Charges:

the Charges payable by the Customer for the Services, together with the breakdown of Charges and the applicable payment frequency set out in the relevant Order Form (or, where applicable, in the Proposal), and any other sums payable by the Customer under this Agreement.

Customer’s Equipment:

any equipment, including tools, systems, cabling or facilities, provided by the Customer, its agents, subcontractors or consultants which is used directly or indirectly in the supply of the Services including any such items specified in a SOW.

Customer Materials:

all documents, information, items and materials in any form, whether owned by the Customer or a third party, which are provided by the Customer to Aruga in connection with the Services, including the items provided pursuant to clause 6.1(d).

Customer Personal Data:

any personal data which Aruga processes in connection with this Agreement, in the capacity of a processor on behalf of the Customer.

Cyber-Security Threat:

any event, act, or attempted act delivered via or involving cyberspace that is intended to disrupt, disable, destroy, compromise, or maliciously control any computing environment, system, network, infrastructure, or service; or that is intended to corrupt data integrity, exfiltrate, access, or steal information.

Deliverables:

any output expressly identified as a deliverable in a SOW or, where no SOW applies, in the Service Description, if neither specifies there are no Deliverables under the Agreement no Deliverables form part of the Services under the Agreement.

EU GDPR:

means the General Data Protection Regulation ((EU) 2016/679), as it has effect in EU law.

Initial Term:

means the initial term specified in the Order Form from the date specified in the Order Form (or, if none is specified, twelve (12) months) from the Commencement Date.

Intellectual Property Rights:

patents, utility models, rights to inventions, copyright and neighbouring and related rights, moral rights, trademarks and service marks, business names and domain names, rights in get-up and trade dress, goodwill and the right to sue for passing off or unfair competition, rights in designs, rights in computer software, database rights, rights to use, and protect the confidentiality of, confidential information (including know-how and trade secrets) and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted, renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world.

Master Service Agreement or MSA:

This Agreement as amended from time to time.

Order Form:

means the Order Form template published by Aruga for use under this Master Services Agreement, as completed and signed by the parties.

Renewal Term:

has the meaning set out in clause 3.1.

Policies:

Aruga’s business policies, as made available to the Customer at the following URL https://arugacyber.com/x/4e2a7c9b1f53. Aruga is under no obligation to notify the Customer directly of any update, amendment or replacement of the Policies, and the Customer shall be solely responsible for periodically checking the above URL to ensure it is aware of, and complies with, the current version of the Policies in force from time to time.

Quote:

means the draft Order Form documentation setting out an estimate of the Services prior to being signed by both parties.

Proposal:

a document issued by Aruga to the Customer describing the Services on offer, including the Service Description(s), the associated Charges and the SOW. The SOW forms part of the Proposal and is not a separate document. The Proposal becomes binding only to the extent, and only in respect of the Service Descriptions, Charges and SOW expressly incorporated into the Order Form in accordance with this Agreement.

Third Party Software:

software proprietary to any third-party supplier that is either licensed to the Customer or used by Aruga in providing the Services.

Software Licence:

any software licence agreement that the Customer is required to enter into in respect of Third Party Software used in the Services or required to complement the Services under a relevant Order Form and/or SOW.

Services:

the service selected in the relevant Order Form, as described in the applicable Service Description incorporated by reference into that Order Form, and, where applicable, further detailed in any SOW.

Service Description:

the description of the Services set out in the paper Proposal identified in, and incorporated by reference into, the relevant Order Form. Where an Order Form incorporates a Service Description from such a Proposal, only that Service Description, together with the Charges and (where applicable) the SOW set out in the Proposal, forms part of this Agreement. No other part of the Proposal has any contractual effect.

Service Level Agreement or SLA:

any service levels set out in the Service Description, any SOW or otherwise agreed in writing between the parties.

Services Start Date:

the date on which Aruga is to begin providing the Services, as set out in the Order Form. If no date is specified in the Order Form, the Services Start Date is the Commencement Date.

Statement of Work or SOW:

the statement of work set out within, and forming part of, the Proposal referenced in the relevant Order Form. The SOW is incorporated into this Agreement only where the corresponding Service is selected in that Order Form, and describes the Services to be provided by Aruga, the timetable for their performance, and any related matters.

Third Party:

means any services, goods, code or software provided by a third party supplier pursuant that Aruga agrees to source for the provision of all or part of the Services.

TUPE Annex:

the annex containing the detailed TUPE provisions, in the form maintained by Aruga, which is incorporated into an Order Form only where expressly stated in that Order Form.

UK GDPR:

has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.

VAT:

value added tax or any equivalent tax chargeable in the UK or elsewhere.

In this Agreement:

1. clause, Schedule and paragraph headings do not affect interpretation;
2. words importing one gender include all genders and the singular includes the plural and vice versa;
3. a reference to a person includes a natural person, and any company or other body corporate wherever incorporated;
4. a reference to legislation includes it as amended or re-enacted and all subordinate legislation made under it;
5. a reference to writing includes email;
6. any reference to including, in particular or similar words is illustrative and does not limit the words preceding them;
7. any obligation not to do something includes an obligation not to allow it to be done;
8. any reference to the Supplier is a reference to Aruga; and
9. The Order Form, the SOW (where applicable), the Service Description, the Charges, and any SOW elements of a Proposal that the Order Form expressly incorporates, together with any other documents stated in the MSA to be incorporated into this Agreement, all form part of this Agreement and take effect as if set out in full in its body. No other part of any Proposal has contractual effect.

This Agreement is made up of the following:

1. the Order Form;
2. the SOW;
3. the MSA (including reference to any other expressly incorporated documents);
4. the Aruga Data Processing Agreement; and
5. any Software License.

2.2 If there is any conflict or ambiguity between the terms of the documents listed in clause 2.1, a term contained in a document higher in the list shall have priority over one contained in a document lower in the list.

2.3 The purpose of this MSA is to establish the terms and conditions that, together with the Order Form, any SOW and any Software Licence, govern the performance of the Services and the provision of the Deliverables between Aruga and the Customer. This Agreement contains the only terms and conditions under which Aruga intends to perform the Services. It governs the provision of the Services and/or Deliverables to the exclusion of all other terms and conditions, including any terms contained in or attached to any purchase order, invoice or similar documentation.

3.1 This Agreement commences on the Commencement Date, being the date on which the relevant Order Form is signed and becomes binding. The Services shall begin on the Services Start Date specified in the Order Form, or, if no Services Start Date is specified, on the Commencement Date. This Agreement continues for the Initial Term, unless terminated earlier in accordance with clause 18 (Termination), and shall automatically renew for successive twelve (12)-month periods (each a Renewal Term) unless either party gives the other not less than 90 days’ written notice prior to the end of the Initial Term or the then-current Renewal Term to terminate this Agreement.

3.2 Subject to clause 3.1, if the Customer seeks to terminate this Agreement before the end of the Initial Term or any Renewal Term, the Customer shall remain fully liable for all Charges payable for the remainder of the Initial Term or the then-current Renewal Term.

3.3 The parties shall not enter into any further Order Forms and/or SOWs after the date on which written notice to terminate the Agreement is served under clause 3.1.

4.1 Aruga may issue the Customer with a Proposal describing the Services on offer, including an indicative Service Description, Charges and where relevant a SOW. A Proposal does not form part of this Agreement and creates no binding obligation on either party, save as set out in clause 4.11.

4.2 Where the Customer wishes to accept a Proposal, Aruga shall prepare a draft Order Form incorporating the relevant Service Description, Charges (where included in the Proposal) the SOW set out in the Proposal.

4.3 The Customer may procure any of the Services by agreeing an Order Form and where relevant a SOW with Aruga pursuant to this clause 4 and in accordance with this Agreement.

4.4 Aruga shall provide the Services from the Services Start Date (and if not specified the Commencement Date) in accordance with this Agreement.

4.5 Each Order Form shall be agreed as follows:

1. After acceptance of a Proposal under clause 4.2, or on the Customer’s request, the Customer shall provide Aruga with all information reasonably required to prepare a draft Order Form for the requested Services;
2. Aruga shall, as soon as reasonably practicable, either:
   1. decline to provide the requested Services, or
   2. issue a draft Order Form.

4.6 The parties shall agree the draft Order Form. Once signed by both parties, the Order Form becomes legally binding under this Agreement and incorporates, by reference, the Service Description, the Charges, and any SOW set out in the Proposal or reference expressly identified in that Order Form.

4.7 A draft Order Form is valid for 30 days from issue and does not form part of this Agreement unless signed by both parties under clause 4.6.

4.8 Aruga may charge for the preparation of SOW’s on a time and materials basis in accordance with Aruga’s Charges set out in the applicable Order Form.

4.9 Once incorporated via a signed Order Form, the SOW may only be amended in accordance with clause 10 (Change Control) or clause 22 (Variation).

4.10 Each Order Form forms part of this Agreement and shall constitute a separate contract.

4.11 Where an Order Form incorporates a Service Description from a Proposal, only that Service Description, the Charges, and the SOW contained in that Proposal are incorporated and have contractual effect. No other part of the Proposal is incorporated or has any legal effect, and the Customer shall have no claim in respect of any other Proposal content.

5.1 In this clause, TUPE means the Transfer of Undertakings (Protection of Employment) Regulations 2006 and/or the European Communities (Protection of Employees on Transfer of Undertakings) Regulations 2003 of Ireland, and any other legislation in any jurisdiction implementing Council Directive 2001/23/EC, in each case as amended or replaced.

5.2 The parties acknowledge TUPE may apply on the commencement, termination or expiry, of the Services under an Order Form, where relevant, the parties shall incorporate the TUPE Annex (and any other reference in this Agreement to TUPE) then constitutes the parties sole rights, obligations, indemnities and liability allocation in respect of TUPE, such that the employment of one or more employees may transfer by operation of law.

5.3 Where no TUPE Annex is incorporated into an Order Form, no contractual apportionment, indemnity or other TUPE relation obligation applies between the parties for those services, without prejudice to their respective statutory rights and obligations.

6.1 Aruga shall provide the Services and deliver the Deliverables to the Customer, in all material respects in accordance with the Order Form and where relevant the SOW in all material respects and subject to the terms of this Agreement.

6.2 Aruga shall use reasonable endeavours to meet any performance dates specified, but such dates are estimates only and time for performance is not of the essence. Aruga may (at its sole discretion) prioritise protecting the Customer’s systems where there is an alleged or potential Cyber-Security Threat, even if this impacts the Customer’s business activities. Aruga will notify the Customer as soon as practicable in these circumstances.

6.3 Aruga shall appoint a manager in respect of the Services to be performed under each SOW. That person shall have authority to contractually bind Aruga on all matters relating to the relevant Services (including by signing Change Orders).

6.4 Aruga shall use reasonable endeavours to observe all health, safety and security requirements at the Customer’s premises that have been communicated under clause 8.1(e). Aruga shall not be liable under this Agreement to the extent that complying with those requirements causes it to breach any of its obligations under this Agreement.

6.5 Aruga may recommend improvements to the Services from time to time. If the Customer does not implement a recommendation and Aruga cannot continue providing the relevant Service without it, Aruga may at its own discretion, withdraw that Service.

6.6 Aruga may perform its obligations under this Agreement through its Affiliates, subcontractors, agents or Third-Party Suppliers. Aruga remains responsible for the Services, subject to the exclusions and limitations in clause 16. The Customer is not entitled to any reduction in the Charges, and Aruga incurs no additional liability, as a result of using any subcontractor, Affiliate or Third-Party Supplier.

6.7 The Customer acknowledges that the Services use artificial intelligence, machine-learning and automation tools (AI Tools). The Customer accepts that AI Tools operate probabilistically, may produce incomplete, inaccurate or unexpected outputs, and cannot guarantee the detection or prevention of all threats. Aruga applies human oversight to material outputs but does not warrant the accuracy or completeness of any AI-generated output. AI-generated outputs are provided solely to assist and must not be relied on as the Customer’s only basis for any security or operational decision.

6.8 Aruga and its licensors retain all Intellectual Property Rights in the AI Tools and in any models, configurations, detection logic and improvements developed in providing the Services, and nothing in clause 12 transfers any right in the AI Tools to the Customer.

6.9 Aruga may collect and use telemetry, log, threat and security data derived from the Services in aggregated and anonymised form (which shall not identify the Customer or any individual) to operate, develop, train and improve its security services and threat intelligence. This clause 6.9 survives termination.

7.1 The Customer acknowledges that no security service can prevent all Cyber-Security Threats. The Services are designed to reduce and manage risk, not to guarantee that no incident will occur. This clause is without prejudice to clauses 16.9(e) and 16.11.

7.2 Customer security prerequisites. As a condition of the Services, the Customer shall at its own cost:

1. enforce multi-factor authentication on all user, administrator and remote-access accounts;
2. apply security patches and updates within a reasonable period;
3. maintain all necessary Microsoft (or equivalent) licences and log-ingestion entitlements required for the Services;
4. operate least-privilege access and not disable, bypass or downgrade any control implemented or recommended by Aruga; and
5. implement Aruga’s reasonable security recommendations within a reasonable time.

7.3 Aruga shall have no liability for any loss, and any affected Service Level Agreement shall be suspended, to the extent an incident is caused or aggravated by the Customer’s failure to comply with clause 7.2, by inaccurate or incomplete information or scope provided by the Customer, or by gaps in logging or visibility arising from sources the Customer has not made available.

7.4 Aruga’s detection and response is limited to the data, log sources and environment made available to it. Aruga is not responsible for any compromise pre-dating the Services Start Date or occurring in any system, tenant or log source outside the agreed scope.

7.5 In the event of a Cyber-Security Threat, Aruga’s obligations are limited to detection, triage and containment in accordance with the applicable Service Description. Recovery, rebuild, forensic investigation and any remediation beyond containment are chargeable and, where undertaken, are provided under a Change Order. Aruga may prioritise containment over the Customer’s business continuity in accordance with clause 6.2. Subject only to clause 16.2 (deliberate default) and clause 16.5 (liabilities which cannot legally be limited), Aruga shall have no liability of any kind arising out of or in connection with its performance or non-performance of incident detection, triage or containment under this clause 7.5, notwithstanding the Warranty in clause 17 and clause 16.10.

7.6 The Customer is solely responsible for its own regulatory, contractual and data-subject notifications (including to the FCA and the ICO). Aruga will assist on a time-and-materials basis at the Customer’s request and cost.

8.1 The Customer undertakes, warrants and represents that it shall:

1. co-operate with Aruga in all matters relating to the Services;
2. create any Third-Party subscriptions and access permissions that are reasonably requested or set out in the relevant SOW for and on behalf of Aruga on or before the Services Start Date;
3. appoint a manager in respect of the Services to be performed under each Order Form, such person as identified in the SOW. That person shall have authority to contractually bind the Customer on all matters relating to the relevant Services (including by signing Change Orders);
4. provide, for Aruga, its agents, subcontractors, consultants and employees, in a timely manner and at no charge, access to the Customer’s premises, systems, data, documents, information, items, materials and other facilities (whether owned by the Customer or a third party) as reasonably required by Aruga for the Services, including any such access as is specified in writing, ensure that they are accurate and complete, and obtain and maintain all necessary licences, permissions, rights to use and consents and comply with all relevant legislation as required to enable Aruga to provide the Services, including in relation to the installation of Aruga’s Equipment, the use of all Customer Materials or any materials and the use of the Customer’s Equipment insofar as such licences, permissions, rights to use, consents and legislation relate to the Customer’s business, premises, staff and equipment, in each case before the date on which the Services are to start;
5. inform Aruga of all health and safety and security requirements that apply at the Customer’s premises.
6. ensure that all the Customer’s Equipment is in good working order and suitable for the purposes for which it is used and conforms to all relevant United Kingdom standards or requirements;
7. keep and maintain Aruga’s Equipment in good condition and not dispose of or use Aruga’s Equipment other than in accordance with Aruga’s written instructions or authorisation;
8. comply with any additional responsibilities of the Customer requested by Aruga; and
9. comply with Aruga’s Policies and all applicable requirements communicated by Aruga from time to time, including those made available at the URL specified in the definition of Policies in clause 1.1;
10. the Customer has full capacity and authority to enter into and perform this Agreement, it has authority to grant all rights granted to Aruga under it, and this Agreement has been executed by a duly authorised representative of the Customer.

8.2 If Aruga’s performance of its obligations under this Agreement is prevented or delayed by any act or omission of the Customer, or its agents, subcontractors, consultants or employees, Aruga shall, without prejudice to any other right or remedy, Aruga be entitled to an extension of time equal to the delay caused by the Customer.

8.3 The Customer is responsible for maintaining its own back-ups, business-continuity and disaster-recovery arrangements and appropriate cyber-insurance. Aruga is not a substitute for, and does not assume responsibility for, the Customer’s own IT operations, back-ups or insurance.

9.1 The Customer shall not, without the prior written consent of Aruga, at any time from the date on which any Services commence to the expiry of 12 months after the completion of such Services, solicit or entice away from Aruga or employ or attempt to employ any person who is, or has been, engaged as an employee, consultant or subcontractor of Aruga in the provision of such Services.

9.2 Any consent given by Aruga in accordance with clause 9.1 shall be subject to the Customer paying to Aruga a sum equivalent to 20% of the then current annual remuneration of Aruga’s employee, consultant or subcontractor or, if higher, 20% of the annual remuneration to be paid by the Customer to that employee, consultant or subcontractor.

10.1 Either party may propose changes to the scope or execution of the Services, but no change takes effect until a Change Order is signed by both parties. A Change Order shall set out the proposed changes and their impact on:

1. the Services;
2. the Charges;
3. the timetable for the Services; and
4. any of the other terms of the relevant Order Form and/or SOW.

10.2 If Aruga wishes to make a change to the Services, it shall provide a draft Change Order to the Customer.

10.3 If the Customer wishes to make a change to the Services:

1. it shall notify Aruga and provide all information reasonably required, including the timing of the proposed change; and
2. Aruga shall, as soon as reasonably practicable, provide a draft Change Order to the Customer.

10.4 If the parties:

1. agree to a Change Order, they shall sign it and that Change Order shall amend the relevant Order Form; or
2. cannot agree a Change Order, either party may refer the matter to the dispute resolution procedure in clause 30.

10.5 Aruga may charge for the time it spends on preparing and negotiating Change Orders which implement changes proposed by the Customer pursuant to clause 10.3 on a time and materials basis.

11.1 In consideration of the provision of the Services by Aruga, the Customer shall pay the Charges.

11.2 Where the Charges are calculated on a time and materials basis:

1. Aruga’s daily fee rates for each individual person are as set out in the Charges Breakdown in the Proposal identified in, and attached to, the relevant Order Form, calculated on the basis of a seven-hour day, worked during Business Hours;
2. Aruga shall be entitled to charge an overtime rate of 20% on top of the daily fee rate referred to in clause 11.2(a) on a pro rata basis for any time worked by individuals whom it engages on the Services outside Business Hours; and
3. Aruga shall ensure that every individual whom it engages on the Services records time spent on the Services, and Aruga shall indicate the time spent.

11.3 Where the Charges are calculated on a fixed price or subscription basis, the amount and intervals of those charges shall be as set out in an Order Form or Proposal.

11.4 The Charges exclude the following, which shall be payable by the Customer monthly in arrears, following submission of an appropriate invoice:

1. the cost of hotel, subsistence, travelling and any other ancillary expenses reasonably incurred by the individuals whom Aruga engages in connection with the Services; and
2. the cost to Aruga of any materials or services procured by Aruga from a Third Party for the provision of the Services as such items and their cost are approved by the Customer in advance from time to time.

11.5 Aruga may increase the Charges annually, with effect from each anniversary of the date of this Agreement, in line with the percentage increase in the Retail Prices Index for the preceding 12-month period, based on the latest available figure. The first increase takes effect on the first anniversary. Any such increase applies to all Charges under Order Forms in force on that date, and to those entered into thereafter.

11.6 Aruga shall invoice the Customer at the intervals specified in the Order Form (or Charges in the Proposal), or if none is specified at the end of each month for Services performed that month, and the Customer shall pay each invoice within 30 days of the invoice date to a bank account nominated in writing by Aruga.

11.7 Without prejudice to any other right or remedy that it may have, if the Customer fails to pay Aruga any sum due under this Agreement on the due date:

1. the Customer shall pay interest on the overdue sum from the due date until payment of the overdue sum, whether before or after judgment. Interest under this clause will accrue each day at 8% a year above the Bank of England’s base rate from time to time, but at 8% a year for any period when that base rate is below 0%; and
2. Aruga may suspend part or all of the Services as set out in clause 11.10, without liability to the Customer, until payment has been made in full.

11.8 All sums payable to Aruga under this Agreement:

1. are exclusive of VAT, and the Customer shall in addition pay an amount equal to any VAT chargeable on those sums on delivery of a VAT invoice; and
2. shall be paid in full without any set-off, counterclaim, deduction or withholding (other than any deduction or withholding of tax as required by law).

11.9 Charges invoiced in advance are non-refundable, except where the Customer validly exercises a break right expressly set out in the Order Form or where Aruga commits an uncured material breach. Any amounts for additional users, devices or scope beyond that stated in the Order Form are chargeable as a change under clause 10.

11.10 If the Customer fails to pay any undisputed sum under this Agreement and it remains unpaid for 14 days after Aruga has issued written notice requiring payment, Aruga may, on a further 7 days’ written notice, suspend all or part of the Services until full payment is made. A sum is undisputed unless it is the subject of a genuine, bona fide dispute notified to Aruga in writing at least 15 days before the due date; only the disputed portion is treated as disputed, and the Customer shall pay the undisputed balance when due. Suspension does not relieve the Customer of its obligation to pay the Charges (including for the suspended period), and Aruga shall have no liability for any consequence of a suspension made in accordance with this clause. Aruga may decline to suspend where suspension would prejudice containment of a live security incident.

12.1 In relation to any Deliverables (being only those outputs expressly identified as a deliverable in a SOW, or where no SOW applies in the Service Description, in accordance with the definition of Deliverables in clause 1.1):

1. Aruga and its licensors shall retain ownership of all IPRs in the Deliverables, excluding the Customer Materials;
2. Aruga grants the Customer, or shall procure for the Customer, a fully paid-up, worldwide, non-exclusive, royalty-free, perpetual and irrevocable licence during the term to copy the Deliverables (excluding the Customer Materials and any Third Party Software) solely to receive and use the Services and Deliverables in its business; and
3. the Customer shall not sub-license, assign or otherwise transfer the rights granted in clause 12.1(b).

12.2 In relation to the Customer Materials, the Customer:

1. and its licensors shall retain ownership of all IPRs in the Customer Materials; and
2. grants to Aruga a fully paid-up, non-exclusive, royalty-free, non-transferable licence to copy and modify the Customer Materials for the term of this Agreement for the purpose of providing the Services to the Customer.

12.3 Aruga:

1. warrants that the receipt and use of any Deliverables (as identified in accordance with clause 12.1) by the Customer shall not infringe any rights of third parties to the extent that the infringement results from copying;
2. shall, subject to clause 12.5, indemnify the Customer against all direct liabilities, reasonable costs, expenses, damages and losses arising from any claim that the Customer’s receipt and correct use of any Deliverables (as identified in accordance with clause 12.1) infringes a third party’s Intellectual Property Rights, but only to the extent the infringement results from copying. For the avoidance of doubt, Aruga gives no warranty and owes no indemnity under this clause 12.3 in respect of any output of the Services that is not a Deliverable.
3. shall not be in breach of the warranty at clause 12.3(a), and the Customer shall have no claim under the indemnity at clause 12.3(b), to the extent the infringement arises from the use or inclusion of Customer Materials or in the Services or any Deliverable, any modification of the Services or Deliverables made otherwise than by or on behalf of Aruga, or compliance with the Customer’s specifications or instructions.

12.4 The Customer:

1. warrants that the receipt and use in the performance of this Agreement by Aruga, its agents, subcontractors or consultants of the Customer Materials shall not infringe the rights, including any Intellectual Property Rights, of any third party; and
2. shall indemnify Aruga against all liabilities, costs, expenses, damages and losses (including but not limited to any direct, indirect and consequential losses and all interest, penalties and legal costs (calculated on a full indemnity basis) and all other professional costs and expenses) suffered or incurred or paid by Aruga arising out of or in connection with any claim brought against Aruga, its agents, subcontractors or consultants for actual or alleged infringement of a third party’s Intellectual Property Rights arising out of, or in connection with, the receipt or use in the performance of this Agreement of the Customer Materials.

12.5 If either party (Indemnifying Party) is required to indemnify the other party (Indemnified Party) under this clause 12, the Indemnified Party shall:

1. promptly notify the Indemnifying Party in writing of any claim against it in respect of which it wishes to rely on the indemnity at clause 12.3(b) or clause 12.4(b) (as applicable) (IPRs Claim);
2. allow the Indemnifying Party, at its own cost, to conduct all negotiations and proceedings and to settle the IPRs Claim, always provided that the Indemnifying Party shall obtain the Indemnified Party’s prior approval of any settlement terms, such approval not to be unreasonably withheld;
3. provide the Indemnifying Party with such reasonable assistance regarding the IPRs Claim as is required by the Indemnifying Party, subject to reimbursement by the Indemnifying Party of the Indemnified Party’s costs so incurred; and
4. not, without prior consultation with the Indemnifying Party, make any admission relating to the IPRs Claim or attempt to settle it, provided that the Indemnifying Party considers and defends any IPRs Claim diligently, using competent counsel and in such a way as not to bring the reputation of the Indemnified Party into disrepute.

13.1 In performing its obligations under this Agreement, Aruga shall comply with the Applicable Laws and Policies.

14.1 The processing of personal data under this Agreement is governed by the Aruga Data Processing Agreement available at https://arugacyber.com/x/7f3c1a9e4b, as updated from time to time, which the parties agree applies to the Services and forms part of this Agreement.

14.2 Both parties shall comply with all applicable requirements of Applicable Data Protection Laws, and nothing in this clause 14 relieves, removes or replaces a party’s obligations under those laws.

14.3 Aruga’s liability for losses arising from breach of this clause 14 is as set out in clause 16.6(b).

15.1 Each party undertakes that it shall not at any time during this Agreement, and for a period of two years after termination or expiry of this Agreement, disclose to any person any confidential information concerning the business, affairs, customers, clients or suppliers of the other party or of any member of the group of companies to which the other party belongs, except as permitted by clause 15.2(a).

15.2 Each party may disclose the other party’s confidential information:

1. to its employees, officers, representatives, contractors, subcontractors or advisers who need to know such information for the purposes of exercising the party’s rights or carrying out its obligations under or in connection with this Agreement. Each party shall ensure that its employees, officers, representatives, contractors, subcontractors or advisers to whom it discloses the other party’s confidential information comply with this clause 15; and
2. as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.

15.3 No party shall use the other party’s confidential information for any purpose other than to exercise its rights and perform its obligations under or in connection with this Agreement.

15.4 The Customer acknowledges that Aruga may use artificial intelligence tools and third-party artificial intelligence service providers in the performance of the Services and that such use does not, of itself, constitute a breach of Aruga’s confidentiality obligations under this clause 15.

16.1 References to liability in this clause 16 include every kind of liability arising under or in connection with this Agreement, including in contract, tort (including negligence), misrepresentation, restitution or otherwise. Aruga has obtained insurance for aggregate claims not exceeding £1,000,000 and the limits and exclusions in this clause reflect that cover, the Customer is responsible for insuring any excess loss.

16.2 Neither party may benefit from the limitations and exclusions set out in this clause in respect of any liability arising from its deliberate default.

16.3 Nothing in this clause 16 shall limit the Customer’s payment obligations under this Agreement.

16.4 Nothing in this Agreement shall limit the Customer’s liability under the following clauses:

1. clause 12.4 (IPR indemnities);
2. the TUPE Annex (where incorporated into an Order Form); and
3. Clause 14 (data protection).

16.5 Nothing in this Agreement limits any liability which cannot legally be limited, including but not limited to liability for:

1. death or personal injury caused by negligence;
2. fraud or fraudulent misrepresentation; and
3. breach of the terms implied by section 2 of the Supply of Goods and Services Act 1982 (title and quiet possession).

16.6 Subject to clause 16.2 (no limitations in respect of deliberate default) and clause 16.5 (liabilities which cannot legally be limited), Aruga’s total liability to the Customer:

1. for damage to property caused by the negligence of its employees and agents in connection with this Agreement shall not exceed £100,000 for any one event or series of connected events;
2. for loss arising from Aruga’s failure to comply with its data processing obligations under clause 14 (Data protection) shall not exceed the greater of (i) 125% of the total Charges paid or payable by the Customer under the applicable Order Form in the 6 months preceding the first event giving rise to the claim, or (ii) £100,000; and
3. for all other loss or damage which does not fall within subclause (a) or (b) shall not exceed the greater of (i) 125% of the total Charges paid or payable by the Customer under the applicable Order Form in the 6 months preceding the first event giving rise to the claim, or (ii) £100,000, and in any event Aruga’s total aggregate liability under this Agreement shall not exceed the limit of Aruga’s insurance cover referred to in clause 16.1.

Subject to clauses 16.2, 16.4 and 16.5, the Customer’s total liability to Aruga shall not exceed £12,000,000 for any one event or series of connected events.

16.7 The caps on the Customer’s liabilities shall not be reduced by:

1. amounts awarded or agreed to be paid under:
   1. clause 12 (IPR indemnities); and
   2. the TUPE Annex (where incorporated into an Order Form).
2. amounts awarded by a court or arbitrator, using their procedural or statutory powers in respect of costs of proceedings or interest for late payment.

16.8 Subject to clause 16.2 (No limitations in respect of deliberate default), clause 16.4 (liability under identified clauses) and clause 16.5 (Liabilities which cannot legally be limited), Aruga shall not be liable to the Customer, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any of the following types of loss (and this exclusion does not limit the Customer’s liability to Aruga for any such loss):

1. loss of profits;
2. loss of sales or business;
3. loss of Agreements or contracts;
4. loss of anticipated savings;
5. loss of use or corruption of software, data or information (including any Cyber Security Threat), or any loss arising from or attributable to the inaccuracy, incompleteness, bias, hallucination or systematic error of any AI Tool, or from the Customer’s reliance on any AI-generated output;
6. loss of or damage to goodwill; and
7. indirect or consequential loss.

16.9 Aruga has given commitments as to compliance of the Services with relevant specifications in clause 6.1 (Aruga’s responsibilities). In view of these commitments, the terms implied by sections 3, 4 and 5 of the Supply of Goods and Services Act 1982 are, to the fullest extent permitted by law, excluded from this Agreement.

16.10 The Customer acknowledges that Aruga cannot prevent all Cyber-Security Threats and, subject only to clauses 16.2 and 16.5, Aruga shall have no liability for any loss, damage or liability arising out of or in connection with a Cyber-Security Threat, including any threat that is not detected or contained. This is subject to Aruga performing the Services in accordance with the Warranty in clause 17, except that for incident detection, triage and containment under clause 7.5 this exclusion applies regardless of clause 17, in accordance with clause 7.5.

16.11 Unless the Customer notifies Aruga that it intends to make a claim in respect of an event within the notice period, Aruga shall have no liability for that event. The notice period for an event shall start on the day on which the Customer became, or ought reasonably to have become, aware of the event having occurred and shall expire 12 months from that date. The notice must be in writing and must identify the event and the grounds for the claim in reasonable detail.

17.1 Aruga warrants that the Services will substantially conform to the Service Description and will be performed in a workmanlike manner (Warranty). The Warranty does not apply to incident detection triage or containment under clause 7.5 which is provided without warranty and is governed by clause 7.5 and clause 16.10.

17.2 If the Services are not performed in accordance with the Warranty, the Customer must notify Aruga in writing within 7 days of the non-compliance. Aruga shall, at its option, use commercially reasonable efforts to re-perform the non-conforming Services. If the Services cannot be re-performed or corrected, Aruga may, at its option, refund the portion of the Charges relating to the non-conforming Services. The Customer acknowledges that this clause sets out its sole and exclusive remedy for any failure to meet the Warranty, and the Agreement shall otherwise continue until expiry or termination in accordance with its terms.

The Warranty does not apply to: (i) any use of a Third-Party or use of any other third party services, goods or software; (ii) any Services that have been modified, serviced, altered, repaired or operated by any other party other than Aruga or under Aruga’s written instructions; (iii) the Customer and its representatives not operating the Services in accordance with Aruga’s instructions; (iv) any event or circumstance outside Aruga’s control; (v) any network defect, delay or failure of Customer’s hardware, software or other systems; (vi) any failure by the Customer to provide accurate information to Aruga; and (vii) any breach or failure to comply with this Agreement by the Customer.

17.3 Except for the Warranty, the Services and any Third-Party Software is provided on an ‘as is’ basis and the Customer’s use of the same is at its own risk. Aruga does not warrant that the Services will be uninterrupted or error free or that all failures or defects will be corrected and disclaims all other express or implied warranties, including but not limited to warranties of merchantability and fitness for a particular purpose.

17.4 The Services are dependent on third-party platforms, software and feeds (including Microsoft Azure, Microsoft Sentinel, Microsoft Defender XDR and Microsoft 365) that are outside Aruga’s control. Aruga shall not be liable for any unavailability, defect, change, deprecation, latency, or act or omission of any Third Party or third-party platform, nor for any consequence of the Customer’s own licensing (including inadequate log-ingestion entitlements). Any Third-Party Software is provided subject to the relevant Software Licence, and the Customer’s remedies in respect of it are limited to those Aruga is able to pass through from the relevant Third Party.

18.1 Without affecting any other right or remedy available to it, either party may terminate this Agreement with immediate effect by giving written notice to the other party if:

1. the other party commits a material breach of any term of this Agreement and (if such breach is remediable) fails to remedy that breach within a period of 30 days after being notified in writing to do so;
2. the other party suspends, or threatens to suspend, payment of its debts or is unable to pay its debts as they fall due or admits inability to pay its debts or (being a company or limited liability partnership) is deemed unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986 (IA 1986) as if the words “it is proved to the satisfaction of the court” did not appear in sections 123(1)(e) or 123(2) of the IA 1986;
3. the other party commences negotiations with all or any class of its creditors with a view to rescheduling any of its debts, or makes a proposal for or enters into any compromise or arrangement with any of its creditors;
4. the other party suspends or ceases, or threatens to suspend or cease, carrying on all or a substantial part of its business; or
5. the other party’s financial position deteriorates so far as to reasonably justify the opinion that its ability to give effect to the terms of this Agreement is in jeopardy.

18.2 For the purposes of clause 18.1(a) material breach means a breach (including an anticipatory breach) that is serious in the widest sense of having a serious effect on the benefit which the terminating party would otherwise derive from:

1. a substantial portion of this Agreement; or
2. any of the obligations set out in clauses 6 and 14.

18.3 Without affecting any other right or remedy available to it, Aruga may terminate this Agreement with immediate effect by giving written notice to the Customer if:

1. the Customer fails to pay any undisputed amount due under this Agreement on the due date for payment (a sum being undisputed unless it is the subject of a genuine and bona fide dispute of which the Customer has given Aruga written notice no less than 15 days before the due date for payment) and that amount remains unpaid on the due date; or
2. there is a change of Control of the Customer.

19.1 On termination or expiry of this Agreement:

1. the Customer shall immediately pay to Aruga all of Aruga’s outstanding unpaid invoices and interest and, in respect of the Services supplied but for which no invoice has been submitted, Aruga may submit an invoice, which shall be payable immediately on receipt;
2. the Customer shall, promptly, return all of Aruga’s Equipment and discontinue use of any software. If the Customer fails to do so, then Aruga may enter the Customer’s premises and take possession of Aruga’s Equipment. Until Aruga’s Equipment has been returned or repossessed, the Customer shall be solely responsible for its safe keeping; and
3. Aruga shall on request return any of the Customer Materials not used up in the provision of the Services.

19.2 Survival

1. On termination or expiry of this Agreement, all existing Order Forms shall terminate automatically.
2. Any provision of this Agreement that expressly or by implication is intended to come into or continue in force on or after termination or expiry of this Agreement shall remain in full force and effect.
3. Termination or expiry of this Agreement shall not affect any rights, remedies, obligations or liabilities of the parties that have accrued up to the date of termination or expiry, including the right to claim damages in respect of any breach of the Agreement which existed at or before the date of termination or expiry.

20.1 Force Majeure Event means any event or circumstance not within a party’s reasonable control, including acts of God, flood, earthquake or other natural disaster, epidemic or pandemic, war, terrorism, civil unrest, imposition of sanctions, any law or action by a government or public authority, fire or explosion, industrial disputes, non-performance by suppliers or subcontractors, and interruption or failure of utility services.

20.2 Provided it has complied with clause 20.4, if a party is prevented, hindered or delayed in or from performing any of its obligations under this Agreement by a Force Majeure Event (Affected Party), the Affected Party shall not be in breach of this Agreement or otherwise liable for any such failure or delay in the performance of such obligations. The time for performance of such obligations shall be extended accordingly.

20.3 The corresponding obligations of the other party will be suspended, and its time for performance of such obligations extended, to the same extent as those of the Affected Party.

20.4 The Affected Party shall:

1. as soon as reasonably practicable after the start of the Force Majeure Event but no later than 3 days from its start, notify the other party in writing of the Force Majeure Event, the date on which it started, its likely or potential duration, and the effect of the Force Majeure Event on its ability to perform any of its obligations under the Agreement; and
2. use all reasonable endeavours to mitigate the effect of the Force Majeure Event on the performance of its obligations.

20.5 If the Force Majeure Event prevents, hinders or delays the Affected Party’s performance of its obligations for a continuous period of more than 4 weeks, the party not affected by the Force Majeure Event may terminate this Agreement by giving 4 weeks’ written notice to the Affected Party.

21.1 The Customer shall not assign, transfer, mortgage, charge, subcontract, delegate, declare a trust over or deal in any other manner with any of its rights and obligations under this Agreement.

21.2 Aruga may at any time assign, mortgage, charge, subcontract, delegate, declare a trust over or deal in any other manner with any or all of its rights and obligations under this Agreement.

22.1 Subject to clause 10 (Change control), no variation of this Agreement shall be effective unless it is in writing and signed by the parties (or their authorised representatives).

23.1 A waiver of any right or remedy under this Agreement or by law is only effective if given in writing and is not a waiver of any subsequent right or remedy. No failure or delay in exercising, and no single or partial exercise of, any right or remedy prevents or restricts the further exercise of that or any other right or remedy. A waiver of a right or remedy against one party does not affect a party’s rights against any other party.

24.1 The rights and remedies provided under this Agreement are in addition to, and not exclusive of, any rights or remedies provided by law.

25.1 If any provision or part-provision of this Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed deleted, but that shall not affect the validity and enforceability of the rest of this Agreement; and the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.

26.1 This Agreement constitutes the entire Agreement between the parties and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter.

26.2 Each party agrees that it shall have no remedies in respect of any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in this Agreement.

27.1 Nothing in this Agreement is intended to, or shall be deemed to, establish any partnership or joint venture between any of the parties, constitute any party the agent of another party, or authorise any party to make or enter into any commitments for or on behalf of any other party, and each party confirms it is acting on its own behalf and not for the benefit of any other person.

28.1 This Agreement does not give rise to any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.

28.2 The rights of the parties to rescind or vary this Agreement are not subject to the consent of any other person.

29.1 Any notice or other communication given to a party under or in connection with this Agreement shall be in writing and shall be:

1. delivered by other next Business Day delivery service at its registered office (if a company) or its principal place of business (in any other case); or
2. sent by email to the following email address:
   1. for Aruga info@arugacyber.com
   2. for the Customer: the email address stated in the Order Form.

29.2 Any notice or communication shall be deemed to have been received:

1. if sent by other next Business Day delivery services, at 9.00 am on the second Business Day after posting; or
2. if sent by email, at the time of transmission, or, if this time falls outside business hours in the place of receipt, when business hours resume. In this clause 29.2(c), business hours mean 9.00am to 5.00pm Monday to Friday on a day that is not a public holiday in the place of receipt.

29.3 This clause does not apply to the service of any proceedings or any documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.

Counterparts

29.4 This Agreement may be executed in any number of counterparts, each of which shall constitute a duplicate original, but all the counterparts shall together constitute the one Agreement.

30.1 This clause 30 does not apply to, and shall not prevent or delay, any claim by Aruga for recovery of an undisputed sum due under this Agreement. Aruga may commence court proceedings under clause 31, and/or seek interim or injunctive relief, immediately and without first following the procedure in clause 30. A sum is undisputed unless it is the subject of a genuine, bona fide dispute notified by the Customer to Aruga in writing before the due date. Subject to the foregoing, if a dispute arises out of or in connection with this Agreement or its performance, validity or enforceability, the parties shall follow the procedure set out in this clause:

1. either party shall give to the other written notice of the Dispute, setting out its nature and full particulars (Dispute Notice), together with relevant supporting documents. On service of the Dispute Notice, the Account Manager of the Customer and Account Manager of Aruga shall attempt in good faith to resolve the Dispute;
2. if the Account Manager of the Customer and the Account Manager of Aruga are for any reason unable to resolve the Dispute within 30 days of service of the Dispute Notice, the Dispute shall be referred to the Managing Director of the Customer and Managing Director of Aruga who shall attempt in good faith to resolve it; and
3. if the Managing Director of the Customer and Managing Director of Aruga are for any reason unable to resolve the Dispute within 30 days of it being referred to them, the parties will attempt to settle it by mediation in accordance with the CEDR Model Mediation Procedure. Unless otherwise agreed between the parties, the mediator shall be nominated by CEDR. To initiate the mediation, a party must serve notice in writing (ADR notice) to the other party to the Dispute, requesting a mediation. A copy of the ADR notice should be sent to CEDR. The mediation will start not later than 60 days after the date of the ADR notice.

30.2 No party may commence any court proceedings under clause 31 in relation to the whole or part of the Dispute until 60 days after service of the ADR notice, provided that the right to issue proceedings is not prejudiced by a delay.

30.3 If the Dispute is not resolved within 60 days after service of the ADR notice, or either party fails to participate or to continue to participate in the mediation before the expiration of the said period of 60 days, or the mediation terminates before the expiration of the said period of 60 days, the Dispute shall be finally resolved by the courts of England and Wales in accordance with clause 31 (Governing Law and Jurisdiction).

31.1 This Agreement and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation shall be governed by and construed in accordance with the law of England and Wales and each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any such dispute or claim.

This Master Services Agreement has been entered into on the Commencement Date.